本文對arm linux頁表建立函式進行說明。在http://blog.csdn.net/flaoter/article/details/73381695中對MMU使能之前的臨時頁表進行了說明，此文是對kernel中正式頁表建立過程進行說明。文中使用的kernel版本為4.4。
arm linux使用兩級頁表，L1是pgd，L2是pte。其中L1頁表共2048項，每項佔用8bytes，每項對應2M記憶體，共佔用2048*8=16K bytes。L1項指向的page中放有2個L2頁表，每個頁表256項，每項佔用4 bytes，對應4K記憶體，共2*256*4=2K bytes，如下面程式碼中的h/w pt。Linux pt是linux管理用的頁表。
arch/arm/include/asm/pgtable-2level.h

   pgd             pte
 |        |
 +--------+
 |        |       +------------+ +0
 +- - - - +       | Linux pt 0 |
 |        |       +------------+ +1024
 +--------+ +0    | Linux pt 1 |
 |        |-----> +------------+ +2048
 +- - - - + +4    |  h/w pt 0  |
 |        |-----> +------------+ +3072
 +
 
--------+ +8    |  h/w pt 1  |
 |        |       +------------+ +4096

頁表建立通過函式create_mapping實現，在kernel初始化時的paging_init函式中會對memblock進行頁表建立。

struct map_desc {
    unsigned long virtual; //虛擬地址
    unsigned long pfn; //page frame
    unsigned long length; //地址的長度
    unsigned int type;
};
struct mem_type {
    pteval_t prot_pte;
    pteval_t prot_pte_s2;
    pmdval_t prot_l1;
    pmdval_t prot_sect;
    unsigned
 
 int domain;
};

static void __init create_mapping(struct map_desc *md)
{
    unsigned long addr, length, end;
    phys_addr_t phys;
    const struct mem_type *type;
    pgd_t *pgd;

    if (md->virtual != vectors_base() && md->virtual < TASK_SIZE) { //使用者空間返回
        pr_warn("BUG: not creating mapping for 0x%08llx at 0x%08lx in user region\n",
            (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
        return;
    }

    if ((md->type == MT_DEVICE || md->type == MT_ROM) &&
        md->virtual >= PAGE_OFFSET && md->virtual < FIXADDR_START &&
        (md->virtual < VMALLOC_START || md->virtual >= VMALLOC_END)) {   //IO型別記憶體申請低端記憶體
        pr_warn("BUG: mapping for 0x%08llx at 0x%08lx out of vmalloc space\n",
            (long long)__pfn_to_phys((u64)md->pfn), md->virtual);
    }

    type = &mem_types[md->type];

    addr = md->virtual & PAGE_MASK;
    phys = __pfn_to_phys(md->pfn);
    length = PAGE_ALIGN(md->length + (md->virtual & ~PAGE_MASK));

    if (type->prot_l1 == 0 && ((addr | phys | length) & ~SECTION_MASK)) {  //非段對映，返回  
        pr_warn("BUG: map for 0x%08llx at 0x%08lx can not be mapped using pages, ignoring.\n",
            (long long)__pfn_to_phys(md->pfn), addr);
        return;
    }

    pgd = pgd_offset_k(addr);             //(1)
    end = addr + length;
    do {
        unsigned long next = pgd_addr_end(addr, end);

        alloc_init_pud(pgd, addr, next, phys, type);  //(2)

        phys += next - addr;
        addr = next;
    } while (pgd++, addr != end);
}

(1) 查詢一級頁表項

#define PGDIR_SHIFT     21
#define pgd_index(addr)     ((addr) >> PGDIR_SHIFT)
#define pgd_offset(mm, addr)    ((mm)->pgd + pgd_index(addr))
#define pgd_offset_k(addr)  pgd_offset(&init_mm, addr)

在kernel初始化彙編階段的head.S中可知，一級頁表的地址範圍是0xC0004000~0xC0008000，即pgd的起始地址是0xC0004000, map_lowmem中addr=0xC0000000, pgd_offset_k(addr)解釋為
(pgd_t*)0xC0004000 + (0xC0000000) >> 21

pgtable-2level-types.h

typedef u32 pmdval_t;
typedef pmdval_t pgd_t[2];

pgd_t型別是u32[2]的陣列型別，所以(pgd_t*)0xC0004000 + (0xC0000000) >> 21=0xC0007000

(2) 呼叫alloc_init_pmd

static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
                      unsigned long end, phys_addr_t phys,
                      const struct mem_type *type)
{
    pmd_t *pmd = pmd_offset(pud, addr);
    unsigned long next;

    do {
        /*
         * With LPAE, we must loop over to map
         * all the pmds for the given range.
         */
        next = pmd_addr_end(addr, end);

        /*
         * Try a section mapping - addr, next and phys must all be
         * aligned to a section boundary.
         */
        if (type->prot_sect &&
                ((addr | next | phys) & ~SECTION_MASK) == 0) {
            __map_init_section(pmd, addr, next, phys, type);  //(a)
        } else {
            alloc_init_pte(pmd, addr, next,
                        __phys_to_pfn(phys), type);   //(b)
        }

        phys += next - addr;

    } while (pmd++, addr = next, addr != end);
}

(a)段對映，

static void __init __map_init_section(pmd_t *pmd, unsigned long addr,
            unsigned long end, phys_addr_t phys,
            const struct mem_type *type)
{
    pmd_t *p = pmd;

#ifndef CONFIG_ARM_LPAE
    /*
     * In classic MMU format, puds and pmds are folded in to
     * the pgds. pmd_offset gives the PGD entry. PGDs refer to a
     * group of L1 entries making up one logical pointer to
     * an L2 table (2MB), where as PMDs refer to the individual
     * L1 entries (1MB). Hence increment to get the correct
     * offset for odd 1MB sections.
     * (See arch/arm/include/asm/pgtable-2level.h)
     */
    if (addr & SECTION_SIZE)
        pmd++;
#endif
    do {
        *pmd = __pmd(phys | type->prot_sect);        //頁表填充項是(phys | type->prot_sect)
        phys += SECTION_SIZE;
    } while (pmd++, addr += SECTION_SIZE, addr != end);

    flush_pmd_entry(p);    //重新整理到記憶體
}

typedef u32 pmdval_t;
typedef pmdval_t pmd_t;

pmd_t是u32型別，指標值就是傳進來的pgd_t，*pmd填充的內容即頁表項就是(phys | type->prot_sect)。此處地址是按1M累加的，傳進來的addr是按2M累加的，所以一般情況此函式的do{}while()迴圈都是執行兩次。
下圖是我的平臺執行map_lowmem後的結果，一共佔用了0x74項內容，建立了虛擬地址0xC0000000~0xC7300000到實體地址0x80000000~0x87300000的對映。
0xC0000000 –> 頁表項地址0xC0007000 –>頁表項內容0x8001141E –>實體地址0x80000000

(b) 二級頁表對映

pte_t * __init early_pte_alloc(pmd_t *pmd, unsigned long addr, unsigned long prot)
{
    if (pmd_none(*pmd)) {  //如果L1頁表沒對映
        pte_t *pte = early_alloc(PTE_HWTABLE_OFF + PTE_HWTABLE_SIZE);  //PTE_HWTABLE_OFF=512*4 bytes,PTE_HWTABLE_SIZE=512*4bystes，共申請4K
        __pmd_populate(pmd, __pa(pte), prot);   //填充L1頁表，使L1頁表關聯到L2頁表
    }
    BUG_ON(pmd_bad(*pmd));
    return pte_offset_kernel(pmd, addr);
}

void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,
                  unsigned long end, unsigned long pfn,
                  const struct mem_type *type)
{
    pte_t *pte = early_pte_alloc(pmd, addr, type->prot_l1);  //pte為二級頁表指標
    do {
        set_pte_ext(pte, pfn_pte(pfn, __pgprot(type->prot_pte)), 0);  //填充L2頁表項
        pfn++;    //L2頁表每一項對應4k地址
    } while (pte++, addr += PAGE_SIZE, addr != end);
}

本例中virtual_addr = 0xFFFF0000, virtual_end=0xFFFF1000, pfn=0x000873FC，只進行4K地址的對映，因此只需要填充二級頁表的1項內容即可。
二級頁表指標pte = 0xC73FF7C0， [0xC73FF7C0] = 0x873FC5DF。建立了虛擬地址0xFFFF0000到實體地址0x873FC000的對映關係。