Subversion Repositories neorv32

:sectnums:

== NEORV32 Central Processing Unit (CPU)

image::riscv_logo.png[width=350,align=center]

**Key Features**

* 32-bit multi-cycle in-order `rv32` RISC-V CPU

* Optional RISC-V extensions:

** `A` - atomic memory access operations

** `B` - bit-manipulation instructions

** `C` - 16-bit compressed instructions

** `I` - integer base ISA (always enabled)

** `E` - embedded CPU version (reduced register file size)

** `M` - integer multiplication and division hardware

** `U` - less-privileged _user_ mode

** `Zfinx` - single-precision floating-point unit

** `Zicsr` - control and status register access (privileged architecture)

** `Zicntr` - CPU base counters

** `Zihpm` - hardware performance monitors

** `Zifencei` - instruction stream synchronization

** `Zmmul` - integer multiplication hardware

** `PMP` - physical memory protection

** `Debug` - debug mode

* Compatible to the RISC-V user specifications and a subset of the RISC-V privileged architecture specifications - passes the official RISC-V Architecture Tests (v2+)

* Official RISC-V open-source architecture ID

* Standard RISC-V interrupts (_external_, _timer_, _software_) plus 16 _fast_ interrupts

* Supports _all_ of the machine-level traps from the RISC-V specifications (including bus access exceptions and all unimplemented/illegal/malformed instructions)

** This is a special aspect on _execution safety_ by <<_full_virtualization>>

* Optional physical memory configuration (PMP), compatible to the RISC-V specifications

* Optional hardware performance monitors (HPM) for application benchmarking

* Separated interfaces for instruction fetch and data access (merged into a single processor bus))

* little-endian byte order

* Configurable hardware reset

* No hardware support of unaligned data/instruction accesses - they will trigger an exception.

[NOTE]

It is recommended to use the **NEORV32 Processor** as default top instance even if you only want to use the actual

CPU. Simply disable all the processor-internal modules via the generics and you will get a "CPU

wrapper" that provides a minimal CPU environment and an external bus interface (like AXI4). This

setup also allows to further use the default bootloader and software framework. From this base you

can start building your own SoC. Of course you can also use the CPU in it’s true stand-alone mode.

[NOTE]

This documentation assumes the reader is familiar with the official RISC-V "User" and "Privileged Architecture" specifications.

<<<

// ####################################################################################################################

:sectnums:

=== Architecture

The NEORV32 CPU was designed from scratch based only on the official ISA / privileged architecture

specifications. The following figure shows the simplified architecture of the CPU.

image::neorv32_cpu.png[align=center]

The CPU implements a _multi-cycle_ architecture. Hence, each instruction is executed as a series of consecutive

micro-operations. In order to increase performance, the CPU's **front-end** (instruction fetch) and **back-end**

(instruction execution) are de-couples via a FIFO (the "instruction prefetch buffer"). Therefore, the

front-end can already fetch new instructions while the back-end is still processing previously-fetched instructions.

The front-end is responsible for fetching 32-bit chunks of instruction words (one aligned 32-bit instruction,

two 16-bit instructions or a mixture if 32-bit instructions are not aligned to 32-bit boundaries). The instruction

data is stored to a FIFO queue - the instruction prefetch buffer.

The back-end is responsible for the actual execution of the instruction. It includes an "issue engine",

which takes data from the instruction prefetch buffer and assembles 32-bit instruction words (plain 32-bit

instruction or decompressed 16-bit instructions) for execution.

Front-end and back-end operate in parallel and with overlapping operations. Hence, the optimal CPI

(cycles per instructions) is 2, but it can be significantly higher: for instance when executing loads/stores

(accessing memory-mapped devices with high latency), executing multi-cycle ALU operations (like divisions) or

when the CPU front-end has to reload the prefetch buffer due to a taken branch.

Basically, the NEORV32 CPU is somewhere between a classical pipelined architecture, where each stage

requires exactly one processing cycle (if not stalled) and a classical multi-cycle architecture, which executes

every single instruction (_including_ fetch) in a series of consecutive micro-operations. The combination of

these two classical design paradigms allows an increased instruction execution in contrast to a pure multi-cycle

approach (due to overlapping operation of fetch and execute) at a reduced hardware footprint (due to the

multi-cycle concept).

As a Von-Neumann machine, the CPU provides independent interfaces for instruction fetch and data access.

These two bus interfaces are merged into a single processor-internal bus via a prioritizing bus switch (data accesses

have higher priority). Hence, ALL memory locations including peripheral devices are mapped to a single unified 32-bit

address space.

// ####################################################################################################################

:sectnums:

=== Full Virtualization

Just like the RISC-V ISA the NEORV32 aims to provide _maximum virtualization_ capabilities on CPU _and_ SoC level to

allow a high standard of **execution safety**. The CPU supports **all** traps specified by the official RISC-V specifications.

footnote:[If the `Zicsr` CPU extension is enabled (implementing the full set of the privileged architecture).]

Thus, the CPU provides defined hardware fall-backs via traps for any expected and unexpected situation (e.g. executing an

malformed instruction word or accessing a not-allocated memory address). For any kind of trap the core is always in a

defined and fully synchronized state throughout the whole architecture (i.e. there are no out-of-order operations that

might have to reverted). This allows predictable execution behavior at any time improving overall _execution safety_.

**Execution Safety - NEORV32 Virtualization Features**

* Due to the acknowledged memory accesses the CPU is _always_ sync with the memory system

(i.e. there is no speculative execution / no out-of-order states).

* The CPU supports _all_ RISC-V compatible bus exceptions including access exceptions, which are triggered if an

accessed address does not respond or encounters an internal error during access.

* Accessed memory addresses (plain memory, but also memory-mapped devices) need to respond within a fixed time

window. Otherwise a bus access exception is raised.

* The RISC-V specs. state that executing an malformed instruction results in unpredictable behavior. As an additional

execution safety feature the NEORV32 CPU ensures that _all_ unimplemented/malformed/illegal instructions do raise an

illegal instruction exceptions and do not commit any state-changing operation (like writing registers or triggering

memory operations).

* To be continued...

// ####################################################################################################################

:sectnums:

=== RISC-V Compatibility

The NEORV32 CPU passes the rv32_m/I, rv32_m/M, rv32_m/C, rv32_m/privilege, and

rv32_m/Zifencei tests of the official RISC-V Architecture Tests (GitHub). The port files for the

NEORV32 processor are located in the repository's `sw/isa-test` folder.

[NOTE]

See section https://stnolting.github.io/neorv32/ug/#_risc_v_architecture_test_framework[User Guide: RISC-V Architecture Test Framework]

for information how to run the tests on the NEORV32.

.**RISC-V `rv32_m/C` Tests**

...................................

Check cadd-01           ... OK

Check caddi-01          ... OK

Check caddi16sp-01      ... OK

Check caddi4spn-01      ... OK

Check cand-01           ... OK

Check candi-01          ... OK

Check cbeqz-01          ... OK

Check cbnez-01          ... OK

Check cebreak-01        ... OK

Check cj-01             ... OK

Check cjal-01           ... OK

Check cjalr-01          ... OK

Check cjr-01            ... OK

Check cli-01            ... OK

Check clui-01           ... OK

Check clw-01            ... OK

Check clwsp-01          ... OK

Check cmv-01            ... OK

Check cnop-01           ... OK

Check cor-01            ... OK

Check cslli-01          ... OK

Check csrai-01          ... OK

Check csrli-01          ... OK

Check csub-01           ... OK

Check csw-01            ... OK

Check cswsp-01          ... OK

Check cxor-01           ... OK

--------------------------------

OK: 27/27 RISCV_TARGET=neorv32 RISCV_DEVICE=C XLEN=32

...................................

.**RISC-V `rv32_m/I` Tests**

...................................

Check add-01            ... OK

Check addi-01           ... OK

Check and-01            ... OK

Check andi-01           ... OK

Check auipc-01          ... OK

Check beq-01            ... OK

Check bge-01            ... OK

Check bgeu-01           ... OK

Check blt-01            ... OK

Check bltu-01           ... OK

Check bne-01            ... OK

Check fence-01          ... OK

Check jal-01            ... OK

Check jalr-01           ... OK

Check lb-align-01       ... OK

Check lbu-align-01      ... OK

Check lh-align-01       ... OK

Check lhu-align-01      ... OK

Check lui-01            ... OK

Check lw-align-01       ... OK

Check or-01             ... OK

Check ori-01            ... OK

Check sb-align-01       ... OK

Check sh-align-01       ... OK

Check sll-01            ... OK

Check slli-01           ... OK

Check slt-01            ... OK

Check slti-01           ... OK

Check sltiu-01          ... OK

Check sltu-01           ... OK

Check sra-01            ... OK

Check srai-01           ... OK

Check srl-01            ... OK

Check srli-01           ... OK

Check sub-01            ... OK

Check sw-align-01       ... OK

Check xor-01            ... OK

Check xori-01           ... OK

--------------------------------

OK: 38/38 RISCV_TARGET=neorv32 RISCV_DEVICE=I XLEN=32

...................................

.**RISC-V `rv32_m/M` Tests**

...................................

Check div-01            ... OK

Check divu-01           ... OK

Check mul-01            ... OK

Check mulh-01           ... OK

Check mulhsu-01         ... OK

Check mulhu-01          ... OK

Check rem-01            ... OK

Check remu-01           ... OK

--------------------------------

OK: 8/8 RISCV_TARGET=neorv32 RISCV_DEVICE=M XLEN=32

...................................

.**RISC-V `rv32_m/privilege` Tests**

...................................

Check ebreak            ... OK

Check ecall             ... OK

Check misalign-beq-01   ... OK

Check misalign-bge-01   ... OK

Check misalign-bgeu-01  ... OK

Check misalign-blt-01   ... OK

Check misalign-bltu-01  ... OK

Check misalign-bne-01   ... OK

Check misalign-jal-01   ... OK

Check misalign-lh-01    ... OK

Check misalign-lhu-01   ... OK

Check misalign-lw-01    ... OK

Check misalign-sh-01    ... OK

Check misalign-sw-01    ... OK

Check misalign1-jalr-01 ... OK

Check misalign2-jalr-01 ... OK

--------------------------------

OK: 16/16 RISCV_TARGET=neorv32 RISCV_DEVICE=privilege XLEN=32

...................................

.**RISC-V `rv32_m/Zifencei` Tests**

...................................

Check Fencei            ... OK

--------------------------------

OK: 1/1 RISCV_TARGET=neorv32 RISCV_DEVICE=Zifencei XLEN=32

...................................

<<<

:sectnums:

==== RISC-V Incompatibility Issues and Limitations

This list shows the currently identified issues regarding full RISC-V-compatibility. More specific information

can be found in section <<_instruction_sets_and_extensions>>.

.Hardwired R/W CSRs

[IMPORTANT]

The `misa`, `mip` and `mtval` CSRs in the NEORV32 are _read-only_.

Any write access to it (in machine mode) to them are ignored and will _not_ cause any exceptions or side-effects.

Pending interrupt can only be cleared by acknowledging the interrupt-causing device. However, pending interrupts

can still be ignored by clearing the according `mie` register bits.

.Physical memory protection

[IMPORTANT]

The physical memory protection (see section <<_machine_physical_memory_protection>>)

only supports the modes _OFF_ and _NAPOT_ yet and a minimal granularity of 8 bytes per region.

.Atomic memory operations

[IMPORTANT]

The `A` CPU extension only implements the `lr.w` and `sc.w` instructions yet.

However, these instructions are sufficient to emulate all further atomic memory operations.

.Bit-manipulation operations

[IMPORTANT]

The NEORV32 `B` extension only implements the _basic bit-manipulation instructions_ (`Zbb`) subset

and the _address generation instructions_ (`Zba`) subset yet.

.Instruction Misalignment

[NOTE]

This is not a real RISC-V incompatibility, but something that might not be clear when studying the RISC-V privileged

architecture specifications: for 32-bit only instructions (no `C` extension) the misaligned instruction exception

is raised if bit 1 of the access address is set (i.e. not on 32-bit boundary). If the `C` extension is implemented

there will be no misaligned instruction exceptions _at all_.

In both cases bit 0 of the program counter and all related registers is hardwired to zero.

<<<

// ####################################################################################################################

:sectnums:

=== CPU Top Entity - Signals

The following table shows all interface signals of the CPU top entity `rtl/core/neorv32_cpu.vhd`. The

type of all signals is _std_ulogic_ or _std_ulogic_vector_, respectively. The "Dir." column shows the signal

direction seen from the CPU.

.NEORV32 CPU top entity signals

[cols="<2,^1,^1,<6"]

[options="header", grid="rows"]

|=======================

| Signal           | Width | Dir.   | Function

4+^| **Global Signals**

| `clk_i`          |     1 | in  | global clock line, all registers triggering on rising edge

| `rstn_i`         |     1 | in  | global reset, low-active

| `sleep_o`        |     1 | out | CPU is in sleep mode when set

4+^| **Instruction Bus Interface (<<_bus_interface>>)**

| `i_bus_addr_o`   |    32 | out | destination address

| `i_bus_rdata_i`  |    32 | in  | read data

| `i_bus_wdata_o`  |    32 | out | write data (always zero)

| `i_bus_ben_o`    |     4 | out | byte enable

| `i_bus_we_o`     |     1 | out | write transaction (always zero)

| `i_bus_re_o`     |     1 | out | read transaction

| `i_bus_lock_o`   |     1 | out | exclusive access request (always zero)

| `i_bus_ack_i`    |     1 | in  | bus transfer acknowledge from accessed peripheral

| `i_bus_err_i`    |     1 | in  | bus transfer terminate from accessed peripheral

| `i_bus_fence_o`  |     1 | out | indicates an executed _fence.i_ instruction

| `i_bus_priv_o`   |     2 | out | current CPU privilege level

4+^| **Data Bus Interface (<<_bus_interface>>)**

| `d_bus_addr_o`   |    32 | out | destination address

| `d_bus_rdata_i`  |    32 | in  | read data

| `d_bus_wdata_o`  |    32 | out | write data

| `d_bus_ben_o`    |     4 | out | byte enable

| `d_bus_we_o`     |     1 | out | write transaction

| `d_bus_re_o`     |     1 | out | read transaction

| `d_bus_lock_o`   |     1 | out | exclusive access request

| `d_bus_ack_i`    |     1 | in  | bus transfer acknowledge from accessed peripheral

| `d_bus_err_i`    |     1 | in  | bus transfer terminate from accessed peripheral

| `d_bus_fence_o`  |     1 | out | indicates an executed _fence_ instruction

| `d_bus_priv_o`   |     2 | out | current CPU privilege level

4+^| **System Time (see <<_timeh>> CSR)**

| `time_i`         |    64 | in  | system time input (from MTIME)

4+^| **Interrupts, RISC-V-compatible (<<_traps_exceptions_and_interrupts>>)**

| `msw_irq_i`      |     1 | in  | RISC-V machine software interrupt

| `mext_irq_i`     |     1 | in  | RISC-V machine external interrupt

| `mtime_irq_i`    |     1 | in  | RISC-V machine timer interrupt

4+^| **Fast Interrupts, NEORV32-specific (<<_traps_exceptions_and_interrupts>>)**

| `firq_i`         |    16 | in  | fast interrupt request signals

4+^| **Enter Debug Mode Request (<<_on_chip_debugger_ocd>>)**

| `db_halt_req_i`  |     1 | in  | request CPU to halt and enter debug mode

|=======================

<<<

// ####################################################################################################################

:sectnums:

=== CPU Top Entity - Generics

Most of the CPU configuration generics are a subset of the actual Processor configuration generics (see section <<_processor_top_entity_generics>>).

and are not listed here. However, the CPU provides some _specific_ generics that are used to configure the CPU for the

NEORV32 processor setup. These generics are assigned by the processor setup only and are not available for user defined configuration.

The _specific_ generics are listed below.

[cols="4,4,2"]

[frame="all",grid="none"]

|======

| **CPU_BOOT_ADDR** | _std_ulogic_vector(31 downto 0)_ | 0x00000000

3+| This address defines the reset address at which the CPU starts fetching instructions after reset. In terms of the NEORV32 processor, this

generic is configured with the base address of the bootloader ROM (default) or with the base address of the processor-internal instruction

memory (IMEM) if the bootloader is disabled (_INT_BOOTLOADER_EN_ = _false_). See section <<_address_space>> for more information.

|======

[cols="4,4,2"]

[frame="all",grid="none"]

|======

| **CPU_DEBUG_ADDR** | _std_ulogic_vector(31 downto 0)_ | 0x00000000

3+| This address defines the entry address for the "execution based" on-chip debugger. By default, this generic is configured with the base address

of the debugger memory. See section <<_on_chip_debugger_ocd>> for more information.

|======

[cols="4,4,2"]

[frame="all",grid="none"]

|======

| **CPU_EXTENSION_RISCV_DEBUG** | _boolean_ | false

3+| Implement RISC-V-compatible "debug" CPU operation mode. See section <<_cpu_debug_mode>> for more information.

|======

<<<

// ####################################################################################################################

:sectnums:

=== Instruction Sets and Extensions

The basic NEORV32 is a RISC-V `rv32i` architecture that provides several _optional_ RISC-V CPU and ISA

(instruction set architecture) extensions. For more information regarding the RISC-V ISA extensions please

see the the _RISC-V Instruction Set Manual - Volume I: Unprivileged ISA_ and _The RISC-V Instruction Set Manual

Volume II: Privileged Architecture_, which are available in the projects `docs/references` folder.

[TIP]

The CPU can discover available ISA extensions via the <<_misa>> CSR and the

`CPU` <<_system_configuration_information_memory_sysinfo, SYSINFO>> register

or by executing an instruction and checking for an _illegal instruction exception_.

[NOTE]

Executing an instruction from an extension that is not supported yet or that is currently not enabled

(via the according top entity generic) will raise an _illegal instruction_ exception.

==== **`A`** - Atomic Memory Access

Atomic memory access instructions allow more sophisticated memory operations like implementing semaphores and mutexes.

The RICS-C specs. defines a specific _atomic_ extension that provides instructions for atomic memory accesses. The `A`

ISA extension is enabled if the `CPU_EXTENSION_RISCV_A` configuration generic is _true_.

In this case the following additional instructions are available:

* `lr.w`: load-reservate

* `sc.w`: store-conditional

[NOTE]

Even though only `lr.w` and `sc.w` instructions are implemented yet, all further atomic operations

(load-modify-write instruction) can be emulated using these two instruction. Furthermore, the

instruction's ordering flags (`aq` and `lr`) are ignored by the CPU hardware. Using any other (not yet

implemented) AMO (atomic memory operation) will raise an illegal instruction exception.

The *load-reservate* instruction behaves as a "normal" load-word instruction (`lw`) but will also set a CPU-internal

_data memory access lock_. Executing a *store-conditional* behaves as "normal" store-word instruction (`sw`) that will

only conduct an actual memory write operations if the lock is still intact. Additionally, the store-conditional instruction

will also return the lock state (returns zero if the lock is still intact or non-zero if the lock has been broken).

After the execution of the `sc` instruction, the lock is automatically removed.

The lock is broken if at least one of the following conditions occur:

. executing any data memory access instruction other than `lr.w`

. raising _any_ t (for example an interrupt or a memory access exception)

[NOTE]

The atomic instructions have special requirements for memory system / bus interconnect. More

information can be found in sections <<_bus_interface>> and <<_processor_external_memory_interface_wishbone_axi4_lite>>, respectively.

==== **`B`** - Bit-Manipulation Operations

The `B` ISA extension adds instructions for bit-manipulation operations. This extension is enabled if the

`CPU_EXTENSION_RISCV_B` configuration generic is _true_.

The official RISC-V specifications can be found here: https://github.com/riscv/riscv-bitmanip

[IMPORTANT]

The NEORV32 `B` extension only implements the _basic bit-manipulation instructions_ (`Zbb`) subset

and the _address generation instructions_ (`Zba`) subset yet.

The `Zbb` sub-extension adds the following instruction:

* `andn`, `orn`, `xnor`

* `clz`, `ctz`, `cpop`

* `max`, `maxu`, `min`, `minu`

* `sext.b`, `sext.h`, `zext.h`

* `rol`, `ror`, `rori`

* `orc.b`, `rev8`

The `Zba` sub-extension adds the following instruction:

* `sh1add`, `sh2add`, `sh3add`

[TIP]

By default, the bit-manipulation unit uses an _iterative_ approach to compute shift-related operations

like `clz` and `rol`. To increase performance (at the cost of additional hardware resources) the

<<_fast_shift_en>> generic can be enabled to implement full-parallel logic (like barrel shifters) for all

shift-related `B` instructions.

[WARNING]

The `B` extension is frozen but not officially ratified yet. There is no

software support for this extension in the upstream GCC RISC-V port yet. However, an

intrinsic library is provided to utilize the provided `B` extension features from C-language

code (see `sw/example/bitmanip_test`).

==== **`C`** - Compressed Instructions

The _compressed_ ISA extension provides 16-bit encodings of commonly used instructions to reduce code space size.

The `C` extension is available when the `CPU_EXTENSION_RISCV_C` configuration generic is _true_.

In this case the following instructions are available:

* `c.addi4spn`, `c.lw`, `c.sw`, `c.nop`, `c.addi`, `c.jal`, `c.li`, `c.addi16sp`, `c.lui`, `c.srli`, `c.srai` `c.andi`, `c.sub`,

`c.xor`, `c.or`, `c.and`, `c.j`, `c.beqz`, `c.bnez`, `c.slli`, `c.lwsp`, `c.jr`, `c.mv`, `c.ebreak`, `c.jalr`, `c.add`, `c.swsp`

[NOTE]

When the compressed instructions extension is enabled, branches to an _unaligned_ and _uncompressed_ instruction require

an additional instruction fetch to load the according second half-word of that instruction. The performance can be increased

again by forcing a 32-bit alignment of branch target addresses. By default, this is enforced via the GCC `-falign-functions=4`,

`-falign-labels=4`, `-falign-loops=4` and `-falign-jumps=4` compile flags (via the makefile).

==== **`E`** - Embedded CPU

The embedded CPU extensions reduces the size of the general purpose register file from 32 entries to 16 entries to

decrease physical hardware requirements (for example block RAM). This extensions is enabled when the `CPU_EXTENSION_RISCV_E`

configuration generic is _true_. Accesses to registers beyond `x15` will raise and _illegal instruction exception_.

This extension does not add any additional instructions or features.

[IMPORTANT]

Due to the reduced register file size an alternate toolchain ABI (**`ilp32e`**) is required.

==== **`I`** - Base Integer ISA

The CPU always supports the complete `rv32i` base integer instruction set. This base set is always enabled

regardless of the setting of the remaining exceptions. The base instruction set includes the following

instructions:

* immediate: `lui`, `auipc`

* jumps: `jal`, `jalr`

* branches: `beq`, `bne`, `blt`, `bge`, `bltu`, `bgeu`

* memory: `lb`, `lh`, `lw`, `lbu`, `lhu`, `sb`, `sh`, `sw`

* alu: `addi`, `slti`, `sltiu`, `xori`, `ori`, `andi`, `slli`, `srli`, `srai`, `add`, `sub`, `sll`, `slt`, `sltu`, `xor`, `srl`, `sra`, `or`, `and`

* environment: `ecall`, `ebreak`, `fence`

[NOTE]

In order to keep the hardware footprint low, the CPU's shift unit uses a bit-serial serial approach. Hence, shift operations

take up to 32 cycles (plus overhead) depending on the actual shift amount. Alternatively, the shift operations can be processed

completely in parallels by a fast (but large) barrel shifter when the `FAST_SHIFT_EN` generic is _true_. In that case, shift operations

complete within 2 cycles (plus overhead) regardless of the actual shift amount.

[NOTE]

Internally, the `fence` instruction does not perform any operation inside the CPU. It only sets the

top’s `d_bus_fence_o` signal high for one cycle to inform the memory system a `fence` instruction has been

executed. Any flags within the `fence` instruction word are ignore by the hardware.

==== **`M`** - Integer Multiplication and Division

Hardware-accelerated integer multiplication and division operations are available when the

`CPU_EXTENSION_RISCV_M` configuration generic is _true_. In this case the following instructions are

available:

* multiplication: `mul`, `mulh`, `mulhsu`, `mulhu`

* division: `div`, `divu`, `rem`, `remu`

[NOTE]

By default, multiplication and division operations are executed in a bit-serial approach.

Alternatively, the multiplier core can be implemented using DSP blocks if the `FAST_MUL_EN`

generic is _true_ allowing faster execution. Multiplications and divisions

always require a fixed amount of cycles to complete - regardless of the input operands.

==== **`Zmmul`** - Integer Multiplication

This is a _sub-extension_ of the `M` ISA extension. It implements the multiplication-only operations

of the `M` extensions and is intended for size-constrained setups that require hardware-based

integer multiplications but not hardware-based divisions, which will be computed entirely in software.

This extension requires only ~50% of the hardware utilization of the "full" `M` extension.

* multiplication: `mul`, `mulh`, `mulhsu`, `mulhu`

If `Zmmul` is enabled, executing any division instruction from the `M` ISA extension (`div`, `divu`, `rem`, `remu`)

will raise an _illegal instruction exception_.

Note that `M` and `Zmmul` extensions _cannot_ be enabled at the same time.

[TIP]

If your RISC-V GCC toolchain does not (yet) support the `_Zmmul` ISA extensions, it can be "emulated"

using a `rv32im` machine architecture and setting the `-mno-div` compiler flag

(example `$ make MARCH=rv32im USER_FLAGS+=-mno-div clean_all exe`).

==== **`U`** - Less-Privileged User Mode

In addition to the basic (and highest-privileged) machine-mode, the _user-mode_ ISA extensions adds a second less-privileged

operation mode. It is implemented if the `CPU_EXTENSION_RISCV_U` configuration generic is _true_.

Code executed in user-mode cannot access machine-mode CSRs. Furthermore, user-mode access to the address space (like

peripheral/IO devices) can be constrained via the physical memory protection (_PMP_).

Any kind of privilege rights violation will raise an exception to allow full virtualization.

==== **`X`** - NEORV32-Specific (Custom) Extensions

The NEORV32-specific extensions are always enabled and are indicated by the set `X` bit in the `misa` CSR.

The most important points of the NEORV32-specific extensions are:

* The CPU provides 16 _fast interrupt_ interrupts (`FIRQ)`, which are controlled via custom bits in the `mie`

and `mip` CSR. This extension is mapped to _reserved_ CSR bits, that are available for custom use (according to the

RISC-V specs). Also, custom trap codes for `mcause` are implemented.

* All undefined/unimplemented/malformed/illegal instructions do raise an illegal instruction exception (see <<_full_virtualization>>).

==== **`Zfinx`** Single-Precision Floating-Point Operations

The `Zfinx` floating-point extension is an _alternative_ of the standard `F` floating-point ISA extension.

The `Zfinx` extensions also uses the integer register file `x` to store and operate on floating-point data

instead of a dedicated floating-point register file (hence, `F-in-x`). Thus, the `Zfinx` extension requires

less hardware resources and features faster context changes. This also implies that there are NO dedicated `f`

register file-related load/store or move instructions.

The official RISC-V specifications can be found here: https://github.com/riscv/riscv-zfinx

[TIP]

The NEORV32 floating-point unit used by the `Zfinx` extension is compatible to the _IEEE-754_ specifications.

The `Zfinx` extensions only supports single-precision (`.s` instruction suffix), so it is a direct alternative

to the `F` extension. The `Zfinx` extension is implemented when the `CPU_EXTENSION_RISCV_Zfinx` configuration

generic is _true_. In this case the following instructions and CSRs are available:

* conversion: `fcvt.s.w`, `fcvt.s.wu`, `fcvt.w.s`, `fcvt.wu.s`

* comparison: `fmin.s`, `fmax.s`, `feq.s`, `flt.s`, `fle.s`

* computational: `fadd.s`, `fsub.s`, `fmul.s`

* sign-injection: `fsgnj.s`, `fsgnjn.s`, `fsgnjx.s`

* number classification: `fclass.s`

* additional CSRs: `fcsr`, `frm`, `fflags`

[WARNING]

Fused multiply-add instructions `f[n]m[add/sub].s` are not supported!

Division `fdiv.s` and square root `fsqrt.s` instructions are not supported yet!

[WARNING]

Subnormal numbers ("de-normalized" numbers) are not supported by the NEORV32 FPU.

Subnormal numbers (exponent = 0) are _flushed to zero_ setting them to +/- 0 before entering the

FPU's processing core. If a computational instruction (like `fmul.s`) generates a subnormal result, the

result is also flushed to zero during normalization.

[WARNING]

The `Zfinx` extension is not yet officially ratified, but is expected to stay unchanged. There is no

software support for the `Zfinx` extension in the upstream GCC RISC-V port yet. However, an

intrinsic library is provided to utilize the provided `Zfinx` floating-point extension from C-language

code (see `sw/example/floating_point_test`).

==== **`Zicsr`** Control and Status Register Access / Privileged Architecture

The CSR access instructions as well as the exception and interrupt system (= the privileged architecture)

is implemented when the `CPU_EXTENSION_RISCV_Zicsr` configuration generic is _true_.

In this case the following instructions are available:

* CSR access: `csrrw`, `csrrs`, `csrrc`, `csrrwi`, `csrrsi`, `csrrci`

* environment: `mret`, `wfi`

[WARNING]

If the `Zicsr` extension is disabled the CPU does not provide any _privileged architecture_ features at all!

In order to provide the full set of functions and to allow a secure execution

environment the `Zicsr` extension should always be enabled.

[NOTE]

The "wait for interrupt instruction" `wfi` works like a sleep command. When executed, the CPU is

halted until a valid interrupt request occurs. To wake up again, the according interrupt source has to

be enabled via the `mie` CSR and the global interrupt enable flag in `mstatus` has to be set.

[NOTE]

The `wfi` instruction may also be executed in user-mode without causing an exception as <<_mstatus>> bit

`TW` (timeout wait) is hardwired to zero.

==== **`Zicntr`** CPU Base Counters

The `Zicntr` ISA extension adds the basic cycle `[m]cycle[h]`), instruction-retired (`[m]instret[h]`) and time (`time[h]`)

counters. This extensions is stated is _mandatory_ by the RISC-V spec. However, size-constrained setups may remove support for

these counters. Section <<_machine_counter_and_timer_csrs>> shows a list of all `Zicntr`-related CSRs.

These are available if the `Zicntr` ISA extensions is enabled via the <<_cpu_extension_riscv_zicntr>> generic.

[NOTE]

Disabling the `Zicntr` extension does not remove the `time[h]`-driving MTIME unit.

If `Zicntr` is disabled, all accesses to the according counter CSRs will raise an illegal instruction exception.

==== **`Zihpm`** Hardware Performance Monitors

In additions to the base cycle, instructions-retired and time counters the NEORV32 CPU provides

up to 29 hardware performance monitors (HPM 3..31), which can be used to benchmark applications. Each HPM consists of an

N-bit wide counter (split in a high-word 32-bit CSR and a low-word 32-bit CSR), where N is defined via the top's

`HPM_CNT_WIDTH` generic (0..64-bit) and a corresponding event configuration CSR. The event configuration

CSR defines the architectural events that lead to an increment of the associated HPM counter.

The HPM counters are available if the `Zihpm` ISA extensions is enabled via the <<_cpu_extension_riscv_zihpm>> generic.

Depending on the configuration the following additional CSR are available:

* counters: `mhpmcounter*[h]` (3..31, depending on `HPM_NUM_CNTS`)

* event configuration: `mhpmevent*` (3..31, depending on `HPM_NUM_CNTS`)

[IMPORTANT]

The HPM counter CSR can only be accessed in machine-mode. Hence, the according `mcounteren` CSR bits

are always zero and read-only. Any access from less-privileged modes will raise an illegal instruction

exception.

[TIP]

Auto-increment of the HPMs can be individually deactivated via the `mcountinhibit` CSR.

[TIP]

For a list of all HPM-related CSRs and all provided event configurations

see section <<_hardware_performance_monitors_hpm>>.

==== **`Zifencei`** Instruction Stream Synchronization

The `Zifencei` CPU extension is implemented if the `CPU_EXTENSION_RISCV_Zifencei` configuration

generic is _true_. It allows manual synchronization of the instruction stream via the following instruction:

* `fence.i`

The `fence.i` instruction resets the CPU's front-end (instruction fetch) and flushes the prefetch buffer.

This allows a clean re-fetch of modified instructions from memory. Also, the top's `i_bus_fencei_o` signal is set

high for one cycle to inform the memory system (like the i-cache to perform a flush/reload.

Any additional flags within the `fence.i` instruction word are ignore by the hardware.

==== **`PMP`** Physical Memory Protection

The NEORV32 physical memory protection (PMP) is compatible to the RISC-V PMP specifications. It can be used

to constrain memory read/write/execute rights for each available privilege level.

The NEORV32 PMP only supports _NAPOT_ mode yet and a minimal region size (granularity) of 8 bytes. Larger

minimal sizes can be configured via the top `PMP_MIN_GRANULARITY` generic to reduce hardware requirements.

The physical memory protection system is implemented when the `PMP_NUM_REGIONS` configuration generic is >0.

In this case the following additional CSRs are available:

* `pmpcfg*` (0..15, depending on configuration): PMP configuration registers

* `pmpaddr*` (0..63, depending on configuration): PMP address registers

[TIP]

See section <<_machine_physical_memory_protection>> for more information regarding the PMP CSRs.

The actual number of regions and the minimal region granularity are defined via the top entity

`PMP_MIN_GRANULARITY` and `PMP_NUM_REGIONS` generics. `PMP_MIN_GRANULARITY` defines the minimal available

granularity of each region in bytes. `PMP_NUM_REGIONS` defines the total number of implemented regions and thus, the

number of available `pmpcfg*` and `pmpaddr*` CSRs.

When implementing more PMP regions that a _certain critical limit_ *an additional register stage

is automatically inserted* into the CPU's memory interfaces to reduce critical path length. Unfortunately, this will also

increase the latency of instruction fetches and data access by +1 cycle.

The critical limit can be adapted for custom use by a constant from the main VHDL package file

(`rtl/core/neorv32_package.vhd`). The default value is 8:

[source,vhdl]

----

-- "critical" number of PMP regions --

constant pmp_num_regions_critical_c : natural := 8;

----

**Operation**

Any CPU memory access address (from the instruction fetch or data access interface) is tested if it is accessing _any_

of the specified  PMP regions(configured via `pmpaddr*` and enabled via `pmpcfg*`). If an

address matches one of these regions, the configured access rights (attributes in `pmpcfg*`) are enforced:

* a write access (store) will fail if no write attribute is set

* a read access (load) will fail if no read attribute is set

* an instruction fetch access will fail if no execute attribute is set

If an access to a protected region does not have the according access rights it will raise the according

instruction/load/store _access fault_ exception.

By default, all PMP checks are enforced for user-level programs only. If you wish to enforce the physical

memory protection also for machine-level programs you need to set the _locked bit_ in the according

`pmpcfg*` configuration CSR.

[IMPORTANT]

After updating the address configuration registers `pmpaddr*` the system requires up to 33 cycles for

internal (iterative) computations before the configuration becomes valid.

[NOTE]

For more information regarding RISC-V physical memory protection see the official _The RISC-V

Instruction Set Manual - Volume II: Privileged Architecture_ specifications.

<<<

// ####################################################################################################################

:sectnums:

=== Instruction Timing

The instruction timing listed in the table below shows the required clock cycles for executing a certain

instruction. These instruction cycles assume a bus access without additional wait states and a filled

pipeline.

Average CPI (cycles per instructions) values for "real applications" like for executing the CoreMark benchmark for different CPU

configurations are presented in <<_cpu_performance>>.

.Clock cycles per instruction

[cols="<2,^1,^4,<3"]

[options="header", grid="rows"]

|=======================

| Class | ISA | Instruction(s) | Execution cycles

| ALU           | `I/E` | `addi` `slti` `sltiu` `xori` `ori` `andi` `add` `sub` `slt` `sltu` `xor` `or` `and` `lui` `auipc` | 2

| ALU           | `C`   | `c.addi4spn` `c.nop` `c.addi` `c.li` `c.addi16sp` `c.lui` `c.andi` `c.sub` `c.xor` `c.or` `c.and` `c.add` `c.mv` | 2

| ALU           | `I/E` | `slli` `srli` `srai` `sll` `srl` `sra` | 3 + SAfootnote:[Shift amount.]/4 + SA%4; FAST_SHIFTfootnote:[Barrel shift when `FAST_SHIFT_EN` is enabled.]: 4; TINY_SHIFTfootnote:[Serial shift when `TINY_SHIFT_EN` is enabled.]: 2..32

| ALU           | `C`   | `c.srli` `c.srai` `c.slli` | 3 + SAfootnote:[Shift amount (0..31).]; FAST_SHIFTfootnote:[Barrel shifter when `FAST_SHIFT_EN` is enabled.]:

| Branches      | `I/E` | `beq` `bne` `blt` `bge` `bltu` `bgeu` | Taken: 5 + MLfootnote:[Memory latency.]; Not taken: 3

| Branches      | `C`   | `c.beqz` `c.bnez`                     | Taken: 5 + MLfootnote:[Memory latency.]; Not taken: 3

| Jumps / Calls | `I/E` | `jal` `jalr`                  | 4 + ML

| Jumps / Calls | `C`   | `c.jal` `c.j` `c.jr` `c.jalr` | 4 + ML

| Memory access | `I/E` | `lb` `lh` `lw` `lbu` `lhu` `sb` `sh` `sw` | 4 + ML

| Memory access | `C`   | `c.lw` `c.sw` `c.lwsp` `c.swsp`           | 4 + ML

| Memory access | `A`   | `lr.w` `sc.w`                             | 4 + ML

| Multiplication | `M`  | `mul` `mulh` `mulhsu` `mulhu` | 2+31+3; FAST_MULfootnote:[DSP-based multiplication; enabled via `FAST_MUL_EN`.]: 5

| Division       | `M`  | `div` `divu` `rem` `remu`     | 22+32+4

| CSR access | `Zicsr` | `csrrw` `csrrs` `csrrc` `csrrwi` `csrrsi` `csrrci` | 4

| System | `I/E`+`Zicsr` | `ecall` `ebreak` | 4

| System | `I/E` | `fence` | 3

| System | `C`+`Zicsr` | `c.break` | 4

| System | `Zicsr` | `mret` `wfi` | 5

| System | `Zifencei` | `fence.i` | 3 + ML

| Floating-point - artihmetic | `Zfinx` | `fadd.s` | 110

| Floating-point - artihmetic | `Zfinx` | `fsub.s` | 112

| Floating-point - artihmetic | `Zfinx` | `fmul.s` | 22

| Floating-point - compare | `Zfinx` | `fmin.s` `fmax.s` `feq.s` `flt.s` `fle.s` | 13

| Floating-point - misc | `Zfinx` | `fsgnj.s` `fsgnjn.s` `fsgnjx.s` `fclass.s` | 12

| Floating-point - conversion | `Zfinx` | `fcvt.w.s` `fcvt.wu.s` | 47

| Floating-point - conversion | `Zfinx` | `fcvt.s.w` `fcvt.s.wu` | 48

| Bit-manipulation - arithmetic/logic | `B(Zbb)` | `sext.b` `sext.h` `min` `minu` `max` `maxu` `andn` `orn` `xnor` `zext`(pack) `rev8`(grevi) `orc.b`(gorci) | 3

| Bit-manipulation - arithmetic/logic | `B(Zba)` | `sh1add` `sh2add` `sh3add` | 3

| Bit-manipulation - shifts | `B(Zbb)` | `clz` `ctz` | 3 + 0..32

| Bit-manipulation - shifts | `B(Zbb)` | `cpop` | 3 + 32

| Bit-manipulation - shifts | `B(Zbb)` | `rol` `ror` `rori` | 3 + SA

| Bit-manipulation - single-bit | `B(Zbs)` | `sbset[i]` `sbclr[i]` `sbinv[i]` `sbext[i]` | 3

| Bit-manipulation - shifted-add | `B(Zba)` | `sh1add` `sh2add` `sh3add` | 3

|=======================

[NOTE]

The presented values of the *floating-point execution cycles* are average values - obtained from

4096 instruction executions using pseudo-random input values. The execution time for emulating the

instructions (using pure-software libraries) is ~17..140 times higher.

<<<

// ####################################################################################################################

include::cpu_csr.adoc[]

<<<

// ####################################################################################################################

:sectnums:

==== Traps, Exceptions and Interrupts

In this document the following nomenclature regarding traps is used:

* _interrupts_ = asynchronous exceptions

* _exceptions_ = synchronous exceptions

* _traps_ = exceptions + interrupts (synchronous or asynchronous exceptions)

Whenever an exception or interrupt is triggered, the CPU transfers control to the address stored in `mtvec`

CSR. The cause of the according interrupt or exception can be determined via the content of `mcause`

CSR. The address that reflects the current program counter when a trap was taken is stored to `mepc` CSR.

Additional information regarding the cause of the trap can be retrieved from `mtval` CSR.

The traps are prioritized. If several _exceptions_ occur at once only the one with highest priority is triggered

while all remaining exceptions are ignored. If several _interrupts_ trigger at once, the one with highest priority

is serviced first while the remaining ones stay _pending_. After completing the interrupt handler the interrupt with

the second highest priority will get serviced and so on until no further interrupt are pending.

.Interrupt Signal Requirements

[IMPORTANT]

All interrupts request signals (including FIRQs) are **high-active**. A request has to stay at high-level (=asserted)

until it is explicitly acknowledged by the CPU software (for example by writing to a specific memory-mapped register).

.Instruction Atomicity

[NOTE]

All instructions execute as atomic operations - interrupts can only trigger between two instructions.

So if there is a permanent interrupt request, exactly one instruction from the interrupt program will be executed before

a new interrupt handler can start.

:sectnums:

==== Memory Access Exceptions**

If a load operation causes any exception, the instruction's destination register is

_not written_ at all. Load exceptions caused by a misalignment or a physical memory protection fault do not

trigger a bus read-operation at all. Exceptions caused by a store address misalignment or a store physical

memory protection fault do not trigger a bus write-operation at all.

:sectnums:

==== Custom Fast Interrupt Request Lines

As a custom extension, the NEORV32 CPU features 16 fast interrupt request (FIRQ) lines via the `firq_i` CPU top

entity signals. These interrupts have custom configuration and status flags in the `mie` and `mip` CSRs and also

provide custom trap codes in `mcause`. These FIRQs are reserved for NEORV32 processor-internal usage only.

<<<

// ####################################################################################################################

:sectnums!:

===== NEORV32 Trap Listing

.NEORV32 trap listing

[cols="3,6,5,14,11,4,4"]

[options="header",grid="rows"]

|=======================

| Prio. | `mcause` | [RISC-V] | ID [C] | Cause | `mepc` | `mtval`

| 1  | `0x00000000` | 0.0  | _TRAP_CODE_I_MISALIGNED_ | instruction address misaligned | _B-ADR_ | _PC_

| 2  | `0x00000001` | 0.1  | _TRAP_CODE_I_ACCESS_     | instruction access fault | _B-ADR_ | _PC_

| 3  | `0x00000002` | 0.2  | _TRAP_CODE_I_ILLEGAL_    | illegal instruction | _PC_ | _Inst_

| 4  | `0x0000000B` | 0.11 | _TRAP_CODE_MENV_CALL_    | environment call from M-mode (`ecall` in machine-mode) | _PC_ | _PC_

| 5  | `0x00000008` | 0.8  | _TRAP_CODE_UENV_CALL_    | environment call from U-mode (`ecall` in user-mode) | _PC_ | _PC_

| 6  | `0x00000003` | 0.3  | _TRAP_CODE_BREAKPOINT_   | breakpoint (EBREAK) | _PC_ | _PC_

| 7  | `0x00000006` | 0.6  | _TRAP_CODE_S_MISALIGNED_ | store address misaligned | _B-ADR_ | _B-ADR_

| 8  | `0x00000004` | 0.4  | _TRAP_CODE_L_MISALIGNED_ | load address misaligned | _B-ADR_ | _B-ADR_

| 9  | `0x00000007` | 0.7  | _TRAP_CODE_S_ACCESS_     | store access fault | _B-ADR_ | _B-ADR_

| 10 | `0x00000005` | 0.5  | _TRAP_CODE_L_ACCESS_     | load access fault | _B-ADR_ | _B-ADR_

| 11 | `0x80000010` | 1.16 | _TRAP_CODE_FIRQ_0_       | fast interrupt request channel 0 | _I-PC_ | _0_

| 12 | `0x80000011` | 1.17 | _TRAP_CODE_FIRQ_1_       | fast interrupt request channel 1 | _I-PC_ | _0_

| 13 | `0x80000012` | 1.18 | _TRAP_CODE_FIRQ_2_       | fast interrupt request channel 2 | _I-PC_ | _0_

| 14 | `0x80000013` | 1.19 | _TRAP_CODE_FIRQ_3_       | fast interrupt request channel 3 | _I-PC_ | _0_

| 15 | `0x80000014` | 1.20 | _TRAP_CODE_FIRQ_4_       | fast interrupt request channel 4 | _I-PC_ | _0_

| 16 | `0x80000015` | 1.21 | _TRAP_CODE_FIRQ_5_       | fast interrupt request channel 5 | _I-PC_ | _0_

| 17 | `0x80000016` | 1.22 | _TRAP_CODE_FIRQ_6_       | fast interrupt request channel 6 | _I-PC_ | _0_

| 18 | `0x80000017` | 1.23 | _TRAP_CODE_FIRQ_7_       | fast interrupt request channel 7 | _I-PC_ | _0_

| 19 | `0x80000018` | 1.24 | _TRAP_CODE_FIRQ_8_       | fast interrupt request channel 8 | _I-PC_ | _0_

| 20 | `0x80000019` | 1.25 | _TRAP_CODE_FIRQ_9_       | fast interrupt request channel 9 | _I-PC_ | _0_

| 21 | `0x8000001a` | 1.26 | _TRAP_CODE_FIRQ_10_      | fast interrupt request channel 10 | _I-PC_ | _0_

| 22 | `0x8000001b` | 1.27 | _TRAP_CODE_FIRQ_11_      | fast interrupt request channel 11 | _I-PC_ | _0_

| 23 | `0x8000001c` | 1.28 | _TRAP_CODE_FIRQ_12_      | fast interrupt request channel 12 | _I-PC_ | _0_

| 24 | `0x8000001d` | 1.29 | _TRAP_CODE_FIRQ_13_      | fast interrupt request channel 13 | _I-PC_ | _0_

| 25 | `0x8000001e` | 1.30 | _TRAP_CODE_FIRQ_14_      | fast interrupt request channel 14 | _I-PC_ | _0_

| 26 | `0x8000001f` | 1.31 | _TRAP_CODE_FIRQ_15_      | fast interrupt request channel 15 | _I-PC_ | _0_

| 27 | `0x8000000B` | 1.11 | _TRAP_CODE_MEI_          | machine external interrupt | _I-PC_ | _0_

| 28 | `0x80000003` | 1.3  | _TRAP_CODE_MSI_          | machine software interrupt | _I-PC_ | _0_

| 29 | `0x80000007` | 1.7  | _TRAP_CODE_MTI_          | machine timer interrupt | _I-PC_ | _0_

|=======================

**Notes**

The "Prio." column shows the priority of each trap. The highest priority is 1. The "`mcause`" column shows the

cause ID of the according trap that is written to `mcause` CSR. The "[RISC-V]" columns show the interrupt/exception code value from the

official RISC-V privileged architecture manual. The "[C]" names are defined by the NEORV32 core library (`sw/lib/include/neorv32.h`) and can

be used in plain C code. The "`mepc`" and "`mtval`" columns show the value written to