An Introduction to the RISC-V Architecture

Drew Barbier - Sr. Product Marketing Manager

Date May, 2019
 About This Presentation

This presentation is targeted at embedded developers who want to

learn more about RISC-V

At the end of this presentation you should have a basic

understanding of RISC-V fundamentals and know where to find
more information

2
 3-Part Webinar Series

May 7th May 15th May 23rd

An Introduction to the SiFive’s 2 Series Core IP From a Custom 2 Series

RISC-V Architecture Core to Hello World in
30 Minutes

https://info.sifive.com/risc-v-second-webinar-series

3
 How To Ask Questions

4
RISC-V Introduction
 RISC-V Origin Story (pronounced: risk five)

• Started as a “3-month project” in 2010 at UC Berkeley

– Required a simple ISA which could be extended
– Commercial ISAs were too complex and presented IP legal
issues

What is RISC-V?
• A high-quality, license-free, royalty-free RISC ISA
• Standard maintained by the non-profit RISC-V Foundation
• Suitable for all types of computing systems
– From Microcontrollers to Supercomputers
• RISC-V is available freely under a permissive license
• RISC-V is not…
– A Company Andrew
Waterman
Yunsup Lee Krste Asanovic

– A CPU implementation
Inventors of RISC-V

6
 RISC-V Foundation – riscv.org

• RISC-V Foundation is a non-profit

organization formed in August
2015 to publicly govern the ISA

• Foundation Functions
– Directs future development of ISA
– Compliance tests
– Promotion of the ISA

• >230 members representing a

wide range of markets

7
RISC-V foundation now > 230 members. Free, open, extensible ISA for all computing devices

8
 Status of the RISC-V Specifications

• User Mode - version 2.2 Ratified

– Frozen in 2014 at version 2.0
– Updates since 2.0:
• CSR and FENCE.I instructions moved out
of base extension “I”
• Memory model clarifications
• Privilege Mode - version 1.11 Ratified
– Version 1.11 ratified May 2019
• Debug Spec - version 0.13 Ratified
• Specifications in Progress
– Hypervisor Extension - version 0.3 Draft
– Vector Extension - version 0.7 Draft
– And many more
• Participate - https://riscv.org
– Join the mailing list
– Become a member

9
RISC-V Basics
 RISC-V Instruction Set Architectures

• RISC-V uses a standard naming convention to

describe the ISAs supported in a given
implementation

• ISA Name format: RV[###][abc…..xyz]

– RV – Indicates a RISC-V architecture
– [###] - {32, 64, 128} indicate the width of the
integer register file and the size of the user
address space
– [abc…xyz] – Used to indicate the set of
extensions supported by an implementation.

11
 The Standard Extensions

• Extensions define instructions

– “I” for Integer is the only required extension in a RISC-V Extension Description
implementation and defines 40 instructions I Integer
• The RISC-V Specification defines a number of “Standard
M Integer Multiplication and Division
Extensions”
– Standard Extensions are defined by the RISC-V Foundation A Atomics
and are optional F Single-Precision Floating Point
• RISC-V allows for custom, “Non-Standard”, extensions in D Double-Precision Floating Point
an implementation
• Putting it all together (examples) G General Purpose = IMAFD
– RV32I – The most basic RISC-V implementation C 16-bit Compressed Instructions
– RV32IMAC – Integer + Multiply + Atomic + Compressed Non-Standard User-Level Extensions
– RV64GC – 64bit IMAFDC
– RV64GCXext – IMAFDC + a non-standard extension Xext Non-standard extension “ext”
Common RISC-V Standard Extensions
*Not a complete list

12
 Register File

• RV32I/64I have 32 Integer Registers Register ABI Name Description Saver

– Optional 32 FP registers with the F x0 zero Hard-wired zero -

and D extensions x1 ra Return address Caller
– RV32E reduces the register file to 16 x2 sp Stack pointer Callee
integer registers for area constrained x3 gp Global pointer -
embedded devices x4 tp Thread pointer -
• Width of Registers is determined by ISA x5-7 t0-2 Temporaries Caller
• RISC-V Application Binary Interface (ABI) x8 s0/fp Saved register/Frame pointer Callee
defines standard functions for registers x9 s1 Saved register Callee
– Allows for software interoperability x10-11 a0-1 Function Arguments/return Caller
• Development tools usually use ABI names values
for simplicity x12-17 a2-7 Function arguments Caller
x18-27 s2-11 Saved registers Callee
x28-31 t3-6 Temporaries Caller

13
 RISC-V Modes

RISC-V Modes
Level Name Abbr.
• RISC-V Privileged Specification defines 3 levels of 0 User/Application U
privilege, called Modes
1 Supervisor S
2 Hypervisor HS
• Machine mode is the highest privileged mode and the
3 Machine M
only required mode
– Flexibility allows for a range of targeted
implementations from simple MCUs to Supported Combinations of Modes
high-performance Application Processors
Supported Levels Modes
1 M
• Machine, Hypervisor, Supervisor modes each have Control
2 M, U
and Status Registers (CSRs)
– More on these later 3 M, S, U
4 M, HS, S, U

14
RISC-V Instructions
 Base Integer ISA Encoding

• 32-bit fixed-width, naturally aligned instructions

• rd/rs1/rs2 in fixed location, no implicit registers
• Immediate field (instr[31]) always sign-extended
• Instruction Encoding Types
– R-type – Register
– I-type – Immediate
– S-type – Stores
– U-Type – Loads with immediate
• Reserved opcode space for custom instructions
– This opcode space will not be used by future
standard extensions
– instr[6:0] = 0b0001011 and 0b0101011

16
 RISC-V Reference Card

17
 RISC-V Reference Card

18
 Compressed Instructions (C Extension)

• Most base integer instructions “Compress”

to 16-bit equivalents
– 1:1 mapping of compressed instructions to standard
I’m mostly
instructions
embedded flash
• Smaller code size can reduce cost in
embedded systems
– Directly resulting in smaller Flash/ROM/RAM
• Smaller code size can increase performance
and reduce power
– Better utilization of Cache RAMs
– Fewer transactions across high power interfaces (DRAM,
Flash, etc…)
• RV64 can also use the C Extension A Microcontroller

19
 Code Size Comparison - SpecInt 2006

• RISC-V is smallest ISA for 32- and 64-bit processors in SpecInt2k6

• All results with same GCC compiler and options

20
 Atomics (A Extension)

• Atomic memory operations (AMO) perform

Read-Modify-Write operations in a single
Atomic instruction li t0, 1 # Initialize swap value.
again:
– Logical, Arithmetic, Swap amoswap.w.aq t0, t0, (a0) # Attempt to acquire
lock.
– Acquire (aq) and Release (rl) bits for bnez t0, again # Retry if held.

release consistency # ...

# Critical section.
# ...
amoswap.w.rl x0, x0, (a0) # Release lock by
storing 0.

• Load-Reserved/Store-Conditional pairs
Example RISC-V Spinlock
– Guaranteed forward progress for short
sequences

21
 Fence Instructions

• Fences are used to enforce program order Predecessor Load/Store

on device I/O and memory accesses

• FENCE instruction format Fence

– FENCE predecessor, successor
– Predecessor/successor can be
• R,W,I,O
Successor Load/Store
– FENCE RWIO, RWIO – full barrier

22
 CSR and ECALL Instructions

• Control and Status Registers (CSRs) have their own dedicated

instructions :
– Read/Write
– Read and Set bit
– Read and Clear bit
• Environment Call instruction used to transfer control to the
execution environment and a higher privileged mode
– Triggers a synchronous Interrupt (discussed later)
– Example: User mode program can use an ECALL to transfer control to
a Machine mode OS kernel, aka System Call

23
RISC-V Control and Status Registers (CSR)
 What are Control and Status Registers (CSRs)

• CSRs are Registers which contain the working

state of a RISC-V machine

• CSRs are specific to a Mode

– Machine Mode has ~17 CSRs (not including performance
monitor CSRs)
– Supervisor Mode has a similar number, though most are
subsets of their equivalent Machine Mode CSRs
• Machine Mode can also access Supervisor CSRs

• CSRs are defined in the RISC-V privileged

specification
– We will cover a few key CSRs here

25
 Identification CSRs

• misa – Machine ISA Register

– Reports the ISA supported by the hart (i.e.
RV32IMAC)
–
• mhartid – Machine hart ID
– Integer ID of the Hardware Thread
–
• mvendorid – Machine Vendor ID
– JEDEC Vendor ID
–
• marchid – Machine Architecture ID
– Used along with mvendorid to identify a
implementation. No format specified
–
• mimpid - Machine Implementation ID
– Implementation defined format

26
 Machine Status (mstatus) - The Most Important CSR

Control and track the hart’s current operating state

Bits Field Name Description Bits Field Name Description

0 UIE User Interrupt Enable [14:13] FS Floating Point State
1 SIE Supervisor Interrupt Enable [16:15] XS User Mode Extension State
2 Reserved 17 MPRIV Modify Privilege (access memory as MPP)
3 MIE Machine Interrupt Enable 18 SUM Permit Supervisor User Memory Access
4 UPIE User Previous Interrupt Enable 19 MXR Make Executable Readable
5 SPIE Supervisor Previous Interrupt Enable 20 TVM Trap Virtual memory
6 Reserved 21 TW Timeout Wait (traps S-Mode wfi)
7 MPIE Machine Previous Interrupt Enabler 22 TSR Trap SRET
8 SPP Supervisor Previous Privilege [23:30] Reserved
[10:9] Reserved [31] SD State Dirty (FS and XS summary bit)
[12:11] MPP Machine Previous Privilege

RV32 mstatus CSR

27
 Timer CSRs

• mtime • mtimecmp
– RISC-V defines a requirement – RISC-V defines a memory
for a counter exposed as a mapped timer compare
memory mapped register register
– There is no frequency – Triggers an interrupt when
requirement on the timer, but mtime is greater than or
• It must run at a constant
frequency equal to mtimecmp
• The platform must expose
frequency

Bits Field Name Description Bits Field Name Description

[63:0] mtime Machine Time Register [63:0] mtimecmp Machine Time Compare Register
mtime CSR mtimecmp CSR

28
 Supervisor CSRs

• Most of the Machine mode CSRs have

Supervisor mode equivalents
– Supervisor mode CSRs can be used to control the Bits Field Name Description
state of Supervisor and User Modes. [21:0] PPN Physical Page Number of the root page table
– Most equivalent Supervisor CSRs have the same [30:22] ASID Address Space Identifier
mapping as Machine mode without Machine 31 MODE MODE=1 uses Sv32 Address Translation
mode control bits RV32 satp CSR
– sstatus, stvec, sip, sie, sepc, scause, satp, and
more Bits Field Name Description
• satp - Supervisor Address Translation and [43:0] PPN Physical Page Number of the root page table
Protection Register [59:44] ASID Address Space Identifier
– Used to control Supervisor mode address [63:60] MODE Encodings for Sv32, Sv39, Sv48
translation and protection RV64 satp CSR

29
 Virtual Memory

0xFFFF_FFFF 0xFFFF_FFFF
• RISC-V has support for Virtual Memory
allowing for sophisticated memory
management and OS support (Linux)

• Requires an S-Mode implementation

• Sv32 Physical
– 32bit Virtual Address Address
– 4KiB, 4MiB page tables (2 Levels)
• Sv39 (requires an RV64 implementation)
– 39bit Virtual Address
– 4KiB, 2MiB, 1GiB page tables (3 Levels)
• Sv48 (requires an RV64 implementation)
– 48bit Virtual Address
– 4KiB, 2MiB, 1 GiB, 512GB page tables (4 Levels)
• Page Tables also contain access permission Virtual
attributes 0x0000_0000 Address 0x0000_0000

Virtual Address Map Physical Address Map

30
 Physical Memory Protection (PMP)

• Can be used to enforce access 0xFFFF_FFFF

restrictions on less privileged modes 4 Byte Region Locked.
– Prevent Supervisor and User Only accessible after a Locked Region
Mode software from accessing reset

unwanted memory
User Mode has full User Mode
RWX Privileges
Context
• Up to 16 regions with a minimum Can define
region size of 4 bytes entire address
map as not
accessible
User Mode has Read to U-Mode in 1
only Privileges User Mode Data register
• Ability to Lock a region
– A locked region enforces
permissions on all accesses, User Mode has Shared Library
including M-Mode Execute only Privileges
Code
– Only way to unlock a region is a
Reset 0x0000_0000
Example PMP Memory Map

31
RISC-V Interrupts
 RISC-V Interrupts

• RISC-V defines the following interrupts per Hart

– Software – architecturally defined software interrupt
– Timer – architecturally defined timer interrupt
– External – Peripheral Interrupts
– Local - Hart specific Peripheral Interrupts

• Optionally per privilege level

– Can have Supervisor Software/Timer/Machine
Interrupts
– Can have User Software/Timer/Machine

• Local interrupts are optional and implementation

specific
– Can be used for hart-specific peripheral interrupts
– Useful for latency-sensitive embedded systems or
small embedded systems with a small number of
interrupts

33
 Machine Status (mstatus) – As it relates to Interrupts

Bits Field Name Description Bits Field Name Description

0 UIE User Interrupt Enable [14:13] FS Floating Point State
1 SIE Supervisor Interrupt Enable [16:15] XS User Mode Extension State
2 Reserved 17 MPRIV Modify Privilege (access memory as MPP)
3 MIE Machine Interrupt Enable 18 SUM Permit Supervisor User Memory Access
4 UPIE User Previous Interrupt Enable 19 MXR Make Executable Readable
5 SPIE Supervisor Previous Interrupt Enable 20 TVM Trap Virtual memory
6 Reserved 21 TW Timeout Wait (traps S-Mode wfi)
7 MPIE Machine Previous Interrupt Enabler 22 TSR Trap SRET
8 SPP Supervisor Previous Privilege [23:30] Reserved
[10:9] Reserved [31] SD State Dirty (FS and XS summary bit)
[12:11] MPP Machine Previous Privilege

RV32 mstatus CSR

• M/S/U IE – Global Interrupt Enables for Modes which supports interrupts

• M/S/U PIE – Encodes the state of interrupt enables prior to an interrupt.
– These bits can also be written to in order to enable interrupts when returning to lower privilege modes
• M/S PP – Encodes the privilege level prior to the previous interrupt
– These bits can also be written to in order to enter a lower privilege mode when executing MRET or SRET instructions

34
 Machine Interrupt Cause CSR (mcause)

Interrupt = 0 (exception)
• Interrupts are identified by reading the Exception Description
Code
mcause CSR
0 Instruction Address Misaligned
• The interrupt field determines if a trap Interrupt = 1 (interrupt)
1 Instruction Access Fault
was caused by an interrupt or an Exception Description
2 Illegal Instruction
Code
exception 3 Breakpoint
0 User Software Interrupt
4 Load Address Misaligned
1 Supervisor Software Interrupt
2 Reserved 5 Load Access Fault

3 Machine Software Interrupt 6 Store/AMO Address Misaligned

Bits Field Name Description
4 User Timer Interrupt 7 Store/AMO Access Fault
XLEN-1 Interrupt Identifies if an interrupt was
5 Supervisor Timer Interrupt 8 Environment Call from U-mode
synchronous or asynchronous
[XLEN-2:0] Exception Code Identifies the exception 6 Reserved 9 Environment Call from S-mode

mcause CSR 7 Machine Timer Interrupt 10 Reserved

8 User External Interrupt 11 Environment Call from M-mode

9 Supervisor External Interrupt 12 Instruction Page Fault

10 Reserved 13 Load Page Fault
11 Machine External Interrupt 14 Reserved
12 - 15 Reserved 15 Store/AMO Page Fault
≥16 Local Interrupt X ≥16 Reserved
35
 Machine Interrupt-Enable and Pending CSRs (mie, mip)

• mie used to enable/disable a given

Bits Field Name Description
interrupt 0 USIE User Software Interrupt Enable
• mip indicates which interrupts are 1 SSIE Supervisor Software Interrupt Enable

currently pending 2 Reserved

3 MSIE Machine Software Interrupt Enable
– Can be used for polling 4 UTIE User Timer Interrupt Enable

• Lesser-privilege bits in mip are writeable 5 STIE Supervisor Timer Interrupt Enable
6 Reserved
– i.e. Machine-mode software can be used to 7 MTIE Machine Timer Interrupt Enable
generate a supervisor interrupt by setting the 8 UEIE User External Interrupt Enable
STIP bit 9 SEIE Supervisor External Interrupt Enable

• mip has the same mapping as mie 10 Reserved

11 MEIE Machine External Interrupt Enable
12-15 Reserved
≥16 LIE Local Interrupt Enable
mie CSR

36
 Machine Trap Vector CSR (mtvec)

mtvec sets the Base interrupt vector and the interrupt Mode

Bits Field Name Description mtvec Modes

[XLEN-1:6] Base Machine Trap Vector Base Address. Value Name Description
64-byte Alignment
0x0 Direct All Exceptions set PC to mtvec.BASE
[1:0] Mode MODE Sets the interrupt processing Requires 4-Byte alignment
mode.
0x1 Vectored Asynchronous interrupts set pc to
mtvec CSR mtvec.BASE + (4×mcause.EXCCODE)
Requires 4-Byte alignment
• mtvec.Mode = Direct > 0x01 Reserved
– All Interrupts trap to the address mtvec.Base
– Software must read the mcause CSR and react accordingly
• mtvec.Vectored
– Interrupts trap to the address mtvec.Base + (4*mcause.ExCode)
– Eliminates the need to read mcause for asynchronous exceptions

37
 Trap Handler – Entry and Exit
mtevc.MODE = Direct

• On entry, the RISC-V hart will

– Save the current state • Typical trap handler software will

PC MEPC Push Registers

Priv mstatus.MPP …
interrupt = mcause.msb
MIE mstatus.MPIE
if interrupt
branch isr_handler[mcause.code]
else
– Then set PC = mtvec, mstatus.MIE = 0 branch exception_handler[mcause.code]
…
Pop Registers
MRET
• MRET instruction restores state
Interrupt handler pseudo code

PC MEPC
Priv mstatus.MPP

MIE mstatus.MPIE

38
 Interrupt Handler Code

RISC-V Assembly interrupt handler C Code Handler determines interrupt cause and branches to the appropriate
to Push and Pop register file function

void handle_trap()
.align 2
{
.global trap_entry
trap_entry: unsigned long mcause = read_csr(mcause);
addi sp, sp, -16*REGBYTES if (mcause & MCAUSE_INT) {
//mask interrupt bit and branch to handler
//store ABI Caller Registers isr_handler[mcause & MCAUSE_CAUSE] ();
STORE x1, 0*REGBYTES(sp)
STORE x5, 2*REGBYTES(sp) } else {
… //branch to handler
STORE x30, 14*REGBYTES(sp) exception_handler[mcause]();
STORE x31, 15*REGBYTES(sp) }
//call C Code Handler }
call handle_trap

//restore ABI Caller Registers //write trap_entry address to mtvec

LOAD x1, 0*REGBYTES(sp) write_csr(mtvec, ((unsigned long)&trap_entry));
LOAD x5, 2*REGBYTES(sp)
…
LOAD x30, 14*REGBYTES(sp)
LOAD x31, 15*REGBYTES(sp)

addi sp, sp, 16*REGBYTES

mret

39
 Compiler Interrupt Attribute

• Pushing and Popping Registers in Assembly Interrupt handler with interrupt attribute.
No assembly Code necessary
is a pain
void handle_trap(void) __attribute((interrupt));
void handle_trap()
• The interrupt attribute was added to GCC {

to facilitate interrupt handlers written unsigned long mcause = read_csr(mcause);

if (mcause & MCAUSE_INT) {
entirely in C //mask interrupt bit and branch to handler
isr_handler[mcause & MCAUSE_CAUSE] ();
– Interrupt functions only saves/restores } else {

necessary registers onto the stack //synchronous exception, branch to handler

exception_handler[mcause & MCAUSE_CAUSE]();
– Align function on an 8-byte boundary }
}
– Calles MRET after popping register file back
off the stack //write handle_trap address to mtvec
write_csr(mtvec, ((unsigned long)&handle_trap));

40
 RISC-V Global Interrupts

• RISC-V defines Global Interrupts as a

Interrupt which can be routed to any
hart in a system

• Global Interrupts are prioritized and

distributed by the Platform Level
Interrupt Controller (PLIC)

• The PLIC is connected to the External

Interrupt signal for 1 or more harts in
an implementation

41
 PLIC Interrupt Code Example
• In this example an interrupt is presented to the PLIC
• The PLIC signals an interrupt to a hart using the Machine External Interrupt (interrupt 11)
• The interrupt handler (handle_trap) branches to the defined function to handle the Machine External Interrupt
– C Code placed the address of machine_external_interrupt function in location 11 of the async_handler vector table
• The machine_external_interrupt handler does the following:
– Reads the PLIC’s claim/complete register to determine highest priority pending interrupt
– Uses another vector table to branch to the interrupt’s specific handler
– Completes the interrupt by writing the interrupt number back to the PLIC’s claim/complete

void handle_trap(void) __attribute((interrupt)); void machine_external_interrupt()

void handle_trap()
{
{
unsigned long mcause = read_csr(mcause); //get the highest priority pending PLIC interrupt
if (mcause & MCAUSE_INT) { uint32_t int_num = plic.claim_comlete;
//mask interrupt bit and branch to handler //branch to handler
isr_handler[mcause & MCAUSE_CAUSE] (); plic_handler[int_num]();
} else { //complete interrupt by writing interrupt number
//synchronous exception, branch to handler back to PLIC
exception_handler[mcause & MCAUSE_CAUSE](); plic.claim_complete = int_num;
} }
}

//install PLIC handler at MEIP Location

isr_handler[11] = machine_external_interrupt;
//write trap_entry address to mtvec
write_csr(mtvec, ((unsigned long)&handle_trap));

42
 RISC-V Interrupt System Architecture (M-mode only example)

43
More Information
 Resources

• https://riscv.org/
– RISC-V Specifications
– Links to the RISC-V mailing lists
– Workshop proceedings

• GitHub
– https://github.com/sifive/
– https://github.com/riscv

• https://www.sifive.com/
– RISC-V IP and Development Boards
– RISC-V Tools
– Forums

45
 3-Part Webinar Series

May 7th May 15th May 23rd

An Introduction to the SiFive’s 2 Series Core IP From a Custom 2 Series

RISC-V Architecture Core to Hello World in
30 Minutes

https://info.sifive.com/risc-v-second-webinar-series

46
Questions?