12.3-5Sv32, Sv39, Sv48: Page Tables & the Translation Algorithm

All the Sv schemes are one design — a radix tree of 4 KiB page-table nodes, walked by hardware — differing only in depth. Sv32 (SXLEN=32): 2 levels, 4-byte PTEs pte Page Table Entry: V validity, R/W/X permissions (000 = pointer to next level; W without R reserved), U user-accessible, G global, A accessed, D dirty, RSW software bits, PPN. RV64 formats add N (Svnapot) and PBMT (Svpbmt) in the high bits. defined in ch. II·12 — open in glossary . Sv39/48/57 (SXLEN=64): 3/4/5 levels, 8-byte PTEs, 512 entries per node. Every table is exactly one page, page-aligned; the root’s physical page number lives in satp.

Address formats

Sv48 prepends VPN[3] (bits 47:39, canonical above 47); Sv57 prepends VPN[4] (bits 56:48). The translated PPN is 22 bits on Sv32 (34-bit physical addresses — RV32 reaches beyond 4 GiB) and 44 bits on all the RV64 schemes (56-bit physical). Canonicality is sign-based, not zero-based: the entrenched OS convention of user-low/kernel-high falls out of one bit test.

The PTE

Sv32’s PTE is the 4-byte tail of this (PPN[1] 12b, PPN[0] 10b, bits 9:0 identical). Any level may hold a leaf: Sv32 offers 4 MiB megapages; Sv39 adds 2 MiB megapages + 1 GiB gigapages; Sv48 adds 512 GiB terapages — each virtually and physically aligned to its size, or page fault. Fetch from X=0, load from R=0 (MXR relaxes to R∨X), store to W=0 → the corresponding page fault; AMOs raise only store faults. For non-leaf PTEs, D/A/U are reserved-zero. With A and paging, the LR/SC reservation set must fit in one 4 KiB page.

Accessed & Dirty

Two conformant schemes, all harts alike:

• Svade: touching a page with A=0 (or storing with D=0) page faults; the OS maintains A/D in the handler. Radically simpler hardware.
• Hardware update (Svadu, gated by menvcfg.ADUE): the walker sets A (and D on stores) itself — atomically compare-and-swap against the value it walked, re-running all checks, restarting the walk on mismatch. A may be set speculatively (prefetcher-friendly); D must be exact and program-ordered, and the PTE update must hit the global memory order before the store that caused it. Page tables must live in RsrvEventual PMA memory.

The algorithm

1. a = satp.ppn × 4096, i = LEVELS−1 (satp must be active).
2. Read pte at a + va.vpn[i] × PTESIZE — one atomic PTESIZE-wide access; PMA/PMP violation → access fault.
3. pte.v=0, or R=0∧W=1, or any reserved bit set → page fault.
4. R∨X → leaf (step 5). Else descend: i−− (i<0 → page fault), a = pte.ppn × 4096, back to 2.
5. Leaf at i>0 with ppn[i−1:0] ≠ 0 → misaligned superpage, page fault.
6. Privilege check (U bit vs mode, SUM, MXR) → page fault if denied.
7. Shadow-stack rules (Zicfiss) → access fault if violated.
8. R/W/X permission check → page fault.
9. A=0, or store with D=0 → Svade: page fault; else the CAS update (PMP/PMA-checked as a store now; mismatch → step 2).
10. Done: pa.pgoff = va.pgoff; superpage: pa.ppn[i−1:0] = va.vpn[i−1:0]; pa.ppn[LEVELS−1:i] = pte.ppn[LEVELS−1:i].

Step-2 reads may be served by the SFENCE.VMA sfence.vma Supervisor memory-management fence: orders prior stores before subsequent implicit page-table reads and invalidates address-translation cache entries, filtered by rs1 (one VA) and rs2 (one ASID) — x0 meaning 'all'. Local-hart only; cross-hart shootdown = fence + IPI + remote SFENCE.VMA. defined in ch. II·12 — open in glossary -governed translation cache — hart-private, read-only, incoherent, arbitrarily many entries per (VA, ASID). Step 9 never uses the cache: A/D updates go to memory. Speculative walks may pre-warm the cache any time satp is active, but must not set D, fault, or install entries an intervening fence would have killed.