HomeRISC-V MMU

RISC-V Virtual Address Translation

Sv39XLEN 643 levels64-bit PTE
Mode
Page Table Presets
Demo scope

This page is not a complete MMU or OS page-table implementation. It demonstrates VA canonical-form checks and splitting, PTE V/R/W/X/A/D decisions, leaf/non-leaf paths, superpage alignment, and PA composition; it does not model full S/U privilege access rules, SUM/MXR, atomic details of A/D-bit updates, PMA/PMP checks for page-table and final physical accesses, two-stage virtualization, exception priority, SFENCE.VMA/SINVAL ordering and invalidation, or implementation-specific behavior.

Current Mode Basics
VA[38:0] =VPN[2]9VPN[1]9VPN[0]9offset12

VPN fields index page tables level by level; offset is the 4 KiB in-page byte offset. Sv39 also requires high VA bits to sign-extend bit 38.

The animation demonstrates one page-table walk for the selected access type; SUM/MXR, implementation details of A/D-bit updates, and reserved-bit details are intentionally left out.

VA
39 bits
PA
56 bits
offset
12 bits
level
512 PTEs
satp.MODE
8
Page walk steps1 / 9parse

VA → PA

bit 63 → 0

PA is composed from the hit leaf PTE field and VA fields. PA = 0x000000002601189a

parse
L2
VA = VPN[...] | offset
VA
0x000000123456789a
sign [63:39]
VPN[2] [38:30]
VPN[1] [29:21]
VPN[0] [20:12]
offset [11:0]
0
63
0
0
0
0
0
0
0
56
0
0
0
0
0
0
0
0
48
0
0
0
0
0
0
0
0
40
0
0
0
1
0
0
1
0
32
0
0
1
1
0
1
0
0
24
0
1
0
1
0
1
1
0
16
0
1
1
1
1
0
0
0
8
1
0
0
1
1
0
1
0
0
VA.VPN -> PTE index path
VPN indexes page tables level by level; leaf PTE.PPN and VA offset directly form PA at the end
VPN indexes page tables level by level; leaf PTE.PPN and VA offset directly form PA at the end
PA[55:12]
not PA.PPN bits
L2
table[512]
VPN[2]
satp.PPN << 12 = 0x000014000000
0
1...
...511
PA
0
63
0
0
0
0
0
0
0
56
0
0
0
0
0
0
0
0
48
0
0
0
0
0
0
0
0
40
0
0
0
0
0
0
0
0
32
0
0
0
0
0
0
0
0
24
0
0
0
0
0
0
0
0
16
0
0
0
0
0
0
0
0
8
0
0
0
0
0
0
0
0
0

How To Read This

Start with the VA split

A program issues a virtual address. The MMU splits it into VPN fields and offset: VPN fields find page tables level by level, while the offset stays in the low PA bits.

Then let the PTE decide

Each level reads one PTE. An invalid entry faults; a non-leaf entry points to the next table; a leaf entry supplies the physical page number and permissions.

End at PA or page fault

A valid leaf PTE composes a PA. If the address form, PTE, permission, or superpage alignment rule fails, the walk stops at the matching fault step.

Paging Mode Structure Comparison

Shown by the current animation model
ModeVirtual addressPhysical addressLevelsVPN splitPTEsatp.MODE
Sv32
XLEN 32
32 bits
full RV32 VA
34 bits
2 levels
root level L1
VPN[1] 10VPN[0] 10off 12
32-bit
1024 entries/level, 4 KiB base page
1
Sv39
XLEN 64
39 bits
upper bits sign-extend bit 38
56 bits
3 levels
root level L2
VPN[2] 9VPN[1] 9VPN[0] 9off 12
64-bit
512 entries/level, 4 KiB base page
8
Sv48
XLEN 64
48 bits
upper bits sign-extend bit 47
56 bits
4 levels
root level L3
VPN[3] 9VPN[2] 9VPN[1] 9VPN[0] 9off 12
64-bit
512 entries/level, 4 KiB base page
9
Sv57
XLEN 64
57 bits
upper bits sign-extend bit 56
56 bits
5 levels
root level L4
VPN[4] 9VPN[3] 9VPN[2] 9VPN[1] 9VPN[0] 9off 12
64-bit
512 entries/level, 4 KiB base page
10

What happens after a page fault?

After a page-table walk stops at a page fault, privilege-architecture trap entry writes CSRs, dispatches a handler, and returns.

Learn Page Fault Trap