riscv-privileged-v1.10

TheRISC-VInstructionSetManualVolumeII:PrivilegedArchitecturePrivilegedArchitectureVersion1.10DocumentVersion1.10Warning!ThisdraftspecificationmaychangebeforebeingacceptedasstandardbytheRISC-VFoundation.Whiletheeditorsintendfuturechangestothisspecificationtobeforwardcompatible,itremainspossiblethatimplementationsmadetothisdraftspecificationwillnotconformtothefuturestandard.Editors:AndrewWaterman1,KrsteAsanović1,21SiFiveInc.,2CSDivision,EECSDepartment,UniversityofCalifornia,Berkeleyandrew@sifive.com,krste@berkeley.eduMay7,2017Contributorstoallversionsofthespecinalphabeticalorder(pleasecontacteditorstosuggestcorrections):KrsteAsanović,RimasAvižienis,JacobBachmeyer,AllenJ.Baum,PaoloBonzini,RuslanBukin,ChristopherCelio,DavidChisnall,AnthonyCoulter,PalmerDabbelt,MonteDal-rymple,DennisFerguson,MikeFrysinger,JohnHauser,DavidHorner,OlofJohansson,YunsupLee,AndrewLutomirski,JonathanNeuschäfer,RishiyurNikhil,StefanO’Rear,AlbertOu,JohnOusterhout,DavidPatterson,ColinSchmidt,WesleyTerpstra,MattThomas,TommyThorn,RayVanDeWalker,MeganWachs,AndrewWaterman,andReinoudZandijk.ThisdocumentisreleasedunderaCreativeCommonsAttribution4.0InternationalLicense.ThisdocumentisaderivativeoftheRISC-Vprivilegedspecificationversion1.9.1releasedunderfollowinglicense:c©2010–2017AndrewWaterman,YunsupLee,RimasAvižienis,DavidPatterson,KrsteAsanović.CreativeCommonsAttribution4.0InternationalLicense.Pleaseciteas:“TheRISC-VInstructionSetManual,VolumeII:PrivilegedArchitecture,Version1.10”,EditorsAndrewWatermanandKrsteAsanović,RISC-VFoundation,May2017.PrefaceThisisversion1.10oftheRISC-Vprivilegedarchitectureproposal.Changesfromversion1.9.1include:•ThepreviousversionofthisdocumentwasreleasedunderaCreativeCommonsAttribution4.0InternationalLicencebytheoriginalauthors,andthisandfutureversionsofthisdocumentwillbereleasedunderthesamelicence.•TheexplicitconventiononshadowCSRaddresseshasbeenremovedtoreclaimCSRspace.ShadowCSRscanstillbeaddedasneeded.•ThemvendoridregisternowcontainstheJEDECcodeofthecoreproviderasopposedtoacodesuppliedbytheFoundation.ThisavoidsredundancyandoffloadsworkfromtheFoundation.•Theinterrupt-enablestackdisciplinehasbeensimplified.•AnoptionalmechanismtochangethebaseISAusedbysupervisorandusermodeshasbeenaddedtothemstatusCSR,andthefieldpreviouslycalledBaseinmisahasbeenrenamedtoMXLforconsistency.•ClarifiedexpecteduseofXStosummarizeadditionalextensionstatestatusfieldsinmstatus.•OptionalvectoredinterruptsupporthasbeenaddedtothemtvecandstvecCSRs.•TheSEIPandUEIPbitsinthemipCSRhavebeenredefinedtosupportsoftwareinjectionofexternalinterrupts.•Thembadaddrregisterhasbeensubsumedbyamoregeneralmtvalregisterthatcannowcapturebadinstructionbitsonanillegalinstructionfaulttospeedinstructionemulation.•Themachine-modebase-and-boundstranslationandprotectionschemeshavebeenremovedfromthespecificationaspartofmovingthevirtualmemoryconfigurationtosptbr(nowsatp).SomeofthemotivationforthebaseandboundschemesarenowcoveredbythePMPregisters,butspaceremainsavailableinmstatustoaddthesebackatalaterdateifdeemeduseful.•InsystemswithonlyM-mode,orwithbothM-modeandU-modebutwithoutU-modetrapsupport,themedelegandmidelegregistersnowdonotexist,whereaspreviouslytheyreturnedzero.•Virtual-memorypagefaultsnowhavemcausevaluesdistinctfromphysical-memoryaccessexceptions.Page-faultexceptionscannowbedelegatedtoS-modewithoutdelegatingexcep-tionsgeneratedbyPMAandPMPchecks.•Anoptionalphysical-memoryprotection(PMP)schemehasbeenproposed.•Thesupervisorvirtualmemoryconfigurationhasbeenmovedfromthemstatusregistertothesptbrregister.Accordingly,thesptbrregisterhasbeenrenamedtosatp(SupervisoriiiVolumeII:RISC-VPrivilegedArchitecturesV1.10AddressTranslationandProtection)toreflectisbroadenedrole.•TheSFENCE.VMinstructionhasbeenremovedinfavoroftheimprovedSFENCE.VMAinstruction.•ThemstatusbitMXRhasbeenexposedtoS-modeviasstatus.•ThepolarityofthePUMbitinsstatushasbeeninvertedtoshortencodesequencesinvolvingMXR.ThebithasbeenrenamedtoSUM.•Hardwaremanagementofpage-tableentryAccessedandDirtybitshasbeenmadeoptional;simplerimplementationsmaytraptosoftwaretosetthem.•Thecounter-enableschemehaschanged,sothatS-modecancontrolavailabilityofcounterstoU-mode.•H-modehasbeenremoved,aswearefocusingonrecursivevirtualizationsupportinS-mode.Theencodingspacehasbeenreservedandmayberepurposedatalaterdate.•AmechanismtoimprovevirtualizationperformancebytrappingS-modevirtual-memorymanagementoperationshasbeenadded.•TheSupervisorBinaryInterface(SBI)chapterhasbeenremoved,sothatitcanbemaintainedasaseparatespecification.VolumeII:RISC-VPrivilegedArchitecturesV1.10iiiPrefacetoVersion1.9.1Thisisversion1.9.1oftheRISC-Vprivilegedarchitectureproposal.Changesfromversion1.9include:•Numerousadditionsandimprovementstothecommentarysections.•ChangeconfigurationstringproposaltobeuseasearchprocessthatsupportsvariousformatsincludingDeviceTreeStringandflattenedDeviceTree.•MademisaoptionallywritabletosupportmodifyingbaseandsupportedISAextensions.CSRaddressofmisachanged.•AddeddescriptionofdebugmodeanddebugCSRs.•Addedahardwareperformancemonitoringscheme.Simplifiedthehandlingofexistinghard-warecounters,removingprivilegedversionsofthecountersandthecorrespondingdeltareg-isters.•FixeddescriptionofSPIEinpresenceofuser-levelinterrupts.ivVolumeII:RISC-VPrivilegedArchitecturesV1.10ContentsPrefacei1Introduction11.1RISC-VHardwarePlatformTerminology........................11.2RISC-VPrivilegedSoftwareStackTerminology.....................21.3PrivilegeLevels.......................................31.4DebugMode........................................52ControlandStatusRegisters(CSRs)72.1CSRAddressMappingConventions...........................72.2CSRListing.........................................92.3CSRFieldSpecifications..................................133Machine-LevelISA,version1.10153.1Machine-LevelCSRs....................................153.1.1MachineISARegistermisa............................153.1.2MachineVendorIDRegistermvendorid.....................183.1.3MachineArchitectureIDRegistermarchid...................183.1.4MachineImplementationIDRegistermimpid..................193.1.5HartIDRegistermhartid.............................193.1.6MachineStatusRegister(mstatus)........................193.1.7PrivilegeandGlobalInterrupt-EnableStackinmstatusregister.......20vviVolumeII:RISC-VPrivilegedArchitecturesV1.103.1.8BaseISAControlinmstatusRegister......................213.1.9MemoryPrivilegeinmstatusRegister......................223.1.10VirtualizationSupportinmstatusRegister...................223.1.11ExtensionContextStatusinmstatusRegister.................233.1.12MachineTrap-VectorBase-AddressRegister(mtvec)..............263.1.13MachineTrapDelegationRegisters(medelegandmideleg)..........273.1.14MachineInterruptRegisters(mipandmie)...................283.1.15MachineTimerRegisters(mtimeandmtimecmp)................303.1.16HardwarePerformanceMonitor..........................313.1.17Counter-EnableRegisters([m|h|s]counteren).................323.1.18MachineScratchRegister(mscratch)......................333.1.19MachineExceptionProgramCounter(mepc)..................343.1.20MachineCauseRegister(mcause)........................343.1.21MachineTrapValue(mtval)Register......................353.2Machine-ModePrivilegedInstructions..........................373.2.1EnvironmentCallandBreakpoint........................373.2.2Trap-ReturnInstructions.............................373.2.3WaitforInterrupt.................................383.3Reset.............................................393.4Non-MaskableInterrupts..................................393.5PhysicalMemoryAttributes................................393.5.1MainMemoryversusI/OversusEmptyRegions................413.5.2SupportedAccessTypePMAs..........................413.5.3AtomicityPMAs..................................413.5.4Memory-OrderingPMAs.............................423.5.5CoherenceandCacheabilityPMAs........................433.5.6IdempotencyPMAs................................443.6PhysicalMemoryProtection................................44VolumeII:RISC-VPrivilegedArchitecturesV1.10vii3.6.1PhysicalMemoryProtectionCSRs........................454Supervisor-LevelISA,Version1.10494.1SupervisorCSRs......................................494.1.1SupervisorStatusRegister(sstatus)......................494.1.2BaseISAControlinsstatusRegister......................504.1.3MemoryPrivilegeinsstatusRegister......................514.1.4SupervisorTrapVectorBaseAddressRegister(stvec).............514.1.5SupervisorInterruptRegisters(sipandsie)..................524.1.6SupervisorTimersandPerformanceCounters..................534.1.7Counter-EnableRegister(scounteren).....................534.1.8SupervisorScratchRegister(sscratch).....................544.1.9SupervisorExceptionProgramCounter(sepc).................544.1.10SupervisorCauseRegister(scause).......................544.1.11SupervisorTrapValue(stval)Register.....................554.1.12SupervisorAddressTranslationandProtection(satp)Register........564.2SupervisorInstructions...................................584.2.1SupervisorMemory-ManagementFenceInstruction...............584.3Sv32:Page-Based32-bitVirtual-MemorySystems...................594.3.1AddressingandMemoryProtection.......................594.3.2VirtualAddressTranslationProcess.......................624.4Sv39:Page-Based39-bitVirtual-MemorySystem....................624.4.1AddressingandMemoryProtection.......................634.5Sv48:Page-Based48-bitVirtual-MemorySystem....................634.5.1AddressingandMemoryProtection.......................645HypervisorExtensions,Version0.0656RISC-VPrivilegedInstructionSetListings67viiiVolumeII:RISC-VPrivilegedArchitecturesV1.107Platform-LevelInterruptController(PLIC)697.1PLICOverview.......................................697.2InterruptSources......................................697.2.1LocalInterruptSources..............................707.2.2GlobalInterruptSources..............................717.3InterruptTargetsandHartContexts...........................717.4InterruptGateways.....................................717.5InterruptIdentifiers(IDs).................................727.6InterruptPriorities.....................................727.7InterruptEnables......................................737.8InterruptPriorityThresholds...............................737.9InterruptNotifications...................................747.10InterruptClaims......................................747.11InterruptCompletion....................................757.12InterruptFlow.......................................757.13PLICCoreSpecification..................................767.14ControllingAccesstothePLIC..............................768MachineConfigurationDescription778.1ConfigurationStringSearchProcedure..........................779History799.1ResearchFundingatUCBerkeley............................79Chapter1IntroductionThisisadraftoftheprivilegedarchitecturedescriptiondocumentforRISC-V.Feedbackwelcome.Changeswilloccurbeforethefinalrelease.ThisdocumentdescribestheRISC-Vprivilegedarchitecture,whichcoversallaspectsofRISC-Vsystemsbeyondtheuser-levelISA,includingprivilegedinstructionsaswellasadditionalfunction-alityrequiredforrunningoperatingsystemsandattachingexternaldevices.Commentaryonourdesigndecisionsisformattedasinthisparagraph,andcanbeskippedifthereaderisonlyinterestedinthespecificationitself.Webrieflynotethattheentireprivileged-leveldesigndescribedinthisdocumentcouldbereplacedwithanentirelydifferentprivileged-leveldesignwithoutchangingtheuser-levelISA,andpos-siblywithoutevenchangingtheABI.Inparticular,thisprivilegedspecificationwasdesignedtorunexistingpopularoperatingsystems,andsoembodiestheconventionallevel-basedprotectionmodel.Alternateprivilegedspecificationscouldembodyothermoreflexibleprotection-domainmodels.1.1RISC-VHardwarePlatformTerminologyARISC-VhardwareplatformcancontainoneormoreRISC-V-compatibleprocessingcoresto-getherwithothernon-RISC-V-compatiblecores,fixed-functionaccelerators,variousphysicalmem-orystructures,I/Odevices,andaninterconnectstructuretoallowthecomponentstocommunicate.Acomponentistermedacoreifitcontainsanindependentinstructionfetchunit.ARISC-V-compatiblecoremightsupportmultipleRISC-V-compatiblehardwarethreads,orharts,throughmultithreading.ARISC-Vcoremighthaveadditionalspecializedinstructionsetextensionsoranaddedcoprocessor.WeusethetermcoprocessortorefertoaunitthatisattachedtoaRISC-VcoreandismostlysequencedbyaRISC-Vinstructionstream,butwhichcontainsadditionalarchitecturalstateandinstructionsetextensions,andpossiblysomelimitedautonomyrelativetotheprimaryRISC-Vinstructionstream.12VolumeII:RISC-VPrivilegedArchitecturesV1.10Weusethetermacceleratortorefertoeitheranon-programmablefixed-functionunitoracorethatcanoperateautonomouslybutisspecializedforcertaintasks.InRISC-Vsystems,weexpectmanyprogrammableacceleratorswillbeRISC-V-basedcoreswithspecializedinstructionsetextensionsand/orcustomizedcoprocessors.AnimportantclassofRISC-VacceleratorsareI/Oaccelerators,whichoffloadI/Oprocessingtasksfromthemainapplicationcores.Thesystem-levelorganizationofaRISC-Vhardwareplatformcanrangefromasingle-coremicro-controllertoamany-thousand-nodeclusterofshared-memorymanycoreservernodes.Evensmallsystems-on-a-chipmightbestructuredasahierarchyofmulticomputersand/ormultiprocessorstomodularizedevelopmenteffortortoprovidesecureisolationbetweensubsystems.Thisdocumentfocusesontheprivilegedarchitecturevisibletoeachhart(hardwarethread)runningwithinauniprocessororashared-memorymultiprocessor.1.2RISC-VPrivilegedSoftwareStackTerminologyThissectiondescribestheterminologyweusetodescribecomponentsofthewiderangeofpossibleprivilegedsoftwarestacksforRISC-V.Figure1.1showssomeofthepossiblesoftwarestacksthatcanbesupportedbytheRISC-Varchi-tecture.Theleft-handsideshowsasimplesystemthatsupportsonlyasingleapplicationrunningonanapplicationexecutionenvironment(AEE).Theapplicationiscodedtorunwithaparticularapplicationbinaryinterface(ABI).TheABIincludesthesupporteduser-levelISAplusasetofABIcallstointeractwiththeAEE.TheABIhidesdetailsoftheAEEfromtheapplicationtoal-lowgreaterflexibilityinimplementingtheAEE.ThesameABIcouldbeimplementednativelyonmultipledifferenthostOSs,orcouldbesupportedbyauser-modeemulationenvironmentrunningonamachinewithadifferentnativeISA.ApplicationABIAEEApplicationABIOSSBISEEApplicationABISBIHypervisorApplicationABIOSApplicationABIApplicationABIOSApplicationABISBIHBIHEEFigure1.1:Differentimplementationstackssupportingvariousformsofprivilegedexecution.Ourgraphicalconventionrepresentsabstractinterfacesusingblackboxeswithwhitetext,toseparatethemfromconcreteinstancesofcomponentsimplementingtheinterfaces.Themiddleconfigurationshowsaconventionaloperatingsystem(OS)thatcansupportmultipro-grammedexecutionofmultipleapplications.EachapplicationcommunicatesoveranABIwiththeOS,whichprovidestheAEE.JustasapplicationsinterfacewithanAEEviaanABI,RISC-Voperatingsystemsinterfacewithasupervisorexecutionenvironment(SEE)viaasupervisorbinaryinterface(SBI).AnSBIcomprisestheuser-levelandsupervisor-levelISAtogetherwithasetofVolumeII:RISC-VPrivilegedArchitecturesV1.103SBIfunctioncalls.UsingasingleSBIacrossallSEEimplementationsallowsasingleOSbinaryimagetorunonanySEE.TheSEEcanbeasimplebootloaderandBIOS-styleIOsysteminalow-endhardwareplatform,orahypervisor-providedvirtualmachineinahigh-endserver,orathintranslationlayeroverahostoperatingsysteminanarchitecturesimulationenvironment.Mostsupervisor-levelISAdefinitionsdonotseparatetheSBIfromtheexecutionenvironmentand/orthehardwareplatform,complicatingvirtualizationandbring-upofnewhardwareplat-forms.Therightmostconfigurationshowsavirtualmachinemonitorconfigurationwheremultiplemulti-programmedOSsaresupportedbyasinglehypervisor.EachOScommunicatesviaanSBIwiththehypervisor,whichprovidestheSEE.Thehypervisorcommunicateswiththehypervisorexecu-tionenvironment(HEE)usingahypervisorbinaryinterface(HBI),toisolatethehypervisorfromdetailsofthehardwareplatform.TheABI,SBI,andHBIarestillawork-in-progress,butwearenowprioritizingsupportforType-2hypervisorswheretheSBIisprovidedrecursivelybyanS-modeOS.HardwareimplementationsoftheRISC-VISAwillgenerallyrequireadditionalfeaturesbeyondtheprivilegedISAtosupportthevariousexecutionenvironments(AEE,SEE,orHEE).1.3PrivilegeLevelsAtanytime,aRISC-Vhardwarethread(hart)isrunningatsomeprivilegelevelencodedasamodeinoneormoreCSRs(controlandstatusregisters).ThreeRISC-VprivilegelevelsarecurrentlydefinedasshowninTable1.1.LevelEncodingNameAbbreviation000User/ApplicationU101SupervisorS210Reserved311MachineMTable1.1:RISC-Vprivilegelevels.Privilegelevelsareusedtoprovideprotectionbetweendifferentcomponentsofthesoftwarestack,andattemptstoperformoperationsnotpermittedbythecurrentprivilegemodewillcauseanexceptiontoberaised.Theseexceptionswillnormallycausetrapsintoanunderlyingexecutionenvironment.ThemachinelevelhasthehighestprivilegesandistheonlymandatoryprivilegelevelforaRISC-Vhardwareplatform.Coderuninmachine-mode(M-mode)isusuallyinherentlytrusted,asithaslow-levelaccesstothemachineimplementation.M-modecanbeusedtomanagesecureexecutionenvironmentsonRISC-V.User-mode(U-mode)andsupervisor-mode(S-mode)areintendedforconventionalapplicationandoperatingsystemusagerespectively.ThepreviousHypervisormode(H-mode)designedtosupportType-1hypervisorshasbeenre-movedandtheencodingspacereservedaswearefocusingonhypervisorsupportviaanextended4VolumeII:RISC-VPrivilegedArchitecturesV1.10SmodesuitableforbothType-1andType-2hypervisorsasdescribedinChapter5.Theencod-ingspaceforHisreservedforfutureuseandtoavoidbackwardsincompatiblechangesinbitpositionsinvariousstatusregusters.ThebitpositionsmightbereusedinthefuturefordifferentType-1hypervisorsupportorpossiblyadditionalsecureexecutionmodes.EachprivilegelevelhasacoresetofprivilegedISAextensionswithoptionalextensionsandvariants.Forexample,machine-modesupportsseveraloptionalstandardvariantsforaddresstranslationandmemoryprotection.Also,supervisor-modecanbeextendedtosupportType-2hypervisorexecutionasdescribedinChapter5.Implementationsmightprovideanywherefrom1to3privilegemodestradingoffreducedisolationforlowerimplementationcost,asshowninTable1.2.Inthedescription,wetrytoseparatetheprivilegelevelforwhichcodeiswritten,fromtheprivilegemodeinwhichitruns,althoughthetwoareoftentied.Forexample,asupervisor-leveloperatingsystemcanruninsupervisor-modeonasystemwiththreeprivilegemodes,butcanalsoruninuser-modeunderaclassicvirtualmachinemonitoronsystemswithtwoormoreprivilegemodes.Inbothcases,thesamesupervisor-leveloperatingsystembinarycodecanbeused,codedtoasupervisor-levelSBIandhenceexpectingtobeabletousesupervisor-levelprivilegedinstructionsandCSRs.WhenrunningaguestOSinusermode,allsupervisor-levelactionswillbetrappedandemulatedbytheSEErunninginthehigher-privilegelevel.NumberoflevelsSupportedModesIntendedUsage1MSimpleembeddedsystems2M,USecureembeddedsystems3M,S,USystemsrunningUnix-likeoperatingsystemsTable1.2:Supportedcombinationsofprivilegemodes.AllhardwareimplementationsmustprovideM-mode,asthisistheonlymodethathasunfetteredaccesstothewholemachine.ThesimplestRISC-VimplementationsmayprovideonlyM-mode,thoughthiswillprovidenoprotectionagainstincorrectormaliciousapplicationcode.ThelockfeatureoftheoptionalPMPfacilitycanprovidesomelimitedprotectionevenwithonlyM-modeimplemented.ManyRISC-Vimplementationswillalsosupportatleastusermode(U-mode)toprotecttherestofthesystemfromapplicationcode.Supervisormode(S-mode)canbeaddedtoprovideisolationbetweenasupervisor-leveloperatingsystemandtheSEE.AhartnormallyrunsapplicationcodeinU-modeuntilsometrap(e.g.,asupervisorcalloratimerinterrupt)forcesaswitchtoatraphandler,whichusuallyrunsinamoreprivilegedmode.Thehartwillthenexecutethetraphandler,whichwilleventuallyresumeexecutionatoraftertheoriginaltrappedinstructioninU-mode.Trapsthatincreaseprivilegelevelaretermedverticaltraps,whiletrapsthatremainatthesameprivilegelevelaretermedhorizontaltraps.TheRISC-Vprivilegedarchitectureprovidesflexibleroutingoftrapstodifferentprivilegelayers.Horizontaltrapscanbeimp