What is the Armv8 VMMU address range limit for 4K pages

Question

We need to be able to address something that is fixed at address 0x200-0000-0000 on an ARMv8 system that uses a hypervisor with VMMU that is configured with 4K page sizes. It appears to me that it is impossible to reach that address unless I switch to a 64K page size which will have bad implications elsewhere. Here is is the math - tell me if I am wrong somehow:

The root table has 512 entries and each one addresses up to a 0x4000-0000 range. 512 x 0x4000-0000 is 0x80-0000-0000 which falls short of the address that I need to reach. If someone knows a workaround without switching to 64K pages, I would like to know it. (The problem with 64K pages is that it is too broad to include and exclude memory and devices in a granular way, so we would like to avoid it).

Answer 1

MMU is not flat, it's multilevel hierarchical being...

So each level has 512 entries. When you set page size 4KB, that means lowest level consisting of 512 entries has physical addresses on 4KB pages.

Next upper level operates in 512 * 4KB = 2MB mappings. Respectively every entry (out of 512 entries in total) on this level could either map 2MB directly or point to list of 512 * 4KB entries.

And so on, eg next upper level is 512 * 2MB = 1GB with same functionality, either mapping a whole 1GB or pointing on lower level of 512 * 2MB.

Yes you could go even higher! But to reach desired 0x200-0000-0000, entries on 1GB level is good enough.

All you need now is to set translation configuration. In AArch64 it's TCR_EL1, Translation Control Register (EL1) register.
Particularly you need T1SZ, bits [21:16] and T0SZ, bits [5:0] fields.

For 512GB max memory size (eg 512 mmu entries by 1GB) field value should be 25.