Page-table walks are implicit memory reads — ordinarily unordered against your explicit stores. SFENCE.VMA sfence.vma Supervisor memory-management fence: orders prior stores before subsequent implicit page-table reads and invalidates address-translation cache entries, filtered by rs1 (one VA) and rs2 (one ASID) — x0 meaning 'all'. Local-hart only; cross-hart shootdown = fence + IPI + remote SFENCE.VMA. defined in ch. II·12 — open in glossary is the one instruction that bridges the two worlds: it orders all prior visible stores before subsequent implicit page-table references, and it invalidates cached translations. The spec deliberately calls it a fence, not a “TLB flush” — the semantics survive any caching structure you build.
The four quadrants
| Orders stores before implicit reads of… | Invalidates… | |
|---|---|---|
| rs1=x0, rs2=x0 | all page-table levels, all address spaces | every translation-cache entry |
| rs1=x0, rs2=asid | all levels, that ASID only | that ASID’s entries — except global mappings |
| rs1=va, rs2=x0 | leaf PTEs mapping va, all spaces | all leaf entries for va |
| rs1=va, rs2=asid | leaf PTEs mapping va in that ASID | matching leaf entries, except globals |
An invalid virtual address in rs1 makes the instruction a silent no-op — deliberately, so trivial implementations can ignore rs1 entirely. When rs2≠x0, bits above ASIDMAX must be zeroed by software; bits between ASIDLEN and ASIDMAX are ignored by hardware.
What forgetting the fence means
Between a PTE store and its subsuming fence, an access may use any
translation valid at any time since the last subsuming SFENCE.VMA —
old, new, varying per access, even one cached under a different
satp.MODE width, or both a stale non-leaf and a fresh superpage leaf
after an in-place upgrade. Consequences the spec spells out:
- Never update a live PTE with narrower-than-PTESIZE stores — the walker may legally read between the halves.
- V=0 PTEs may be cached: OSes must fence after populating a previously-invalid entry (unless Svvptc lifts exactly this, next pages), and eager invalid-entry caching just manufactures page faults.
- The fence orders implicit reads; it does not make prior explicit stores visible to other harts — cross-hart TLB shootdown is software: local fence → IPI → remote SFENCE.VMA → ack.
The standard recipes: ASID recycle → fence that ASID with rs1=x0 (or defer until the reload); no ASIDs → fence after every satp write, passing a zero-valued non-x0 register as rs2 to spare the globals; non-leaf change → rs1=x0 (a VA-filtered fence only covers leaves); permission increases → fence lazily from the page-fault handler.
Speculative walks may run any time satp is active, pre-populating the translation cache — but they must follow only V=1 pointers reachable from satp, never set D or fault, and never install what an intervening fence would have killed. Changes to SUM/MXR, Bare↔paged toggles, and ASID switches need no fence at all. A satp-RO-Bare implementation may make SFENCE.VMA an illegal instruction, and mstatus.TVM traps it from S-mode for virtualization.
Hardware Designer Notes
The cheap-and-correct v1: a flash-clear signal on every TLB valid bit, asserted by SFENCE.VMA decode, plus a pipeline flush so younger instructions re-translate. Filtered invalidation (VA CAM match, ASID compare, G-bit exemption) is pure performance tuning — measure Linux context-switch cost before you build it.
Minimal Linux-boot hart MUST
- On SFENCE.VMA: drain or kill in-flight speculative walks (for the matching ASID where filtered), invalidate matching TLB entries, and order prior stores before subsequent walker reads
- Honor the G-bit exemption in ASID-filtered flushes — or ignore ASIDs entirely and flush-all (over-fencing is always conformant)
- Keep translation caches hart-private: a shared last-level TLB must behave as-if private per hart (ASIDs are hart-local)
MAY simplify / trap-and-emulate
- Ignore rs1 and rs2 completely — flush-everything on every SFENCE.VMA is the standard first implementation
- Cache V=0 or non-leaf entries — legal, but eagerly caching invalids only costs you page faults
- Raise illegal-instruction on SFENCE.VMA if satp is hardwired Bare
Check yourself — SFENCE.VMA
1.A hart modifies a leaf PTE for one page in one address space. What is the surgical SFENCE.VMA?
2.Why is a hardware TLB-shootdown broadcast NOT part of SFENCE.VMA?
3.Software updates a leaf PTE but forgets the SFENCE.VMA. What may subsequent accesses to that VA observe?
4.Which invariant makes speculative page-table walking safe to allow at any time?