Memory Address Translation

Memory address translation is a separate pipeline after effective-address calculation. Effective-address evaluation produces an address value or operand designator; segmentation optionally turns that value into a linear address, and paging optionally turns the linear address into a memory-system address.

Instruction fetches use CS, stack accesses use SS, and ordinary data accesses use the operation default data segment unless an effective-address form explicitly selects another segment. SP and PC forms use their fixed segments.

SEGLEA exposes the linear address produced by segment pre-translation when software explicitly needs it. Its instruction description defines the point check, FLAGS result, destination suppression, and auto-update commit behavior. SEGLEA applies segment pre-translation to the computed starting point.

Address Translation Pipeline

Segment Pre-Translation

Segment pre-translation interprets the selected 64-bit segment image before paging. The segment fields, derived quantities, and image-validity condition are defined in Segment Registers. A disabled segment passes the effective address through. An enabled segment either checks the effective address as an offset and adds the base, or checks an already-linear address in bounds-only mode.

Segment Pre-Translation Modes

Mode	Segment State	Check	Linear Address
disabled	SEGMENT.M=0	no segment-window check	linear = EA
translated window	SEGMENT.M!=0, SEGMENT.B=0	complete byte range lies within \(0 \le \mathrm{EA}<\mathrm{span}\)	linear = base + EA
bounds-only window	SEGMENT.M!=0, SEGMENT.B=1	complete byte range lies within \(\mathrm{base}\le\mathrm{EA}<\mathrm{limit}\)	linear = EA

Address validation begins by forming the starting EA and its segment-pretranslated linear value. The starting point must be within the selected segment. With paging enabled, the complete byte range is translated in increasing linear-address order after canonicality checks. With paging disabled, the same byte-range rules apply directly.

Complete range additions are mathematical: 64-bit wraparound never makes an out-of-range access valid. A range failure raises SEGMENT_BOUNDS_VIOLATION before the instruction's target memory access begins.

The segment result is the linear address. With PTCR.PE set, the page-table walker consumes that address and applies the selected PTE frame and attributes. With paging disabled, the linear address is the physical byte address and must fit PABITS. An out-of-range direct address raises PHYSICAL_ADDRESS_FAULT. An invalid segment image raises INVALID_CONTROL_IMAGE when written; a failed segment bound or canonical-address check raises SEGMENT_BOUNDS_VIOLATION or NONCANONICAL_ADDRESS, respectively, during access.

Paging Stage

Paging is enabled by PTCR.PE and translates the linear address produced by segment pre-translation. Before the walk can produce a translation, the linear address must be canonical for the translation-table format selected by PTCR.TT. A noncanonical address raises NONCANONICAL_ADDRESS. With paging disabled, the memory system uses the linear address directly and does not interpret PTCR.TT or PTCR.ROOT_PAGE.

Every page-table entry is one naturally aligned 64-bit descriptor. L4, L3, and L2 are 16-KiB-aligned table objects containing 2048 entries selected by an 11-bit address field. L1 is a 4-KiB-aligned table object containing exactly 512 entries selected by a nine-bit address field. For a table-object base address \(B\) and index \(i\), the selected entry is always at \(B+8i\). PTEs are a dense array of eight-byte descriptors; an L1 object has no architecturally unreachable trailing storage.

The walker starts at the 16-KiB-aligned physical table object named by PTCR.ROOT_PAGE for the selected format. At each active level, a present selected entry with PTE.T=1 supplies PTE.NEXT_TABLE, the exact base address of the next table object; this form is valid only above L1. An L4-to-L3 or L3-to-L2 transition requires a 16-KiB-aligned target. An L2-to-L1 transition requires only a 4-KiB-aligned target, so the walker preserves PTE.NEXT_TABLE[13:12] for that transition. A selected entry with PTE.T=0 terminates the walk as a byte-addressed leaf. Define the number of low linear-address bits supplied by a leaf at level \(L\) as \(o(L1)=14\), \(o(L2)=23\), \(o(L3)=34\), and \(o(L4)=45\). The leaf PTE.PFN supplies a naturally aligned physical base, and the final byte address is:

\[\mathit{byte\_address} = (\mathit{leaf\_PFN} \ll 14) \mathbin{|} \mathit{linear}[o(L)-1:0].\]

The resulting L1 through L4 leaf sizes are 16 KiB, 8 MiB, 16 GiB, and 32 TiB. Bit 7 is PTE.A in both descriptor layouts and does not participate in address formation.

Software may place up to four independent L1 objects in one 16-KiB physical backing frame, including objects belonging to different roots or ASIDs in the same supervisor-owned physical-memory domain. Such co-location does not combine address-space permissions: each table pointer and leaf continues to govern its own subtree or mapping. A backing frame is used only for L1 storage while any of its four slots is live. Slot allocation, ownership, zeroing before linking, reference counting, and reclamation are software responsibilities. Independently protected physical ownership domains may use separate allocator pools without changing the descriptor format. Software may instead allocate every L1 object at a 16-KiB-aligned address by keeping PTE.NEXT_TABLE[13:12]=00; every conforming walker must nevertheless accept all four 4-KiB-aligned L1 positions.

The walker intersects table-pointer PTE.R/PTE.W/PTE.X/PTE.U fields while descending. The terminating leaf supplies decoded PTE.AM permissions, PTE.U, the final PTE.PFN, PTE.G, PTE.CP, and the Normal/MMIO class. The detailed entry-validity, permission, accessed, and dirty rules are specified under Page-Table Entry Format. At each consumed level, result priority is not-present first, structural validity second, and effective permission third; the walker resolves those results before consuming a lower level.

Linear-Address Paging Fields

LA45 Three-Level Paging

When PTCR.TT is 010, bits 63..45 of the linear address must equal the sign extension of bit 44. Bits 44..34, 33..23, and 22..14 select the L3, L2, and L1 entries respectively. A byte-addressed leaf may terminate the walk at any of those levels and uses the level-specific offset defined by the Paging Stage. The L3 table is the root table named by PTCR.ROOT_PAGE.

LA45 Three-Level Page Walk

LA56 Four-Level Paging

When PTCR.TT is 011, bits 63..56 of the linear address must equal the sign extension of bit 55. Bits 55..45 select an additional L4 entry. A table pointer continues into the same L3-through-L1 hierarchy used by LA45, while a byte-addressed leaf at any selected level terminates the walk and uses the level-specific offset defined by the Paging Stage. The L4 table is the root table named by PTCR.ROOT_PAGE.

LA56 Four-Level Page Walk

Page-Table Entry Format

Every page-table entry is one naturally aligned 64-bit descriptor. A leaf owns PTE.PFN[55:14], while a table pointer owns PTE.NEXT_TABLE[55:12]. Both layouts therefore have a 56-bit architectural physical-address ceiling. An implementation reports its exact PABITS value, from 32 through 56, through CPUID ADDRESS_WIDTHS. In a present descriptor, bits of the layout-selected physical-address field at or above that value must be zero. Bits 57..56 are PTE.SW[1:0] and are ignored by hardware; bits 63..58 are reserved and must be zero.

P in bit 0 is common. When PTE.P=0, the remaining bits are ignored and the entry is not present. When PTE.P=1, T in bit 1 selects the leaf or table-pointer layout. A nonzero reserved bit in a present descriptor raises MALFORMED_PAGE_TABLE_ENTRY.

Leaf Descriptor Fields (PTE.P=1, PTE.T=0)

Field	Bits	Meaning
PTE.P	0	present, one
PTE.T	1	leaf selector, zero
AM	4..2	permission and Normal/MMIO access class
U	5	user-domain permission
G	6	global translation
A	7	accessed state
D	8	exact dirty state
CP	10..9	cache policy
reserved	13..11	must be zero
PFN	55..14	mapped physical frame number
SW[1:0]	57..56	software-defined, ignored by hardware
reserved	63..58	must be zero

Leaf PTE.AM Encodings

PTE.AM	Permission	Class	Name
000	read	Normal	R
001	write	Normal	W
010	execute	Normal	X
011	read/write	Normal	RW
100	read/execute	Normal	RX
101	read	MMIO	MMIO_R
110	write	MMIO	MMIO_W
111	read/write	MMIO	MMIO_RW

No leaf encoding grants both write and execute, and no MMIO leaf grants execute. This W^X property applies to one selected translation. The architecture does not compare aliases: distinct descriptors for the same physical page may have different permissions, PTE.AM classes, or PTE.CP values.

Table-Pointer Descriptor Fields (PTE.P=1, PTE.T=1)

Field	Bits	Meaning
PTE.P	0	present, one
PTE.T	1	table-pointer selector, one
R/W/X	2/3/4	subtree maximum permissions
PTE.U	5	subtree maximum user-domain permission
reserved	6	must be zero
PTE.A	7	accessed state
reserved	11..8	must be zero
NEXT_TABLE	55..12	physical base address of the next table object
PTE.SW[1:0]	57..56	software-defined, ignored by hardware
reserved	63..58	must be zero

A table pointer with PTE.R=PTE.W=PTE.X=0, or a table pointer at L1, is malformed. An L4-to-L3 or L3-to-L2 pointer targets a 16-KiB table object and is malformed when PTE.NEXT_TABLE[13:12] is nonzero. An L2-to-L1 pointer targets a 4-KiB table object and may use all four values of those bits. Every walker, PTQUERY implementation, and page-walk cache preserves the complete PTE.NEXT_TABLE value while descending. The walker begins with PTE.R, PTE.W, PTE.X, and PTE.U enabled, intersects each table bitmap and PTE.U bit, then intersects the terminating leaf's decoded PTE.AM permissions and PTE.U bit. The leaf alone supplies PTE.G, PTE.CP, and Normal/MMIO class. An L1, L2, L3, or L4 leaf must have a physical base aligned to \(2^{14}\), \(2^{23}\), \(2^{34}\), or \(2^{45}\) bytes respectively.

The PTE.CP field is orthogonal to PTE.AM: all 32 PTE.AM/PTE.CP combinations are structurally valid. PTE.CP values 0 through 3 mean cacheable write-back, coherent uncacheable, coherent write-through, and coherent write-combining respectively. PTE.CP never weakens an MMIO execution rule.

Hardware sets PTE.A on each structurally valid descriptor consumed by a completed walk and may also set PTE.A during a speculative walk whose instruction later faults or is squashed. In that latter case, PTE.A is an imprecise, PTE-owned usage hint; it is not instruction progress, restart state, or generic continuation state. PTE.D is set only when the corresponding store or atomic update commits, and every required PTE.D update succeeds before its memory update becomes visible. Hardware PTE.A/PTE.D changes are conditional atomic updates of the complete 64-bit PTE and preserve every other field. A concurrent change causes a re-read and complete revalidation; stale fields are never written back. PTQUERY and VTOP do not modify PTE.A or PTE.D.

Translation-Cache Identity and Invalidation

A translation-cache entry is identified by the components below, including the leaf-aligned linear range that it maps. Translation-cache identity excludes PTCR.ROOT_PAGE. While ASCR.AE is one, system software binds one ASCR.ASID to one PTCR root and translation-table format; it completes the required shootdown before reusing that ASCR.ASID for a different PTCR image. While ASCR.AE is zero, the current untagged context is invalidated when PTCR changes.

No translation-cache entry may be interpreted under a different PTCR.TT value from the one that produced it.

Translation-Cache Entry Identity

Identity Component	Applies To
leaf-aligned linear mapping range	every entry
PTCR.TT	every entry
ASCR.ASID	non-global entry while ASCR.AE is one

Local Translation-Cache Transitions

Operation	Non-Global Entries	Global Entries
WRCR with changedPTCR.ROOT_PAGE	invalidate all current untagged entries when ASCR.AE is zero; when ASCR.AE is one software must invalidate the ASCR.ASID before rebinding it	preserve only mappings whose complete leaf attributes are identical in every context
WRCR with changedPTCR.TT	invalidate entries using the old translation-table format	invalidate entries using the old translation-table format
WRCR changingASCR.ASIDwhileASCR.AEremains one	select the new ASCR.ASID-tagged entries	preserve
WRCR changingASCR.AE	invalidate the old untagged context or select the new tagged context as applicable	preserve
SWPT	install PTCR and invalidate the current untagged context	preserve only identical global mappings
SWPTA	install PTCR and ASCR and select the new ASCR.ASID-tagged context	preserve only identical global mappings
INVPAGE	invalidate every mapping containing the addressed linear value for the current ASCR.ASID, or the current untagged context when ASCR.AE is zero	invalidate every addressed global mapping containing that linear value
INVASID	invalidate every entry tagged with the selected ASCR.ASID	preserve
INVTLB	invalidate every local entry	invalidate every local entry

Remote Translation Shootdown Protocol

Step	Required Action
1	PTE store
2	AFENCE
3	local invalidate
4	release shootdown request
5	target acquire and local invalidate
6	target release acknowledgement
7	updater acquire of every acknowledgement
8	AFENCE
9	reclaim or reuse

A global leaf ignores ASID matching. Its PTE.PFN, effective permissions, PTE.AM, and PTE.CP attributes must be identical in every context in which that global entry can be used. Changing any of those attributes requires invalidating the global entry on every target logical processor.

The page-table walker reads page tables as PTE.CP=0 coherent normal memory. Each 64-bit PTE read observes one coherence version; it does not combine fields from different writes. An in-progress walk may complete with the old or new coherence version, so the updater does not reclaim the old mapping until the complete shootdown protocol finishes. The local invalidation instructions affect only the executing logical processor; the request and acknowledgement steps are ordinary shared-memory communication ordered by the stated release, acquire, and AFENCE operations.

Leaf Byte Addresses and Access Ranges

Every leaf at level \(L\) forms a byte address from PTE.PFN, where \(o(L1)=14\), \(o(L2)=23\), \(o(L3)=34\), and \(o(L4)=45\): $\(\mathit{byte\_address} = (\text{\hyperref[pte-field:base-memory-translation-pte-pfn]{\texttt{PTE.\allowbreak{}PFN}}}\ll14)\mathbin{|}\mathit{linear}[o(L)-1:0].\)$ A width-\(n\) access covers the half-open byte interval \([a,a+n)\). Bit 7 records PTE.A and may be set by an ordinary walk. Atomics require natural byte alignment; a misaligned operand raises ATOMIC_ALIGNMENT before the memory read or write. PTQUERY returns the raw selected descriptor, while VTOP reports the translated byte address; neither instruction modifies PTE.A or PTE.D.

Physical Class and MMIO Accesses

The platform assigns each physical address an authoritative Normal or Device class. A Normal leaf selecting Device physical memory raises MEMORY_TYPE_FAULT. A MMIO leaf may select either physical class and imposes MMIO rules; paging-disabled Device accesses also use those rules. Paging-disabled Normal addresses are Normal accesses.

A permitted MMIO operation is one naturally aligned scalar load or store of 1, 2, 4, or 8 bytes. All complete-range and translation checks finish before one architectural MMIO event is produced, and that event is not split. A permitted scalar that is misaligned raises MMIO_ALIGNMENT_FAULT. Atomic, read-modify-write, repeated, and every other operation that is not one permitted scalar load or store raise UNSUPPORTED_MMIO_OPERATION before alignment is considered and before any target effect. A prefetch to MMIO is a no-op. Instruction fetch is never permitted from MMIO.

Within one memory operand, failures are selected in this order: segment range and wrap, canonicality, complete translation of all covered mappings in increasing address order, physical memory class, MMIO operation class, MMIO or atomic alignment, then the target access and bus fault. Thus a later mapping's translation fault precedes an MMIO condition already visible in an earlier mapping.

Multi-Page Accesses

For a byte range that intersects more than one distinct leaf mapping, translation and accumulated permission checks are resolved once per mapping in increasing linear-address order. Each mapping's walk reaches its existing not-present, structural-validity, and permission result before the next mapping is consumed. The first mapping in that order that fails supplies the architectural fault and walk level.

Every covered leaf mapping of a store is validated before any byte of the store becomes visible. A later-mapping translation, permission or synchronous data-access fault leaves every destination byte and every leaf PTE.D bit unchanged. PTE.A updates completed while consuming an earlier valid entry retain the speculative-A rule and may remain set when a later mapping faults.

Instruction-record fetch uses the same increasing-address rule for all bytes required by the encoded record. A fault in a later mapping completes as an instruction-fetch fault before decode or operand evaluation, while earlier instruction-cache and PTE.A effects retain their ordinary rules.