When I try to execute code from a region mapped as read/write (AP[2] == 0), the CPU issues a permission fault (exception class == 0b100001, instruction fault status code == 0b001111). When I change the mapping to read-only (AP[2] == 1), the permission fault goes away. Is this expected behavior from the MMU? I thought executing code from a region mapped as read/write was allowed. Could someone point me to a section in the "Arm Architecture Reference Manual" that explains this?

For reference:

  • See ARM DDI 0487I.a, page D8-5136 for information about the AP (access permission) bits
  • See ARM DDI 0487I.a, page D17-5657 for information about exception class 0b100001 (Instruction Abort taken without a change in Exception level)
  • See ARM DDI 0487I.a, page D17-5680 for information about instruction fault status code 0b001111 (Permission fault, level 3)

Arm Architecture Reference Manual for A-profile architecture


1 Answer 1


These CPUs and their memory management are very complex, as evidenced by the 12,000-page manual. Given the amount of caching and instruction execution overlapping, it is to be expected that you have to take special measures to ensure you can execute some writeable memory.

The answer in your situation will depend on how much caching you have enabled and many other parameters about how you have your system configured.

The references you gave are for data fetches: are you sure these apply to instruction fetches, not just operand fetches?

The following sections should help, and perhaps help you solve the exact problem.

  • p9196 Access permissions for instruction execution "Execute-never controls provide an additional level of control on memory accesses ..."
  • p9198 Preventing execution from writable locations "The architecture provides control bits that [can] force writable memory to be treated as Execute-Never ..."

Additionally, you should read the parts about cache synchronisation appropriate to your exact configuration and initialisation.

  • 1
    \$\begingroup\$ Thanks @jonathanjo. SCTLR_ELx.WXN is the field I was looking for. Also, ARM DDI 0487I.a, page D8-5142 has the answer for AArch64: "There are register control fields that can be used to force writable memory to be treated as XN, PXN, or UXN, regardless of the value of the corresponding descriptor fields ..." \$\endgroup\$
    – Jorge
    Sep 27, 2022 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.