// Copyright (c) 1997-2009 Nokia Corporation and/or its subsidiary(-ies).

 // All rights reserved.

 // This component and the accompanying materials are made available

 // under the terms of the License "Eclipse Public License v1.0"

 // which accompanies this distribution, and is available

 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

 //

 // Initial Contributors:

 // Nokia Corporation - initial contribution.

 //

 // Contributors:

 //

 // Description:

 // e32\memmodel\epoc\multiple\arm\xmmu.cpp

 // 

 //

 #include "arm_mem.h"

 #include <mmubase.inl>

 #include <ramcache.h>

 #include <demand_paging.h>

 #include "execs.h"

 #include <defrag.h>

 #include "cache_maintenance.inl"

 #undef __MMU_MACHINE_CODED__

 // SECTION_PDE(perm, attr, domain, execute, global)

 // PT_PDE(domain)

 // LP_PTE(perm, attr, execute, global)

 // SP_PTE(perm, attr, execute, global)

 const TInt KPageColourShift=2;

 const TInt KPageColourCount=(1<<KPageColourShift);

 const TInt KPageColourMask=KPageColourCount-1;

 const TPde KPdPdePerm=PT_PDE(0);

 const TPde KPtPdePerm=PT_PDE(0);

 const TPde KShadowPdePerm=PT_PDE(0);

 #if defined(__CPU_MEMORY_TYPE_REMAPPING)

 // ARM1176, ARM11MPCore, ARMv7 and later

 // __CPU_MEMORY_TYPE_REMAPPING means that only three bits (TEX0:C:B) in page table define

 // memory attributes. Kernel runs with a limited set of memory types: stronlgy ordered,

 // device, normal un-cached & and normal WBWA. Due to lack of write through mode, page tables are

 // write-back which means that cache has to be cleaned on every page/directory table update.

 const TPte KPdPtePerm=				SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1);

 const TPte KPtPtePerm=				SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1);

 const TPte KPtInfoPtePerm=			SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1);

 const TPte KRomPtePerm=				SP_PTE(KArmV6PermRORO, EMemAttNormalCached, 1, 1);

 const TPte KShadowPtePerm=			SP_PTE(KArmV6PermRORO, EMemAttNormalCached, 1, 1);

 const TPde KRomSectionPermissions=	SECTION_PDE(KArmV6PermRORO, EMemAttNormalCached, 0, 1, 1);

 const TPte KUserCodeLoadPte=		SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 1, 0);

 const TPte KUserCodeRunPte=			SP_PTE(KArmV6PermRORO, EMemAttNormalCached, 1, 0);

 const TPte KGlobalCodeRunPte=		SP_PTE(KArmV6PermRORO, EMemAttNormalCached, 1, 1);

 const TPte KKernelCodeRunPte=		SP_PTE(KArmV6PermRONO, EMemAttNormalCached, 1, 1);

 const TInt KNormalUncachedAttr = EMemAttNormalUncached;

 const TInt KNormalCachedAttr = EMemAttNormalCached;

 #else

 //ARM1136 

 const TPte KPtInfoPtePerm=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1);

 #if defined (__CPU_WriteThroughDisabled)

 const TPte KPdPtePerm=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1);

 const TPte KPtPtePerm=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1);

 const TPte KRomPtePerm=SP_PTE(KArmV6PermRORO, KArmV6MemAttWBWAWBWA, 1, 1);

 const TPte KShadowPtePerm=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWBWAWBWA, 1, 1);

 const TPde KRomSectionPermissions	=	SECTION_PDE(KArmV6PermRORO, KArmV6MemAttWBWAWBWA, 0, 1, 1);

 const TPte KUserCodeLoadPte=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 1, 0);

 const TPte KUserCodeRunPte=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWBWAWBWA, 1, 0);

 const TPte KGlobalCodeRunPte=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWBWAWBWA, 1, 1);

 const TInt KKernelCodeRunPteAttr = KArmV6MemAttWBWAWBWA;

 #else

 const TPte KPdPtePerm=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBRAWTRA, 0, 1);

 const TPte KPtPtePerm=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBRAWTRA, 0, 1);

 const TPte KRomPtePerm=SP_PTE(KArmV6PermRORO, KArmV6MemAttWTRAWTRA, 1, 1);

 const TPte KShadowPtePerm=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWTRAWTRA, 1, 1);

 const TPde KRomSectionPermissions	=	SECTION_PDE(KArmV6PermRORO, KArmV6MemAttWTRAWTRA, 0, 1, 1);

 const TPte KUserCodeLoadPte=SP_PTE(KArmV6PermRWNO, KArmV6MemAttWTRAWTRA, 1, 0);

 const TPte KUserCodeRunPte=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWTRAWTRA, 1, 0);

 const TPte KGlobalCodeRunPte=SP_PTE(KArmV6PermRWRO, KArmV6MemAttWTRAWTRA, 1, 1);

 const TInt KKernelCodeRunPteAttr = KArmV6MemAttWTRAWTRA;

 #endif

 #if defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 const TInt KKernelCodeRunPtePerm = KArmV6PermRONO;

 #else

 const TInt KKernelCodeRunPtePerm = KArmV6PermRORO;

 #endif

 const TPte KKernelCodeRunPte=SP_PTE(KKernelCodeRunPtePerm, KKernelCodeRunPteAttr, 1, 1);

 const TInt KNormalUncachedAttr = KArmV6MemAttNCNC;

 const TInt KNormalCachedAttr = KArmV6MemAttWBWAWBWA;

 #endif

 extern void __FlushBtb();

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 extern void remove_and_invalidate_page(TPte* aPte, TLinAddr aAddr, TInt aAsid);

 extern void remove_and_invalidate_section(TPde* aPde, TLinAddr aAddr, TInt aAsid);

 #endif

 LOCAL_D const TPte ChunkPtePermissions[ENumChunkTypes] =

 	{

 #if defined(__CPU_MEMORY_TYPE_REMAPPING)

 // ARM1176, ARM11 mcore, ARMv7 and later

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1),		// EKernelData

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1),		// EKernelStack

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 1, 1),		// EKernelCode - loading

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 1, 1),		// EDll (used for global code) - loading

 	SP_PTE(KArmV6PermRORO, EMemAttNormalCached, 1, 0),		// EUserCode - run

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 1),		// ERamDrive

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 0),		// EUserData

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 0),		// EDllData

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 1, 0),		// EUserSelfModCode

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 0),		// ESharedKernelSingle

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 0),		// ESharedKernelMultiple

 	SP_PTE(KArmV6PermRWRW, EMemAttNormalCached, 0, 0),		// ESharedIo

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1),		// ESharedKernelMirror

 	SP_PTE(KArmV6PermRWNO, EMemAttNormalCached, 0, 1),		// EKernelMessage

 #else

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1),		// EKernelData

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1),		// EKernelStack

 #if defined (__CPU_WriteThroughDisabled)

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 1, 1),		// EKernelCode - loading

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 1, 1),		// EDll (used for global code) - loading

 	SP_PTE(KArmV6PermRWRO, KArmV6MemAttWBWAWBWA, 1, 0),		// EUserCode - run

 #else

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWTRAWTRA, 1, 1),		// EKernelCode - loading

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWTRAWTRA, 1, 1),		// EDll (used for global code) - loading

 	SP_PTE(KArmV6PermRWRO, KArmV6MemAttWTRAWTRA, 1, 0),		// EUserCode - run

 #endif

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 1),		// ERamDrive

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 0),		// EUserData

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 0),		// EDllData

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 1, 0),		// EUserSelfModCode

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 0),		// ESharedKernelSingle

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 0),		// ESharedKernelMultiple

 	SP_PTE(KArmV6PermRWRW, KArmV6MemAttWBWAWBWA, 0, 0),		// ESharedIo

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1),		// ESharedKernelMirror

 	SP_PTE(KArmV6PermRWNO, KArmV6MemAttWBWAWBWA, 0, 1),		// EKernelMessage

 #endif

 	};

 // The domain for each chunk is selected according to its type.

 // The RamDrive lives in a separate domain, to minimise the risk

 // of accidental access and corruption. User chunks may also be

 // located in a separate domain (15) in DEBUG builds.

 LOCAL_D const TPde ChunkPdePermissions[ENumChunkTypes] =

 	{

 	PT_PDE(0),						// EKernelData

 	PT_PDE(0),						// EKernelStack

 	PT_PDE(0),						// EKernelCode

 	PT_PDE(0),						// EDll

 	PT_PDE(USER_MEMORY_DOMAIN),		// EUserCode

 	PT_PDE(1),						// ERamDrive

 	PT_PDE(USER_MEMORY_DOMAIN),		// EUserData

 	PT_PDE(USER_MEMORY_DOMAIN),		// EDllData

 	PT_PDE(USER_MEMORY_DOMAIN),		// EUserSelfModCode

 	PT_PDE(USER_MEMORY_DOMAIN),		// ESharedKernelSingle

 	PT_PDE(USER_MEMORY_DOMAIN),		// ESharedKernelMultiple

 	PT_PDE(0),						// ESharedIo

 	PT_PDE(0),						// ESharedKernelMirror

 	PT_PDE(0),						// EKernelMessage

 	};

 // Inline functions for simple transformations

 inline TLinAddr PageTableLinAddr(TInt aId)

 	{

 	return (KPageTableBase+(aId<<KPageTableShift));

 	}

 inline TPte* PageTable(TInt aId)

 	{

 	return (TPte*)(KPageTableBase+(aId<<KPageTableShift));

 	}

 inline TPte* PageTableEntry(TInt aId, TLinAddr aAddress)

 	{

 	return PageTable(aId) + ((aAddress >> KPageShift) & (KChunkMask >> KPageShift));

 	}

 inline TLinAddr PageDirectoryLinAddr(TInt aOsAsid)

 	{

 	return (KPageDirectoryBase+(aOsAsid<<KPageDirectoryShift));

 	}

 inline TPde* PageDirectoryEntry(TInt aOsAsid, TLinAddr aAddress)

 	{

 	return PageDirectory(aOsAsid) + (aAddress >> KChunkShift);

 	}

 extern void InvalidateTLBForPage(TLinAddr /*aLinAddr*/, TInt /*aAsid*/);

 extern void FlushTLBs();

 extern TUint32 TTCR();

 TPte* SafePageTableFromPde(TPde aPde)

 	{

 	if((aPde&KPdeTypeMask)==KArmV6PdePageTable)

 		{

 		SPageInfo* pi = SPageInfo::SafeFromPhysAddr(aPde);

 		if(pi)

 			{

 			TInt id = (pi->Offset()<<KPtClusterShift) | ((aPde>>KPageTableShift)&KPtClusterMask);

 			return PageTable(id);

 			}

 		}

 	return 0;

 	}

 TPte* SafePtePtrFromLinAddr(TLinAddr aAddress, TInt aOsAsid=0)

 	{

 	if ((TInt)(aAddress>>KChunkShift)>=(TheMmu.iLocalPdSize>>2))

 		aOsAsid = 0;

 	TPde pde = PageDirectory(aOsAsid)[aAddress>>KChunkShift];

 	TPte* pt = SafePageTableFromPde(pde);

 	if(pt)

 		pt += (aAddress>>KPageShift)&(KChunkMask>>KPageShift);

 	return pt;

 	}

 #ifndef _DEBUG

 // inline in UREL builds...

 #ifdef __ARMCC__

 	__forceinline /* RVCT ignores normal inline qualifier :-( */

 #else

 	inline

 #endif

 #endif

 TPte* PtePtrFromLinAddr(TLinAddr aAddress, TInt aOsAsid=0)

 	{

 	// this function only works for process local memory addresses, or for kernel memory (asid==0).

 	__NK_ASSERT_DEBUG(aOsAsid==0 || (TInt)(aAddress>>KChunkShift)<(TheMmu.iLocalPdSize>>2));

 	TPde pde = PageDirectory(aOsAsid)[aAddress>>KChunkShift];

 	SPageInfo* pi = SPageInfo::FromPhysAddr(pde);

 	TInt id = (pi->Offset()<<KPtClusterShift) | ((pde>>KPageTableShift)&KPtClusterMask);

 	TPte* pt = PageTable(id);

 	pt += (aAddress>>KPageShift)&(KChunkMask>>KPageShift);

 	return pt;

 	}

 TInt ArmMmu::LinearToPhysical(TLinAddr aLinAddr, TInt aSize, TPhysAddr& aPhysicalAddress, TPhysAddr* aPhysicalPageList, TInt aOsAsid)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::LinearToPhysical %08x+%08x, asid=%d",aLinAddr,aSize,aOsAsid));

 	TPhysAddr physStart = ArmMmu::LinearToPhysical(aLinAddr,aOsAsid);

 	TPhysAddr nextPhys = physStart&~KPageMask;

 	TUint32* pageList = aPhysicalPageList;

 	TInt pageIndex = aLinAddr>>KPageShift;

 	TInt pagesLeft = ((aLinAddr+aSize-1)>>KPageShift)+1 - pageIndex;

 	TInt pdeIndex = aLinAddr>>KChunkShift;

 	TPde* pdePtr = (pdeIndex<(iLocalPdSize>>2) || (iAsidInfo[aOsAsid]&1))

 					? PageDirectory(aOsAsid)

 					: ::InitPageDirectory;

 	pdePtr += pdeIndex;

 	while(pagesLeft)

 		{

 		pageIndex &= KChunkMask>>KPageShift;

 		TInt pagesLeftInChunk = (1<<(KChunkShift-KPageShift))-pageIndex;

 		if(pagesLeftInChunk>pagesLeft)

 			pagesLeftInChunk = pagesLeft;

 		pagesLeft -= pagesLeftInChunk;

 		TPhysAddr phys;

 		TPde pde = *pdePtr++;

 		TUint pdeType = pde&KPdeTypeMask;

 		if(pdeType==KArmV6PdeSection)

 			{

 			phys = (pde & KPdeSectionAddrMask) + (pageIndex*KPageSize);

 			__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::LinearToPhysical Section phys=%8x",phys));

 			TInt n=pagesLeftInChunk;

 			phys==nextPhys ? nextPhys+=n*KPageSize : nextPhys=KPhysAddrInvalid;

 			if(pageList)

 				{

 				TUint32* pageEnd = pageList+n;

 				do

 					{

 					*pageList++ = phys;

 					phys+=KPageSize;

 					}

 				while(pageList<pageEnd);

 				}

 			}

 		else

 			{

 			TPte* pt = SafePageTableFromPde(pde);

 			if(!pt)

 				{

 				__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::LinearToPhysical missing page table: PDE=%8x",pde));

 				return KErrNotFound;

 				}

 			pt += pageIndex;

 			for(;;)

 				{

 				TPte pte = *pt++;

 				TUint pte_type = pte & KPteTypeMask;

 				if (pte_type >= KArmV6PteSmallPage)

 					{

 					phys = (pte & KPteSmallPageAddrMask);

 					__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::LinearToPhysical Small Page phys=%8x",phys));

 					phys==nextPhys ? nextPhys+=KPageSize : nextPhys=KPhysAddrInvalid;

 					if(pageList)

 						*pageList++ = phys;

 					if(--pagesLeftInChunk)

 						continue;

 					break;

 					}

 				if (pte_type == KArmV6PteLargePage)

 					{

 					--pt; // back up ptr

 					TUint pageOffset = ((TUint)pt>>2)&(KLargeSmallPageRatio-1);

 					phys = (pte & KPteLargePageAddrMask) + pageOffset*KPageSize;

 					__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::LinearToPhysical Large Page phys=%8x",phys));

 					TInt n=KLargeSmallPageRatio-pageOffset;

 					if(n>pagesLeftInChunk)

 						n = pagesLeftInChunk;

 					phys==nextPhys ? nextPhys+=n*KPageSize : nextPhys=KPhysAddrInvalid;

 					if(pageList)

 						{

 						TUint32* pageEnd = pageList+n;

 						do

 							{

 							*pageList++ = phys;

 							phys+=KPageSize;

 							}

 						while(pageList<pageEnd);

 						}

 					pt += n;

 					if(pagesLeftInChunk-=n)

 						continue;

 					break;

 					}

 				__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::LinearToPhysical bad PTE %8x",pte));

 				return KErrNotFound;

 				}

 			}

 		if(!pageList && nextPhys==KPhysAddrInvalid)

 			{

 			__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::LinearToPhysical not contiguous"));

 			return KErrNotFound;

 			}

 		pageIndex = 0;

 		}

 	if(nextPhys==KPhysAddrInvalid)

 		{

 		// Memory is discontiguous...

 		aPhysicalAddress = KPhysAddrInvalid;

 		return 1;

 		}

 	else

 		{

 		// Memory is contiguous...

 		aPhysicalAddress = physStart;

 		return KErrNone;

 		}

 	}

 TInt ArmMmu::PreparePagesForDMA(TLinAddr aLinAddr, TInt aSize, TInt aOsAsid, TPhysAddr* aPhysicalPageList)

 //Returns the list of physical pages belonging to the specified memory space.

 //Checks these pages belong to a chunk marked as being trusted. 

 //Locks these pages so they can not be moved by e.g. ram defragmenation.

 	{

 	SPageInfo* pi = NULL;

 	DChunk* chunk = NULL;

 	TInt err = KErrNone;

 	__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::PreparePagesForDMA %08x+%08x, asid=%d",aLinAddr,aSize,aOsAsid));

 	TUint32* pageList = aPhysicalPageList;

 	TInt pagesInList = 0;				//The number of pages we put in the list so far

 	TInt pageIndex = (aLinAddr & KChunkMask) >> KPageShift;	// Index of the page within the section

 	TInt pagesLeft = ((aLinAddr & KPageMask) + aSize + KPageMask) >> KPageShift;

 	TInt pdeIndex = aLinAddr>>KChunkShift;

 	MmuBase::Wait(); 	// RamAlloc Mutex for accessing page/directory tables.

 	NKern::LockSystem();// SystemlLock for accessing SPageInfo objects.

 	TPde* pdePtr = (pdeIndex<(iLocalPdSize>>2) || (iAsidInfo[aOsAsid]&1)) ? PageDirectory(aOsAsid) : ::InitPageDirectory;

 	pdePtr += pdeIndex;//This points to the first pde 

 	while(pagesLeft)

 		{

 		TInt pagesLeftInChunk = (1<<(KChunkShift-KPageShift))-pageIndex;

 		if(pagesLeftInChunk>pagesLeft)

 			pagesLeftInChunk = pagesLeft;

 		pagesLeft -= pagesLeftInChunk;

 		TPte* pt = SafePageTableFromPde(*pdePtr++);

 		if(!pt) { err = KErrNotFound; goto fail; }// Cannot get page table.

 		pt += pageIndex;

 		for(;pagesLeftInChunk--;)

 			{

 			TPhysAddr phys = (*pt++ & KPteSmallPageAddrMask);

 			pi =  SPageInfo::SafeFromPhysAddr(phys);

 			if(!pi)	{ err = KErrNotFound; goto fail; }// Invalid address

 			__KTRACE_OPT(KMMU2,Kern::Printf("PageInfo: PA:%x T:%x S:%x O:%x C:%x",phys, pi->Type(), pi->State(), pi->Owner(), pi->LockCount()));

 			if (chunk==NULL)

 				{//This is the first page. Check 'trusted' bit.

 				if (pi->Type()!= SPageInfo::EChunk)

 					{ err = KErrAccessDenied; goto fail; }// The first page do not belong to chunk.	

 				chunk = (DChunk*)pi->Owner();

 				if ( (chunk == NULL) || ((chunk->iAttributes & DChunk::ETrustedChunk)== 0) )

 					{ err = KErrAccessDenied; goto fail; }// Not a trusted chunk

 				}

 			pi->Lock();

 			*pageList++ = phys;

 			if ( (++pagesInList&127) == 0) //release system lock temporarily on every 512K

 				NKern::FlashSystem();

 			}

 		pageIndex = 0;

 		}

 	if (pi->Type()!= SPageInfo::EChunk)

 		{ err = KErrAccessDenied; goto fail; }// The last page do not belong to chunk.	

 	if (chunk && (chunk != (DChunk*)pi->Owner()))

 		{ err = KErrArgument; goto fail; }//The first & the last page do not belong to the same chunk.

 	NKern::UnlockSystem();

 	MmuBase::Signal();

 	return KErrNone;

 fail:

 	__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::PreparePagesForDMA failed"));

 	NKern::UnlockSystem();

 	MmuBase::Signal();

 	ReleasePagesFromDMA(aPhysicalPageList, pagesInList);

 	return err;

 	}

 TInt ArmMmu::ReleasePagesFromDMA(TPhysAddr* aPhysicalPageList, TInt aPageCount)

 // Unlocks physical pages.

 // @param aPhysicalPageList - points to the list of physical pages that should be released.

 // @param aPageCount		- the number of physical pages in the list.

 	{

 	NKern::LockSystem();

 	__KTRACE_OPT(KMMU2,Kern::Printf("ArmMmu::ReleasePagesFromDMA count:%d",aPageCount));

 	while (aPageCount--)

 		{

 		SPageInfo* pi =  SPageInfo::SafeFromPhysAddr(*aPhysicalPageList++);

 		if(!pi)

 			{

 			NKern::UnlockSystem();

 			return KErrArgument;

 			}

 		__KTRACE_OPT(KMMU2,Kern::Printf("PageInfo: T:%x S:%x O:%x C:%x",pi->Type(), pi->State(), pi->Owner(), pi->LockCount()));

 		pi->Unlock();

 		}

 	NKern::UnlockSystem();

 	return KErrNone;

 	}

 TPhysAddr ArmMmu::LinearToPhysical(TLinAddr aLinAddr, TInt aOsAsid)

 //

 // Find the physical address corresponding to a given linear address in a specified OS

 // address space. Call with system locked.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::LinearToPhysical(%08x,%d)",aLinAddr,aOsAsid));

 	TInt pdeIndex=aLinAddr>>KChunkShift;

 	TPde pde = (pdeIndex<(iLocalPdSize>>2) || (iAsidInfo[aOsAsid]&1)) ? PageDirectory(aOsAsid)[pdeIndex] : ::InitPageDirectory[pdeIndex];

 	TPhysAddr pa=KPhysAddrInvalid;

 	if ((pde&KPdePresentMask)==KArmV6PdePageTable)

 		{

 		SPageInfo* pi = SPageInfo::SafeFromPhysAddr(pde);

 		if (pi)

 			{

 			TInt id = (pi->Offset()<<KPtClusterShift) | ((pde>>KPageTableShift)&KPtClusterMask);

 			TPte* pPte=PageTable(id);

 			TPte pte=pPte[(aLinAddr&KChunkMask)>>KPageShift];

 			if (pte & KArmV6PteSmallPage)

 				{

 				pa=(pte&KPteSmallPageAddrMask)+(aLinAddr&~KPteSmallPageAddrMask);

 				__KTRACE_OPT(KMMU,Kern::Printf("Mapped with small page - returning %08x",pa));

 				}

 			else if ((pte & KArmV6PteTypeMask) == KArmV6PteLargePage)

 				{

 				pa=(pte&KPteLargePageAddrMask)+(aLinAddr&~KPteLargePageAddrMask);

 				__KTRACE_OPT(KMMU,Kern::Printf("Mapped with large page - returning %08x",pa));

 				}

 			}

 		}

 	else if ((pde&KPdePresentMask)==KArmV6PdeSection)

 		{

 		pa=(pde&KPdeSectionAddrMask)|(aLinAddr&~KPdeSectionAddrMask);

 		__KTRACE_OPT(KMMU,Kern::Printf("Mapped with section - returning %08x",pa));

 		}

 	return pa;

 	}

 // permission table indexed by XN:APX:AP1:AP0

 static const TInt PermissionLookup[16]=

 	{													//XN:APX:AP1:AP0

 	0,													//0   0   0   0  no access

 	EMapAttrWriteSup|EMapAttrReadSup|EMapAttrExecSup,	//0   0   0   1  RW sup			execute

 	EMapAttrWriteSup|EMapAttrReadUser|EMapAttrExecUser,	//0   0   1   0  supRW usrR		execute

 	EMapAttrWriteUser|EMapAttrReadUser|EMapAttrExecUser,//0   0   1   1  supRW usrRW	execute

 	0,													//0   1   0   0  reserved

 	EMapAttrReadSup|EMapAttrExecSup,					//0   1   0   1  supR			execute

 	EMapAttrReadUser|EMapAttrExecUser,					//0   1   1   0  supR usrR		execute

 	0,													//0   1   1   1  reserved

 	0,													//1   0   0   0  no access

 	EMapAttrWriteSup|EMapAttrReadSup,					//1   0   0   1  RW sup

 	EMapAttrWriteSup|EMapAttrReadUser,					//1   0   1   0  supRW usrR

 	EMapAttrWriteUser|EMapAttrReadUser,					//1   0   1   1  supRW usrRW

 	0,													//1   1   0   0  reserved

 	EMapAttrReadSup,									//1   1   0   1  supR

 	EMapAttrReadUser,									//1   1   1   0  supR usrR

 	EMapAttrReadUser,									//1   1   1   1  supR usrR

 	};

 TInt ArmMmu::PageTableId(TLinAddr aAddr, TInt aOsAsid)

 	{

 	TInt id=-1;

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::PageTableId(%08x,%d)",aAddr,aOsAsid));

 	TInt pdeIndex=aAddr>>KChunkShift;

 	TPde pde = (pdeIndex<(iLocalPdSize>>2) || (iAsidInfo[aOsAsid]&1)) ? PageDirectory(aOsAsid)[pdeIndex] : ::InitPageDirectory[pdeIndex];

 	if ((pde&KArmV6PdeTypeMask)==KArmV6PdePageTable)

 		{

 		SPageInfo* pi = SPageInfo::SafeFromPhysAddr(pde);

 		if (pi)

 			id = (pi->Offset()<<KPtClusterShift) | ((pde>>KPageTableShift)&KPtClusterMask);

 		}

 	__KTRACE_OPT(KMMU,Kern::Printf("ID=%d",id));

 	return id;

 	}

 // Used only during boot for recovery of RAM drive

 TInt ArmMmu::BootPageTableId(TLinAddr aAddr, TPhysAddr& aPtPhys)

 	{

 	TInt id=KErrNotFound;

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu:BootPageTableId(%08x,&)",aAddr));

 	TPde* kpd=(TPde*)KPageDirectoryBase;	// kernel page directory

 	TInt pdeIndex=aAddr>>KChunkShift;

 	TPde pde = kpd[pdeIndex];

 	if ((pde & KArmV6PdeTypeMask) == KArmV6PdePageTable)

 		{

 		aPtPhys = pde & KPdePageTableAddrMask;

 		SPageInfo* pi = SPageInfo::SafeFromPhysAddr(pde);

 		if (pi)

 			{

 			SPageInfo::TType type = pi->Type();

 			if (type == SPageInfo::EPageTable)

 				id = (pi->Offset()<<KPtClusterShift) | ((pde>>KPageTableShift)&KPtClusterMask);

 			else if (type == SPageInfo::EUnused)

 				id = KErrUnknown;

 			}

 		}

 	__KTRACE_OPT(KMMU,Kern::Printf("ID=%d",id));

 	return id;

 	}

 TBool ArmMmu::PteIsPresent(TPte aPte)

 	{

 	return aPte & KArmV6PteTypeMask;

 	}

 TPhysAddr ArmMmu::PtePhysAddr(TPte aPte, TInt aPteIndex)

 	{

 	TUint32 pte_type = aPte & KArmV6PteTypeMask;

 	if (pte_type == KArmV6PteLargePage)

 		return (aPte & KPteLargePageAddrMask) + (TPhysAddr(aPteIndex << KPageShift) & KLargePageMask);

 	else if (pte_type != 0)

 		return aPte & KPteSmallPageAddrMask;

 	return KPhysAddrInvalid;

 	}

 TPhysAddr ArmMmu::PdePhysAddr(TLinAddr aAddr)

 	{

 	TPde* kpd = (TPde*)KPageDirectoryBase;	// kernel page directory

 	TPde pde = kpd[aAddr>>KChunkShift];

 	if ((pde & KPdePresentMask) == KArmV6PdeSection)

 		return pde & KPdeSectionAddrMask;

 	return KPhysAddrInvalid;

 	}

 void ArmMmu::Init1()

 	{

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("ArmMmu::Init1"));

 	// MmuBase data

 	iPageSize=KPageSize;

 	iPageMask=KPageMask;

 	iPageShift=KPageShift;

 	iChunkSize=KChunkSize;

 	iChunkMask=KChunkMask;

 	iChunkShift=KChunkShift;

 	iPageTableSize=KPageTableSize;

 	iPageTableMask=KPageTableMask;

 	iPageTableShift=KPageTableShift;

 	iPtClusterSize=KPtClusterSize;

 	iPtClusterMask=KPtClusterMask;

 	iPtClusterShift=KPtClusterShift;

 	iPtBlockSize=KPtBlockSize;

 	iPtBlockMask=KPtBlockMask;

 	iPtBlockShift=KPtBlockShift;

 	iPtGroupSize=KChunkSize/KPageTableSize;

 	iPtGroupMask=iPtGroupSize-1;

 	iPtGroupShift=iChunkShift-iPageTableShift;

 	//TInt* iPtBlockCount;		// dynamically allocated - Init2

 	//TInt* iPtGroupCount;		// dynamically allocated - Init2

 	iPtInfo=(SPageTableInfo*)KPageTableInfoBase;

 	iPageTableLinBase=KPageTableBase;

 	//iRamPageAllocator;		// dynamically allocated - Init2

 	//iAsyncFreeList;			// dynamically allocated - Init2

 	//iPageTableAllocator;		// dynamically allocated - Init2

 	//iPageTableLinearAllocator;// dynamically allocated - Init2

 	iPtInfoPtePerm=KPtInfoPtePerm;

 	iPtPtePerm=KPtPtePerm;

 	iPtPdePerm=KPtPdePerm;

 	iUserCodeLoadPtePerm=KUserCodeLoadPte;

 	iKernelCodePtePerm=KKernelCodeRunPte;

 	iTempAddr=KTempAddr;

 	iSecondTempAddr=KSecondTempAddr;

 	iMapSizes=KPageSize|KLargePageSize|KChunkSize;

 	iRomLinearBase = ::RomHeaderAddress;

 	iRomLinearEnd = KRomLinearEnd;

 	iShadowPtePerm = KShadowPtePerm;

 	iShadowPdePerm = KShadowPdePerm;

 	// Mmu data

 	TInt total_ram=TheSuperPage().iTotalRamSize;

 	// Large or small configuration?

 	// This is determined by the bootstrap based on RAM size

 	TUint32 ttcr=TTCR();

 	__NK_ASSERT_ALWAYS(ttcr==1 || ttcr==2);

 	TBool large = (ttcr==1);

 	// calculate cache colouring...

 	TInt iColourCount = 0;

 	TInt dColourCount = 0;

 	TUint32 ctr = InternalCache::TypeRegister();

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("CacheTypeRegister = %08x",ctr));

 #ifdef __CPU_ARMV6

 	__NK_ASSERT_ALWAYS((ctr>>29)==0);	// check ARMv6 format

 	if(ctr&0x800)

 		iColourCount = 4;

 	if(ctr&0x800000)

 		dColourCount = 4;

 #else

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("CacheTypeRegister = %08x",ctr));

 	__NK_ASSERT_ALWAYS((ctr>>29)==4);	// check ARMv7 format

 	TUint l1ip = (ctr>>14)&3;			// L1 instruction cache indexing and tagging policy

 	__NK_ASSERT_ALWAYS(l1ip>=2);		// check I cache is physically tagged

 	TUint32 clidr = InternalCache::LevelIDRegister();

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("CacheLevelIDRegister = %08x",clidr));

 	TUint l1type = clidr&7;

 	if(l1type)

 		{

 		if(l1type==2 || l1type==3 || l1type==4)

 			{

 			// we have an L1 data cache...

 			TUint32 csir = InternalCache::SizeIdRegister(0,0);

 			TUint sets = ((csir>>13)&0x7fff)+1;

 			TUint ways = ((csir>>3)&0x3ff)+1;

 			TUint lineSizeShift = (csir&7)+4;

 			// assume L1 data cache is VIPT and alias checks broken and so we need data cache colouring...

 			dColourCount = (sets<<lineSizeShift)>>KPageShift;

 			if(l1type==4) // unified cache, so set instruction cache colour as well...

 				iColourCount = (sets<<lineSizeShift)>>KPageShift;

 			__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("L1DCache = 0x%x,0x%x,%d colourCount=%d",sets,ways,lineSizeShift,(sets<<lineSizeShift)>>KPageShift));

 			}

 		if(l1type==1 || l1type==3)

 			{

 			// we have a separate L1 instruction cache...

 			TUint32 csir = InternalCache::SizeIdRegister(1,0);

 			TUint sets = ((csir>>13)&0x7fff)+1;

 			TUint ways = ((csir>>3)&0x3ff)+1;

 			TUint lineSizeShift = (csir&7)+4;

 			iColourCount = (sets<<lineSizeShift)>>KPageShift;

 			__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("L1ICache = 0x%x,0x%x,%d colourCount=%d",sets,ways,lineSizeShift,(sets<<lineSizeShift)>>KPageShift));

 			}

 		}

 	if(l1ip==3)

 		{

 		// PIPT cache, so no colouring restrictions...

 		__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("L1ICache is PIPT"));

 		iColourCount = 0;

 		}

 	else

 		{

 		// VIPT cache...

 		__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("L1ICache is VIPT"));

 		}

 #endif

 	TUint colourShift = 0;

 	for(TUint colourCount=Max(iColourCount,dColourCount); colourCount!=0; colourCount>>=1)

 		++colourShift;

 	iAliasSize=KPageSize<<colourShift;

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("iAliasSize=0x%x",iAliasSize));

 	iAliasMask=iAliasSize-1;

 	iAliasShift=KPageShift+colourShift;

 	iDecommitThreshold = CacheMaintenance::SyncAllPerformanceThresholdPages();

 	iNumOsAsids=KArmV6NumAsids;

 	iNumGlobalPageDirs=1;

 	//iOsAsidAllocator;			// dynamically allocated - Init2

 	iGlobalPdSize=KPageDirectorySize;

 	iGlobalPdShift=KPageDirectoryShift;

 	iAsidGroupSize=KChunkSize/KPageDirectorySize;

 	iAsidGroupMask=iAsidGroupSize-1;

 	iAsidGroupShift=KChunkShift-KPageDirectoryShift;

 	iUserLocalBase=KUserLocalDataBase;

 	iAsidInfo=(TUint32*)KAsidInfoBase;

 	iPdeBase=KPageDirectoryBase;

 	iPdPtePerm=KPdPtePerm;

 	iPdPdePerm=KPdPdePerm;

 	iRamDriveMask=0x00f00000;

 	iGlobalCodePtePerm=KGlobalCodeRunPte;

 #if defined(__CPU_MEMORY_TYPE_REMAPPING)

 	iCacheMaintenanceTempMapAttr = CacheMaintenance::TemporaryMapping();

 #else

 	switch(CacheMaintenance::TemporaryMapping())

 		{

 		case EMemAttNormalUncached:

 			iCacheMaintenanceTempMapAttr = KArmV6MemAttNCNC;

 			break;

 		case EMemAttNormalCached:

 			iCacheMaintenanceTempMapAttr = KArmV6MemAttWBWAWBWA;

 			break;

 		default:

 			Panic(ETempMappingFailed);

 		}

 #endif	

 	iMaxDllDataSize=Min(total_ram/2, 0x08000000);				// phys RAM/2 up to 128Mb

 	iMaxDllDataSize=(iMaxDllDataSize+iChunkMask)&~iChunkMask;	// round up to chunk size

 	iMaxUserCodeSize=Min(total_ram, 0x10000000);				// phys RAM up to 256Mb

 	iMaxUserCodeSize=(iMaxUserCodeSize+iChunkMask)&~iChunkMask;	// round up to chunk size

 	if (large)

 		{

 		iLocalPdSize=KPageDirectorySize/2;

 		iLocalPdShift=KPageDirectoryShift-1;

 		iUserSharedBase=KUserSharedDataBase2GB;

 		iUserLocalEnd=iUserSharedBase-iMaxDllDataSize;

 		iUserSharedEnd=KUserSharedDataEnd2GB-iMaxUserCodeSize;

 		iDllDataBase=iUserLocalEnd;

 		iUserCodeBase=iUserSharedEnd;

 		}

 	else

 		{

 		iLocalPdSize=KPageDirectorySize/4;

 		iLocalPdShift=KPageDirectoryShift-2;

 		iUserSharedBase=KUserSharedDataBase1GB;

 		iUserLocalEnd=iUserSharedBase;

 		iDllDataBase=KUserSharedDataEnd1GB-iMaxDllDataSize;

 		iUserCodeBase=iDllDataBase-iMaxUserCodeSize;

 		iUserSharedEnd=iUserCodeBase;

 		}

 	__KTRACE_OPT(KMMU,Kern::Printf("LPD size %08x GPD size %08x Alias size %08x",

 													iLocalPdSize, iGlobalPdSize, iAliasSize));

 	__KTRACE_OPT(KMMU,Kern::Printf("ULB %08x ULE %08x USB %08x USE %08x",iUserLocalBase,iUserLocalEnd,

 																			iUserSharedBase,iUserSharedEnd));

 	__KTRACE_OPT(KMMU,Kern::Printf("DDB %08x UCB %08x",iDllDataBase,iUserCodeBase));

 	// ArmMmu data

 	// other

 	PP::MaxUserThreadStack=0x14000;			// 80K - STDLIB asks for 64K for PosixServer!!!!

 	PP::UserThreadStackGuard=0x2000;		// 8K

 	PP::MaxStackSpacePerProcess=0x200000;	// 2Mb

 	K::SupervisorThreadStackSize=0x1000;	// 4K

 	PP::SupervisorThreadStackGuard=0x1000;	// 4K

 	K::MachineConfig=(TMachineConfig*)KMachineConfigLinAddr;

 	PP::RamDriveStartAddress=KRamDriveStartAddress;

 	PP::RamDriveRange=KRamDriveMaxSize;

 	PP::RamDriveMaxSize=KRamDriveMaxSize;	// may be reduced later

 	K::MemModelAttributes=EMemModelTypeMultiple|EMemModelAttrNonExProt|EMemModelAttrKernProt|EMemModelAttrWriteProt|

 						EMemModelAttrVA|EMemModelAttrProcessProt|EMemModelAttrSameVA|EMemModelAttrSvKernProt|

 						EMemModelAttrIPCKernProt|EMemModelAttrRamCodeProt;

 	Arm::DefaultDomainAccess=KDefaultDomainAccess;

 	Mmu::Init1();

 	}

 void ArmMmu::DoInit2()

 	{

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("ArmMmu::DoInit2"));

 	iTempPte=PageTable(PageTableId(iTempAddr,0))+((iTempAddr&KChunkMask)>>KPageShift);

 	iSecondTempPte=PageTable(PageTableId(iSecondTempAddr,0))+((iSecondTempAddr&KChunkMask)>>KPageShift);

 	__KTRACE_OPT2(KBOOT,KMMU,Kern::Printf("iTempAddr=%08x, iTempPte=%08x, iSecondTempAddr=%08x, iSecondTempPte=%08x",

 			iTempAddr, iTempPte, iSecondTempAddr, iSecondTempPte));

 	CreateKernelSection(KKernelSectionEnd, iAliasShift);

 	CreateUserGlobalSection(KUserGlobalDataBase, KUserGlobalDataEnd);

 	Mmu::DoInit2();

 	}

 #ifndef __MMU_MACHINE_CODED__

 void ArmMmu::MapRamPages(TInt aId, SPageInfo::TType aType, TAny* aPtr, TUint32 aOffset, const TPhysAddr* aPageList, TInt aNumPages, TPte aPtePerm)

 //

 // Map a list of physical RAM pages into a specified page table with specified PTE permissions.

 // Update the page information array.

 // Call this with the system locked.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::MapRamPages() id=%d type=%d ptr=%08x off=%08x n=%d perm=%08x",

 			aId, aType, aPtr, aOffset, aNumPages, aPtePerm));

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	ptinfo.iCount+=aNumPages;

 	aOffset>>=KPageShift;

 	TInt ptOffset=aOffset & KPagesInPDEMask;				// entry number in page table

 	TPte* pPte=PageTable(aId)+ptOffset;						// address of first PTE

 	TLinAddr firstPte = (TLinAddr)pPte; //Will need this to clean page table changes in cache.

 	while(aNumPages--)

 		{

 		TPhysAddr pa = *aPageList++;

 		if(pa==KPhysAddrInvalid)

 			{

 			++pPte;

 			__NK_ASSERT_DEBUG(aType==SPageInfo::EInvalid);

 			continue;

 			}

 		*pPte++ =  pa | aPtePerm;					// insert PTE

 		__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x",pPte[-1],pPte-1));

 		if (aType!=SPageInfo::EInvalid)

 			{

 			SPageInfo* pi = SPageInfo::SafeFromPhysAddr(pa);

 			if(pi)

 				{

 				pi->Set(aType,aPtr,aOffset);

 				__KTRACE_OPT(KMMU,Kern::Printf("I: %d %08x %08x",aType,aPtr,aOffset));

 				++aOffset;	// increment offset for next page

 				}

 			}

 		}

 	CacheMaintenance::MultiplePtesUpdated(firstPte, (TUint)pPte-firstPte);

 	}

 void ArmMmu::MapPhysicalPages(TInt aId, SPageInfo::TType aType, TAny* aPtr, TUint32 aOffset, TPhysAddr aPhysAddr, TInt aNumPages, TPte aPtePerm)

 //

 // Map consecutive physical pages into a specified page table with specified PTE permissions.

 // Update the page information array if RAM pages are being mapped.

 // Call this with the system locked.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::MapPhysicalPages() id=%d type=%d ptr=%08x off=%08x phys=%08x n=%d perm=%08x",

 			aId, aType, aPtr, aOffset, aPhysAddr, aNumPages, aPtePerm));

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	ptinfo.iCount+=aNumPages;

 	aOffset>>=KPageShift;

 	TInt ptOffset=aOffset & KPagesInPDEMask;				// entry number in page table

 	TPte* pPte=(TPte*)(PageTableLinAddr(aId))+ptOffset;		// address of first PTE

 	TLinAddr firstPte = (TLinAddr)pPte; //Will need this to clean page table changes in cache

 	SPageInfo* pi;

 	if(aType==SPageInfo::EInvalid)

 		pi = NULL;

 	else

 		pi = SPageInfo::SafeFromPhysAddr(aPhysAddr);

 	while(aNumPages--)

 		{

 		*pPte++ = aPhysAddr|aPtePerm;						// insert PTE

 		aPhysAddr+=KPageSize;

 		__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x",pPte[-1],pPte-1));

 		if (pi)

 			{

 			pi->Set(aType,aPtr,aOffset);

 			__KTRACE_OPT(KMMU,Kern::Printf("I: %d %08x %08x",aType,aPtr,aOffset));

 			++aOffset;	// increment offset for next page

 			++pi;

 			}

 		}

 	CacheMaintenance::MultiplePtesUpdated(firstPte, (TUint)pPte-firstPte);

 	}

 void ArmMmu::MapVirtual(TInt aId, TInt aNumPages)

 //

 // Called in place of MapRamPages or MapPhysicalPages to update mmu data structures when committing

 // virtual address space to a chunk.  No pages are mapped.

 // Call this with the system locked.

 //

 	{

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	ptinfo.iCount+=aNumPages;

 	}

 void ArmMmu::RemapPage(TInt aId, TUint32 aAddr, TPhysAddr aOldAddr, TPhysAddr aNewAddr, TPte aPtePerm, DProcess* aProcess)

 //

 // Replace the mapping at address aAddr in page table aId.

 // Update the page information array for both the old and new pages.

 // Return physical address of old page if it is now ready to be freed.

 // Call this with the system locked.

 // May be called with interrupts disabled, do not enable/disable them.

 //

 	{

 	TInt ptOffset=(aAddr&KChunkMask)>>KPageShift;			// entry number in page table

 	TPte* pPte=PageTable(aId)+ptOffset;						// address of PTE

 	TPte pte=*pPte;

 	TInt asid=aProcess ? ((DMemModelProcess*)aProcess)->iOsAsid :

 						 (aAddr<KRomLinearBase ? (TInt)UNKNOWN_MAPPING : (TInt)KERNEL_MAPPING );

 	if (pte & KArmV6PteSmallPage)

 		{

 		__ASSERT_ALWAYS((pte & KPteSmallPageAddrMask) == aOldAddr, Panic(ERemapPageFailed));

 		SPageInfo* oldpi = SPageInfo::FromPhysAddr(aOldAddr);

 		__ASSERT_DEBUG(oldpi->LockCount()==0,Panic(ERemapPageFailed));

 		// remap page

 		*pPte = aNewAddr | aPtePerm;					// overwrite PTE

 		CacheMaintenance::SinglePteUpdated((TLinAddr)pPte);

 		InvalidateTLBForPage(aAddr,asid);	// flush TLB entry

 		// update new pageinfo, clear old

 		SPageInfo* pi = SPageInfo::FromPhysAddr(aNewAddr);

 		pi->Set(oldpi->Type(),oldpi->Owner(),oldpi->Offset());

 		oldpi->SetUnused();

 		}

 	else

 		{

 		Panic(ERemapPageFailed);

 		}

 	}

 void ArmMmu::RemapPageByAsid(TBitMapAllocator* aOsAsids, TLinAddr aLinAddr, TPhysAddr aOldAddr, TPhysAddr aNewAddr, TPte aPtePerm)

 //

 // Replace the mapping at address aLinAddr in the relevant page table for all

 // ASIDs specified in aOsAsids, but only if the currently mapped address is

 // aOldAddr.

 // Update the page information array for both the old and new pages.

 // Call this with the system unlocked.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::RemapPageByAsid() linaddr=%08x oldaddr=%08x newaddr=%08x perm=%08x", aLinAddr, aOldAddr, aNewAddr, aPtePerm));

 	TInt asid = -1;

 	TInt lastAsid = KArmV6NumAsids - 1;

 	TUint32* ptr = aOsAsids->iMap;

 	NKern::LockSystem();

 	do

 		{

 		TUint32 bits = *ptr++;

 		do

 			{

 			++asid;

 			if(bits & 0x80000000u)

 				{

 				// mapped in this address space, so update PTE...

 				TPte* pPte = PtePtrFromLinAddr(aLinAddr, asid);

 				TPte pte = *pPte;

 				if ((pte&~KPageMask) == aOldAddr)

 					{

 					*pPte = aNewAddr | aPtePerm;

 					__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x in asid %d",*pPte,pPte,asid));

 					CacheMaintenance::SinglePteUpdated((TLinAddr)pPte);

 					InvalidateTLBForPage(aLinAddr,asid);	// flush TLB entry

 					}

 				}

 			}

 		while(bits<<=1);

 		NKern::FlashSystem();

 		asid |= 31;

 		}

 	while(asid<lastAsid);

 	// copy pageinfo attributes and mark old page unused

 	SPageInfo* oldpi = SPageInfo::FromPhysAddr(aOldAddr);

 	SPageInfo::FromPhysAddr(aNewAddr)->Set(oldpi->Type(),oldpi->Owner(),oldpi->Offset());

 	oldpi->SetUnused();

 	NKern::UnlockSystem();

 	}

 TInt ArmMmu::UnmapPages(TInt aId, TUint32 aAddr, TInt aNumPages, TPhysAddr* aPageList, TBool aSetPagesFree, TInt& aNumPtes, TInt& aNumFree, DProcess* aProcess)

 //

 // Unmap a specified area at address aAddr in page table aId. Place physical addresses of unmapped

 // pages into aPageList, and count of unmapped pages into aNumPtes.

 // Return number of pages still mapped using this page table.

 // Call this with the system locked.

 // On multiple memory model, do not call this method with aSetPagesFree false. Call UnmapUnownedPages instead.

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::UnmapPages() id=%d addr=%08x n=%d pl=%08x set-free=%d",aId,aAddr,aNumPages,aPageList,aSetPagesFree));

 	TInt ptOffset=(aAddr&KChunkMask)>>KPageShift;			// entry number in page table

 	TPte* pPte=PageTable(aId)+ptOffset;						// address of first PTE

 	TInt np=0;

 	TInt nf=0;

 	TUint32 ng=0;

 	TInt asid=aProcess ? ((DMemModelProcess*)aProcess)->iOsAsid :

 	                     (aAddr<KRomLinearBase ? (TInt)UNKNOWN_MAPPING : (TInt)KERNEL_MAPPING );

 	while(aNumPages--)

 		{

 		TPte pte=*pPte;						// get original PTE

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 		remove_and_invalidate_page(pPte, aAddr, asid);

 		++pPte;

 #else

 		*pPte++=0;							// clear PTE

 #endif

 		// We count all unmapped pages in np, including demand paged 'old' pages - but we don't pass

 		// these to PageUnmapped, as the page doesn't become free until it's unmapped from all

 		// processes		

 		if (pte != KPteNotPresentEntry)

 			++np;

 		if (pte & KArmV6PteSmallPage)

 			{

 			ng |= pte;

 #if !defined(__CPU_ARM1136__) || defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 			// Remove_and_invalidate_page will sort out cache and TLB. 

 			// When __CPU_ARM1136_ERRATUM_353494_FIXED, we have to do it here.

 			CacheMaintenance::SinglePteUpdated((TLinAddr)(pPte-1));

 			if (asid >= 0) //otherwise, KUnmapPagesTLBFlushDeferred will be returned.

 				InvalidateTLBForPage(aAddr,asid);	// flush any corresponding TLB entry

 #endif

 			TPhysAddr pa=pte & KPteSmallPageAddrMask;	// physical address of unmapped page

 			if (aSetPagesFree)

 				{

 				SPageInfo* pi = SPageInfo::FromPhysAddr(pa);

 				if(iRamCache->PageUnmapped(pi))

 					{

 					pi->SetUnused();					// mark page as unused

 					if (pi->LockCount()==0)

 						{

 						*aPageList++=pa;			// store in page list

 						++nf;						// count free pages

 						}

 					}

 				}

 			else

 				*aPageList++=pa;				// store in page list

 			}

 		aAddr+=KPageSize;

 		}

 	aNumPtes=np;

 	aNumFree=nf;

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	TInt r=(ptinfo.iCount-=np);

 	if (asid<0)

 		r|=KUnmapPagesTLBFlushDeferred;

 	#if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 	__FlushBtb();

 	#endif

 	__KTRACE_OPT(KMMU,Kern::Printf("Unmapped %d; Freed: %d; Return %08x",np,nf,r));

 	return r;								// return number of pages remaining in this page table

 	}

 TInt ArmMmu::UnmapVirtual(TInt aId, TUint32 aAddr, TInt aNumPages, TPhysAddr* aPageList, TBool aSetPagesFree, TInt& aNumPtes, TInt& aNumFree, DProcess* aProcess)

 //

 // Unmap a specified area at address aAddr in page table aId. Place physical addresses of unmapped

 // pages into aPageList, and count of unmapped pages into aNumPtes.

 // Adjust the page table reference count as if aNumPages pages were unmapped.

 // Return number of pages still mapped using this page table.

 // Call this with the system locked.

 // On multiple memory model, do not call this method with aSetPagesFree false. Call UnmapUnownedVirtual instead.

 //

 	{

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	TInt newCount = ptinfo.iCount - aNumPages;

 	UnmapPages(aId, aAddr, aNumPages, aPageList, aSetPagesFree, aNumPtes, aNumFree, aProcess);

 	ptinfo.iCount = newCount;

 	aNumPtes = aNumPages;

 	return newCount;

 	}

 TInt ArmMmu::UnmapUnownedPages(TInt aId, TUint32 aAddr, TInt aNumPages,

 		TPhysAddr* aPageList, TLinAddr* aLAPageList,TInt& aNumPtes, TInt& aNumFree, DProcess* aProcess)

 /*

  * Unmaps specified area at address aAddr in page table aId.

  * Places physical addresses of not-demaned-paged unmapped pages into aPageList.

  * Corresponding linear addresses are placed into aLAPageList.

  * 'Old' demand-paged pages (holds invalid PE entry with physucal address) are neither unmapped nor

  * encountered in aPageList but are still counted in aNumPtes.

  * 

  * This method should be called to decommit physical memory not owned by the chunk. As we do not know

  * the origin of such memory, PtInfo could be invalid (or does't exist) so cache maintenance may not be

  * able to obtain mapping colour. For that reason, this also returns former linear address of each page 

  * in aPageList.   

  *   

  * @pre All pages are mapped within a single page table identified by aId.

  * @pre On entry, system locked is held and is not released during the execution.

  *

  * @arg aId             Id of the page table that maps tha pages.

  * @arg aAddr           Linear address of the start of the area.

  * @arg aNumPages       The number of pages to unmap.

  * @arg aProcess        The owning process of the mamory area to unmap.

  * @arg aPageList       On  exit, holds the list of unmapped pages.

  * @arg aLAPageList     On  exit, holds the list of linear addresses of unmapped pages.

  * @arg aNumFree        On exit, holds the number of pages in aPageList.

  * @arg aNumPtes        On exit, holds the number of unmapped pages. This includes demand-paged 'old'

  *                      pages (with invalid page table entry still holding the address of physical page.)

  *                      

  * @return              The number of pages still mapped using this page table. It is orred by

  *                      KUnmapPagesTLBFlushDeferred if TLB flush is not executed - which requires 

  *                      the caller to do global TLB flush.

  */ 

     {

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::UnmapUnownedPages() id=%d addr=%08x n=%d pl=%08x",aId,aAddr,aNumPages,aPageList));

 	TInt ptOffset=(aAddr&KChunkMask)>>KPageShift;			// entry number in page table

 	TPte* pPte=PageTable(aId)+ptOffset;						// address of first PTE

 	TInt np=0;

 	TInt nf=0;

 	TUint32 ng=0;

 	TInt asid=aProcess ? ((DMemModelProcess*)aProcess)->iOsAsid :

 	                     (aAddr<KRomLinearBase ? (TInt)UNKNOWN_MAPPING : (TInt)KERNEL_MAPPING );

 	while(aNumPages--)

 		{

 		TPte pte=*pPte;						// get original PTE

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 		remove_and_invalidate_page(pPte, aAddr, asid);

 		++pPte;

 #else

 		*pPte++=0;							// clear PTE

 #endif

 		// We count all unmapped pages in np, including demand paged 'old' pages - but we don't pass

 		// these to PageUnmapped, as the page doesn't become free until it's unmapped from all

 		// processes		

 		if (pte != KPteNotPresentEntry)

 			++np;

 		if (pte & KArmV6PteSmallPage)

 			{

 			ng |= pte;

 #if !defined(__CPU_ARM1136__) || defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 			// Remove_and_invalidate_page will sort out cache and TLB. 

 			// When __CPU_ARM1136_ERRATUM_353494_FIXED, we have to do it here.

 			CacheMaintenance::SinglePteUpdated((TLinAddr)(pPte-1));

 			if (asid >= 0) //otherwise, KUnmapPagesTLBFlushDeferred will be returned.

 				InvalidateTLBForPage(aAddr,asid);	// flush any corresponding TLB entry

 #endif

 			TPhysAddr pa=pte & KPteSmallPageAddrMask;	// physical address of unmapped page

 	        ++nf;

 	        *aPageList++=pa;				// store physical aaddress in page list

 	        *aLAPageList++=aAddr;			// store linear address in page list

 			}

 		aAddr+=KPageSize;

 		}

 	aNumPtes=np;

 	aNumFree=nf;

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	TInt r=(ptinfo.iCount-=np);

 	if (asid<0)

 		r|=KUnmapPagesTLBFlushDeferred;

 	#if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 	__FlushBtb();

 	#endif

 	__KTRACE_OPT(KMMU,Kern::Printf("Unmapped %d; Freed: %d; Return %08x",np,nf,r));

 	return r;								// return number of pages remaining in this page table

 	}

 TInt ArmMmu::UnmapUnownedVirtual(TInt aId, TUint32 aAddr, TInt aNumPages,

 		TPhysAddr* aPageList, TLinAddr* aLAPageList,TInt& aNumPtes, TInt& aNumFree, DProcess* aProcess)

 //

 // Unmap a specified area at address aAddr in page table aId. Place physical addresses of unmapped

 // pages into aPageList, and count of unmapped pages into aNumPtes.

 // Adjust the page table reference count as if aNumPages pages were unmapped.

 // Return number of pages still mapped using this page table.

 // Call this with the system locked.

 //

 	{

 	SPageTableInfo& ptinfo=iPtInfo[aId];

 	TInt newCount = ptinfo.iCount - aNumPages;

 	UnmapUnownedPages(aId, aAddr, aNumPages, aPageList,  aLAPageList, aNumPtes,  aNumFree,  aProcess);

 	ptinfo.iCount = newCount;

 	aNumPtes = aNumPages;	

 	return newCount;

 	}

 void ArmMmu::DoAssignPageTable(TInt aId, TLinAddr aAddr, TPde aPdePerm, const TAny* aOsAsids)

 //

 // Assign an allocated page table to map a given linear address with specified permissions.

 // This should be called with the system unlocked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::DoAssignPageTable %d to %08x perm %08x asid %08x",aId,aAddr,aPdePerm,aOsAsids));

 	TLinAddr ptLin=PageTableLinAddr(aId);

 	TPhysAddr ptPhys=LinearToPhysical(ptLin,0);

 	TInt pdeIndex=TInt(aAddr>>KChunkShift);

 	TBool gpd=(pdeIndex>=(iLocalPdSize>>2));

 	TInt os_asid=(TInt)aOsAsids;

 	if (TUint32(os_asid)<TUint32(iNumOsAsids))

 		{

 		// single OS ASID

 		TPde* pageDir=PageDirectory(os_asid);

 		NKern::LockSystem();

 		pageDir[pdeIndex]=ptPhys|aPdePerm;	// will blow up here if address is in global region aOsAsid doesn't have a global PD

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 		NKern::UnlockSystem();

 		__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",ptPhys|aPdePerm,pageDir+pdeIndex));

 		}

 	else if (os_asid==-1 && gpd)

 		{

 		// all OS ASIDs, address in global region

 		TInt num_os_asids=iNumGlobalPageDirs;

 		const TBitMapAllocator& b=*(const TBitMapAllocator*)iOsAsidAllocator;

 		for (os_asid=0; num_os_asids; ++os_asid)

 			{

 			if (!b.NotAllocated(os_asid,1) && (iAsidInfo[os_asid]&1))

 				{

 				// this OS ASID exists and has a global page directory

 				TPde* pageDir=PageDirectory(os_asid);

 				NKern::LockSystem();

 				pageDir[pdeIndex]=ptPhys|aPdePerm;

 				CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 				NKern::UnlockSystem();

 				__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",ptPhys|aPdePerm,pageDir+pdeIndex));

 				--num_os_asids;

 				}

 			}

 		}

 	else

 		{

 		// selection of OS ASIDs or all OS ASIDs

 		const TBitMapAllocator* pB=(const TBitMapAllocator*)aOsAsids;

 		if (os_asid==-1)

 			pB=iOsAsidAllocator;	// 0's in positions which exist

 		TInt num_os_asids=pB->iSize-pB->iAvail;

 		for (os_asid=0; num_os_asids; ++os_asid)

 			{

 			if (pB->NotAllocated(os_asid,1))

 				continue;			// os_asid is not needed

 			TPde* pageDir=PageDirectory(os_asid);

 			NKern::LockSystem();

 			pageDir[pdeIndex]=ptPhys|aPdePerm;

 			CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 			NKern::UnlockSystem();

 			__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",ptPhys|aPdePerm,pageDir+pdeIndex));

 			--num_os_asids;

 			}

 		}

 	}

 void ArmMmu::RemapPageTableSingle(TPhysAddr aOld, TPhysAddr aNew, TLinAddr aAddr, TInt aOsAsid)

 //

 // Replace a single page table mapping the specified linear address.

 // This should be called with the system locked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::RemapPageTableSingle %08x to %08x at %08x asid %d",aOld,aNew,aAddr,aOsAsid));

 	TPde* pageDir=PageDirectory(aOsAsid);

 	TInt pdeIndex=TInt(aAddr>>KChunkShift);

 	TPde pde=pageDir[pdeIndex];

 	__ASSERT_ALWAYS((pde & KPdePageTableAddrMask) == aOld, Panic(ERemapPageTableFailed));

 	TPde newPde=aNew|(pde&~KPdePageTableAddrMask);

 	pageDir[pdeIndex]=newPde;	// will blow up here if address is in global region aOsAsid doesn't have a global PD

 	CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 	__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",newPde,pageDir+pdeIndex));

 	}

 void ArmMmu::RemapPageTableGlobal(TPhysAddr aOld, TPhysAddr aNew, TLinAddr aAddr)

 //

 // Replace a global page table mapping the specified linear address.

 // This should be called with the system locked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::RemapPageTableGlobal %08x to %08x at %08x",aOld,aNew,aAddr));

 	TInt pdeIndex=TInt(aAddr>>KChunkShift);

 	TInt num_os_asids=iNumGlobalPageDirs;

 	const TBitMapAllocator& b=*(const TBitMapAllocator*)iOsAsidAllocator;

 	for (TInt os_asid=0; num_os_asids; ++os_asid)

 		{

 		if (!b.NotAllocated(os_asid,1) && (iAsidInfo[os_asid]&1))

 			{

 			// this OS ASID exists and has a global page directory

 			TPde* pageDir=PageDirectory(os_asid);

 			TPde pde=pageDir[pdeIndex];

 			if ((pde & KPdePageTableAddrMask) == aOld)

 				{

 				TPde newPde=aNew|(pde&~KPdePageTableAddrMask);

 				pageDir[pdeIndex]=newPde;

 				CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 				__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",newPde,pageDir+pdeIndex));

 				}

 			--num_os_asids;

 			}

 		if ((os_asid&31)==31)

 			NKern::FlashSystem();

 		}

 	}

 void ArmMmu::RemapPageTableMultiple(TPhysAddr aOld, TPhysAddr aNew, TLinAddr aAddr, const TAny* aOsAsids)

 //

 // Replace multiple page table mappings of the specified linear address.

 // This should be called with the system locked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::RemapPageTableMultiple %08x to %08x at %08x asids %08x",aOld,aNew,aAddr,aOsAsids));

 	TInt pdeIndex=TInt(aAddr>>KChunkShift);

 	const TBitMapAllocator* pB=(const TBitMapAllocator*)aOsAsids;

 	if ((TInt)aOsAsids==-1)

 		pB=iOsAsidAllocator;	// 0's in positions which exist

 	TInt asid = -1;

 	TInt lastAsid = KArmV6NumAsids - 1;

 	const TUint32* ptr = pB->iMap;

 	do

 		{

 		TUint32 bits = *ptr++;

 		do

 			{

 			++asid;

 			if ((bits & 0x80000000u) == 0)

 				{

 				// mapped in this address space - bitmap is inverted

 				TPde* pageDir=PageDirectory(asid);

 				TPde pde=pageDir[pdeIndex];

 				if ((pde & KPdePageTableAddrMask) == aOld)

 					{

 					TPde newPde=aNew|(pde&~KPdePageTableAddrMask);

 					pageDir[pdeIndex]=newPde;

 					CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 					__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x",newPde,pageDir+pdeIndex));

 					}

 				}

 			}

 		while(bits<<=1);

 		NKern::FlashSystem();

 		asid |= 31;

 		}

 	while(asid<lastAsid);

 	}

 void ArmMmu::RemapPageTableAliases(TPhysAddr aOld, TPhysAddr aNew)

 //

 // Replace aliases of the specified page table.

 // This should be called with the system locked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::RemapPageTableAliases %08x to %08x",aOld,aNew));

 	SDblQue checkedList;

 	SDblQueLink* next;

 	while(!iAliasList.IsEmpty())

 		{

 		next = iAliasList.First()->Deque();

 		checkedList.Add(next);

 		DMemModelThread* thread = (DMemModelThread*)((TInt)next-_FOFF(DMemModelThread,iAliasLink));

 		TPde pde = thread->iAliasPde;

 		if ((pde & ~KPageMask) == aOld)

 			{

 			// a page table in this page is being aliased by the thread, so update it...

 			thread->iAliasPde = (pde & KPageMask) | aNew;

 			}

 		NKern::FlashSystem();

 		}

 	// copy checkedList back to iAliasList

 	iAliasList.MoveFrom(&checkedList);

 	}

 void ArmMmu::DoUnassignPageTable(TLinAddr aAddr, const TAny* aOsAsids)

 //

 // Unassign a now-empty page table currently mapping the specified linear address.

 // We assume that TLB and/or cache flushing has been done when any RAM pages were unmapped.

 // This should be called with the system unlocked and the MMU mutex held.

 //

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::DoUnassignPageTable at %08x a=%08x",aAddr,aOsAsids));

 	TInt pdeIndex=TInt(aAddr>>KChunkShift);

 	TBool gpd=(pdeIndex>=(iLocalPdSize>>2));

 	TInt os_asid=(TInt)aOsAsids;

 	TUint pde=0;

 	SDblQue checkedList;

 	SDblQueLink* next;

 	if (TUint32(os_asid)<TUint32(iNumOsAsids))

 		{

 		// single OS ASID

 		TPde* pageDir=PageDirectory(os_asid);

 		NKern::LockSystem();

 		pde = pageDir[pdeIndex];

 		pageDir[pdeIndex]=0;

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 		__KTRACE_OPT(KMMU,Kern::Printf("Clearing PDE at %08x",pageDir+pdeIndex));

 		// remove any aliases of the page table...

 		TUint ptId = pde>>KPageTableShift;

 		while(!iAliasList.IsEmpty())

 			{

 			next = iAliasList.First()->Deque();

 			checkedList.Add(next);

 			DMemModelThread* thread = (DMemModelThread*)((TInt)next-_FOFF(DMemModelThread,iAliasLink));

 			if(thread->iAliasOsAsid==os_asid && (thread->iAliasPde>>KPageTableShift)==ptId)

 				{

 				// the page table is being aliased by the thread, so remove it...

 				thread->iAliasPde = 0;

 				}

 			NKern::FlashSystem();

 			}

 		}

 	else if (os_asid==-1 && gpd)

 		{

 		// all OS ASIDs, address in global region

 		TInt num_os_asids=iNumGlobalPageDirs;

 		const TBitMapAllocator& b=*(const TBitMapAllocator*)iOsAsidAllocator;

 		for (os_asid=0; num_os_asids; ++os_asid)

 			{

 			if (!b.NotAllocated(os_asid,1) && (iAsidInfo[os_asid]&1))

 				{

 				// this OS ASID exists and has a global page directory

 				TPde* pageDir=PageDirectory(os_asid);

 				NKern::LockSystem();

 				pageDir[pdeIndex]=0;

 				CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 				NKern::UnlockSystem();

 				__KTRACE_OPT(KMMU,Kern::Printf("Clearing PDE at %08x",pageDir+pdeIndex));

 				--num_os_asids;

 				}

 			}

 		// we don't need to look for aliases in this case, because these aren't

 		// created for page tables in the global region.

 		NKern::LockSystem();

 		}

 	else

 		{

 		// selection of OS ASIDs or all OS ASIDs

 		const TBitMapAllocator* pB=(const TBitMapAllocator*)aOsAsids;

 		if (os_asid==-1)

 			pB=iOsAsidAllocator;	// 0's in positions which exist

 		TInt num_os_asids=pB->iSize-pB->iAvail;

 		for (os_asid=0; num_os_asids; ++os_asid)

 			{

 			if (pB->NotAllocated(os_asid,1))

 				continue;			// os_asid is not needed

 			TPde* pageDir=PageDirectory(os_asid);

 			NKern::LockSystem();

 			pde = pageDir[pdeIndex];

 			pageDir[pdeIndex]=0;

 			CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 			NKern::UnlockSystem();

 			__KTRACE_OPT(KMMU,Kern::Printf("Clearing PDE at %08x",pageDir+pdeIndex));

 			--num_os_asids;

 			}

 		// remove any aliases of the page table...

 		TUint ptId = pde>>KPageTableShift;

 		NKern::LockSystem();

 		while(!iAliasList.IsEmpty())

 			{

 			next = iAliasList.First()->Deque();

 			checkedList.Add(next);

 			DMemModelThread* thread = (DMemModelThread*)((TInt)next-_FOFF(DMemModelThread,iAliasLink));

 			if((thread->iAliasPde>>KPageTableShift)==ptId && !pB->NotAllocated(thread->iAliasOsAsid,1))

 				{

 				// the page table is being aliased by the thread, so remove it...

 				thread->iAliasPde = 0;

 				}

 			NKern::FlashSystem();

 			}

 		}

 	// copy checkedList back to iAliasList

 	iAliasList.MoveFrom(&checkedList);

 	NKern::UnlockSystem();

 	}

 #endif

 // Initialise page table at physical address aXptPhys to be used as page table aXptId

 // to expand the virtual address range used for mapping page tables. Map the page table

 // at aPhysAddr as page table aId using the expanded range.

 // Assign aXptPhys to kernel's Page Directory.

 // Called with system unlocked and MMU mutex held.

 void ArmMmu::BootstrapPageTable(TInt aXptId, TPhysAddr aXptPhys, TInt aId, TPhysAddr aPhysAddr)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::BootstrapPageTable xptid=%04x, xptphys=%08x, id=%04x, phys=%08x",

 						aXptId, aXptPhys, aId, aPhysAddr));

 	// put in a temporary mapping for aXptPhys

 	// make it noncacheable

 	TPhysAddr pa=aXptPhys&~KPageMask;

 	*iTempPte = pa | SP_PTE(KArmV6PermRWNO, KNormalUncachedAttr, 0, 1);

 	CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 	// clear XPT

 	TPte* xpt=(TPte*)(iTempAddr+(aXptPhys&KPageMask));

 	memclr(xpt, KPageTableSize);

 	// must in fact have aXptPhys and aPhysAddr in same physical page

 	__ASSERT_ALWAYS( TUint32(aXptPhys^aPhysAddr)<TUint32(KPageSize), MM::Panic(MM::EBootstrapPageTableBadAddr));

 	// so only need one mapping

 	xpt[(aXptId>>KPtClusterShift)&KPagesInPDEMask] = pa | KPtPtePerm;

 	CacheMaintenance::MultiplePtesUpdated((TLinAddr)xpt, KPageTableSize);

 	// remove temporary mapping

 	*iTempPte=0;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 	InvalidateTLBForPage(iTempAddr, KERNEL_MAPPING);

 	// initialise PtInfo...

 	TLinAddr xptAddr = PageTableLinAddr(aXptId);

 	iPtInfo[aXptId].SetGlobal(xptAddr>>KChunkShift);

 	// map xpt...

 	TInt pdeIndex=TInt(xptAddr>>KChunkShift);

 	TPde* pageDir=PageDirectory(0);

 	NKern::LockSystem();

 	pageDir[pdeIndex]=aXptPhys|KPtPdePerm;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)(pageDir+pdeIndex));

 	NKern::UnlockSystem();				

 	}

 // Edit the self-mapping entry in page table aId, mapped at aTempMap, to

 // change the physical address from aOld to aNew. Used when moving page

 // tables which were created by BootstrapPageTable.

 // Called with system locked and MMU mutex held.

 void ArmMmu::FixupXPageTable(TInt aId, TLinAddr aTempMap, TPhysAddr aOld, TPhysAddr aNew)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::FixupXPageTable id=%04x, tempmap=%08x, old=%08x, new=%08x",

 						aId, aTempMap, aOld, aNew));

 	// find correct page table inside the page

 	TPte* xpt=(TPte*)(aTempMap + ((aId & KPtClusterMask) << KPageTableShift));

 	// find the pte in that page table

 	xpt += (aId>>KPtClusterShift)&KPagesInPDEMask;

 	// switch the mapping

 	__ASSERT_ALWAYS((*xpt&~KPageMask)==aOld, Panic(EFixupXPTFailed));

 	*xpt = aNew | KPtPtePerm;

 	// mapped with MapTemp, and thus not mapped as a PTE - have to do real cache clean.

 	CacheMaintenance::SinglePteUpdated((TLinAddr)xpt);

 	}

 TInt ArmMmu::NewPageDirectory(TInt aOsAsid, TBool aSeparateGlobal, TPhysAddr& aPhysAddr, TInt& aNumPages)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::NewPageDirectory(%d,%d)",aOsAsid,aSeparateGlobal));

 	TInt r=0;

 	TInt nlocal=iLocalPdSize>>KPageShift;

 	aNumPages=aSeparateGlobal ? KPageDirectorySize/KPageSize : nlocal;

 	__KTRACE_OPT(KMMU,Kern::Printf("nlocal=%d, aNumPages=%d",nlocal,aNumPages));

 	if (aNumPages>1)

 		{

 		TInt align=aSeparateGlobal ? KPageDirectoryShift : KPageDirectoryShift-1;

 		r=AllocContiguousRam(aNumPages<<KPageShift, aPhysAddr, EPageFixed, align);

 		}

 	else

 		r=AllocRamPages(&aPhysAddr,1, EPageFixed);

 	__KTRACE_OPT(KMMU,Kern::Printf("r=%d, phys=%08x",r,aPhysAddr));

 	if (r!=KErrNone)

 		return r;

 #ifdef BTRACE_KERNEL_MEMORY

 	BTrace4(BTrace::EKernelMemory, BTrace::EKernelMemoryMiscAlloc, aNumPages<<KPageShift);

 	Epoc::KernelMiscPages += aNumPages;

 #endif

 	SPageInfo* pi = SPageInfo::FromPhysAddr(aPhysAddr);

 	NKern::LockSystem();

 	TInt i;

 	for (i=0; i<aNumPages; ++i)

 		pi[i].SetPageDir(aOsAsid,i);

 	NKern::UnlockSystem();

 	return KErrNone;

 	}

 inline void CopyPdes(TPde* aDest, const TPde* aSrc, TLinAddr aBase, TLinAddr aEnd)

 	{

 	memcpy(aDest+(aBase>>KChunkShift), aSrc+(aBase>>KChunkShift), ((aEnd-aBase)>>KChunkShift)*sizeof(TPde));

 	CacheMaintenance::MultiplePtesUpdated((TLinAddr)(aDest+(aBase>>KChunkShift)), ((aEnd-aBase)>>KChunkShift)*sizeof(TPde));

 	}

 inline void ZeroPdes(TPde* aDest, TLinAddr aBase, TLinAddr aEnd)

 	{

 	memclr(aDest+(aBase>>KChunkShift), ((aEnd-aBase)>>KChunkShift)*sizeof(TPde));

 	CacheMaintenance::MultiplePtesUpdated((TLinAddr)(aDest+(aBase>>KChunkShift)), ((aEnd-aBase)>>KChunkShift)*sizeof(TPde));

 	}

 void ArmMmu::InitPageDirectory(TInt aOsAsid, TBool aSeparateGlobal)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::InitPageDirectory(%d,%d)",aOsAsid,aSeparateGlobal));

 	TPde* newpd=PageDirectory(aOsAsid);	// new page directory

 	memclr(newpd, iLocalPdSize);		// clear local page directory

 	CacheMaintenance::MultiplePtesUpdated((TLinAddr)newpd, iLocalPdSize);

 	if (aSeparateGlobal)

 		{

 		const TPde* kpd=(const TPde*)KPageDirectoryBase;	// kernel page directory

 		if (iLocalPdSize==KPageSize)

 			ZeroPdes(newpd, KUserSharedDataEnd1GB, KUserSharedDataEnd2GB);

 		ZeroPdes(newpd, KRamDriveStartAddress, KRamDriveEndAddress);	// don't copy RAM drive

 		CopyPdes(newpd, kpd, KRomLinearBase, KUserGlobalDataEnd);		// copy ROM + user global

 		CopyPdes(newpd, kpd, KRamDriveEndAddress, 0x00000000);			// copy kernel mappings

 		}

 	}

 void ArmMmu::ClearPageTable(TInt aId, TInt aFirstIndex)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::ClearPageTable(%d,%d)",aId,aFirstIndex));

 	TPte* pte=PageTable(aId);

 	memclr(pte+aFirstIndex, KPageTableSize-aFirstIndex*sizeof(TPte));

 	CacheMaintenance::MultiplePtesUpdated((TLinAddr)(pte+aFirstIndex), KPageTableSize-aFirstIndex*sizeof(TPte));

 	}

 void ArmMmu::ApplyTopLevelPermissions(TLinAddr aAddr, TInt aOsAsid, TInt aNumPdes, TPde aPdePerm)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::ApplyTopLevelPermissions %04x:%08x->%08x count %d",

 												aOsAsid, aAddr, aPdePerm, aNumPdes));

 	TInt ix=aAddr>>KChunkShift;

 	TPde* pPde=PageDirectory(aOsAsid)+ix;

 	TLinAddr firstPde = (TLinAddr)pPde; //Will need this to clean page table memory region in cache

 	TPde* pPdeEnd=pPde+aNumPdes;

 	NKern::LockSystem();

 	for (; pPde<pPdeEnd; ++pPde)

 		{

 		TPde pde=*pPde;

 		if (pde)

 			*pPde = (pde&KPdePageTableAddrMask)|aPdePerm;

 		}

 	CacheMaintenance::MultiplePtesUpdated(firstPde, aNumPdes*sizeof(TPde));

 	FlushTLBs();

 	NKern::UnlockSystem();

 	}

 void ArmMmu::ApplyPagePermissions(TInt aId, TInt aPageOffset, TInt aNumPages, TPte aPtePerm)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu::ApplyPagePermissions %04x:%03x+%03x perm %08x",

 												aId, aPageOffset, aNumPages, aPtePerm));

 	TPte* pPte=PageTable(aId)+aPageOffset;

 	TLinAddr firstPte = (TLinAddr)pPte; //Will need this to clean page table memory region in cache

 	TPde* pPteEnd=pPte+aNumPages;

 	NKern::LockSystem();

 	for (; pPte<pPteEnd; ++pPte)

 		{

 		TPte pte=*pPte;

 		if (pte)

 			*pPte = (pte&KPteSmallPageAddrMask)|aPtePerm;

 		}

 	CacheMaintenance::MultiplePtesUpdated(firstPte, aNumPages*sizeof(TPte));

 	FlushTLBs();

 	NKern::UnlockSystem();

 	}

 void ArmMmu::ClearRamDrive(TLinAddr aStart)

 	{

 	// clear the page directory entries corresponding to the RAM drive

 	TPde* kpd=(TPde*)KPageDirectoryBase;	// kernel page directory

 	ZeroPdes(kpd, aStart, KRamDriveEndAddress);

 	}

 TPde ArmMmu::PdePermissions(TChunkType aChunkType, TBool aRO)

 	{

 //	if (aChunkType==EUserData && aRO)

 //		return KPdePtePresent|KPdePteUser;

 	return ChunkPdePermissions[aChunkType];

 	}

 TPte ArmMmu::PtePermissions(TChunkType aChunkType)

 	{

 	return ChunkPtePermissions[aChunkType];

 	}

 // Set up a page table (specified by aId) to map a 1Mb section of ROM containing aRomAddr

 // using ROM at aOrigPhys.

 void ArmMmu::InitShadowPageTable(TInt aId, TLinAddr aRomAddr, TPhysAddr aOrigPhys)

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:InitShadowPageTable id=%04x aRomAddr=%08x aOrigPhys=%08x",

 		aId, aRomAddr, aOrigPhys));

 	TPte* ppte = PageTable(aId);

 	TLinAddr firstPte = (TLinAddr)ppte; //Will need this to clean page table memory region in cache

 	TPte* ppte_End = ppte + KChunkSize/KPageSize;

 	TPhysAddr phys = aOrigPhys - (aRomAddr & KChunkMask);

 	for (; ppte<ppte_End; ++ppte, phys+=KPageSize)

 		*ppte = phys | KRomPtePerm;

 	CacheMaintenance::MultiplePtesUpdated(firstPte, sizeof(TPte)*KChunkSize/KPageSize);

 	}

 // Copy the contents of ROM at aRomAddr to a shadow page at physical address aShadowPhys

 // It is assumed aShadowPage is not mapped, therefore any mapping colour is OK.

 void ArmMmu::InitShadowPage(TPhysAddr aShadowPhys, TLinAddr aRomAddr)

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:InitShadowPage aShadowPhys=%08x aRomAddr=%08x",

 		aShadowPhys, aRomAddr));

 	// put in a temporary mapping for aShadowPhys

 	// make it noncacheable

 	*iTempPte = aShadowPhys | SP_PTE(KArmV6PermRWNO, KNormalUncachedAttr, 0, 1);

 	CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 	// copy contents of ROM

 	wordmove( (TAny*)iTempAddr, (const TAny*)aRomAddr, KPageSize );

 	//Temp address is uncached. No need to clean cache, just flush write buffer

 	CacheMaintenance::MemoryToPreserveAndReuse((TLinAddr)iTempAddr, KPageSize, EMapAttrBufferedC);

 	// remove temporary mapping

 	*iTempPte=0;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 	InvalidateTLBForPage(iTempAddr, KERNEL_MAPPING);

 	}

 // Assign a shadow page table to replace a ROM section mapping

 // Enter and return with system locked

 void ArmMmu::AssignShadowPageTable(TInt aId, TLinAddr aRomAddr)

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:AssignShadowPageTable aId=%04x aRomAddr=%08x",

 		aId, aRomAddr));

 	TLinAddr ptLin=PageTableLinAddr(aId);

 	TPhysAddr ptPhys=LinearToPhysical(ptLin, 0);

 	TPde* ppde = ::InitPageDirectory + (aRomAddr>>KChunkShift);

 	TPde newpde = ptPhys | KShadowPdePerm;

 	__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x", newpde, ppde));

 	TInt irq=NKern::DisableAllInterrupts();

 	*ppde = newpde;		// map in the page table

 	CacheMaintenance::SinglePteUpdated((TLinAddr)ppde);

 	FlushTLBs();	// flush both TLBs (no need to flush cache yet)

 	NKern::RestoreInterrupts(irq);

 	}

 void ArmMmu::DoUnmapShadowPage(TInt aId, TLinAddr aRomAddr, TPhysAddr aOrigPhys)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu:DoUnmapShadowPage, id=%04x lin=%08x origphys=%08x", aId, aRomAddr, aOrigPhys));

 	TPte* ppte = PageTable(aId) + ((aRomAddr & KChunkMask)>>KPageShift);

 	TPte newpte = aOrigPhys | KRomPtePerm;

 	__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x", newpte, ppte));

 	TInt irq=NKern::DisableAllInterrupts();

 	*ppte = newpte;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)ppte);

 	InvalidateTLBForPage(aRomAddr, KERNEL_MAPPING);

 	#if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 	__FlushBtb();

 	#endif

 	CacheMaintenance::CodeChanged(aRomAddr, KPageSize, CacheMaintenance::EMemoryRemap);

 	CacheMaintenance::PageToReuse(aRomAddr, EMemAttNormalCached, KPhysAddrInvalid);

 	NKern::RestoreInterrupts(irq);

 	}

 TInt ArmMmu::UnassignShadowPageTable(TLinAddr aRomAddr, TPhysAddr aOrigPhys)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu:UnassignShadowPageTable, lin=%08x origphys=%08x", aRomAddr, aOrigPhys));

 	TPde* ppde = ::InitPageDirectory + (aRomAddr>>KChunkShift);

 	TPde newpde = (aOrigPhys &~ KChunkMask) | KRomSectionPermissions;

 	__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x", newpde, ppde));

 	TInt irq=NKern::DisableAllInterrupts();

 	*ppde = newpde;			// revert to section mapping

 	CacheMaintenance::SinglePteUpdated((TLinAddr)ppde);

 	FlushTLBs();			// flush both TLBs

 	NKern::RestoreInterrupts(irq);

 	return KErrNone;

 	}

 #if defined(__CPU_MEMORY_TYPE_REMAPPING)	// arm1176, arm11mcore, armv7, ...

 /**

 Shadow pages on platforms with remapping (mpcore, 1176, cortex...) are not writable.

 This will map the region into writable memory first.

 @pre No Fast Mutex held

 */

 TInt ArmMmu::CopyToShadowMemory(TLinAddr aDest, TLinAddr aSrc, TUint32 aLength)

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:CopyToShadowMemory aDest=%08x aSrc=%08x aLength=%08x", aDest, aSrc, aLength));

 	// Check that destination is ROM

 	if (aDest<iRomLinearBase || (aDest+aLength) > iRomLinearEnd)

 		{

 		__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu:CopyToShadowMemory: Destination not entirely in ROM"));

 		return KErrArgument;

 		}

 	// do operation with RamAlloc mutex held (to prevent shadow pages from being released from under us)

 	MmuBase::Wait();

 	TInt r = KErrNone;

 	while (aLength)

 		{

 		// Calculate memory size to copy in this loop. A single page region will be copied per loop

 		TInt copySize = Min(aLength, iPageSize - (aDest&iPageMask));

 		// Get physical address

 		TPhysAddr	physAddr = LinearToPhysical(aDest&~iPageMask, 0);

 		if (KPhysAddrInvalid==physAddr)

 			{

 			r = KErrArgument;

 			break;

 			}

 		//check whether it is shadowed rom

 		SPageInfo* pi = SPageInfo::SafeFromPhysAddr(physAddr);

 		if (pi==0 || pi->Type()!=SPageInfo::EShadow)

 			{

 			__KTRACE_OPT(KMMU,Kern::Printf("ArmMmu:CopyToShadowMemory: No shadow page at this address"));

 			r = KErrArgument;

 			break;

 			}

 		//Temporarily map into writable memory and copy data. RamAllocator DMutex is required

 		TLinAddr tempAddr = MapTemp (physAddr, aDest&~iPageMask);

 		__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:CopyToShadowMemory Copy aDest=%08x aSrc=%08x aSize=%08x", tempAddr+(aDest&iPageMask), aSrc, copySize));

 		memcpy ((TAny*)(tempAddr+(aDest&iPageMask)), (const TAny*)aSrc, copySize);  //Kernel-to-Kernel copy is presumed

 		UnmapTemp();

 		//Update variables for the next loop/page

 		aDest+=copySize;

 		aSrc+=copySize;

 		aLength-=copySize;

 		}

 	MmuBase::Signal();

 	return r;

 	}

 #endif

 void ArmMmu::DoFreezeShadowPage(TInt aId, TLinAddr aRomAddr)

 	{

 #if defined(__CPU_MEMORY_TYPE_REMAPPING) //arm1176, arm11mcore, armv7 and later

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:DoFreezeShadowPage not required with MEMORY_TYPE_REMAPPING"));

 #else

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:DoFreezeShadowPage aId=%04x aRomAddr=%08x",

 		aId, aRomAddr));

 	TPte* ppte = PageTable(aId) + ((aRomAddr & KChunkMask)>>KPageShift);

 	TPte newpte = (*ppte & KPteSmallPageAddrMask) | KRomPtePerm;

 	__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x", newpte, ppte));

 	*ppte = newpte;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)ppte);

 	InvalidateTLBForPage(aRomAddr, KERNEL_MAPPING);

 #endif	

 	}

 /** Replaces large page(64K) entry in page table with small page(4K) entries.*/

 void ArmMmu::Pagify(TInt aId, TLinAddr aLinAddr)

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu:Pagify aId=%04x aLinAddr=%08x", aId, aLinAddr));

 	TInt pteIndex = (aLinAddr & KChunkMask)>>KPageShift;

 	TPte* pte = PageTable(aId);

 	if ((pte[pteIndex] & KArmV6PteTypeMask) == KArmV6PteLargePage)

 		{

 		__KTRACE_OPT(KMMU,Kern::Printf("Converting 64K page to 4K pages"));

 		pteIndex &= ~0xf;

 		TPte source = pte[pteIndex];

 		source = (source & KPteLargePageAddrMask) | SP_PTE_FROM_LP_PTE(source);

 		pte += pteIndex;

 		for (TInt entry=0; entry<16; entry++)

 			{

 			pte[entry] = source | (entry<<12);

 			}

 		CacheMaintenance::MultiplePtesUpdated((TLinAddr)pte, 16*sizeof(TPte));

 		FlushTLBs();

 		}

 	}

 void ArmMmu::FlushShadow(TLinAddr aRomAddr)

 	{

 	CacheMaintenance::CodeChanged(aRomAddr, KPageSize, CacheMaintenance::EMemoryRemap);

 	CacheMaintenance::PageToReuse(aRomAddr, EMemAttNormalCached, KPhysAddrInvalid);

 	InvalidateTLBForPage(aRomAddr, KERNEL_MAPPING);		// remove all TLB references to original ROM page

 	}

 #if defined(__CPU_MEMORY_TYPE_REMAPPING) //arm1176, arm11mcore, armv7

 /**

 Calculates page directory/table entries for memory type described in aMapAttr.

 Global, small page (4KB) mapping is assumed.

 (All magic numbers come from ARM page table descriptions.)

 @param aMapAttr On entry, holds description(memory type, access permisions,...) of the memory.

 				It is made up of TMappingAttributes constants or TMappingAttributes2 object. If TMappingAttributes,

 				may be altered 	on exit to hold the actual cache attributes & access permissions.

 @param aPde		On exit, holds page-table-entry for the 1st level descriptor

 				for given type of memory, with base address set to 0.

 @param aPte		On exit, holds small-page-entry (4K) for the 2nd level descriptor

 				for given type of memory, with base address set to 0.

 @return KErrNotSupported 	If memory described in aMapAttr is not supported

 		KErrNone			Otherwise

 */

 TInt ArmMmu::PdePtePermissions(TUint& aMapAttr, TPde& aPde, TPte& aPte)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf(">ArmMmu::PdePtePermissions, mapattr=%08x",aMapAttr));

 	TMappingAttributes2& memory = (TMappingAttributes2&)aMapAttr;

 	if(memory.ObjectType2())

 		{

 //---------Memory described by TMappingAttributes2 object-----------------

 		aPde = 	KArmV6PdePageTable	|

 				(memory.Parity() ? KArmV6PdeECCEnable : 0);

 #if defined(FAULTY_NONSHARED_DEVICE_MEMORY)

 		if(!memory.Shared() && (memory.Type() == EMemAttDevice ))

 		{

 			aMapAttr ^= EMapAttrBufferedNC;

 			aMapAttr |= EMapAttrFullyBlocking;

 			// Clear EMemAttDevice

 			aMapAttr ^= (EMemAttDevice << 26);

 			aMapAttr |= (EMemAttStronglyOrdered << 26);

 		}

 #endif

 		aPte =	KArmV6PteSmallPage										|

 				KArmV6PteAP0											|	// AP0 bit always 1

 				((memory.Type()&3)<<2) | ((memory.Type()&4)<<4)			|	// memory type

 				(memory.Executable() ? 0			: KArmV6PteSmallXN)	|	// eXecuteNever bit

 #if defined	(__CPU_USE_SHARED_MEMORY)

 				KArmV6PteS 												|	// Memory is always shared.

 #else

 				(memory.Shared()	  ? KArmV6PteS	: 0) 				|	// Shared bit

 #endif				

 				(memory.Writable()	  ? 0			: KArmV6PteAPX)		|	// APX = !Writable

 				(memory.UserAccess() ? KArmV6PteAP1: 0);					// AP1 = UserAccess

 		// aMapAttr remains the same

 		}

 	else

 		{

 //---------Memory described by TMappingAttributes bitmask-----------------

 #if defined(FAULTY_NONSHARED_DEVICE_MEMORY)

 		if(((aMapAttr & EMapAttrL1CacheMask) == EMapAttrBufferedNC) && !(aMapAttr & EMapAttrShared))

 		{

 			// Clear EMapAttrBufferedNC attribute

 			aMapAttr ^= EMapAttrBufferedNC;

 			aMapAttr |= EMapAttrFullyBlocking;

 		}

 #endif

 		//	1.	Calculate TEX0:C:B bits in page table and actual cache attributes.

 		//		Only L1 cache attribute from aMapAttr matters. Outer (L2) cache policy will be the same as inner one.

 		TUint l1cache=aMapAttr & EMapAttrL1CacheMask; // Inner cache attributes. May change to actual value.

 		TUint l2cache;	// Will hold actual L2 cache attributes (in terms of TMappingAttributes constants)

 		TUint tex0_c_b; // Will hold TEX[0]:C:B value in page table

 		switch (l1cache)

 			{

 			case EMapAttrFullyBlocking:

 				tex0_c_b = EMemAttStronglyOrdered;

 				l2cache = EMapAttrL2Uncached;

 				break;

 			case EMapAttrBufferedNC:

 				tex0_c_b = EMemAttDevice;

 				l2cache = EMapAttrL2Uncached;

 				break;

 			case EMapAttrBufferedC:

 			case EMapAttrL1Uncached:

 			case EMapAttrCachedWTRA:

 			case EMapAttrCachedWTWA:

 				tex0_c_b = EMemAttNormalUncached;

 				l1cache = EMapAttrBufferedC;

 				l2cache = EMapAttrL2Uncached;

 				break;

 			case EMapAttrCachedWBRA:

 			case EMapAttrCachedWBWA:

 			case EMapAttrL1CachedMax:

 				tex0_c_b = EMemAttNormalCached;

 				l1cache = EMapAttrCachedWBWA;

 				l2cache = EMapAttrL2CachedWBWA;

 				break;

 			default:

 				return KErrNotSupported;

 			}

 		//	2.	Step 2 has been removed :)

 		//	3.	Calculate access permissions (apx:ap bits in page table + eXecute it)

 		TUint read=aMapAttr & EMapAttrReadMask;

 		TUint write=(aMapAttr & EMapAttrWriteMask)>>4;

 		TUint exec=(aMapAttr & EMapAttrExecMask)>>8;

 		read|=exec; 		// User/Sup execute access requires User/Sup read access.

 		if (exec) exec = 1; // There is a single eXecute bit in page table. Set to one if User or Sup exec is required.

 		TUint apxap=0;

 		if (write==0) 		// no write required

 			{

 			if 		(read>=4)	apxap=KArmV6PermRORO;		// user read required

 			else if (read==1) 	apxap=KArmV6PermRONO;		// supervisor read required

 			else 				return KErrNotSupported;	// no read required

 			}

 		else if (write<4)	// supervisor write required

 			{

 			if (read<4) 		apxap=KArmV6PermRWNO;		// user read not required

 			else 				return KErrNotSupported;	// user read required 

 			}

 		else				// user & supervisor writes required

 			{

 			apxap=KArmV6PermRWRW;		

 			}

 		//	4.	Calculate page-table-entry for the 1st level (aka page directory) descriptor 

 		aPde=((aMapAttr&EMapAttrUseECC)>>8)|KArmV6PdePageTable;

 		//	5.	Calculate small-page-entry for the 2nd level (aka page table) descriptor 

 		aPte=SP_PTE(apxap, tex0_c_b, exec, 1);	// always global

 		if (aMapAttr&EMapAttrShared)

 			aPte |= KArmV6PteS;

 		//	6.	Fix aMapAttr to hold the actual values for access permission & cache attributes

 		TUint xnapxap=((aPte<<3)&8)|((aPte>>7)&4)|((aPte>>4)&3);

 		aMapAttr &= ~(EMapAttrAccessMask|EMapAttrL1CacheMask|EMapAttrL2CacheMask);

 		aMapAttr |= PermissionLookup[xnapxap]; 	// Set actual access permissions

 		aMapAttr |= l1cache;					// Set actual inner cache attributes

 		aMapAttr |= l2cache;					// Set actual outer cache attributes

 		}

 	__KTRACE_OPT(KMMU,Kern::Printf("<ArmMmu::PdePtePermissions, mapattr=%08x, pde=%08x, pte=%08x", 	aMapAttr, aPde, aPte));

 	return KErrNone;

 	}

 #else //ARMv6 (arm1136)

 const TUint FBLK=(EMapAttrFullyBlocking>>12);

 const TUint BFNC=(EMapAttrBufferedNC>>12);

 //const TUint BUFC=(EMapAttrBufferedC>>12);

 const TUint L1UN=(EMapAttrL1Uncached>>12);

 const TUint WTRA=(EMapAttrCachedWTRA>>12);

 //const TUint WTWA=(EMapAttrCachedWTWA>>12);

 const TUint WBRA=(EMapAttrCachedWBRA>>12);

 const TUint WBWA=(EMapAttrCachedWBWA>>12);

 const TUint AWTR=(EMapAttrAltCacheWTRA>>12);

 //const TUint AWTW=(EMapAttrAltCacheWTWA>>12);

 //const TUint AWBR=(EMapAttrAltCacheWBRA>>12);

 const TUint AWBW=(EMapAttrAltCacheWBWA>>12);

 const TUint MAXC=(EMapAttrL1CachedMax>>12);

 const TUint L2UN=(EMapAttrL2Uncached>>16);

 const TUint8 UNS=0xffu;	// Unsupported attribute

 //Maps L1 & L2 cache attributes into TEX[4:2]:CB[1:0]

 //ARMv6 doesn't do WTWA so we use WTRA instead

 #if !defined(__CPU_ARM1136_ERRATUM_399234_FIXED)

 // L1 Write-Through mode is outlawed, L1WT acts as L1UN.

 static const TUint8 CBTEX[40]=

 	{            // L1CACHE:

 //  FBLK  BFNC  BUFC  L1UN  WTRA  WTWA  WBRA  WBWA 	  L2CACHE:

 	0x00, 0x01, 0x01, 0x04, 0x04, 0x04, 0x13, 0x11,	//NC

 	0x00, 0x01, 0x01, 0x18, 0x18, 0x18, 0x1b, 0x19,	//WTRA

 	0x00, 0x01, 0x01, 0x18, 0x18, 0x18, 0x1b, 0x19,	//WTWA

 	0x00, 0x01, 0x01, 0x1c, 0x1c, 0x1c, 0x1f, 0x1d,	//WBRA

 	0x00, 0x01, 0x01, 0x14, 0x14, 0x14, 0x17, 0x15	//WBWA

 	};

 #else

 static const TUint8 CBTEX[40]=

 	{            // L1CACHE:

 //  FBLK  BFNC  BUFC  L1UN  WTRA  WTWA  WBRA  WBWA 	  L2CACHE:

 	0x00, 0x01, 0x01, 0x04, 0x12, 0x12, 0x13, 0x11,	//NC

 	0x00, 0x01, 0x01, 0x18, 0x02, 0x02, 0x1b, 0x19,	//WTRA

 	0x00, 0x01, 0x01, 0x18, 0x02, 0x02, 0x1b, 0x19,	//WTWA

 	0x00, 0x01, 0x01, 0x1c, 0x1e, 0x1e, 0x1f, 0x1d,	//WBRA

 	0x00, 0x01, 0x01, 0x14, 0x16, 0x16, 0x17, 0x15	//WBWA

 	};

 #endif

 //Maps TEX[4:2]:CB[1:0] value into L1 cache attributes

 static const TUint8 L1Actual[32]=

 	{

 //CB 00		 01		 10		 11		//TEX

 	FBLK,	BFNC,	WTRA,	WBRA,	//000

 	L1UN,  	UNS,  	UNS, 	WBWA,	//001

 	BFNC,	UNS,	UNS,  	UNS,	//010

 	UNS,	UNS,	UNS,	UNS,	//011

 	L1UN, 	WBWA, 	WTRA, 	WBRA,	//100

 	L1UN, 	WBWA, 	WTRA, 	WBRA,	//101

 	L1UN, 	WBWA, 	WTRA, 	WBRA,	//110

 	L1UN, 	WBWA, 	WTRA, 	WBRA	//111

 	};

 //Maps TEX[4:2]:CB[1:0] value into L2 cache attributes

 static const TUint8 L2Actual[32]=

 	{

 //CB 00		 01		 10		 11		//TEX

 	L2UN,	L2UN,	WTRA,	WBRA,	//000

 	L2UN,	UNS,	UNS,	WBWA,	//001

 	L2UN,	UNS,	UNS,	UNS,	//010

 	UNS,	UNS,	UNS,	UNS,	//011

 	L2UN,	L2UN,	L2UN,	L2UN,	//100

 	WBWA,	WBWA,	WBWA,	WBWA,	//101

 	WTRA,	WTRA,	WTRA,	WTRA,	//110

 	WBRA,	WBRA,	WBRA,	WBRA	//111

 	};

 TInt ArmMmu::PdePtePermissions(TUint& aMapAttr, TPde& aPde, TPte& aPte)

 	{

 	__KTRACE_OPT(KMMU,Kern::Printf(">ArmMmu::PdePtePermissions, mapattr=%08x",aMapAttr));

 	TUint read=aMapAttr & EMapAttrReadMask;

 	TUint write=(aMapAttr & EMapAttrWriteMask)>>4;

 	TUint exec=(aMapAttr & EMapAttrExecMask)>>8;

 	TUint l1cache=(aMapAttr & EMapAttrL1CacheMask)>>12;

 	TUint l2cache=(aMapAttr & EMapAttrL2CacheMask)>>16;

 	if (l1cache==MAXC) l1cache=WBRA;	// map max cache to WBRA

 	if (l1cache>AWBW)

 		return KErrNotSupported;		// undefined attribute

 	if (l1cache>=AWTR) l1cache-=4;		// no alternate cache, so use normal cache

 	if (l1cache<L1UN) l2cache=0;		// for blocking/device, don't cache L2

 	if (l2cache==MAXC) l2cache=WBRA;	// map max cache to WBRA

 	if (l2cache>WBWA)

 		return KErrNotSupported;		// undefined attribute

 	if (l2cache) l2cache-=(WTRA-1);		// l2cache now in range 0-4

 	aPde=((aMapAttr&EMapAttrUseECC)>>8)|KArmV6PdePageTable;

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 	// if broken 1136, can't have supervisor only code

 	if (exec)

 		exec = TUint(EMapAttrExecUser>>8);

 #endif

 	// if any execute access, must have read=execute

 	if (exec)

 		(void)(read>=exec || (read=exec)!=0), exec=1;

 	// l1cache between 0 and 7, l2cache between 0 and 4; look up CBTEX

 	TUint cbtex=CBTEX[(l2cache<<3)|l1cache];

 	// work out apx:ap

 	TUint apxap;

 	if (write==0)

 		apxap=(read>=4)?KArmV6PermRORO:(read?KArmV6PermRONO:KArmV6PermNONO);

 	else if (write<4)

 		apxap=(read>=4)?KArmV6PermRWRO:KArmV6PermRWNO;

 	else

 		apxap=KArmV6PermRWRW;

 	TPte pte=SP_PTE(apxap, cbtex, exec, 1);	// always global

 	if (aMapAttr&EMapAttrShared)

 		pte |= KArmV6PteS;

 	// Translate back to get actual map attributes

 	TUint xnapxap=((pte<<3)&8)|((pte>>7)&4)|((pte>>4)&3);

 	cbtex=((pte>>4)&0x1c)|((pte>>2)&3);  // = TEX[4:2]::CB[1:0]

 	aMapAttr &= ~(EMapAttrAccessMask|EMapAttrL1CacheMask|EMapAttrL2CacheMask);

 	aMapAttr |= PermissionLookup[xnapxap];

 	aMapAttr |= (L1Actual[cbtex]<<12);

 	aMapAttr |= (L2Actual[cbtex]<<16);

 	aPte=pte;

 	__KTRACE_OPT(KMMU,Kern::Printf("<ArmMmu::PdePtePermissions, mapattr=%08x, pde=%08x, pte=%08x",

 								aMapAttr, aPde, aPte));

 	return KErrNone;

 	}

 #endif

 void ArmMmu::Map(TLinAddr aLinAddr, TPhysAddr aPhysAddr, TInt aSize, TPde aPdePerm, TPte aPtePerm, TInt aMapShift)

 //

 // Map a region of physical addresses aPhysAddr to aPhysAddr+aSize-1 to virtual address aLinAddr.

 // Use permissions specified by aPdePerm and aPtePerm. Use mapping sizes up to and including (1<<aMapShift).

 // Assume any page tables required are already assigned.

 // aLinAddr, aPhysAddr, aSize must be page-aligned.

 //

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu::Map lin=%08x phys=%08x size=%08x", aLinAddr, aPhysAddr, aSize));

 	__KTRACE_OPT(KMMU, Kern::Printf("pde=%08x pte=%08x mapshift=%d", aPdePerm, aPtePerm, aMapShift));

 	TPde pt_pde=aPdePerm;

 	TPte sp_pte=aPtePerm;

 	TPde section_pde=SECTION_PDE_FROM_PDEPTE(pt_pde, sp_pte);

 	TPte lp_pte=LP_PTE_FROM_SP_PTE(sp_pte);

 	TLinAddr la=aLinAddr;

 	TPhysAddr pa=aPhysAddr;

 	TInt remain=aSize;

 	while (remain)

 		{

 		if (aMapShift>=KChunkShift && (la & KChunkMask)==0 && remain>=KChunkSize)

 			{

 			// use sections - ASSUMES ADDRESS IS IN GLOBAL REGION

 			TInt npdes=remain>>KChunkShift;

 			const TBitMapAllocator& b=*iOsAsidAllocator;

 			TInt num_os_asids=iNumGlobalPageDirs;

 			TInt os_asid=0;

 			for (; num_os_asids; ++os_asid)

 				{

 				if (b.NotAllocated(os_asid,1) || (iAsidInfo[os_asid]&1)==0)

 					continue;			// os_asid is not needed

 				TPde* p_pde=PageDirectory(os_asid)+(la>>KChunkShift);

 				TPde* p_pde_E=p_pde+npdes;

 				TPde pde=pa|section_pde;

 				TLinAddr firstPde = (TLinAddr)p_pde; //Will need this to clean page table memory region from cache

 				NKern::LockSystem();

 				for (; p_pde < p_pde_E; pde+=KChunkSize)

 					{

 					__ASSERT_DEBUG(*p_pde==0, MM::Panic(MM::EPdeAlreadyInUse));

 					__KTRACE_OPT(KMMU,Kern::Printf("Writing PDE %08x to %08x", pde, p_pde));

 					*p_pde++=pde;

 					}

 				CacheMaintenance::MultiplePtesUpdated(firstPde, (TUint)p_pde-firstPde);

 				NKern::UnlockSystem();

 				--num_os_asids;

 				}

 			npdes<<=KChunkShift;

 			la+=npdes, pa+=npdes, remain-=npdes;

 			continue;

 			}

 		TInt block_size = Min(remain, KChunkSize-(la&KChunkMask));

 		TPte pa_mask=~KPageMask;

 		TPte pte_perm=sp_pte;

 		if (aMapShift>=KLargePageShift && block_size>=KLargePageSize)

 			{

 			if ((la & KLargePageMask)==0)

 				{

 				// use 64K large pages

 				pa_mask=~KLargePageMask;

 				pte_perm=lp_pte;

 				}

 			else

 				block_size = Min(remain, KLargePageSize-(la&KLargePageMask));

 			}

 		block_size &= pa_mask;

 		// use pages (large or small)

 		TInt id=PageTableId(la, 0);

 		__ASSERT_DEBUG(id>=0, MM::Panic(MM::EMmuMapNoPageTable));

 		TPte* p_pte=PageTable(id)+((la&KChunkMask)>>KPageShift);

 		TPte* p_pte_E=p_pte + (block_size>>KPageShift);

 		SPageTableInfo& ptinfo=iPtInfo[id];

 		TLinAddr firstPte = (TLinAddr)p_pte; //Will need this to clean page table memory region from cache

 		NKern::LockSystem();

 		for (; p_pte < p_pte_E; pa+=KPageSize)

 			{

 			__ASSERT_DEBUG(*p_pte==0, MM::Panic(MM::EPteAlreadyInUse));

 			TPte pte = (pa & pa_mask) | pte_perm;

 			__KTRACE_OPT(KMMU,Kern::Printf("Writing PTE %08x to %08x", pte, p_pte));

 			*p_pte++=pte;

 			++ptinfo.iCount;

 			NKern::FlashSystem();

 			}

 		CacheMaintenance::MultiplePtesUpdated(firstPte, (TUint)p_pte-firstPte);

 		NKern::UnlockSystem();

 		la+=block_size, remain-=block_size;

 		}

 	}

 void ArmMmu::Unmap(TLinAddr aLinAddr, TInt aSize)

 //

 // Remove all mappings in the specified range of addresses.

 // Assumes there are only global mappings involved.

 // Don't free page tables.

 // aLinAddr, aSize must be page-aligned.

 //

 	{

 	__KTRACE_OPT(KMMU, Kern::Printf("ArmMmu::Unmap lin=%08x size=%08x", aLinAddr, aSize));

 	TLinAddr a=aLinAddr;

 	TLinAddr end=a+aSize;

 	__KTRACE_OPT(KMMU,Kern::Printf("a=%08x end=%08x",a,end));

 	NKern::LockSystem();

 	while(a!=end)

 		{

 		TInt pdeIndex=a>>KChunkShift;

 		TLinAddr next=(pdeIndex<<KChunkShift)+KChunkSize;

 		TInt to_do = Min(TInt(end-a), TInt(next-a))>>KPageShift;

 		__KTRACE_OPT(KMMU,Kern::Printf("a=%08x next=%08x to_do=%d",a,next,to_do));

 		TPde pde=::InitPageDirectory[pdeIndex];

 		if ( (pde&KArmV6PdeTypeMask)==KArmV6PdeSection )

 			{

 			__ASSERT_DEBUG(!(a&KChunkMask), MM::Panic(MM::EUnmapBadAlignment));

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 			remove_and_invalidate_section(::InitPageDirectory + pdeIndex, a, KERNEL_MAPPING);

 #else

 			::InitPageDirectory[pdeIndex]=0;

 			CacheMaintenance::SinglePteUpdated(TLinAddr(::InitPageDirectory + pdeIndex));

 			InvalidateTLBForPage(a, KERNEL_MAPPING);		// ASID irrelevant since global

 #endif

 			a=next;

 			NKern::FlashSystem();

 			continue;

 			}

 		TInt ptid=PageTableId(a,0);

 		SPageTableInfo& ptinfo=iPtInfo[ptid];

 		if (ptid>=0)

 			{

 			TPte* ppte=PageTable(ptid)+((a&KChunkMask)>>KPageShift);

 			TPte* ppte_End=ppte+to_do;

 			for (; ppte<ppte_End; ++ppte, a+=KPageSize)

 				{

 				if (*ppte & KArmV6PteSmallPage)

 					{

 					--ptinfo.iCount;

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 					remove_and_invalidate_page(ppte, a, KERNEL_MAPPING);

 #else

 					*ppte=0;

 					CacheMaintenance::SinglePteUpdated((TLinAddr)ppte);

 					InvalidateTLBForPage(a, KERNEL_MAPPING);

 #endif

 					}

 				else if ((*ppte & KArmV6PteTypeMask) == KArmV6PteLargePage)

 					{

 					__ASSERT_DEBUG(!(a&KLargePageMask), MM::Panic(MM::EUnmapBadAlignment));

 					ptinfo.iCount-=KLargeSmallPageRatio;

 #if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 					remove_and_invalidate_page(ppte, a, KERNEL_MAPPING);

 #else

 					memclr(ppte, KLargeSmallPageRatio*sizeof(TPte));

 					CacheMaintenance::MultiplePtesUpdated((TLinAddr)ppte, KLargeSmallPageRatio*sizeof(TPte));

 					InvalidateTLBForPage(a, KERNEL_MAPPING);

 #endif

 					a+=(KLargePageSize-KPageSize);

 					ppte+=(KLargeSmallPageRatio-1);

 					}

 				NKern::FlashSystem();

 				}

 			}

 		else

 			a += (to_do<<KPageShift);

 		}

 	NKern::UnlockSystem();

 	#if defined(__CPU_ARM1136__) && !defined(__CPU_ARM1136_ERRATUM_353494_FIXED)

 	__FlushBtb();

 	#endif

 	}

 void ArmMmu::ClearPages(TInt aNumPages, TPhysAddr* aPageList, TUint8 aClearByte)

 	{

 	//map the pages at a temporary address, clear them and unmap

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	while (--aNumPages >= 0)

 		{

 		TPhysAddr pa;

 		if((TInt)aPageList&1)

 			{

 			pa = (TPhysAddr)aPageList&~1;

 			*(TPhysAddr*)&aPageList += iPageSize;

 			}

 		else

 			pa = *aPageList++;

 		*iTempPte = pa | SP_PTE(KArmV6PermRWNO, KNormalUncachedAttr, 0, 1);

 		CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 		InvalidateTLBForPage(iTempAddr, KERNEL_MAPPING);

 		memset((TAny*)iTempAddr, aClearByte, iPageSize);

 		// This temporary mapping is noncached => No need to flush cache here.

 		// Still, we have to make sure that write buffer(s) are drained.

 		CacheMaintenance::MemoryToPreserveAndReuse((TLinAddr)iTempAddr, iPageSize, EMapAttrBufferedC);

 		}

 	*iTempPte=0;

 	CacheMaintenance::SinglePteUpdated((TLinAddr)iTempPte);

 	InvalidateTLBForPage(iTempAddr, KERNEL_MAPPING);

 	}

 /**

 Create a temporary mapping of one or more contiguous physical pages.

 Fully cached memory attributes apply.

 The RamAllocatorMutex must be held before this function is called and not released

 until after UnmapTemp has been called.

 @param aPage	The physical address of the pages to be mapped.

 @param aLinAddr The linear address of any existing location where the page is mapped.

 				If the page isn't already mapped elsewhere as a cachable page then

 				this value irrelevent. (It is used for page colouring.)

 @param aPages	Number of pages to map.

 @return The linear address of where the pages have been mapped.

 */

 TLinAddr ArmMmu::MapTemp(TPhysAddr aPage,TLinAddr aLinAddr,TInt aPages)

 	{

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	__ASSERT_DEBUG(!*iTempPte,MM::Panic(MM::ETempMappingAlreadyInUse));

 	iTempMapColor = (aLinAddr>>KPageShift)&KPageColourMask;

 	iTempMapCount = aPages;

 	if (aPages==1)

 		{

 		iTempPte[iTempMapColor] = (aPage&~KPageMask) | SP_PTE(KArmV6PermRWNO, KNormalCachedAttr, 0, 1);

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(iTempPte+iTempMapColor));

 		}

 	else

 		{

 		__ASSERT_DEBUG(iTempMapColor+aPages<=KPageColourCount,MM::Panic(MM::ETempMappingNoRoom));

 		for (TInt i=0; i<aPages; i++)

 			iTempPte[iTempMapColor+i] = ((aPage&~KPageMask)+(i<<KPageShift)) | SP_PTE(KArmV6PermRWNO, KNormalCachedAttr, 0, 1);	

 		CacheMaintenance::MultiplePtesUpdated((TLinAddr)(iTempPte+iTempMapColor), aPages*sizeof(TPte));

 		}

 	return iTempAddr+(iTempMapColor<<KPageShift);

 	}

 /**

 Create a temporary mapping of one or more contiguous physical pages.

 Memory attributes as specified by aMemType apply.

 @See ArmMmu::MapTemp(TPhysAddr aPage,TLinAddr aLinAddr,TInt aPages) for other details.

 */

 TLinAddr ArmMmu::MapTemp(TPhysAddr aPage,TLinAddr aLinAddr,TInt aPages, TMemoryType aMemType)

 	{

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	__ASSERT_DEBUG(!*iTempPte,MM::Panic(MM::ETempMappingAlreadyInUse));

 	iTempMapColor = (aLinAddr>>KPageShift)&KPageColourMask;

 	iTempMapCount = aPages;

 	TUint pte = SP_PTE(KArmV6PermRWNO, aMemType, 0, 1);

 	if (aPages==1)

 		{

 		iTempPte[iTempMapColor] = (aPage&~KPageMask) | SP_PTE(KArmV6PermRWNO, pte, 0, 1);

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(iTempPte+iTempMapColor));

 		}

 	else

 		{

 		__ASSERT_DEBUG(iTempMapColor+aPages<=KPageColourCount,MM::Panic(MM::ETempMappingNoRoom));

 		for (TInt i=0; i<aPages; i++)

 			iTempPte[iTempMapColor+i] = ((aPage&~KPageMask)+(i<<KPageShift)) | SP_PTE(KArmV6PermRWNO, pte, 0, 1);	

 		CacheMaintenance::MultiplePtesUpdated((TLinAddr)(iTempPte+iTempMapColor), aPages*sizeof(TPte));

 		}

 	return iTempAddr+(iTempMapColor<<KPageShift);

 	}

 /**

 Create a temporary mapping of one or more contiguous physical pages, distinct from

 that created by MapTemp.

 The RamAllocatorMutex must be held before this function is called and not released

 until after UnmapSecondTemp has been called.

 @param aPage	The physical address of the pages to be mapped.

 @param aLinAddr The linear address of any existing location where the page is mapped.

 				If the page isn't already mapped elsewhere as a cachable page then

 				this value irrelevent. (It is used for page colouring.)

 @param aPages	Number of pages to map.

 @return The linear address of where the pages have been mapped.

 */

 TLinAddr ArmMmu::MapSecondTemp(TPhysAddr aPage,TLinAddr aLinAddr,TInt aPages)

 	{

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	__ASSERT_DEBUG(!*iSecondTempPte,MM::Panic(MM::ETempMappingAlreadyInUse));

 	iSecondTempMapColor = (aLinAddr>>KPageShift)&KPageColourMask;

 	iSecondTempMapCount = aPages;

 	if (aPages==1)

 		{

 		iSecondTempPte[iSecondTempMapColor] = (aPage&~KPageMask) | SP_PTE(KArmV6PermRWNO, KNormalCachedAttr, 0, 1);

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(iSecondTempPte+iSecondTempMapColor));

 		}

 	else

 		{

 		__ASSERT_DEBUG(iSecondTempMapColor+aPages<=KPageColourCount,MM::Panic(MM::ETempMappingNoRoom));

 		for (TInt i=0; i<aPages; i++)

 			iSecondTempPte[iSecondTempMapColor+i] = ((aPage&~KPageMask)+(i<<KPageShift)) | SP_PTE(KArmV6PermRWNO, KNormalCachedAttr, 0, 1);	

 		CacheMaintenance::MultiplePtesUpdated((TLinAddr)(iSecondTempPte+iSecondTempMapColor), aPages*sizeof(TPte));

 		}

 	return iSecondTempAddr+(iSecondTempMapColor<<KPageShift);

 	}

 /**

 Remove the temporary mapping created with MapTemp.

 */

 void ArmMmu::UnmapTemp()

 	{

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	for (TInt i=0; i<iTempMapCount; i++)

 		{

 		iTempPte[iTempMapColor+i] = 0;

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(iTempPte+iTempMapColor+i));

 		InvalidateTLBForPage(iTempAddr+((iTempMapColor+i)<<KPageShift), KERNEL_MAPPING);

 		}

 	}

 /**

 Remove the temporary mapping created with MapSecondTemp.

 */

 void ArmMmu::UnmapSecondTemp()

 	{

 	__ASSERT_MUTEX(RamAllocatorMutex);

 	for (TInt i=0; i<iSecondTempMapCount; i++)

 		{

 		iSecondTempPte[iSecondTempMapColor+i] = 0;

 		CacheMaintenance::SinglePteUpdated((TLinAddr)(iSecondTempPte+iSecondTempMapColor+i));

 		InvalidateTLBForPage(iSecondTempAddr+((iSecondTempMapColor+i)<<KPageShift), KERNEL_MAPPING);

 		}

 	}

 TBool ArmMmu::ValidateLocalIpcAddress(TLinAddr aAddr,TInt aSize,TBool aWrite)

 	{

 	__NK_ASSERT_DEBUG(aSize<=KChunkSize);

 	TLinAddr end = aAddr+aSize-1;

 	if(end<aAddr)

 		end = ~0u;

 	if(TUint(aAddr^KIPCAlias)<TUint(KChunkSize) || TUint(end^KIPCAlias)<TUint(KChunkSize))

 		{

 		// local address is in alias region.

 		// remove alias...

 		NKern::LockSystem();

 		((DMemModelThread*)TheCurrentThread)->RemoveAlias();

 		NKern::UnlockSystem();

 		// access memory, which will cause an exception...

 		if(!(TUint(aAddr^KIPCAlias)<TUint(KChunkSize)))

 			aAddr = end;

 		InvalidateTLBForPage(aAddr,((DMemModelProcess*)TheCurrentThread->iOwningProcess)->iOsAsid);

 		if(aWrite)

 			*(volatile TUint8*)aAddr = 0;

 		else

 			aWrite = *(volatile TUint8*)aAddr;

 		// can't get here

 		__NK_ASSERT_DEBUG(0);

 		}

 	TUint32 local_mask;

 	DMemModelProcess* process=(DMemModelProcess*)TheCurrentThread->iOwningProcess;

 	if(aWrite)

 		local_mask = process->iAddressCheckMaskW;

 	else

 		local_mask = process->iAddressCheckMaskR;

 	TUint32 mask = 2<<(end>>27);

 	mask -= 1<<(aAddr>>27);

 	if((local_mask&mask)!=mask)

 		return EFalse;

 	if(!aWrite)

 		return ETrue; // reads are ok

 	// writes need further checking...

 	TLinAddr userCodeStart = iUserCodeBase;

 	TLinAddr userCodeEnd = userCodeStart+iMaxUserCodeSize;

 	if(end>=userCodeStart && aAddr<userCodeEnd)

 		return EFalse; // trying to write to user code area

 	return ETrue;

 	}

 TInt DMemModelThread::Alias(TLinAddr aAddr, DMemModelProcess* aProcess, TInt aSize, TInt aPerm, TLinAddr& aAliasAddr, TInt& aAliasSize)

 //

 // Set up an alias mapping starting at address aAddr in specified process.

 // Check permissions aPerm.

 // Enter and return with system locked.

 // Note: Alias is removed if an exception if trapped by DThread::IpcExcHandler.

 //

 	{

 	__KTRACE_OPT(KMMU2,Kern::Printf("Thread %O Alias %08x+%x Process %O perm %x",this,aAddr,aSize,aProcess,aPerm));

 	__ASSERT_SYSTEM_LOCK

 	if(TUint(aAddr^KIPCAlias)<TUint(KChunkSize))

 		return KErrBadDescriptor; // prevent access to alias region

 	ArmMmu& m=::TheMmu;

 	// check if memory is in region which is safe to access with supervisor permissions...

 	TBool okForSupervisorAccess = aPerm&(EMapAttrReadSup|EMapAttrWriteSup) ? 1 : 0;

 	if(!okForSupervisorAccess)

 		{

 		TInt shift = aAddr>>27;

 		if(!(aPerm&EMapAttrWriteUser))

 			{

 			// reading with user permissions...

 			okForSupervisorAccess = (aProcess->iAddressCheckMaskR>>shift)&1;

 			}

 		else

 			{

 			// writing with user permissions...

 			okForSupervisorAccess = (aProcess->iAddressCheckMaskW>>shift)&1;

 			if(okForSupervisorAccess)

 				{

 				// check for user code, because this is supervisor r/w and so

 				// is not safe to write to access with supervisor permissions.

 				if(TUint(aAddr-m.iUserCodeBase)<TUint(m.iMaxUserCodeSize))

 					return KErrBadDescriptor; // prevent write to this...

 				}

 			}

 		}

 	TInt pdeIndex = aAddr>>KChunkShift;

 	if(pdeIndex>=(m.iLocalPdSize>>2))

 		{

 		// address is in global section, don't bother aliasing it...

 		if(iAliasLinAddr)

 			RemoveAlias();

 		aAliasAddr = aAddr;

 		TInt maxSize = KChunkSize-(aAddr&KChunkMask);

 		aAliasSize = aSize<maxSize ? aSize : maxSize;

 		__KTRACE_OPT(KMMU2,Kern::Printf("DMemModelThread::Alias() abandoned as memory is globaly mapped"));

 		return okForSupervisorAccess;

 		}

 	TInt asid = aProcess->iOsAsid;

 	TPde* pd = PageDirectory(asid);

 	TPde pde = pd[pdeIndex];

 	if ((TPhysAddr)(pde&~KPageMask) == AliasRemapOld)

 		pde = AliasRemapNew|(pde&KPageMask);

 	pde = PDE_IN_DOMAIN(pde, KIPCAliasDomain);

 	TLinAddr aliasAddr = KIPCAlias+(aAddr&(KChunkMask & ~KPageMask));

 	if(pde==iAliasPde && iAliasLinAddr)

 		{

 		// pde already aliased, so just update linear address...

 		iAliasLinAddr = aliasAddr;

 		}

 	else

 		{

 		// alias PDE changed...

 		iAliasPde = pde;

 		iAliasOsAsid = asid;

 		if(!iAliasLinAddr)

 			{

 			ArmMmu::UnlockAlias();

 			::TheMmu.iAliasList.Add(&iAliasLink); // add to list if not already aliased

 			}

 		iAliasLinAddr = aliasAddr;

 		*iAliasPdePtr = pde;

 		CacheMaintenance::SinglePteUpdated((TLinAddr)iAliasPdePtr);

 		}

 	__KTRACE_OPT(KMMU2,Kern::Printf("DMemModelThread::Alias() PDEntry=%x, iAliasLinAddr=%x",pde, aliasAddr));

 	InvalidateTLBForPage(aliasAddr, ((DMemModelProcess*)iOwningProcess)->iOsAsid);

 	TInt offset = aAddr&KPageMask;

 	aAliasAddr = aliasAddr | offset;

 	TInt maxSize = KPageSize - offset;

 	aAliasSize = aSize<maxSize ? aSize : maxSize;

 	iAliasTarget = aAddr & ~KPageMask;

 	return okForSupervisorAccess;

 	}

 void DMemModelThread::RemoveAlias()

 //

 // Remove alias mapping (if present)

 // Enter and return with system locked.

 //

 	{

 	__KTRACE_OPT(KMMU2,Kern::Printf("Thread %O RemoveAlias", this));

 	__ASSERT_SYSTEM_LOCK

 	TLinAddr addr = iAliasLinAddr;

 	if(addr)

 		{

 		ArmMmu::LockAlias();

 		iAliasLinAddr = 0;

 		iAliasPde = 0;

 		*iAliasPdePtr = 0;

 		CacheMaintenance::SinglePteUpdated((TLinAddr)iAliasPdePtr);

 		InvalidateTLBForPage(addr, ((DMemModelProcess*)iOwningProcess)->iOsAsid);

 		iAliasLink.Deque();

 		}

 	}