cv32e40s#1129
Conversation
Configuration for CV32E40P core (Phase 1 CTP research) with all parameters documented and verified against manual. Baseline configuration: COREV_PULP=0, FPU=0, NUM_MHPMCOUNTERS=1 ISA Extensions: - Base: I, M, C - Standard: Zca, Zicsr, Zifencei, Zicntr - Supervisor: Sm, Smhpm Parameters: 44 documented with verification status - 21 VERIFIED (with manual citations) - 7 FROM MANUAL - 13 ASSUMED (reasonable defaults) - 2 QUESTIONABLE (flagged for review) - 1 UNKNOWN Research notes and atomic concepts in separate Obsidian vault.
CV32E40P configuration updates based on detailed RTL source code investigation: Key Changes: - Removed C extension from implemented_extensions (C = Zca + floating-point, FPU=0 means only Zca) - TRAP_ON_UNIMPLEMENTED_CSR: Updated from false to true * RTL cv32e40p_decoder.sv line 2978 has 'default : csr_illegal = 1'b1' * Any CSR not in decoder whitelist causes IllegalInstruction exception * Config assumption (silent 0 return) contradicts actual RTL behavior - TRAP_ON_ILLEGAL_WLRL: Verified false (no changes needed) * Decoder (ID stage) validates CSR addresses, not write data values * Write data only available at EX stage (too late for trap) * cs_registers.sv silently masks WLRL field writes (lines 954-1023) * Architecture constraint: masking is only viable option - Commented out incomplete parameters (MTVAL, misaligned, IDs, MTVEC, Sm, HPM) Investigation Sources: - CV32E40P manual: intro.rst, control_status_registers.rst, exceptions_interrupts.rst - RISC-V Unified DB: extension definitions, parameter schemas - CV32E40P RTL: decoder.sv (CSR validation), cs_registers.sv (field masking)
NUM_PMP_ENTRIES is defined by Smpmp extension which CV32E40P does not implement; remove it. Add TIME_CSR_IMPLEMENTED: false (defined by Zicntr, which CV32E40P does implement); verified via perf_counters.rst:130-133.
Add F extension (v2.2.0) to implemented_extensions. Update description to RV32IMCF. Update IMP_ID_VALUE 0x0->0x1 (cs_registers.sv:511-513: FPU==1 sets mimpid=0x1). Add MUTABLE_MISA_F: false (F bit is RO, control_status_registers.rst:1444,1457). Add HW_MSTATUS_FS_DIRTY_UPDATE: imprecise and MSTATUS_FS_LEGAL_VALUES: [0,1,2,3] (cs_registers.sv:964,1034; control_status_registers.rst:448-456,483).
… RV32IMC (FPU=0) config Move cv32e40p.yaml into cv32e40p_v1.8.3_rv32imcf/ subfolder and rename to match versioned naming convention (core/version-variant/file). Follows same structure as cve2 and cvw configs. Add cv32e40p_v1.8.3_rv32imc.yaml (FPU=0, mimpid=0) recovered from git history as the baseline RV32IMC certified configuration (RTL Freeze v1.8.3, mimpid=0).
Add two architecture configuration yamls for CV32E40P v1.0.0 (RTL Freeze 2020-12-10): - cv32e40p_v1.0.0_rv32imc: FPU=0 baseline, the only certified/frozen config for v1.0.0 (mimpid=0, events 0-10 only) - cv32e40p_v1.0.0_rv32imcf: FPU=1 path for completeness (not RTL-frozen in v1.0.0) Key differences vs v1.8.3 FPU=1: mimpid always 0x0 (hardwired), mstatus.FS not implemented (bits[16:13] hardwired 0, MSTATUS_FS_LEGAL_VALUES=[0]), HPM events 12-15 active via internal APU dispatcher (cv32e40p_core.sv APU localparam).
Verified RTL (cv32e40p_compressed_decoder.sv) expands 16-bit FP load/store (3'b001/3'b111) to 32-bit F-ext ops when FPU=1. Required for ACT compatibility on RV32IMCF.
- .align 8 -> .align 2 (direct mode needs 4-byte alignment only) - la x2, tohost -> li x2, 0x20000000 (symbol ref caused test failures) - remove stale TODO and fix comment
Add stub CTP config directory for CV32E40S (CORE-V security-hardened, RV32IMC + Smepmp + U-mode). RTL pinned to 103056f0 from core-v-verif. Generated cv32e40s_rv32imc.yaml via scaffold_config.py (41 UDB params scaffolded; Sm/Smhpm/Zicsr/Zifencei/Zicntr/I/M/Zca extensions). All 7 companion stub files created from cv32e40p templates with cv32e40s- specific adjustments (marchid=0x15, U-mode support, PMP_NUM_REGIONS noted as 16 for Smepmp). Config validates: 'Config cv32e40s_rv32imc is valid'. Params and rvmodel macros marked STUB -- to be verified against RTL in the next phase before running tests.
Replace stub values with RTL-verified parameters for the cv32e40s default configuration (ZC_EXT=0, B_EXT=NONE, PMP=0, PMA=0). Key changes: MARCHID=0x15, 16 HPM events, Zkt always enabled, MTVEC 256-byte aligned, MUTABLE_MISA_C added, MTVAL_WIDTH=32, PMP regions set to 0, sail.json Zkt enabled.
davidharrishmc
left a comment
There was a problem hiding this comment.
This looks good with minor feedback. It should get feedback from Jordan too.
| MARCHID_IMPLEMENTED: true | ||
| MIMPID_IMPLEMENTED: true | ||
| PMA_GRANULARITY: 2 # Schema minimum (= 4 bytes); PMA_NUM_REGIONS=0 by default → entire memory is main | ||
| # PMP/PMA: defaults are PMP_NUM_REGIONS=0, PMA_NUM_REGIONS=0 (cv32e40s_core.sv lines 42,45) |
There was a problem hiding this comment.
Consider setting PMP_NUM_REGIONS to 0 explicitly rather than relying on default.
There was a problem hiding this comment.
UDB schema minimum is 2.
There was a problem hiding this comment.
The minimum granularity is 2. The minimum number of entries is 0.
There was a problem hiding this comment.
There is a problem:
Setting NUM_PMP_ENTRIES: 0 in a UDB config requires Smpmp in implemented_extensions. Without it:
Parameter is not defined by this config: 'NUM_PMP_ENTRIES'.
Needs: (Smpmp=1.11.0 || Smpmp=1.12.0 || Smpmp=1.13.0)
I can add smpmp in extension list but I cant find any information on this parameter except:
The MC100 CRD (docs/crd/src/mc100_crd.adoc:30) says:
Don't use Smpmp term which is a made-up UDB extension name for the original PMP.
The CTP param summary (docs/ctp/src/param/summary.adoc:556) lists NUM_PMP_ENTRIES and PMP_GRANULARITY as defined by Smpmp, but CTP test plans (PMPSm, PMPS, PMPU) never reference Smpmp as something to declare.
Should I add smpmp as well into extension list @davidharrishmc @jordancarlin ? I think it would correctly define our hardware as having PMP is present but with 0 configured regions.
I will make issue of this if I get clarification on this parameter.
There was a problem hiding this comment.
Smpmp and Smhpm were removed from UDB earlier today (they are not real extensions). NUM_PMP_ENTRIES will always be required when Sm is supported once we update the version of UDB we are using (planning to do that soon).
| # cv32e40s supports both direct (MODE=0) and vectored (MODE=1) mtvec. | ||
| # Direct mode (MODE=0) requires 4-byte alignment only — use .align 2 before handler. | ||
| #define RVMODEL_BOOT \ | ||
| .option push ; \ |
There was a problem hiding this comment.
What is the purpose of setting up this trap handler? Don't the priv tests immediately replace it with the ACT trap handler?
Do you need
csrwi mcountinhibit, 0
as in CV32E40P?
There was a problem hiding this comment.
@davidharrishmc i will try to apply it as @jordancarlin suggested in #1031
| kind: architecture configuration | ||
| type: fully configured | ||
| name: cv32e40s_rv32imc | ||
| description: CV32E40S (CORE-V secure) - RV32IMC default configuration (ZC_EXT=0, B_EXT=NONE, PMP=0, PMA=0) |
There was a problem hiding this comment.
What does ZC_EXT=0 mean? Seems inconsistent with RV32IMC.
There was a problem hiding this comment.
ZC_EXT is register in rtl, it enables optional Zc? subextensions. Removed since I was looking at older version of core, in latest version of core it is enabled by default.
Initial config was based on old RTL (103056f0, Feb 2022) where ZC_EXT was a parameter defaulting to 0. Upstream master (Oct 2024) hardcodes ZC_EXT=1 and NUM_MHPMCOUNTERS=0. Changes: - Add Zcb, Zcmp, Zcmt extensions (ZC_EXT=1 always enabled) - Add JVT params (JVT_BASE_TYPE, JVT_READ_ONLY, JVT_BASE_MASK) - Update HPM: NUM_MHPMCOUNTERS=0, NUM_HPM_EVENTS=2 - Replace trap handler in RVMODEL_BOOT with mcountinhibit clear - Update sail.json: Zcb=true, writable_hpm_counters=0 Note: JVT_BASE_MASK uses 0x7FFFFFC0 as workaround for UDB constraint bug (requires < 0xFFFFFFC0 but RTL mask is exactly 0xFFFFFFC0).
| # Zcmt params (VERIFIED — cv32e40s_pkg.sv: CSR_JVT_MASK=0xFFFFFFC0, JVT_RESET_VAL=0) | ||
| JVT_BASE_TYPE: mask # VERIFIED — upper 26 bits writable via mask | ||
| JVT_READ_ONLY: false # VERIFIED — jvt is writable | ||
| JVT_BASE_MASK: 0x7FFFFFC0 # RTL mask is 0xFFFFFFC0 but UDB requires < 0xFFFFFFC0 for RV32; bit 31 excluded |
SECURE=1 is hardcoded in cv32e40s, so PMP CSRs are always accessible (no illegal instruction trap). PMP_NUM_REGIONS=0 by default means all PMP CSRs are read-only-zero. Smpmp is a UDB placeholder extension that gates PMP parameter visibility.
|
Yes it is a hack and will eventually go away when udb matures, but is the
way to do it for now.
…On Wed, Mar 25, 2026 at 12:52 PM Marin Radic ***@***.***> wrote:
***@***.**** commented on this pull request.
------------------------------
In config/cores/cv32e40s/cv32e40s_rv32imc/cv32e40s_rv32imc.yaml
<#1129?email_source=notifications&email_token=AR4AA37KM4IQ6RXGBECO3ZD4SQ2GJA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBQHE2DEMZRGM32M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJL3QOJPXEZLWNFSXOX3DNRUWG2Y#discussion_r2990651639>
:
> + VENDOR_ID_BANK: 0xC # VERIFIED — cv32e40s_pkg.sv:596: MVENDORID_BANK = 25'hC (OpenHW, JEDEC bank 13)
+ VENDOR_ID_OFFSET: 0x2 # VERIFIED — cv32e40s_pkg.sv:595: MVENDORID_OFFSET = 7'h2
+
+ # MTVEC (VERIFIED — cs_registers.sv: CSR_MTVEC_MASK = 32'hFFFFFF01)
+ MTVEC_MODES: [0, 1] # VERIFIED — mode bit[0] writable; supports direct (0) and vectored (1)
+ MTVEC_ACCESS: rw
+ MTVEC_ILLEGAL_WRITE_BEHAVIOR: custom # VERIFIED — mode = {1'b0, wdata[0]}; masking always produces valid mode
+ MTVEC_BASE_ALIGNMENT_VECTORED: 256 # VERIFIED — bits [7:1] masked to 0 → 256-byte alignment
+ MTVEC_BASE_ALIGNMENT_DIRECT: 256 # VERIFIED — same mask applies to both modes
+
+ # Sm params
+ PRECISE_SYNCHRONOUS_EXCEPTIONS: true # VERIFIED — mepc set to current PC on exception
+ MARCHID_IMPLEMENTED: true
+ MIMPID_IMPLEMENTED: true
+ PMA_GRANULARITY: 2 # Schema minimum (= 4 bytes); PMA_NUM_REGIONS=0 by default → entire memory is main
+ # PMP/PMA: defaults are PMP_NUM_REGIONS=0, PMA_NUM_REGIONS=0 (cv32e40s_core.sv lines 42,45)
There is a problem:
Setting NUM_PMP_ENTRIES: 0 in a UDB config requires Smpmp in
implemented_extensions. Without it:
Parameter is not defined by this config: 'NUM_PMP_ENTRIES'.
Needs: (Smpmp=1.11.0 || Smpmp=1.12.0 || Smpmp=1.13.0)
I can add smpmp in extension list but I cant find any information on this
parameter except:
The MC100 CRD (docs/crd/src/mc100_crd.adoc:30) says:
Don't use Smpmp term which is a made-up UDB extension name for the
original PMP.
The CTP param summary (docs/ctp/src/param/summary.adoc:556) lists
NUM_PMP_ENTRIES and PMP_GRANULARITY as defined by Smpmp, but CTP test
plans (PMPSm, PMPS, PMPU) never reference Smpmp as something to declare.
Should I add smpmp as well into extension list @davidharrishmc
<https://github.com/davidharrishmc> ?
—
Reply to this email directly, view it on GitHub
<#1129?email_source=notifications&email_token=AR4AA34SBEKJNAHO5MWQ3L34SQ2GJA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBQHE2DEMZRGM32M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJPLQOJPXEZLWNFSXOX3ON52GSZTJMNQXI2LPNZZV6Y3MNFRWW#discussion_r2990651639>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AR4AA3YHNFKFVKJUKVBXV5D4SQ2GJAVCNFSM6AAAAACW6Z4N6CVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DAMBZGQZDGMJTG4>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Add two new CTP configurations: - cv32e40s_rv32imc_PMA: PMA-only (PMP_NUM_REGIONS=0) - cv32e40s_rv32imc_PMA-PMP: PMA + PMP enabled (PMP_NUM_REGIONS=16, G=0) Remove Zicntr extension and TIME_CSR param from base config since cv32e40s does not implement user time CSRs.
|
Okay this is almost done. I have tested all three configs both on DUT and sail (it passes signature comparison for RVI20 profile). Notes on needed changes before ready for review:
|
|
Concerning #1187 :
Workaround fo PMA-PMP config
Will try this workaround so we dont get blocked by this issue. |
- split .text.init into its own output section before .text - add *(.text.*) wildcard to .text section - remove .tohost section
This reverts commit bbb15f7.
|
The As is the situation with the other e40 cores, the MTIME and MTIMECMP are Platform CSRs that are not implemented in our testbenches. I should probably RTFM before asking this, but how are the |
yes this was addressed by #1248 it should be removed now
Both RVMODEL_INTERRUPT_LATENCY and RVMODEL_TIMER_INT_SOON_DELAY are also present in cv32e20 and cv32e40p. They should be modified accordingly in these configs also. RVMODEL_INTERRUPT_LATENCY
This must me verified. I assume it is set to high number because it doesn't hurt. I am not sure how to find this should i look at RTL or waveform? RVMODEL_TIMER_INT_SOON_DELAY
I will be removing this , since we dont have mtime |
- Bump Sm to version 1.12.0; remove Smpmp/Smhpm from base config (no PMP in default build) - Add CONFIG_PTR_ADDRESS, MCOUNTENABLE_EN; remove PMP_GRANULARITY/HPM_EVENTS - Comment out RVMODEL_ACCESS_FAULT_ADDRESS (all addresses valid in Sail memory map) - Comment out RVMODEL_MTIME_ADDRESS/MTIMECMP_ADDRESS (no CLINT timer in this config)
- rvmodel_boot - ACCESS_FAULT_ADDRESS
Configuration files for cv32e40s