12.2SFENCE.VMA: The Memory-Management Fence

Part II Linux boot: required Vol. II (Privileged) pp. 126–129 · ~4 min read

  • sfence.vma
  • global mapping

Page-table walks are implicit memory reads — ordinarily unordered against your explicit stores. SFENCE.VMA is the one instruction that bridges the two worlds: it orders all prior visible stores before subsequent implicit page-table references, and it invalidates cached translations. The spec deliberately calls it a fence, not a “TLB flush” — the semantics survive any caching structure you build.

00010013125rs22420rs11915PRIV141200000117111001160SFENCE.VMA (SYSTEM)
Click a field for its role.

The four quadrants

Scope by rs1/rs2 (over-fencing is always legal — simple cores may treat every form as x0/x0)
Orders stores before implicit reads of…Invalidates…
rs1=x0, rs2=x0all page-table levels, all address spacesevery translation-cache entry
rs1=x0, rs2=asidall levels, that ASID onlythat ASID’s entries — except global mappings
rs1=va, rs2=x0leaf PTEs mapping va, all spacesall leaf entries for va
rs1=va, rs2=asidleaf PTEs mapping va in that ASIDmatching leaf entries, except globals
Dotted-underlined cells have explanations — click one.

An invalid virtual address in rs1 makes the instruction a silent no-op — deliberately, so trivial implementations can ignore rs1 entirely. When rs2≠x0, bits above ASIDMAX must be zeroed by software; bits between ASIDLEN and ASIDMAX are ignored by hardware.

What forgetting the fence means

Between a PTE store and its subsuming fence, an access may use any translation valid at any time since the last subsuming SFENCE.VMA — old, new, varying per access, even one cached under a different satp.MODE width, or both a stale non-leaf and a fresh superpage leaf after an in-place upgrade. Consequences the spec spells out:

  • Never update a live PTE with narrower-than-PTESIZE stores — the walker may legally read between the halves.
  • V=0 PTEs may be cached: OSes must fence after populating a previously-invalid entry (unless Svvptc lifts exactly this, next pages), and eager invalid-entry caching just manufactures page faults.
  • The fence orders implicit reads; it does not make prior explicit stores visible to other harts — cross-hart TLB shootdown is software: local fence → IPI → remote SFENCE.VMA → ack.

The standard recipes: ASID recycle → fence that ASID with rs1=x0 (or defer until the reload); no ASIDs → fence after every satp write, passing a zero-valued non-x0 register as rs2 to spare the globals; non-leaf change → rs1=x0 (a VA-filtered fence only covers leaves); permission increases → fence lazily from the page-fault handler.

Speculative walks may run any time satp is active, pre-populating the translation cache — but they must follow only V=1 pointers reachable from satp, never set D or fault, and never install what an intervening fence would have killed. Changes to SUM/MXR, Bare↔paged toggles, and ASID switches need no fence at all. A satp-RO-Bare implementation may make SFENCE.VMA an illegal instruction, and mstatus.TVM traps it from S-mode for virtualization.

Hardware Designer Notes

The cheap-and-correct v1: a flash-clear signal on every TLB valid bit, asserted by SFENCE.VMA decode, plus a pipeline flush so younger instructions re-translate. Filtered invalidation (VA CAM match, ASID compare, G-bit exemption) is pure performance tuning — measure Linux context-switch cost before you build it.

Minimal Linux-boot hart MUST

  • On SFENCE.VMA: drain or kill in-flight speculative walks (for the matching ASID where filtered), invalidate matching TLB entries, and order prior stores before subsequent walker reads
  • Honor the G-bit exemption in ASID-filtered flushes — or ignore ASIDs entirely and flush-all (over-fencing is always conformant)
  • Keep translation caches hart-private: a shared last-level TLB must behave as-if private per hart (ASIDs are hart-local)

MAY simplify / trap-and-emulate

  • Ignore rs1 and rs2 completely — flush-everything on every SFENCE.VMA is the standard first implementation
  • Cache V=0 or non-leaf entries — legal, but eagerly caching invalids only costs you page faults
  • Raise illegal-instruction on SFENCE.VMA if satp is hardwired Bare

Check yourself — SFENCE.VMA

1.A hart modifies a leaf PTE for one page in one address space. What is the surgical SFENCE.VMA?

2.Why is a hardware TLB-shootdown broadcast NOT part of SFENCE.VMA?

3.Software updates a leaf PTE but forgets the SFENCE.VMA. What may subsequent accesses to that VA observe?

4.Which invariant makes speculative page-table walking safe to allow at any time?

4 questions