When is execution legal?
At the supported XLEN, with H implemented: M/HS or V=0 U-mode with HU=1 may execute. V=0 U-mode with HU=0 raises illegal-instruction; V=1 raises virtual-instruction.
HLVX.WU
RISC-V HLVX.WU Instruction Details
Instruction ManualSYSTEM R-type fieldsHypervisor virtual-machine execute-permission word load; execute permission replaces read permission during translation.
Instruction Syntax
hlvx.wu rd, (rs1)
Operand Breakdown
H 1.0; RV32/RV64; 32-bit SYSTEM R-type fields, funct7=0110100, funct3=100, opcode=1110011.
rd=[11:7] receives the 32-bit load zero-extended to XLEN; rs1=[19:15] directly supplies the address. rs2=[24:20] is fixed to 00011, not a source register. No offset immediate.
M/HS or V=0 U-mode with HU=1 may execute; V=1 raises virtual-instruction, and V=0 U-mode with HU=0 raises illegal-instruction. SPVP=0/1 selects VU/VS access; HS SUM is ignored and MPRV does not alter the access.
Both translation stages check execute instead of read permission; final physical attributes, including PMP, still require read and execute. Exceptions remain load-style, and pointer masking does not apply.
Examples assume H is available, relevant modes use the same XLEN, pointer masking is disabled, and translation/protection succeeds. Misaligned completion depends on the execution environment.
HSystem & Privilege
Extension condition: H extension 1.0; RV32/RV64. V=0, in M/HS or U-mode with hstatus.HU=1.
Instruction Behavior
HLVX.WU is the H-extension virtual-machine load variant used for instruction-fetch emulation. It is like the corresponding HLV unsigned load except execute permission takes the place of read permission in both translation stages; the final physical memory attributes must allow both execute and read. It may execute in M-mode or HS-mode, or in U-mode when hstatus.HU=1. HLVX.WU is valid on RV32, where sign extension and zero extension of a 32-bit value are indistinguishable.
HLVX.WU Decode And Execute Animation
Shows HLVX.WU SYSTEM decoding, privilege checks, two-stage translation, and zero-extended writeback without modeling page walks or TLB implementation.
rd
rs1
hlvx.wu,()
Assumes H is implemented, relevant privilege modes use the same XLEN, and pointer masking is disabled. Input is an assembled memory value; the selector supplies the access outcome without validating page tables. rs1=x0 fixes address zero. Steps are teaching stages, not processor cycles.
31..25
24..20
19..15
14..12
11..7
6..0
0110100
funct7
00011
rs2=00011 (HLVX)
01011
rs1/address
100
PRIVM
01010
rd
1110011
SYSTEM
Architectural Data Path
instruction
0x6835C573
decode
funct7=0110100, rs2=00011, funct3=100, rd=01010 -> HLVX.WU
address
a1(x11) -> 0x0000000040001000 (no immediate offset)
privilege
HS: execution permitted
translation
VU effective privilege -> VS-stage -> G-stage; HS SUM ignored; MPRV is not used; HLVX requires execute permission in both stages and final physical read+execute permission
load
32-bit 0x80000001 -> zero-extend -> 0x0000000080000001
state
Architectural state is not committed; the final rd state is shown only at writeback.
Architectural state is not committed; the final rd state is shown only at writeback.
This animation shows only official architectural conditions and outcomes; page walks, TLBs, caches, and platform exception handling are not modeled.
Quick Understanding & Search Notes
Address=rs1 (no offset). Success: zero-extend the 32-bit load to XLEN into rd; rd=x0 discards only writeback.
SPVP=0/1 selects VU/VS. HS-level SUM is ignored; MPRV has no effect.
Both stages require execute instead of read permission; final PMA/PMP needs read and execute. Load-style exceptions; no pointer masking.
Common Usage Scenarios
Guest instruction-fetch emulation
RV64 H, HS-mode, SPVP=0, pointer masking off, address 0x1000 and a successful access: a1=0x1000 and assembled memory value=0x80000001; hlvx.wu a0, (a1) gives a0=0x0000000080000001. Both translation stages permit execute, and final physical attributes permit read and execute.
Pre-Use Checklist
Syntax Check
- H 1.0; RV32/RV64; 32-bit SYSTEM R-type fields, funct7=0110100, funct3=100, opcode=1110011.
- rd=[11:7] receives the 32-bit load zero-extended to XLEN; rs1=[19:15] directly supplies the address. rs2=[24:20] is fixed to 00011, not a source register. No offset immediate.
Semantic Check
- M/HS or V=0 U-mode with HU=1 may execute; V=1 raises virtual-instruction, and V=0 U-mode with HU=0 raises illegal-instruction. SPVP=0/1 selects VU/VS access; HS SUM is ignored and MPRV does not alter the access.
- Both translation stages check execute instead of read permission; final physical attributes, including PMP, still require read and execute. Exceptions remain load-style, and pointer masking does not apply.
- Examples assume H is available, relevant modes use the same XLEN, pointer masking is disabled, and translation/protection succeeds. Misaligned completion depends on the execution environment.
Pitfalls / Common Confusions
HLVX still raises load-style exceptions, not fetch exceptions.
HLVX does not override PMP; PMP execute-only memory can still cause an access fault.
Executing HLV/HLVX/HSV when virtualization mode V=1 raises a virtual-instruction exception.