1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
|
\chapter{Control and Status Registers (CSRs)}
The SYSTEM major opcode is used to encode all privileged instructions
in the RISC-V ISA. These can be divided into two main classes: those
that atomically read-modify-write control and status registers (CSRs),
and all other privileged instructions. In addition to the user-level
state described in Volume I of this manual, an implementation may
contain additional CSRs, accessible by some subset of the privilege
levels using the CSR instructions described in the user-level manual.
In this chapter, we map out the CSR address space. The following
chapters describe the function of each of the CSRs according to
privilege level, as well as the other privileged instructions which
are generally closely associated with a particular privilege level.
Note that although CSRs and instructions are associated with one
privilege level, they are also accessible at all higher privilege
levels.
\section{CSR Address Mapping Conventions}
The standard RISC-V ISA sets aside a 12-bit encoding space (csr[11:0])
for up to 4,096 CSRs. By convention, the upper 4 bits of the CSR
address (csr[11:8]) are used to encode the read and write
accessibility of the CSRs according to privilege level as shown in
Table~\ref{csrrwpriv}. The top two bits (csr[11:10]) indicate whether
the register is read/write ({\tt 00}, {\tt 01}, or {\tt 10}) or
read-only ({\tt 11}). The next two bits (csr[9:8]) encode the lowest
privilege level that can access the CSR.
\begin{commentary}
The CSR address convention uses the upper bits of the CSR address to
encode default access privileges. This simplifies error checking in
the hardware and provides a larger CSR space, but does constrain the
mapping of CSRs into the address space.
Implementations might allow a more-privileged level to trap otherwise
permitted CSR accesses by a less-privileged level to allow these
accesses to be intercepted. This change should be transparent to the
less-privileged software.
\end{commentary}
\vspace{0.2in}
\begin{table*}[h!]
\begin{center}
\begin{tabular}{|c|c|c|c|l|}
\hline
\multicolumn{3}{|c|}{CSR Address} & Hex & \multicolumn{1}{c|}{Use and Accessibility}\\ \cline{1-3}
[11:10] & [9:8] & [7:6] & & \\
\hline
\multicolumn{5}{|c|}{User CSRs} \\
\hline
\tt 00 &\tt 00 &\tt XX & \tt 0x000-0x0FF & Standard read/write \\
\tt 01 &\tt 00 &\tt XX & \tt 0x400-0x4FF & Standard read/write \\
\tt 10 &\tt 00 &\tt XX & \tt 0x800-0x8FF & Non-standard read/write \\
\tt 11 &\tt 00 &\tt 00-10 & \tt 0xC00-0xCBF & Standard read-only \\
\tt 11 &\tt 00 &\tt 11 & \tt 0xCC0-0xCFF & Non-standard read-only \\
\hline
\multicolumn{5}{|c|}{Supervisor CSRs} \\
\hline
\tt 00 &\tt 01 &\tt XX & \tt 0x100-0x1FF & Standard read/write \\
\tt 01 &\tt 01 &\tt 00-10 & \tt 0x500-0x5BF & Standard read/write \\
\tt 01 &\tt 01 &\tt 11 & \tt 0x5C0-0x5FF & Non-standard read/write \\
\tt 10 &\tt 01 &\tt 00-10 & \tt 0x900-0x9BF & Standard read/write \\
\tt 10 &\tt 01 &\tt 11 & \tt 0x9C0-0x9FF & Non-standard read/write \\
\tt 11 &\tt 01 &\tt 00-10 & \tt 0xD00-0xDBF & Standard read-only \\
\tt 11 &\tt 01 &\tt 11 & \tt 0xDC0-0xDFF & Non-standard read-only \\
\hline
\multicolumn{5}{|c|}{Reserved CSRs} \\
\hline
\tt XX &\tt 10 &\tt XX & Reserved & \\
%% \multicolumn{5}{|c|}{Hypervisor CSRs} \\
%% \hline
%% \tt 00 &\tt 10 &\tt XX & \tt 0x200-0x2FF & Standard read/write \\
%% \tt 01 &\tt 10 &\tt 00-10 & \tt 0x600-0x6BF & Standard read/write \\
%% \tt 01 &\tt 10 &\tt 11 & \tt 0x6C0-0x6FF & Non-standard read/write \\
%% \tt 10 &\tt 10 &\tt 00-10 & \tt 0xA00-0xABF & Standard read/write \\
%% \tt 10 &\tt 10 &\tt 11 & \tt 0xAC0-0xAFF & Non-standard read/write \\
%% \tt 11 &\tt 10 &\tt 00-10 & \tt 0xE00-0xEBF & Standard read-only \\
%% \tt 11 &\tt 10 &\tt 11 & \tt 0xEC0-0xEFF & Non-standard read-only \\
\hline
\multicolumn{5}{|c|}{Machine CSRs} \\
\hline
\tt 00 &\tt 11 &\tt XX & \tt 0x300-0x3FF & Standard read/write \\
\tt 01 &\tt 11 &\tt 00-10 & \tt 0x700-0x79F & Standard read/write \\
\tt 01 &\tt 11 &\tt 10 & \tt 0x7A0-0x7AF & Standard read/write debug CSRs \\
\tt 01 &\tt 11 &\tt 10 & \tt 0x7B0-0x7BF & Debug-mode-only CSRs \\
\tt 01 &\tt 11 &\tt 11 & \tt 0x7C0-0x7FF & Non-standard read/write \\
\tt 10 &\tt 11 &\tt 00-10 & \tt 0xB00-0xBBF & Standard read/write \\
\tt 10 &\tt 11 &\tt 11 & \tt 0xBC0-0xBFF & Non-standard read/write \\
\tt 11 &\tt 11 &\tt 00-10 & \tt 0xF00-0xFBF & Standard read-only \\
\tt 11 &\tt 11 &\tt 11 & \tt 0xFC0-0xFFF & Non-standard read-only \\
\hline
\end{tabular}
\end{center}
\caption{Allocation of RISC-V CSR address ranges.}
\label{csrrwpriv}
\end{table*}
Attempts to access a non-existent CSR raise an illegal instruction
exception. Attempts to access a CSR without appropriate privilege
level or to write a read-only register also raise illegal instruction
exceptions. A read/write register might also contain some bits that
are read-only, in which case writes to the read-only bits are ignored.
Table~\ref{csrrwpriv} also indicates the convention to allocate CSR
addresses between standard and non-standard uses. The CSR addresses
reserved for non-standard uses will not be redefined by future
standard extensions.
\begin{commentary}
We have dropped the explicit allocation of CSR space for shadow CSRs
to leave more flexibility for allocated other CSRs. Shadow CSRs can
still be added in the appropriate R/W space. The counters are the
only shadowed CSRs in the current spec.
Shadows CSRs provide a read-write address via which a higher privilege
level can modify a register that is read-only at a lower privilege
level. Note that if one privilege level has already allocated a
read/write shadow address, then any higher privilege level can use the
same CSR address for read/write access to the same register.
Effective virtualization requires that as many instructions run
natively as possible inside a virtualized environment, while any
privileged accesses trap to the virtual machine
monitor~\cite{goldbergvm}. CSRs that are read-only at some lower
privilege level are shadowed into separate CSR addresses if they are
made read-write at a higher privilege level. This avoids trapping
permitted lower-privilege accesses while still causing traps on
illegal accesses.
\end{commentary}
Machine-mode standard read-write CSRs {\tt 0x7A0}--{\tt 0x7BF} are
reserved for use by the debug system. Implementations should raise
illegal instruction exceptions on machine-mode access to these registers.
\section{CSR Listing}
Tables~\ref{ucsrnames}--\ref{mcsrnames} list the CSRs that have
currently been allocated CSR addresses. The timers, counters, and
floating-point CSRs are standard user-level CSRs, as well as the
additional user trap registers added by the N extension. The other
registers are used by privileged code, as described in the following
chapters. Note that not all registers are required on all
implementations.
\begin{table}[htb!]
\begin{center}
\begin{tabular}{|l|l|l|l|}
\hline
Number & Privilege & Name & Description \\
\hline
\multicolumn{4}{|c|}{User Trap Setup} \\
\hline
\tt 0x000 & URW &\tt ustatus & User status register. \\
\tt 0x004 & URW &\tt uie & User interrupt-enable register. \\
\tt 0x005 & URW &\tt utvec & User trap handler base address. \\
\hline
\multicolumn{4}{|c|}{User Trap Handling} \\
\hline
\tt 0x040 & URW &\tt uscratch & Scratch register for user trap handlers. \\
\tt 0x041 & URW &\tt uepc & User exception program counter. \\
\tt 0x042 & URW &\tt ucause & User trap cause. \\
\tt 0x043 & URW &\tt utval & User bad address or instruction. \\
\tt 0x044 & URW &\tt uip & User interrupt pending. \\
\hline
\multicolumn{4}{|c|}{User Floating-Point CSRs} \\
\hline
\tt 0x001 & URW &\tt fflags & Floating-Point Accrued Exceptions. \\
\tt 0x002 & URW &\tt frm & Floating-Point Dynamic Rounding Mode. \\
\tt 0x003 & URW &\tt fcsr & Floating-Point Control and Status
Register ({\tt frm} + {\tt fflags}). \\
\hline
\multicolumn{4}{|c|}{User Counter/Timers} \\
\hline
\tt 0xC00 & URO &\tt cycle & Cycle counter for RDCYCLE instruction. \\
\tt 0xC01 & URO &\tt time & Timer for RDTIME instruction. \\
\tt 0xC02 & URO &\tt instret & Instructions-retired counter for RDINSTRET instruction. \\
\tt 0xC03 & URO &\tt hpmcounter3 & Performance-monitoring counter. \\
\tt 0xC04 & URO &\tt hpmcounter4 & Performance-monitoring counter. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0xC1F & URO &\tt hpmcounter31 & Performance-monitoring counter. \\
\tt 0xC80 & URO &\tt cycleh & Upper 32 bits of {\tt cycle}, RV32I only. \\
\tt 0xC81 & URO &\tt timeh & Upper 32 bits of {\tt time}, RV32I only. \\
\tt 0xC82 & URO &\tt instreth & Upper 32 bits of {\tt instret}, RV32I only. \\
\tt 0xC83 & URO &\tt hpmcounter3h & Upper 32 bits of {\tt hpmcounter3}, RV32I only. \\
\tt 0xC84 & URO &\tt hpmcounter4h & Upper 32 bits of {\tt hpmcounter4}, RV32I only. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0xC9F & URO &\tt hpmcounter31h & Upper 32 bits of {\tt hpmcounter31}, RV32I only. \\
\hline
\end{tabular}
\end{center}
\caption{Currently allocated RISC-V user-level CSR addresses.}
\label{ucsrnames}
\end{table}
\begin{table}[htb!]
\begin{center}
\begin{tabular}{|l|l|l|l|}
\hline
Number & Privilege & Name & Description \\
\hline
\multicolumn{4}{|c|}{Supervisor Trap Setup} \\
\hline
\tt 0x100 & SRW &\tt sstatus & Supervisor status register. \\
\tt 0x102 & SRW &\tt sedeleg & Supervisor exception delegation register. \\
\tt 0x103 & SRW &\tt sideleg & Supervisor interrupt delegation register. \\
\tt 0x104 & SRW &\tt sie & Supervisor interrupt-enable register. \\
\tt 0x105 & SRW &\tt stvec & Supervisor trap handler base address. \\
\tt 0x106 & SRW &\tt scounteren & Supervisor counter enable. \\
\hline
\multicolumn{4}{|c|}{Supervisor Trap Handling} \\
\hline
\tt 0x140 & SRW &\tt sscratch & Scratch register for supervisor trap handlers. \\
\tt 0x141 & SRW &\tt sepc & Supervisor exception program counter. \\
\tt 0x142 & SRW &\tt scause & Supervisor trap cause. \\
\tt 0x143 & SRW &\tt stval & Supervisor bad address or instruction. \\
\tt 0x144 & SRW &\tt sip & Supervisor interrupt pending. \\
\hline
\multicolumn{4}{|c|}{Supervisor Protection and Translation} \\
\hline
\tt 0x180 & SRW &\tt satp & Supervisor address translation and protection. \\
\hline
\end{tabular}
\end{center}
\caption{Currently allocated RISC-V supervisor-level CSR addresses.}
\label{scsrnames}
\end{table}
%% \begin{table}[htb!]
%% \begin{center}
%% \begin{tabular}{|l|l|l|l|}
%% \hline
%% Number & Privilege & Name & Description \\
%% \hline
%% \multicolumn{4}{|c|}{Hypervisor Trap Setup} \\
%% \hline
%% \tt 0x200 & HRW &\tt hstatus & Hypervisor status register. \\
%% \tt 0x202 & HRW &\tt hedeleg & Hypervisor exception delegation register. \\
%% \tt 0x203 & HRW &\tt hideleg & Hypervisor interrupt delegation register. \\
%% \tt 0x204 & HRW &\tt hie & Hypervisor interrupt-enable register. \\
%% \tt 0x205 & HRW &\tt htvec & Hypervisor trap handler base address. \\
%% \tt 0x206 & HRW &\tt hcounteren & Hypervisor counter enable. \\
%% \hline
%% \multicolumn{4}{|c|}{Hypervisor Trap Handling} \\
%% \hline
%% \tt 0x240 & HRW &\tt hscratch & Scratch register for hypervisor trap handlers. \\
%% \tt 0x241 & HRW &\tt hepc & Hypervisor exception program counter. \\
%% \tt 0x242 & HRW &\tt hcause & Hypervisor trap cause. \\
%% \tt 0x243 & HRW &\tt htval & Hypervisor bad address or instruction. \\
%% \tt 0x244 & HRW &\tt hip & Hypervisor interrupt pending. \\
%% \hline
%% \multicolumn{4}{|c|}{Hypervisor Protection and Translation} \\
%% \hline
%% \tt 0x28X & TBD & TBD & TBD. \\
%% \hline
%% \end{tabular}
%% \end{center}
%% \caption{Currently allocated RISC-V hypervisor-level CSR addresses.}
%% \label{hcsrnames}
%% \end{table}
\begin{table}[htb!]
\begin{center}
\begin{tabular}{|l|l|l|l|}
\hline
Number & Privilege & Name & Description \\
\hline
\multicolumn{4}{|c|}{Machine Information Registers} \\
\hline
\tt 0xF11 & MRO &\tt mvendorid & Vendor ID. \\
\tt 0xF12 & MRO &\tt marchid & Architecture ID. \\
\tt 0xF13 & MRO &\tt mimpid & Implementation ID. \\
\tt 0xF14 & MRO &\tt mhartid & Hardware thread ID. \\
\hline
\multicolumn{4}{|c|}{Machine Trap Setup} \\
\hline
\tt 0x300 & MRW &\tt mstatus & Machine status register. \\
\tt 0x301 & MRW &\tt misa & ISA and extensions \\
\tt 0x302 & MRW &\tt medeleg & Machine exception delegation register. \\
\tt 0x303 & MRW &\tt mideleg & Machine interrupt delegation register. \\
\tt 0x304 & MRW &\tt mie & Machine interrupt-enable register. \\
\tt 0x305 & MRW &\tt mtvec & Machine trap-handler base address. \\
\tt 0x306 & MRW &\tt mcounteren & Machine counter enable. \\
\hline
\multicolumn{4}{|c|}{Machine Trap Handling} \\
\hline
\tt 0x340 & MRW &\tt mscratch & Scratch register for machine trap handlers. \\
\tt 0x341 & MRW &\tt mepc & Machine exception program counter. \\
\tt 0x342 & MRW &\tt mcause & Machine trap cause. \\
\tt 0x343 & MRW &\tt mtval & Machine bad address or instruction. \\
\tt 0x344 & MRW &\tt mip & Machine interrupt pending. \\
\hline
\multicolumn{4}{|c|}{Machine Protection and Translation} \\
\hline
%\tt 0x380 & MRW &\tt mbase & Base register. \\
%\tt 0x381 & MRW &\tt mbound & Bound register. \\
%\tt 0x382 & MRW &\tt mibase & Instruction base register. \\
%\tt 0x383 & MRW &\tt mibound & Instruction bound register. \\
%\tt 0x384 & MRW &\tt mdbase & Data base register. \\
%\tt 0x385 & MRW &\tt mdbound & Data bound register. \\
\tt 0x3A0 & MRW &\tt pmpcfg0 & Physical memory protection configuration. \\
\tt 0x3A1 & MRW &\tt pmpcfg1 & Physical memory protection configuration, RV32 only. \\
\tt 0x3A2 & MRW &\tt pmpcfg2 & Physical memory protection configuration. \\
\tt 0x3A3 & MRW &\tt pmpcfg3 & Physical memory protection configuration, RV32 only. \\
\tt 0x3B0 & MRW &\tt pmpaddr0 & Physical memory protection address register. \\
\tt 0x3B1 & MRW &\tt pmpaddr1 & Physical memory protection address register. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0x3BF & MRW &\tt pmpaddr15 & Physical memory protection address register. \\
\hline
\end{tabular}
\end{center}
\caption{Currently allocated RISC-V machine-level CSR addresses.}
\label{mcsrnames}
\end{table}
\begin{table}[htb!]
\begin{center}
\begin{tabular}{|l|l|l|l|}
\hline
Number & Privilege & Name & Description \\
\hline
\multicolumn{4}{|c|}{Machine Counter/Timers} \\
\hline
\tt 0xB00 & MRW &\tt mcycle & Machine cycle counter. \\
\tt 0xB02 & MRW &\tt minstret & Machine instructions-retired counter. \\
\tt 0xB03 & MRW &\tt mhpmcounter3 & Machine performance-monitoring counter. \\
\tt 0xB04 & MRW &\tt mhpmcounter4 & Machine performance-monitoring counter. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0xB1F & MRW &\tt mhpmcounter31 & Machine performance-monitoring counter. \\
\tt 0xB80 & MRW &\tt mcycleh & Upper 32 bits of {\tt mcycle}, RV32I only. \\
\tt 0xB82 & MRW &\tt minstreth & Upper 32 bits of {\tt minstret}, RV32I only. \\
\tt 0xB83 & MRW &\tt mhpmcounter3h & Upper 32 bits of {\tt mhpmcounter3}, RV32I only. \\
\tt 0xB84 & MRW &\tt mhpmcounter4h & Upper 32 bits of {\tt mhpmcounter4}, RV32I only. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0xB9F & MRW &\tt mhpmcounter31h & Upper 32 bits of {\tt mhpmcounter31}, RV32I only. \\
\hline
\multicolumn{4}{|c|}{Machine Counter Setup} \\
\hline
\tt 0x323 & MRW &\tt mhpmevent3 & Machine performance-monitoring event selector. \\
\tt 0x324 & MRW &\tt mhpmevent4 & Machine performance-monitoring event selector. \\
& & \multicolumn{1}{c|}{\vdots} & \ \\
\tt 0x33F & MRW &\tt mhpmevent31 & Machine performance-monitoring event selector. \\
\hline
\multicolumn{4}{|c|}{Debug/Trace Registers (shared with Debug Mode)} \\
\hline
\tt 0x7A0 & MRW &\tt tselect & Debug/Trace trigger register select. \\
\tt 0x7A1 & MRW &\tt tdata1 & First Debug/Trace trigger data register. \\
\tt 0x7A2 & MRW &\tt tdata2 & Second Debug/Trace trigger data register. \\
\tt 0x7A3 & MRW &\tt tdata3 & Third Debug/Trace trigger data register. \\
\hline
\multicolumn{4}{|c|}{Debug Mode Registers } \\
\hline
\tt 0x7B0 & DRW &\tt dcsr & Debug control and status register. \\
\tt 0x7B1 & DRW &\tt dpc & Debug PC. \\
\tt 0x7B2 & DRW &\tt dscratch & Debug scratch register. \\
\hline
\end{tabular}
\end{center}
\caption{Currently allocated RISC-V machine-level CSR addresses.}
\label{mcsrnames}
\end{table}
\clearpage
\section{CSR Field Specifications}
The following definitions and abbreviations are used in specifying the
behavior of fields within the CSRs.
\subsection*{Reserved Writes Ignored, Reads Ignore Values (WIRI)}
Some read-only and read/write registers have read-only fields reserved
for future use. These reserved read-only fields should be ignored on
a read. Writes to these fields have no effect, unless the whole CSR
is read-only, in which case writes might raise an illegal instruction
exception. These fields are labeled \wiri\ in the register
descriptions.
\subsection*{Reserved Writes Preserve Values, Reads Ignore Values (WPRI)}
Some whole read/write fields are reserved for future use. Software
should ignore the values read from these fields, and should preserve
the values held in these fields when writing values to other fields of
the same register. These fields are labeled \wpri\ in the register
descriptions.
\begin{commentary}
To simplify the software model, any backward-compatible future
definition of previously reserved fields within a CSR must cope with
the possibility that a non-atomic read/modify/write sequence is used
to update other fields in the CSR. Alternatively, the original CSR
definition must specify that subfields can only be updated atomically,
which may require a two-instruction clear bit/set bit sequence in
general that can be problematic if intermediate values are not legal.
\end{commentary}
\subsection*{Write/Read Only Legal Values (WLRL)}
Some read/write CSR fields specify behavior for only a subset of
possible bit encodings, with other bit encodings reserved. Software
should not write anything other than legal values to such a field, and
should not assume a read will return a legal value unless the last
write was of a legal value, or the register has not been written since
another operation (e.g., reset) set the register to a legal value.
These fields are labeled \wlrl\ in the register descriptions.
\begin{commentary}
Hardware implementations need only implement enough state bits to
differentiate between the supported values, but must always return the
complete specified bit-encoding of any supported value when read.
\end{commentary}
Implementations are permitted but not required to raise an illegal
instruction exception if an instruction attempts to write a
non-supported value to a CSR field. Hardware implementations can
return arbitrary bit patterns on the read of a CSR field when the last
write was of an illegal value, but the value returned should
deterministically depend on the previous written value.
\subsection*{Write Any Values, Reads Legal Values (WARL)}
Some read/write CSR fields are only defined for a subset of bit
encodings, but allow any value to be written while guaranteeing to
return a legal value whenever read. Assuming that writing the CSR has
no other side effects, the range of supported values can be determined
by attempting to write a desired setting then reading to see if the
value was retained. These fields are labeled \warl\ in the register
descriptions.
Implementations will not raise an exception on writes of unsupported
values to an \warl\ field. Implementations must always
deterministically return the same legal value after a given illegal
value is written.
|