ARM64 Page type

Table of Contents

查看内存属性

find-aarch64-memory-attr.png

两种pagetype

在ARM64中，共分两种内存类型1

指定内存类型

How does system distinguish memory types?
table entry[4:2] -> MAIR(Memory Attribute Indirection Register) -> Attr<n>[7:4] -> Device Memory or Normal Memory
arm64-memory-types.png

/*
 * Memory types available.
 */
#define MT_DEVICE_nGnRnE        0
#define MT_DEVICE_nGnRE         1
#define MT_DEVICE_GRE           2
#define MT_NORMAL_NC            3
#define MT_NORMAL               4
#define MT_NORMAL_WT            5


/*
 * Memory region attributes for LPAE:
 *
 *   n = AttrIndx[2:0]
 *          n   MAIR
 *   DEVICE_nGnRnE  000 00000000
 *   DEVICE_nGnRE   001 00000100
 *   DEVICE_GRE     010 00001100

 *   NORMAL_NC      011 01000100
 *   NORMAL         100 11111111
 *   NORMAL_WT      101 10111011
 */
ldr x5, =MAIR(0x00, MT_DEVICE_nGnRnE) | \
         MAIR(0x04, MT_DEVICE_nGnRE) | \
         MAIR(0x0c, MT_DEVICE_GRE) | \
         MAIR(0x44, MT_NORMAL_NC) | \
         MAIR(0xff, MT_NORMAL) | \
         MAIR(0xbb, MT_NORMAL_WT)
msr mair_el1, x5

来看一看实机抓到的寄存器设置值： (qemu aarch64)

TTBR0_EL1      0x7a13f000       2048126976
TTBR1_EL1      0x14c0000410c6000        93449693359267840
TCR_EL1        0x34b5503510     226380231952
PMUSERENR_EL0  0x0      0
MAIR_EL1       0xbbff440c0400   206705032692736
TCR_EL2        0x0      0
VTTBR_EL2      0x0      0
AMAIR0         0x0      0
Attr<n>[7:4] Meaning
0000 Device memory. See encoding of Attr<n>[3:0] for th00RW, RW not 00 Normal memory, Outer Write-Through Transient
0100 Normal memory, Outer Non-cacheable
01RW RW not 00 Normal memory, Outer Write-Back Transient
10RW Normal memory, Outer Write-Through Non-transien11RW Normal memory, Outer Write-Back Non-transient
Attr<n>[3:0] Meaning when Attr<n>[7:4] is 0000 Meaning when Attr<n>[7:4] is not 0000
0000 Device-nGnRnE memory UNPREDICTABLE
00RW RW not 00 UNPREDICTABLE Normal memory, Inner Write-Through Transient
0100 Device-nGnRE memory Normal memory, Inner Non-cacheable
01RW RW not 00 UNPREDICTABLE Normal memory, Inner Write-Back Transient
1000 Device-nGRE memory Normal memory, Inner Write-Through Non-transient (RW=10RW, RW not 00 UNPREDICTABLE Normal memory, Inner Write-Through Non-transient
1100 Device-GRE memory Normal memory, Inner Write-Back Non-transient (RW=00)
11RW RW not 00 UNPREDICTABLE Normal memory, Inner Write-Back Non-transient

Normal Memory

  • MT_NORMAL_NC

    Attr<n> = 0x44, Normal memory, Outer Non-cacheable, Inner Non-cacheabe
    就是普通的不带cache访问的类型

  • MT_NORMAL

    Attr<n> = 0xff, Normal memory, Outer Write-Back Non-transient, Outer Read-Allocate, Outer Write-Allocate, Inner Write-Back, Inner Read-Allocate, Inner-Write-Allocate
    这个就是带cache的普通内存，速度最快, 读写都是先经过cache。

  • MT_NORMAL_WT

    Attr<n> = 0xbb, Normal memory, Outer Write-Through Non-transient, Outer Read-Allocate, Outer Write-Allocate, Inner Write-Through, Inner Read-Allocate, Inner-Write-Allocate
    这个也是带cache的设置，读取时会经过cache，写入时则不经过cache

Device Memory

  • GRE

    ref to ARM Cortex-A Series Programmer's Guide for ARMv8-A#Device memory

    G
    Gathering
    这个属性决定了多次访问是否可以合并成一次总线访问。如果地址被标记为nG，那么总线上的传输就必须和程序指定的传输相一致
    R
    Re-ordering
    这个属性决定了设备是否会对传输进行重新排序，如果设置为nR,那么对于本块地址空间的访问就

    会全部按照程序中的顺序来进行访问。这块内存的大小时由具体平台决定的，如果这个block很大，那么这个属性将会覆盖多个页面项。

    E
    Early Write Acknowledgement
    这个属性决定了在处理器项从设备写入时是否允许从中间的缓冲buffer发送写入完成的应答信号。如果某个地址被标记为nE，
    那么这个信号就必须由从外设设备发出。如果被标记为E，那么这个信号就可以由中间的互联中的buffer来发出。

Strongly Ordered Memory :: ARMv7 platform, merge into Device Memory

MMU table

Input Address size limit.

通过TCR_ELx.T0SZ 可以控制系统进行映射的地址范围，计算方法 size = 2 ^(64 - TCR_ELx.T0SZ).
默认值为0，启用最大支持的地址范围，一般不需要进行修改，当需要限制地址范围时可以使用这个寄存器来控制.

2021-11-04_18-44-51_screenshot.png

Translate table

VMSAv8-64 translation table format descriptors
11_Translation_table_format.png

  • An invalid or fault entry.

    最低位为0表示无效的表项，当访问该地址时，系统将会产生同步的data abort.

  • A table entry, that points to the next-level translation table.

    table entry表示还有下一级的映射表需要去查询，就只是一个简单的下级地址记录，功能比较简单.

    2021-11-04_18-48-42_screenshot.png

  • A block entry, that defines the memory properties for the access.

    block entry表示一个具体的映射项，当系统记录了最终映射到的地址，以及一些属性的配制，mmu设置的内存属性全部都可以从这里查到.

    2021-11-04_16-25-15_screenshot.png

example

下面是一个具体的映射表的例子，颗粒度：4KB

  • 相关寄存器值以及映射表内容
    i r TCR_EL2
TCR_EL2     0x0007FFF78081351C

i r TTBR0_EL2
TTBR0_EL2   0x00000000FFFF0000

x/16g SP:0x00000000FFFF0000
SP:0x00000000FFFF0000:  0x00000000FFFF1003  0x0060000040000401  0x0000000080000711  0x00000000C0000711  0x0000000100000711  0x0000000140000711  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF0040:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000

x/256g SP:0x00000000FFFF1000
SP:0x00000000FFFF1000:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1040:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1080:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF10C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1100:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1140:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1180:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF11C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1200:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1240:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1280:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF12C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1300:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1340:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1380:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF13C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1400:  0x0060000010000401  0x0060000010200401  0x0060000010400401  0x0060000010600401  0x0060000010800401  0x0060000010A00401  0x0060000010C00401  0x0060000010E00401
SP:0x00000000FFFF1440:  0x0060000011000401  0x0060000011200401  0x0060000011400401  0x0060000011600401  0x0060000011800401  0x0060000011A00401  0x0060000011C00401  0x0060000011E00401
SP:0x00000000FFFF1480:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF14C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1500:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1540:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1580:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF15C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1600:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1640:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1680:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF16C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1700:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1740:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF1780:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
SP:0x00000000FFFF17C0:  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000  0x0000000000000000
  • TCR_EL2

    从这个寄存器中，我们可以得到如下信息：

    field value meaning
    TCR_EL2.TG0 0x0 4KB Granule size
    TCR_EL2.T0SZ 0x1C 可用地址范围 0 ~ 2^(64-28)

    对于4KB的颗粒度, 每一级的地址范围如下图

    2021-11-04_15-45-13_screenshot.png

  • mmu 表项解释

    在上面这个例子中，mmu table位于 0xffff0000 的位置，每个表项有64bit长度, 使用4KB的颗粒度.

    1. T0SZ
      = 0b011100 = 28, 由此可得地址范围为 0 ~ 0x1000000000
    2. 对于每一项
      bit[0]: indicates whether the descriptor is valid, 对于未映射的项，访问是会触发data abort.
      Bit[1] of the descriptor indicates the descriptor type. 0: Block, 1: Table
    3. 解析
      第一项： 0x00000000FFFF1003: 表示存在level 0映射, table类型, 下级table地址在 0x00000000FFFF1000
      64项： 0x00000000FFFF1400 : 0x0060000010000401: block类型, 每个block大小2MB,根据地址计算，对应的范围是 [0x10000000 , 0x10200000) , Upper attribute: [63:51] = 0b0000000001100, Lower attribute: [11:2)] = 0b0100000000 XN,PXN,AF
      第二项： 0x0060000040000401: Block类型，每个block 1GB大小根据地址计算，对应的范围是 [0x40000000 , 0x8000000)
      剩余项； 和第二项类似。

Footnotes:

1

详见ARM官方文档DEN0024A_v8_architecture_PG.pdf 13.1 Memory types
https://developer.arm.com/documentation/101811/0101

Contact me via :)
虚怀乃若谷，水深则流缓。