破案了，原因是U74的MMU行为和QEMU的MMU是不一样的，xv6根本没有考虑到这种情况
Two schemes to manage the A and D bits are permitted:
• When a virtual page is accessed and the A bit is clear, or is written and the D bit is clear, a page-fault exception is raised.
• When a virtual page is accessed and the A bit is clear, or is written and the D bit is clear, the corresponding bit(s) are set in the PTE. The PTE update is atomic with respect to other accesses to the PTE, and memory access will not occur until the PTE update is visible globally.For non-leaf PTEs, the D, A, and U bits are reserved for future use and must be cleared by software for forward compatibility. It is important to note the U7 does not automatically set the accessed (A) and dirty (D) bits in a Sv39 Page Table Entry (PTE). Instead, the U7 MMU will raise a page fault exception for a read to a page with PTE.A=0 or a write to a page with PTE.D=0.
本质上就是PTE_A和PTE_D是用来跟踪使用过的page，不过U7不会自动更新这两个bit，而是让软件来维护。所以你xv6需要把 leaf-PTE 全部都加上PTE_A | PTE_D 不然直接就page-fault寄了