15.5"H" IV: Two-Stage Address Translation

Whenever V=1, every virtual memory access runs two stages two-stage address translation Active whenever V=1: a guest virtual address is translated by VS-stage (vsatp, guest's own page tables) to a guest physical address, then by G-stage (hgatp, hypervisor's tables, Sv39x4-style with 2 extra bits and a 16 KiB root) to a supervisor physical address. Even the VS-stage page-table reads themselves go through G-stage. defined in ch. II·15 — open in glossary : VS-stage (vsatp, the guest’s own page tables) maps guest virtual → guest physical guest physical address GPA: the intermediate address between VS-stage and G-stage translation — what the guest OS believes is physical. 2 bits wider than the VA width (34/41/50/59 bits), reported to hypervisors in htval/mtval2 shifted right by 2. defined in ch. II·15 — open in glossary ; G-stage (hgatp, the hypervisor’s tables) maps guest physical → supervisor physical. Either stage can be Bare. There is no third option: even accesses that “bypass translation” — including the walker’s own reads of VS-level page tables — still pass through G-stage. PMP always checks the final supervisor physical address.

MXR splits by level: vsstatus.MXR opens execute-only pages at VS-stage only; the HS-level sstatus.MXR overrides execute-only at both stages.

The Sv*x4 schemes

Sv32x4/Sv39x4/Sv48x4/Sv57x4 widen the incoming address by 2 bits (34/41/50/59), absorbed entirely by a 16 KiB, 16 KiB-aligned root table — non-root tables and all PTE formats are exactly the Sv* originals. The translation algorithm is the Sv* algorithm with four substitutions:

1. hgatp replaces satp;
2. the effective privilege must be VS or VU for translation to begin;
3. the U-bit check always assumes U-mode — every G-stage access is a user access, so G-stage leaves need U=1 (the bit survives in the format only to allow sharing tables with HS-level translation);
4. guest-page faults (codes 20/21/23) replace page faults.

Accesses made in support of VS-stage translation are checked at G-stage as implicit loads (or stores, when hardware updates VS-level A/D bits) — but any exception reports as the original access type. The G bit in G-stage PTEs is unused: software zeros it, hardware ignores it.

Guest-page faults

Delegable M→HS via medeleg (never further — hedeleg bits 20/21/23 are RO-0). The handler receives: stval/mtval = the guest virtual address (page-boundary rules as usual for straddles); htval/mtval2 = the guest physical address >>2, or zero; htinst/mtinst = transform or pseudoinstruction. When the fault isn’t from an implicit VS-stage access, the GPA in htval corresponds exactly to the VA in stval.

The fence matrix

World switch (no atomic vsatp+hgatp pair exists): write vsatp = 0 → swap hgatp (+ henvcfg bits) → write the new vsatp. Zeroing first prevents speculative walks from caching one guest’s VS translations under the next guest’s VMID.

Pointer masking: with vsatp=Bare, guest “virtual” addresses are GPAs — up to 2 bits wider than the VA the masking hardware assumed. Implementations may mask on the TLB refill path (accepting up to 4 duplicate entries per page) rather than the timing-critical lookup path; hypervisors then issue HFENCE.GVMA when henvcfg.PMM crosses the GPA width (PMLEN 7/16 vs Sv57x4, PMLEN 16 vs Sv48x4).