REVIEW 3 major objections 5 minor 29 references
Advancing Cloud Computing Capabilities on gem5 by Implementing the RISC-V Hypervisor Extension
T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash
Pith's one-line read The paper claims gem5 v24.0 now boots the Xvisor hypervisor and a Linux guest under RISC-V virtualization via a full H-extension implementation.
desk verdict A real gem5 H-extension port with credible boot-level validation, but the functional-correctness claim outruns the tested subset and there's no artifact to check. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the two-stage page-table walker. In the redesigned walk(), the VS-stage walk through the guest page tables is interleaved with a G-stage walk using hgatp for every intermediate address, so that all guest-physical addresses are resolved to host-physical addresses before they are used. Around this sit the CSR machinery, including new registers, alias handling such as hvip reading through mip, and new write masks that keep read-only bits intact, plus the extended fault-handling path that delegates traps to M, HS, or VS depending on the active privilege level and delegation registers. New page-fault types, such as Load Guest Page Fault, and hypervisor load/store translations carry the two-stage behavior into the memory system.
What would settle it
Running the full riscv-hyp-tests suite, including the Sv39x4 two-stage translation cases and the hfence.gvma/hfence.vvma ordering tests, on this gem5 implementation and finding a single failed case, or booting Xvisor with a guest using a 4-level Sv39x4 page table and observing a wrong address translation or fault record, would refute the paper's functional-correctness claim.
Extended reading notes
Core claim
The central claim is that the H extension is functionally integrated into gem5 v24.0's RISC-V model. Concretely, the implementation adds the hypervisor CSRs such as hstatus, hgatp, vsatp, hideleg, hedeleg, hvip, and the virtual supervisor CSRs, handles hypervisor interrupts and traps with correct delegation, and performs two-stage translation: the guest virtual address is translated by vsatp to a guest physical address, and every guest physical address, including intermediate page-table addresses, is translated by hgatp to a host physical address. The authors further claim that this is enough for Xvisor to boot and for a Linux guest to run MiBench workloads, which they take as evidence of functional correctness. The implementation also modifies the TLB to store both guest and supervisor permission bits so that megapage and gigapage translations survive the second stage.
Load-bearing premise
The conclusion that benchmarking results confirm functional correctness of the H extension is only as strong as the tested subset: a selection of riscv-hyp-tests plus a single Xvisor/Linux boot on the atomic CPU, so any untested part of the specification could be wrong while all reported tests pass.
Editorial extensions
If this is right
- gem5 can now bootstrap a full RISC-V virtualization stack, Xvisor plus guest Linux, and run guest workloads, so researchers can study H-extension behavior without patching a simulator from scratch.
- The measured guest overhead, 30-100% more simulation time and single-digit-percent increases in executed instructions across MiBench, provides a baseline for future H-extension optimizations in gem5.
- New page-fault types and the TLB change that stores both guest and supervisor permission bits become part of gem5's RISC-V model, affecting all subsequent full-system RISC-V simulations.
- The authors' roadmap, covering all virtual address sizes, all CPU models, and KVM support, is a direct extension of this work and is expected to reuse the same CSR and translation infrastructure.
Reading between the lines
- Beyond the paper's reported tests, the functional-correctness claim is narrower than it sounds because validation covers a subset of riscv-hyp-tests plus one Xvisor/Linux boot; untested behaviors such as Sv39x4 translation, hfence ordering, and VMID handling could still be wrong.
- Because the benchmarks run on gem5's atomic CPU, the overhead numbers reflect instruction-stream effects rather than cycle-accurate performance, and detailed CPU models will likely show a different slowdown profile.
- A natural next experiment, not reported in the paper, is to measure TLB miss rates and nested-walk traffic under the two-stage translation, since the TLB modifications are the main microarchitectural change.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper reports an implementation of the RISC-V H (hypervisor) extension in gem5 v24.0. The implementation covers hypervisor CSRs and their aliasing and write-masking (Section 3.1), exception and interrupt handling with delegation to HS and VS modes (Section 3.2), and two-stage address translation driven by vsatp and hgatp together with hypervisor load/store instructions (Section 3.3). Validation in Section 3.4 uses a listed subset of the external riscv-hyp-tests suite (tinst, wfi, hfence, virtual-instruction, interrupt, CSR-aliasing, one-stage, and two-stage translation tests) plus a full-system boot of the Xvisor type-1 hypervisor running a Linux guest. Section 4 evaluates nine MiBench workloads natively and in the guest, reporting host simulation time, executed instruction counts, and exception counts per privilege level. Section 6 concludes that 'benchmarking results confirm the functional correctness of the H extension' and identifies future work: all ISA-compliant address sizes, all gem5 CPU types, and KVM support.
Significance. If the implementation is correct, this paper fills a real gap: upstream gem5 had no RISC-V H-extension support, which limited full-system virtualization studies in a widely used simulator. The strengths are concrete and should be credited. The validation is anchored to the externally maintained riscv-hyp-tests suite [4] rather than to self-written microbenchmarks, the Xvisor boot with a Linux guest exercises two-stage address translation, CSR delegation, and guest interrupts end to end, and the evaluation is a direct measurement with no fitted model or free parameters. The paper is also candid about its scope, deferring all address sizes and all CPU types to future work in Section 6. The weaknesses are the breadth of the functional-correctness claim relative to the tested subset, the under-specified support for x4 G-stage modes, the missing code artifact, and the conflation of simulator cost with architectural overhead in Section 4.1; all four are fixable without changing the paper's approach.
major comments (3)
- [§3.3, §3.4, §6] Section 6 states that 'benchmarking results confirm the functional correctness of the H extension', but the evidence in Section 3.4 covers only the listed test subset, and the implementation description leaves a load-bearing ambiguity about G-stage translation modes. Section 3.3 says hgatp uses modes 'such as Sv39 and Sv39x4 respectively' and that the guest physical address is widened by 2 bits, but the next paragraph states '(gem5 supports only Sv39)' and never confirms that the redesigned walker implements the x4 modes; if the G-stage walk treats the guest physical address as a 39-bit quantity, translations of guest physical addresses at or above 2^39 are silently wrong, and the reported two-stage tests would not detect this unless they allocate memory in that range. In addition, the hfence_tests bullet in Section 3.4 covers only fences 'affecting only the guest TLB entries', so there is no reported evidence about the hfence.vvma/hfence.gvma distinction, VMID-indexed invalidation, or global-bit semantics, and the HLVX execute-permission path described in Section 3.3 is not exercised by any reported test. Since Section 6 itself defers 'all ISA-compliant virtual address sizes' and 'all CPU types in gem5' to future work, the correctness claim should be scoped to the implemented and tested configuration. To support the current claim, the authors should state explicitly which vsatp/hgatp modes the walker implements, report which modes the two-stage tests used, and either add a targeted test with guest physical memory above the 39-bit boundary or remove the unqualified correctness statement.
- [§3.4, §6] No code artifact is provided and the test configuration is under-specified. The manuscript gives no repository URL, gem5 commit hash, or patch, and Section 6 refers to 'our open-source implementation' only as a plan ('we plan to use our open-source implementation'), so the central contribution cannot be checked or reused. Section 3.4's bullet list names test categories but gives no test counts, no pass/fail summary, and no revision or tag of the riscv-hyp-tests repository [4]. Please supply a public artifact with a pinned commit, the exact gem5 configuration used for the Xvisor boot (device tree, memory map, CPU type), and the full list of tests with pass counts.
- [§4.1, §4.2, Abstract] Section 4.1 reports host wall-clock simulation seconds as 'the time overhead induced by the guest OS' and interprets the 30-100% slowdown as execution-time overhead. Because all measurements use the atomic CPU, which has no timing model, this slowdown is dominated by gem5's own cost of performing two-stage page-table walks in the functional model, not by an architectural performance impact of virtualization; the numbers would not transfer to the detailed CPU models that the introduction describes as the paper's target. Please reframe Section 4.1 as a measurement of simulator cost (reporting simulated instruction counts or simulated ticks alongside host time would make the comparison more robust), and adjust the phrases 'increase in execution time' in Section 4.1 and 'performance impact of the extension' in the abstract accordingly.
minor comments (5)
- [§3.3] The file paths 'arc/riscv/memflags.hh::XlateFlags', 'arc/riscv/isa/decoder.isa', and 'arc/riscv/isa/formats/mem.isa' each misspell the arch directory as 'arc'; correct them to 'arch/riscv/...'.
- [§3.4] In the check_xip_regs bullet, 'the encryption of some of their bit fields' presumably means masking or aliasing of bits; please reword, and report the number of tests run and how many passed for each bullet.
- [§2.1, §5] The phrase 'recently introduced and ratified' in the introduction conflicts with the December 2021 ratification date cited in Section 5; please give the ratified version number so readers know which spec revision was implemented.
- [§3.2] The interrupt-priority discussion cites the AIA document [5] without stating the ordering used for the new hypervisor interrupt bits; a sentence specifying the implemented priority order would make the interrupt_tests results interpretable.
- [Figure 4] The blue slowdown line in Figure 4 is hard to read against the left axis; report the numerical slowdown values in the text as well as in the figure.
Circularity Check
No significant circularity: the implementation is validated against the external RISC-V privileged specification and the independent riscv-hyp-tests suite, and the results are direct measurements rather than fitted predictions.
full rationale
This paper is an engineering and evaluation report, not a derivation with fitted inputs. The H-extension behavior is implemented from the externally maintained RISC-V privileged specification (reference [7]), and the validation in Section 3.4 uses the independent riscv-hyp-tests suite (reference [4]) plus a boot of the Xvisor hypervisor with a guest Linux. The reported overhead results in Section 4 are direct gem5 measurements of simulation time, executed instructions, and exception counts, so no quantity is 'predicted' from a parameter fitted to a subset of the same data. The only self-citation, reference [15], concerns accelerator design-space exploration and appears in the related-work section; it is not load-bearing for the implementation or validation. The broad 'functional correctness' statement in Section 6 is broader than the tested subset, since the validation covers only the atomic CPU, Sv39, and nine MiBench workloads, and some mandatory H-extension paths may be untested. However, that is a limitation in evidence coverage, not circularity: the checks used are external to the implementation, and an untested wrong path would cause the reported tests to pass without the derivation reducing to its own inputs. There is no step in which an equation, result, or benchmark outcome is equivalent by construction to a fitted input or to a self-citation chain.
Assumptions & free parameters
assumptions (3)
- domain assumption The RISC-V privileged architecture specification (version 20240411) correctly defines the behavior of the H extension.
- domain assumption The gem5 atomic CPU and modified TLB/page-table walker faithfully model the architectural semantics of two-stage address translation.
- domain assumption The riscv-hyp-tests suite and the Xvisor/Linux boot constitute adequate conformance evidence for the H extension.
Cite this review
Pith. "Pith review of Advancing Cloud Computing Capabilities on gem5 by Implementing the RISC-V Hypervisor Extension." pith.science (2026). https://pith.science/paper/F6GCKMHU
@misc{pith2026241112444,
author = {Pith},
title = {Pith review of: Advancing Cloud Computing Capabilities on gem5 by Implementing the RISC-V Hypervisor Extension},
year = {2026},
howpublished = {\url{https://pith.science/paper/F6GCKMHU}},
note = {Machine review of arXiv:2411.12444}
}
read the original abstract
This paper presents the implementation and evaluation of the H (hypervisor) extension for the RISC-V instruction set architecture (ISA) on top of the gem5 microarchitectural simulator. The RISC-V ISA, known for its simplicity and modularity, has seen widespread adoption in various computing domains. The H extension aims to enhance RISC-V's capabilities for cloud computing and virtualization. In this paper, we present the architectural integration of the H extension into gem5, an open-source, modular platform for computer system architecture research. We detail the modifications required in gem5's CPU models and virtualization support to accommodate the H extension. We also present evaluation results regarding the performance impact and functional correctness of the extension's implementation on gem5. This study not only provides a pathway for further research and development of RISC-V extensions but also contributes valuable insights into the optimization of the gem5 simulator for advanced architectural features.
Figures
Figures from the paper (3 more)
Reference graph
Works this paper leans on
-
[4]
Unit tests for RISC-V Hypervisor extension
2020. Unit tests for RISC-V Hypervisor extension. https://github.com/ josecm/riscv-hyp-tests. Accessed: 2024-07-30
work page 2020
-
[1]
2003. gem5 GitHub Repository. https://github.com/gem5/gem5. Ac- cessed: 2024-07-30
work page 2003
-
[2]
Xvisor: an open-source bare-metal monolithic hypervisor
2011. Xvisor: an open-source bare-metal monolithic hypervisor. https: //xhypervisor.org. Accessed: 2024-07-30
work page 2011
-
[3]
2011. Xvisor GitHub Repository. https://github.com/xvisor/xvisor. Accessed: 2024-07-30
work page 2011
-
[5]
RISC-V Advanced Interrupt Architecture (AIA)
2021. RISC-V Advanced Interrupt Architecture (AIA). https://github. com/riscv/riscv-aia
work page 2021
-
[6]
The RISC-V Instruction Set Manual Volume I: Un- privileged ISA
2024. The RISC-V Instruction Set Manual Volume I: Un- privileged ISA. https://drive.google.com/file/d/1uviu1nH- tScFfgrovvFCrj7Omv8tFtkp/view?usp=drive_link Document Version 20240411, Accessed: 2024-07-30
work page 2024
-
[7]
The RISC-V Instruction Set Manual Volume II: Privileged Archi- tecture
2024. The RISC-V Instruction Set Manual Volume II: Privileged Archi- tecture. https://drive.google.com/file/d/17GeetSnT5wW3xNuAHI95- SI1gPGd5sJ_/view?usp=drive_link Document Version 20240411, Ac- cessed: 2024-07-30
work page 2024
-
[8]
RISC-V Open Source Supervisor Binary Interface (OpenSBI)
2024. RISC-V Open Source Supervisor Binary Interface (OpenSBI). https://github.com/riscv-software-src/opensbi. Accessed: 2024-07-30
work page 2024
Show all 29 references
-
[9]
Spike RISC-V ISA Simulator
2024. Spike RISC-V ISA Simulator. https://github.com/riscv-software- src/riscv-isa-sim. Accessed: 2024-07-30
2024
-
[10]
The Linux Kernel Archives
2024. The Linux Kernel Archives. https://www.kernel.org. Accessed: 2024-07-30
2024
-
[11]
Barr, Alan L
Thomas W. Barr, Alan L. Cox, and Scott Rixner. 2010. Translation caching: skip, don’t walk (the page table). In Proceedings of the 37th Annual International Symposium on Computer Architecture (Saint-Malo, France) (ISCA ’10). Association for Computing Machinery, New York, NY, U...
2010
-
[12]
Fabrice Bellard. 2005. QEMU, a fast and portable dynamic translator.. In USENIX annual technical conference, FREENIX Track, Vol. 41. California, USA, 10–5555
2005
-
[13]
Ravi Bhargava, Benjamin Serebrin, Francesco Spadini, and Srilatha Manne. 2008. Accelerating two-dimensional page walks for virtualized systems. In Proceedings of the 13th International Conference on Architec- tural Support for Programming Languages and Operating Systems (Seat-...
2008
-
[14]
Rein- hardt, Ali Saidi, Arkaprava Basu, Joel Hestness, Derek R
Nathan Binkert, Bradford Beckmann, Gabriel Black, Steven K. Rein- hardt, Ali Saidi, Arkaprava Basu, Joel Hestness, Derek R. Hower, Tushar Krishna, Somayeh Sardashti, Rathijit Sen, Korey Sewell, Muhammad Shoaib, Nilay Vaish, Mark D. Hill, and David A. Wood. 2011. The Gem5 Simul...
2011
-
[15]
Odysseas Chatzopoulos, George Papadimitriou, Vasileios Karakostas, and Dimitris Gizopoulos. 2023. Enabling Design Space Exploration of RISC-V Accelerator-rich Computing Systems on gem5. https://api. semanticscholar.org/CorpusID:270493978
2023
-
[16]
Enfang Cui, Tianzheng Li, and Qian Wei. 2023. RISC-V Instruction Set Architecture Extensions: A Survey. IEEE Access 11 (2023), 24696–24711. https://doi.org/10.1109/ACCESS.2023.3246491
2023
-
[17]
Xiaoning Ding and Jianchen Shan. 2015. Diagnosing Virtualization Overhead for Multi-threaded Computation on Multicore Platforms. In 2015 IEEE 7th International Conference on Cloud Computing Technology and Science (CloudCom). 226–233. https://doi.org/10.1109/CloudCom. 2015.102
2015 doi
-
[18]
Jaume Gauchola, JuanJosé Costa, Enric Morancho, Ramon Canal, Xavier Carril, Max Doblas, Beatriz Otero, Alex Pajuelo, Eva Rodríguez, Javier Salamero, and Javier Verdú. 2024. Hypervisor Extension for a RISC-V Processor. arXiv:2406.17796 [cs.AR] https://arxiv.org/abs/ 2406.17796
2024 arXiv
-
[19]
Akanksha Gaur. 2024. RISC-V Open-Source Architecture Redefining The Future Of Computing. https://www.opensourceforu.com/ 2024/01/risc-v-open-source-architecture-redefining-the-future-of- computing/. Accessed: 2024-07-30
2024
-
[20]
Guthaus, J.S
M.R. Guthaus, J.S. Ringenberg, D. Ernst, T.M. Austin, T. Mudge, and R.B. Brown. 2001. MiBench: A free, commercially representative embedded benchmark suite. In Proceedings of the Fourth Annual IEEE International Workshop on Workload Characterization. WWC-4 (Cat. No.01EX538) . ...
2001
-
[21]
Peter Yuen Ho Hin, Xiongfei Liao, Jin Cui, Andrea Mondelli, Thannir- malai Muthukaruppan Somu, and Naxin Zhang. 2021. Supporting RISC-V full system simulation in gem5. In Proc. Workshop Comput. Architect. Res. RISC-V
2021
-
[22]
Jason Lowe-Power, Abdul Mutaal Ahmad, Ayaz Akram, Mohammad Alian, Rico Amslinger, Matteo Andreozzi, Adrià Armejach, Nils As- mussen, Brad Beckmann, Srikant Bharadwaj, Gabe Black, Gedare Bloom, Bobby R. Bruce, Daniel Rodrigues Carvalho, Jeronimo Castril- lon, Lizhong Chen, Nico...
2020 arXiv
-
[23]
Watheq El- Kharashi
Anup Patel, Mai Daftedar, Mohamed Shalan, and M. Watheq El- Kharashi. 2015. Embedded Hypervisor Xvisor: A Comparative Analysis. In 2015 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing. 682–691. https://doi.org/10.1109/PDP. 2015.108
2015 doi
-
[24]
Avi Qumranet, Yaniv Qumranet, Dor Qumranet, Uri Qumranet, and Anthony Liguori. 2007. KVM: The Linux virtual ma- chine monitor. Proceedings Linux Symposium 15 (01 2007). https://www.kernel.org/doc/ols/2007/ols2007v1-pages-225-230.pdf
2007
-
[25]
Bruno Sá, José Martins, and Sandro Pinto. 2021. A First Look at RISC-V Virtualization from an Embedded Systems Perspective. arXiv:2103.14951 [cs.AR] https://arxiv.org/abs/2103.14951
2021 arXiv
-
[26]
Bruno Sá, José Martins, and Sandro Pinto. 2022. A First Look at RISC-V Virtualization From an Embedded Systems Perspective. IEEE Trans. Comput. 71, 9 (2022), 2177–2190. https://doi.org/10.1109/TC.2021. 3124320
2022 doi
-
[27]
Bruno Sá, Luca Valente, José Martins, Davide Rossi, Luca Benini, and Sandro Pinto. 2023. CVA6 RISC-V Virtualization: Architecture, Microar- chitecture, and Design Space Exploration. arXiv:2302.02969 [cs.AR] https://arxiv.org/abs/2302.02969
2023 arXiv
-
[28]
Guan Tong, Hai Jin, Xia Xie, Wenzhi Cao, and Pingpeng Yuan. 2011. Measuring and Analyzing CPU Overhead of Virtualization System. In 2011 IEEE Asia-Pacific Services Computing Conference . 243–250. https: //doi.org/10.1109/APSCC.2011.40
2011 doi
-
[29]
Yinan Xu, Zihao Yu, Dan Tang, Guokai Chen, Lu Chen, Lingrui Gou, Yue Jin, Qianruo Li, Xin Li, Zuojun Li, Jiawei Lin, Tong Liu, Zhigang Liu, Jiazhan Tan, Huaqiang Wang, Huizhe Wang, Kaifan Wang, Chuanqi CARRV ’24, November 2024, Austin, Texas, USA Fragkoulis et al. Zhang, Fawan...
2024
Reviewed August 12, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.