armv8 mmu 内存页表属性

armv8中的页表项

D5.3 VMSAv8-64 translation table format descriptors

In general, a descriptor is one of: 页表项的4种类型

• An invalid or fault entry. 有效的或者无效的页表项

• A table entry, that points to the next-level translation table. 指向下一级的页表项

• A block entry, that defines the memory properties for the access. 块页表项

• A reserved format. 保留的页表项

Bit[1] of the descriptor indicates the descriptor type, and bit[0] indicates whether the descriptor is valid. bit1表示页表项的类型，bit0表示这个页表项有效还是无效

介绍L0/L1/L2页表项的格式

D5.3.1 VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats

上图展示了L0/L1/L2页表的三种类型。

Descriptor encodings, Armv8 level 0, level 1, and level 2 formats

Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an

invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation fault.

Descriptor bit[1] identifies the descriptor type, and is encoded as:

0, Block	The descriptor gives the base address of a block of memory, and the attributes for that memory region.
1, Table	The descriptor gives the address of the next level of translation table, and for a stage 1 translation, some attributes for that translation.

The other fields in the valid descriptors are:

Block descriptor

Gives the base address and attributes of a block of memory, as follows:

4KB translation granule

• For a level 1 Block descriptor, bits[47:30] are bits[47:30] of the output address.

This output address specifies a 1GB block of memory.

• For a level 2 descriptor, bits[47:21] are bits[47:21] of the output address.This

output address specifies a 2MB block of memory.

16KB translation granule

For a level 2 Block descriptor, bits[47:25] are bits[47:25] of the output address.This

output address specifies a 32MB block of memory.

64KB translation granule

For a level 1 Block descriptor:

• If ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the output

address and bits[47:42] are bits [47:42] of the output address. This output address

specifies a 4TB block of memory.

• If ARMv8.2-LPA is not implemented, there is no level 1 Block descriptor.

For a level 2 Block descriptor:

• If ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the output

address, and bits[47:29] are bits [47:29] of the output address.This output address

specifies a 512MB block of memory.

• If ARMv8.2-LPA is not implemented, bits[47:29] are bits[47:29] of the output

address.This output address specifies a 512MB block of memory.

In Armv8.0, bits[63:52, 11:2] provide attributes for the target memory block. When

ARMv8.1-TTHM is implemented, bits[63:51, 11:2] provide the attributes for the target memory

block. For more information, see Memory attribute fields in the VMSAv8-64 translation table format

descriptors on page D5-2599.

Note

• In Armv8.0, the position and contents of bits[63:52, 11:2] are identical to bits[63:52, 11:2] in

the Page descriptors.

• When ARMv8.1-TTHM is implemented, the position and contents of bits[63:51, 11:2] are

identical to bits[63:51, 11:2] in the Page descriptors

上诉描述了block类型的页表，在不同粒度下一个block 的位宽以及能覆盖的内存大小

Table descriptor

Gives the translation table address for the next-level lookup, as follows:

4KB translation granule	Bits[47:12] are bits[47:12] of the address of the required next-level table, which is: For a level 0 Table descriptor, the address of a level 1 table. For a level 1 Table descriptor, the address of a level 2 table. For a level 2 Table descriptor, the address of a level 3 table. Bits[11:0] of the table address are zero.
16KB translation granule	Bits[47:14] are bits[47:14] of the address of the required next-level table, which is: For a level 0 Table descriptor, the address of a level 1 table. For a level 1 Table descriptor, the address of a level 2 table. For a level 2 Table descriptor, the address of a level 3 table. • Bits[13:0] of the table address are zero.
64KB translation granule	Bits[47:16] are bits[47:16] of the address of the required next-level table, which is: For a level 1 Table descriptor, the address of a level 2 table. For a level 2 Table descriptor, the address of a level 3 table. When ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the required next-level table. Bits[15:0] of the table address are zero.

For a stage 1 translation only, bits[63:59] provide attributes for the next-level lookup, see Memory

attribute fields in the VMSAv8-64 translation table format descriptors on page D5-2599.

If the translation table defines either the Secure or Non-secure EL1&0, when EL2 is enabled, stage 1 translations,

then the output address in the descriptor is the IPA of the target block or table. Otherwise, it is the PA of the target

block or table.

table类型的页表，在不同粒度下一个table类型指向下一级页表的地址位宽。

L3的页表格式

level 3就是linux内核中的PTE(page table entry)页表

D5.3.2 Armv8 translation table level 3 descriptor formats

 

从上图可以看出armv8架构支持5种 L3页表格式

Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an

invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation

fault.

Descriptor bit[1] identifies the descriptor type, and is encoded as:

• 0, Reserved, invalid

  • Behaves identically to encodings with bit[0] set to 0.

  • This encoding must not be used in level 3 translation tables.

• 1, Page          Gives the address and attributes of a 4KB, 16KB, or 64KB page of memory.

At this level, the only valid format is the Page descriptor. The other fields in the Page descriptor are:.....

内存属性

D5.3.3 Memory attribute fields in the VMSAv8-64 translation table format descriptors

下一级页表的属性

Next-level attributes in stage 1 VMSAv8-64 Table descriptors

In a Table descriptor for a stage 1 translation, bits[63:59] of the descriptor define the attributes for the next-level

translation table access, and bits[58:51] are IGNORED:

These attributes are:(2599页)

name	describe	描述
NSTable, bit[63]	For memory accesses from Secure state, specifies the Security state for subsequent levels of lookup, see Hierarchical control of Secure or Non-secure memory accesses on page D5-2605. For memory accesses from Non-secure state, including all accesses in the EL2 or EL2&0 translation regime, this bit is RES0 and is ignored by the PE.
APTable, bits[62:61]	Access permissions limit for subsequent levels of lookup, see Hierarchical control of data access permissions on page D5-2611. APTable[0] is RES0: • In the EL2 translation regime. • In the EL3 translation regime. From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value of TCR_ELx.HPD{0} or TCR_ELx.HPD1 is 1: • The value of the corresponding APTable field is IGNORED by hardware, allowing the field to be used by software. • The behavior of the system is as if the value of the corresponding APTable field is 0.
UXNTable or XNTable, bit[60]	XN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching on page D5-2616. The naming of this field depends on whether stage 1 of the translation regime can support two VA ranges: Stage 1 can support two VA ranges This field is UXNTable, and determines whether execution at EL0 of instructions fetched from the region identified at a lower level of lookup permitted. Note PXNTable is the equivalent control of execution at a higher Exception level. Stage 1 supports only one VA range This field is XNTable. From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value of TCR_ELx.HPD{0} or TCR_ELx.HPD1 is 1: • The value of the corresponding UXNTable field is IGNORED by hardware, allowing the field to be used by software. • The behavior of the system is as if the value of the corresponding UXNTable field is 0. Note From Armv8.3, if EL2 is enabled in the current Security state, in the EL1 translation regime, when the value of HCR_EL2.{NV, NV1} == {1, 1}, bit[60] holds PXNTable, see Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 1 on page D5-2645.
PXNTable, bit[59]	PXN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching on page D5-2616. This field is valid only for a stage 1 translation that can support two VA ranges. It is RES0 for stage 1 translations that can support only one VA range. From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value of TCR_ELx.HPD{0} or TCR_EL1.HPD1 is 1: • The value of the corresponding PXNTable field is IGNORED by hardware, allowing the field to be used by software. • The behavior of the system is as if the value of the corresponding PXNTable field is 0. Note From Armv8.3, if EL2 is enabled in the current Security state, in the EL1&0 translation regime, when the value of HCR_EL2.{NV, NV1} == {1, 1}, bit[59] is RES0, see Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 1 on page D5-2645.

block或page的页表项的属性

分成高位和低位属性

Attribute fields in stage 1 VMSAv8-64 Block and Page descriptors

In Block and Page descriptors, the memory attributes are split into an upper block and a lower block, as shown for a stage 1 translation:

Attribute fields for VMSAv8-64 stage 1 Block and Page descriptors

名称	比特位	描述
AttrIndx[2:0]	Bit[4:2]	MAIR_ELn寄存器用来表示内存的属性，比如设备内存(Device Memory)、普通内存等。软件可以设置8个不同内存属性。常见的内存属性有： 0：DEVICE_nGnRnE 1：DEVICE_nGnRE 2：DEVICE_GRE 3：NORMAL_NC 4：NORMAL 5：NORMAL_WT AttrIndex用来索引不同的内存属性
NS	Bit[5]	非安全比特位(Non-secure)。当处于安全模式时用来指定访问的内存地址是安全映射的还是非安全映射的
AP[2:1]	Bit[7:6]	数据访问权限比特位。 AP[1]:表示该内存允许用户权限(EL0)还是更高权限的特权异常等级(EL1)来访问。在Linux内核中使用PTE_USER宏来表示可以在用户态访问该页面。 1：表示可以被EL0以及更高特权的异常等级访问 0：表示不能被EL0访问，但是可以被EL1访问。 AP[2]: 只读权限还是可读可写权限。在Linux内核中使用PTE_RDONLY宏来表示该比特位。 1：表示只读 0：表示可读可写
SH	Bit[9:8]	内存缓存共享属性。在Linux内核中使用PTE_SHARED宏来表示该比特位。 00：没有共享 01：保留 10：Outer Shareable 11：Inner Shareable
AF	Bit[10]	访问比特位(access flag)。Linux内核使用PTE_AF宏来表示该比特位。 当第一次访问页面时硬件会自动设置这个访问比特位。
nG	Bit[11]	非全局比特位(the not global bit)。Linux内核使用PTE_NG宏来表示该比特位。 这个比特位用于TLB管理。TLB的表项分成全局的和进程持有的。当设置该比特位时表示这个页面对应的TLB表项是进程持有的。
nT	Bit[16]	块类型(Block)的页表项（block translation entry）
DBM	Bit[51]	脏比特位(Dirty Bit Modifier)。Linux内核使用PTE_DBM宏来表示该比特位
Contiguous	Bit[52]	表示当前页表项处在一个连续物理页面集合中，可以使用一个单一的TLB表项进行优化。 Linux内核使用PTE_CONT宏来表示该比特位。
PXN	Bit[53]	The Privileged execute-never field，表示该页面在特权模式下不能执行。 Linux内核使用PTE_PXN宏来表示该比特位。
XN/UXN	Bit[54]	The Execute-never or Unprivileged execute-never field. XN表示该页面在任何模式下都不能执行。UXN表示该页面在用户模式下不能执行。linux内核使用PTE_UXN宏来表示
PBHA	Bit[62:59]	Page-based Hardware Attributes bits页面相关的硬件属性。