armv8 mmu The Access flag and The dirty state

D5.4.7 The Access flag

page或者section的内存第一次被访问时，会设置AF标志位，如果是armv8.0需要软件管理，如果是armv8.1则是硬件自动管理。

The Access flag indicates when a page or section of memory is accessed for the first time since the Access flag in the corresponding translation table descriptor was set to 0.

The AF bit in the translation table descriptors is the Access flag.

In Armv8.0, the Access flag is managed by software as described in Software management of the Access flag.

From Armv8.1, the Access flag can be managed by hardware as described in Hardware management of the Access

flag on page D5-2619.

Note

The support for hardware management of the Access flag applies only to the VMSAv8-64 translation regimes.

D5.4.8 The dirty state

表示内存是否被修改了。被硬件管理的标志位

The dirty state indicates whether a page or section of memory is modified.

The dirty state can be managed by hardware as described in Hardware management of dirty state on page D5-2620.

Where the dirty state is managed in hardware, the dirty state information is encoded using the access permission bits

AP[2] and S2AP[1] in conjunction with the DBM bit.

D5.4.10 Software management of the Access flag

在armv8.0里面，软件维护AF标志位，当尝试读取TLB entry时，也就是一次读，access flag fault会被触发。

Armv8.0 requires that software manages the Access flag. This means an Access flag fault is generated whenever an attempt is made to read into the TLB a translation table descriptor entry for which the value of Access flag is 0.

当access flag fault触发之后，软件要设置AF为1

The Access flag mechanism expects that, when an Access flag fault occurs, software resets the Access flag to 1 in the translation table entry that caused the fault. This prevents the fault occurring the next time that memory location is accessed. Entries with the Access flag set to 0 are never held in the TLB, meaning software does not have to flush the entry from the TLB after setting the flag.

D5.4.11 Hardware management of the Access flag and dirty state

Armv8.1 introduces the following optional features that perform hardware updates to the translation tables:

• Hardware management of the Access flag.

• Hardware management of dirty state on page D5-2620.

The support for hardware management of the Access flag and dirty state is identified by the feature ARMv8.1-TTHM.

硬件自动更新AF为1

When the hardware management of the Access flag is enabled, in situations where, without this feature, an Access flag fault would be generated, the hardware instead performs an atomic read-modify-write of the appropriate translation table descriptor to update the Access flag from 0 to 1.

dirtry state当没有访问权限时，如果没有这个硬件特性，那么一个permission fault会触发。如果有这个硬件特性，硬件会检查DBM域。若为1，硬件会执行一个read-modify-write操作来修改这个DBM域，来允许它写操作。

When the hardware management of dirty state is enabled, if the Block or Page descriptor in a translation table indicates that a data access does not have write permission, then in situations where, without this feature, a data access would generate a Permission fault only because of this lack of write permission, the hardware checks the value of the DBM field in the Block or Page descriptor. If this field is 1, then instead of generating a Permission fault, the hardware performs an atomic read-modify-write of the translation table descriptor, to change the value of the bit that prohibits the write access.

It is permissible, but not required, that a stage 2 permission failure on the stage 1 translation table walk is generated

(and has priority over the stage 1 abort generated by the stage 1 translation table entry) if all of the following are true:

• Stage 1 hardware updating of either access or dirty information is enabled.

• A stage 1 translation table entry would result in the stage 1 translation table entry having the access or dirty

bit updated.

• The stage 1 translation table entry has stage 2 read permission but not stage 2 write permission.

• The stage 1 translation entry generates an abort (which might be one of an address size fault, an alignment

fault caused by memory type or a permission fault)

Hardware management of the Access flag

硬件管理开启/关闭AF位

Hardware management of the Access flag is enabled, for the corresponding stage of address translation, by the following configuration fields:

For stage 1 translations

• TCR_EL1.HA. //可以用过此位来开启关闭硬件设置AF的功能

• TCR_EL2.HA.

• TCR_EL3.HA.

For stage 2 translations

• VTCR_EL2.HA.

When the value of a configuration bit, HA, is 1, then when a memory access is made using a translation table Block or Page descriptor from the corresponding stage of address translation:

当HA=1，访问一个内存时，硬件自动设置AF为1，它是通过read-modify-write机制来写的。

• The PE sets the value of the Access flag to 1 in the translation table descriptor in memory, in a coherent manner, by an atomic read-modify-write of the translation table descriptor, if both of the following conditions are true:

• • The descriptor does not generate a Permission fault or an Alignment fault based on the memory type.

  • If the hardware update mechanism was disabled or not implemented, the access would have generated an Access flag fault.

bread-before-make机制，因为armv8允许预测访问，意思为在修改页表项时，先把对应的tlb无效掉，在修改页表项

A consequence of the architectural rules for translation table accesses is that the architecture requires that for any

translation to which an architecturally executed memory access occurs, the Access flag is set to 1, except as indicated in Using break-before-make when updating translation table entries on page D5-2669. However, because the architecture permits speculative accesses, the Access flag is permitted to be set to 1, even if there is no architecturally executed memory accesses by the processor.

Hardware management of dirty state

The hardware management of dirty state mechanism can only be enabled if hardware management of the Access flag is enabled. For information on the hardware management of the Access flag, see Hardware management of the Access flag on page D5-2619. The hardware management of dirty state mechanism uses:

• In a stage 1 translation table access, the AP[2] bit in conjunction with the DBM bit in the translation table descriptors.//AP[2]和DBM联合使用

• In a stage 2 translation table access, the S2AP[1] bit in conjunction with the DBM bit in the translation table descriptors.

Hardware management of dirty state is enabled, for the corresponding stage of address translation, by the following

configuration fields:

For stage 1 translations

• TCR_EL1.HD.//此字段开启或关闭此硬件特性

• TCR_EL2.HD.

• TCR_EL3.HD.

When hardware management of dirty state is enabled, and a memory access is made using a translation table Block or Page descriptor:

当HD=1，然后AP2=0,那么

1.硬件会自动设置DBM为1

2.如果HD关闭了，那么当AP2=1时，会触发permission fault，因为这时候没有写权限，则需要软件去写DBM的位

• For a stage 1 address translation, if the value of the TCR_ELx.HD field corresponding to the address translation is 1, then the PE sets AP[2] to 0 in the translation descriptor in memory, in a coherent manner by an atomic read-modify-write of the translation table descriptor, if both of the following conditions are true:

— The value of the DBM field in the descriptor is 1.

— If the hardware update mechanism was disabled or not implemented, the access using this descriptor

would have generated a Permission fault only because the value of the AP[2] field is 1, indicating that the access does not have write permission.

When the PE updates AP[2] in this way no Permission fault is generated because of the value of the AP[2] field.

对于一个写access，如果CPU发现TLB里面的DBM=1, 但是AP2不允许写，那么这时PE应该去检查这个TLB是否陈旧的。

有必要执行一次read-modify-write操作来更新页表项。

If, for a write access, the PE finds that a cached copy of the descriptor in a TLB had the DBM bit set to 1 and the AP[2] or S2AP[1] bit set to the value that forbids writes, then the PE must check that the cached copy is not stale with regard to the descriptor entry in memory, and if necessary perform an atomic read-modify-write update of the descriptor in memory. This applies if the cached copy of the descriptor in a TLB is either:

• A stage 1 descriptor in which DBM has the value 1 and AP[2] has the value 1

注意：当DBM为1，stage 1的AP2为1的时候，可以等同于writable

The OA of a translation table entry where the DBM bit is 1, and the stage 1 AP[2] bit is 1 or the stage 2 S2AP[1] bit is 0, is treated as writable:

• For data cache invalidation instructions that require write permission, that is for the DC IVAC instruction.

• For address translation instructions that require write permission, that is for the AT S12E0W, AT S12E1W, AT S1E0W, AT S1E1W, AT S1E2W, and AT S1E3W instructions.