1. Overview
The NEORV32[1] is an open-source RISC-V compatible processor system that is intended as ready-to-go auxiliary processor within a larger SoC designs or as stand-alone custom / customizable microcontroller.
The system is highly configurable and provides optional common peripherals like embedded memories, timers, serial interfaces, general purpose IO ports and an external bus interface to connect custom IP like memories, NoCs and other peripherals. On-line and in-system debugging is supported by an OpenOCD/gdb compatible on-chip debugger accessible via JTAG.
Special focus is paid on execution safety to provide defined and predictable behavior at any time. Therefore, the CPU ensures that all memory access are acknowledged and no invalid/malformed instructions are executed. Whenever an unexpected situation occurs, the application code is informed via hardware exceptions.
The software framework of the processor comes with application makefiles, software libraries for all CPU and processor features, a bootloader, a runtime environment and several example programs - including a port of the CoreMark MCU benchmark and the official RISC-V architecture test suite. RISC-V GCC is used as default toolchain (prebuilt toolchains are also provided).
Check out the processor’s online User Guide that provides hands-on tutorials to get you started.
Structure
Annotations
Warning |
Important |
Note |
Tip |
1.1. Rationale
Why did you make this?
Processor and CPU architecture designs are fascinating things: they are the magic frontier where software meets hardware. This project started as something like a journey into this magic realm to understand how things actually work down on this very low level and evolved over time to a capable system on chip.
But there is more: when I started to dive into the emerging RISC-V ecosystem I felt overwhelmed by the complexity. As a beginner it is hard to get an overview - especially when you want to setup a minimal platform to tinker with… Which core to use? How to get the right toolchain? What features do I need? How does booting work? How do I create an actual executable? How to get that into the hardware? How to customize things? Where to start???
This project aims to provide a simple to understand and easy to use yet powerful and flexible platform that targets FPGA and RISC-V beginners as well as advanced users.
Why a soft-core processor?
As a matter of fact soft-core processors cannot compete with discrete (like FPGA hard-macro) processors in terms of performance, energy efficiency and size. But they do fill a niche in FPGA design space: for example, soft-core processors allow to implement the control flow part of certain applications (e.g. communication protocol handling) using software like plain C. This provides high flexibility as software can be easily changed, re-compiled and re-uploaded again.
Furthermore, the concept of flexibility applies to all aspects of a soft-core processor. The user can add exactly the features that are required by the application: additional memories, custom interfaces, specialized co-processors and even user-defined instructions.
Why RISC-V?

RISC-V is a free and open ISA enabling a new era of processor innovation through open standard collaboration.
https://riscv.org/about/
Open-source is a great thing! While open-source has already become quite popular in software, hardware-focused projects still need to catch up. Admittedly, there has been quite a development, but mainly in terms of platforms and applications (so schematics, PCBs, etc.). Although processors and CPUs are the heart of almost every digital system, having a true open-source silicon is still a rarity. RISC-V aims to change that - and even it is just one approach, it helps paving the road for future development.
Furthermore, I highly appreciate the community aspect of RISC-V. The ISA and everything beyond is developed in direct contact with the community: this includes businesses and professionals but also hobbyist, amateurs and people that are just curious. Everyone can join discussions and contribute to RISC-V in their very own way.
Finally, I really like the RISC-V ISA itself. It aims to be a clean, orthogonal and "intuitive" ISA that resembles with the basic concepts of RISC: simple yet effective.
Yet another RISC-V core? What makes it special?
The NEORV32 is not based on another RISC-V core. It was build entirely from ground up (just following the official ISA specs). The project does not intend to replace certain RISC-V cores or just beat existing ones like VexRISC in terms of performance or SERV in terms of size. It was build having a different design goal in mind.
The project aims to provide another option in the RISC-V / soft-core design space with a different performance vs. size trade-off and a different focus: embrace concepts like documentation, platform-independence / portability, RISC-V compatibility, extensibility & customization and ease of use (see the Project Key Features below).
Furthermore, the NEORV32 pays special focus on execution safety using Full Virtualization. The CPU aims to provide fall-backs for everything that could go wrong. This includes malformed instruction words, privilege escalations and even memory accesses that are checked for address space holes and deterministic response times of memory-mapped devices. Precise exceptions allow a defined and fully-synchronized state of the CPU at every time an in every situation.
A multi-cycle architecture?!?!
Most mainstream CPUs out there are pipelined architectures to increase throughput. In contrast, most CPUs used for teaching are single-cycle designs since they are probably the most easiest to understand. But what about the multi-cycle architectures?
In terms of energy, throughput, area and maximal clock frequency multi-cycle architectures are somewhere in between single-cycle and fully-pipelined designs: they provide higher throughput and clock speed when compared to their single-cycle counterparts while having less hardware complexity (= area) then a fully-pipelined designs. I decided to use the multi-cycle approach because of the following reasons:
-
Multi-cycle architecture are quite small! There is no need for pipeline hazard detection and resolution logic (e.g. forwarding). Furthermore, you can "re-use" parts of the core to do several tasks (e.g. the ALU is used for the actual data processing, but also for address generation, branch condition check and branch target computation).
-
Single-cycle architectures require memories that can be read asynchronously - a thing that is not feasible to implement in real world applications (i.e. FPGA block RAM is entirely synchronous). Furthermore, such design usually have a very (very!!!) long critical path tremendously reducing maximal operating frequency.
-
Pipelined designs increase performance by having several instruction "in fly" at the same time. But this also means there is some kind of "out-of-order" behavior: if an instruction at the end of the pipeline causes an exception all the instructions in earlier stages have to be invalidated. Potential architecture state changes have to be made undone requiring additional (exception-handling) logic. In a multi-cycle architecture this situation cannot occur because only a single instruction is "in fly" at a time.
-
Having only a single instruction in fly does not only reduce hardware costs, it also simplifies simulation/verification/debugging, state preservation/restoring during exceptions and extensibility (no need to care about pipeline hazards) - but of course at the cost of reduced throughput.
To counteract the loss of performance implied by a pure multi-cycle architecture, the NEORV32 CPU uses a mixed approach: instruction fetch (front-end) and instruction execution (back-end) are de-coupled to operate independently of each other. Data is interchanged via a queue building a simple 2-stage pipeline. Each "pipeline" stage in terms is implemented as multi-cycle architecture to simplify the hardware and to provide precise state control (e.g. during exceptions).
CPU Architecture Details
Want to know more? Check out the description in the CPU’s Architecture section.
|
1.2. Project Key Features
Project
-
all-in-one package: CPU + SoC + Software Framework & Tooling
-
completely described in behavioral, platform-independent VHDL - no vendor- or technology-specific primitives, attributes, macros, libraries, etc. are used at all
-
all-Verilog "version" available (auto-generated netlist)
-
extensive configuration options for adapting the processor to the requirements of the application
-
highly extensible hardware - on CPU, SoC and system level
-
aims to be as small as possible while being as RISC-V-compliant as possible - with a reasonable area-vs-performance trade-off
-
FPGA friendly (e.g. all internal memories can be mapped to block RAM - including the register file)
-
optimized for high clock frequencies to ease timing closure and integration
-
from zero to "hello world!" - completely open source and documented
-
easy to use even for FPGA/RISC-V starters – intended to work out of the box
NEORV32 CPU (the core)
-
32-bit
rv32i
RISC-V CPU -
fully RISC-V ISA compatible - checked by the official RISCOF architecture tests
-
base ISA + privileged ISA (optional) + several ISA extensions (optional)
-
option to add custom RISC-V instructions as custom ISA extension
-
rich set of customization options (ISA extensions, design goal: performance / area (/ energy), …)
-
aims to support Full Virtualization capabilities to increase execution safety
-
official RISC-V open source architecture ID: decimal 19; hexadecimal
0x00000013
NEORV32 Processor (the SoC)
-
highly-configurable full-scale microcontroller-like processor system
-
based on the NEORV32 CPU
-
optional standard serial interfaces (UART, TWI, SPI, 1-Wire)
-
optional timers and counters (watchdog, system timer)
-
optional general purpose IO and PWM; a native NeoPixel(c)-compatible smart LED interface
-
optional embedded memories / caches for data, instructions and bootloader
-
optional external memory interface (Wishbone / AXI4-Lite) and stream link interface (AXI4-Stream) for custom connectivity
-
optional execute_in_place (XIP) module to execute code directly form external SPI flash
-
on-chip debugger compatible with OpenOCD and gdb including hardware trigger module
Software framework
-
GCC-based toolchain - prebuilt toolchains available; application compilation based on GNU makefiles
-
internal bootloader with serial user interface (via UART)
-
core libraries and HAL for high-level usage of the provided functions and peripherals
-
processor-specific runtime environment and several example programs
-
doxygen-based documentation of the software framework; a deployed version is available at https://stnolting.github.io/neorv32/sw/files.html
-
FreeRTOS port + demos available
For more in-depth details regarding the feature provided by he hardware see the according sections: NEORV32 Central Processing Unit (CPU) and NEORV32 Processor (SoC). |
Extensibility and Customization
The NEORV32 processor was designed to ease customization and extensibility and provides several options for adding application-specific custom hardware modules and accelerators. The three most common options for adding custom on-chip modules are listed below.
-
Processor-External Memory Interface (WISHBONE) (AXI4-Lite) for processor-external modules
-
Custom Functions Subsystem (CFS) for tightly-coupled processor-internal co-processors
-
Custom Functions Unit (CFU) for custom RISC-V instructions
A more detailed comparison of the extension/customization options can be found in section Adding Custom Hardware Modules of the user guide. |
1.3. Project Folder Structure
neorv32 - Project home folder │ ├docs - Project documentation │├datasheet - AsciiDoc sources for the NEORV32 data sheet │├figures - Figures and logos │├icons - Misc. symbols │├references - Data sheets and RISC-V specs. │└userguide - AsciiDoc sources for the NEORV32 user guide │ ├rtl - VHDL sources │├core - Core sources of the CPU & SoC ││└mem - SoC-internal memories (default architectures) │├processor_templates - Pre-configured SoC wrappers │├system_integration - System wrappers for advanced connectivity │└test_setups - Minimal test setup "SoCs" used in the User Guide │ ├sim - Simulation files (see User Guide) │ └sw - Software framework ├bootloader - Sources of the processor-internal bootloader ├common - Linker script, crt0.S start-up code and central makefile ├example - Example programs for the core and the SoC modules │└... ├lib - Processor core library │├include - Header files (*.h) │└source - Source files (*.c) ├image_gen - Helper program to generate NEORV32 executables ├ocd_firmware - Firmware for the on-chip debugger's "park loop" ├openocd - OpenOCD configuration files └svd - Processor system view description file (CMSIS-SVD)
1.4. VHDL File Hierarchy
All necessary VHDL hardware description files are located in the project’s rtl/core
folder. The top entity
of the entire processor including all the required configuration generics is neorv32_top.vhd
.
All core VHDL files from the list below have to be assigned to a new design library named neorv32 . Additional
files, like alternative top entities, can be assigned to any library.
|
neorv32_top.vhd - NEORV32 Processor top entity │ ├neorv32_fifo.vhd - General purpose FIFO component ├neorv32_package.vhd - Processor/CPU main VHDL package file │ ├neorv32_cpu.vhd - NEORV32 CPU top entity │├neorv32_cpu_alu.vhd - Arithmetic/logic unit ││├neorv32_cpu_cp_bitmanip.vhd - Bit-manipulation co-processor (B ext.) ││├neorv32_cpu_cp_cfu.vhd - Custom functions (instruction) co-processor (Zxcfu ext.) ││├neorv32_cpu_cp_fpu.vhd - Floating-point co-processor (Zfinx ext.) ││├neorv32_cpu_cp_muldiv.vhd - Mul/Div co-processor (M ext.) ││└neorv32_cpu_cp_shifter.vhd - Bit-shift co-processor (base ISA) │├neorv32_cpu_bus.vhd - Load/store unit + physical memory protection │├neorv32_cpu_control.vhd - CPU control, exception system and CSRs ││└neorv32_cpu_decompressor.vhd - Compressed instructions decoder │└neorv32_cpu_regfile.vhd - Data register file │ ├neorv32_boot_rom.vhd - Bootloader ROM │└neorv32_bootloader_image.vhd - Bootloader ROM memory image ├neorv32_busswitch.vhd - Processor bus switch for CPU buses (I&D) ├neorv32_bus_keeper.vhd - Processor-internal bus monitor ├neorv32_cfs.vhd - Custom functions subsystem ├neorv32_debug_dm.vhd - on-chip debugger: debug module ├neorv32_debug_dtm.vhd - on-chip debugger: debug transfer module ├neorv32_dmem.entity.vhd - Processor-internal data memory (entity-only!) ├neorv32_gpio.vhd - General purpose input/output port unit ├neorv32_gptmr.vhd - General purpose 32-bit timer ├neorv32_icache.vhd - Processor-internal instruction cache ├neorv32_imem.entity.vhd - Processor-internal instruction memory (entity-only!) │└neor32_application_image.vhd - IMEM application initialization image ├neorv32_mtime.vhd - Machine system timer ├neorv32_neoled.vhd - NeoPixel (TM) compatible smart LED interface ├neorv32_onewire.vhd - One-Wire serial interface controller ├neorv32_pwm.vhd - Pulse-width modulation controller ├neorv32_slink.vhd - Stream link controller ├neorv32_spi.vhd - Serial peripheral interface controller ├neorv32_sysinfo.vhd - System configuration information memory ├neorv32_trng.vhd - True random number generator ├neorv32_twi.vhd - Two wire serial interface controller ├neorv32_uart.vhd - Universal async. receiver/transmitter ├neorv32_wdt.vhd - Watchdog timer ├neorv32_wishbone.vhd - External (Wishbone) bus interface ├neorv32_xip.vhd - Execute in place module ├neorv32_xirq.vhd - External interrupt controller │ ├mem/neorv32_dmem.default.vhd - _Default_ data memory (architecture-only) └mem/neorv32_imem.default.vhd - _Default_ instruction memory (architecture-only)
The processor-internal instruction and data memories (IMEM and DMEM) are split into two design files each:
a plain entity definition (neorv32_*mem.entity.vhd ) and the actual architecture definition
(mem/neorv32_*mem.default.vhd ). The *.default.vhd architecture definitions from rtl/core/mem provide a generic and
platform independent memory design that (should) infers embedded memory blocks. You can replace/modify the architecture
source file in order to use platform-specific features (like advanced memory resources) or to improve technology mapping
and/or timing.
|
1.5. FPGA Implementation Results
This section shows exemplary FPGA implementation results for the NEORV32 CPU and NEORV32 Processor modules. Note that certain configuration options might also have an impact on other configuration options. Furthermore, this report cannot cover all possible option combinations. Hence, the presented implementation results are just exemplary. If not otherwise mentioned all implementations use the default generic configurations.
1.5.1. CPU
HW version: |
|
Top entity: |
|
FPGA: |
Intel Cyclone IV E |
Toolchain: |
Quartus Prime Lite 21.1 |
Constraints: |
no timing constraints, "balanced optimization", fmax from "Slow 1200mV 0C Model" |
CPU ISA Configuration | LEs | FFs | MEM bits | DSPs | fmax |
---|---|---|---|---|---|
|
720 |
360 |
512 |
0 |
130 MHz |
|
724 |
364 |
1024 |
0 |
130 MHz |
|
1223 |
607 |
1024 |
0 |
130 MHz |
|
1578 |
773 |
1024 |
0 |
130 MHz |
|
2087 |
983 |
1024 |
0 |
130 MHz |
|
2338 |
992 |
1024 |
0 |
130 MHz |
|
3175 |
1247 |
1024 |
0 |
130 MHz |
|
3186 |
1254 |
1024 |
0 |
130 MHz |
|
3187 |
1254 |
1024 |
0 |
130 MHz |
|
4450 |
1906 |
1024 |
7 |
123 MHz |
|
4825 |
2018 |
1024 |
7 |
123 MHz |
The table above does not show all CPU ISA extensions. More sophisticated and application-specific options like PMP and HMP are not included in this overview. |
Goal-Driven Optimization
The CPU provides further options to reduce the area footprint (for example by constraining the CPU-internal
counter sizes) or to increase performance (for example by using a barrel-shifter; at cost of extra hardware).
See section Processor Top Entity - Generics for more information. Also, take a look at the User Guide section
Application-Specific Processor Configuration.
|
1.5.2. Processor - Modules
HW version: |
|
Top entity: |
|
FPGA: |
Intel Cyclone IV E |
Toolchain: |
Quartus Prime Lite 21.1 |
Constraints: |
no timing constraints, "balanced optimization" |
Module | Description | LEs | FFs | MEM bits | DSPs |
---|---|---|---|---|---|
Boot ROM |
Bootloader ROM (4kB) |
3 |
2 |
32768 |
0 |
BUSKEEPER |
Processor-internal bus monitor |
28 |
15 |
0 |
0 |
BUSSWITCH |
Bus multiplexer for CPU instr. and data interface |
69 |
8 |
0 |
0 |
CFS |
Custom functions subsystem [2] |
- |
- |
- |
- |
DM |
On-chip debugger - debug module |
391 |
220 |
0 |
0 |
DTM |
On-chip debugger - debug transfer module (JTAG) |
259 |
221 |
0 |
0 |
DMEM |
Processor-internal data memory (8kB) |
18 |
2 |
65536 |
0 |
GPIO |
General purpose input/output ports |
102 |
98 |
0 |
0 |
GPTMR |
General Purpose Timer |
153 |
105 |
0 |
0 |
iCACHE |
Instruction cache (2x4 blocks, 64 bytes per block) |
417 |
297 |
4096 |
0 |
IMEM |
Processor-internal instruction memory (16kB) |
12 |
2 |
131072 |
0 |
MTIME |
Machine system timer |
345 |
166 |
0 |
0 |
NEOLED |
Smart LED Interface (NeoPixel/WS28128) (FIFO_depth=1) |
227 |
184 |
0 |
0 |
ONEWIRE |
1-wire interface |
107 |
77 |
0 |
0 |
PWM |
Pulse_width modulation controller (8 channels) |
128 |
117 |
0 |
0 |
SLINK |
Stream link interface (2xRX, 2xTX, FIFO_depth=1) |
136 |
116 |
0 |
0 |
SPI |
Serial peripheral interface |
114 |
94 |
0 |
0 |
SYSINFO |
System configuration information memory |
13 |
11 |
0 |
0 |
TRNG |
True random number generator |
89 |
79 |
0 |
0 |
TWI |
Two-wire interface |
77 |
43 |
0 |
0 |
UART0, UART1 |
Universal asynchronous receiver/transmitter 0/1 (FIFO_depth=1) |
195 |
143 |
0 |
0 |
WDT |
Watchdog timer |
61 |
46 |
0 |
0 |
WISHBONE |
External memory interface |
120 |
112 |
0 |
0 |
XIP |
Execute in place module |
318 |
244 |
0 |
0 |
XIRQ |
External interrupt controller (32 channels) |
245 |
200 |
0 |
0 |
Note that not all IOs were actually connected to FPGA pins (for example some GPIO inputs and outputs) when generating these reports. |
1.5.3. Processor - Exemplary Setups
HW version: |
|
CPU: |
|
Peripherals: |
|
FPGA: |
Xilinx Artix-7 |
Toolchain: |
Xilinx Vivado 2019.2 |
Constraints: |
clock constrained to 150 MHz, default/standard synthesis & implementation settings |
LUTs | FFs | BRAMs | DSPs | Clock |
---|---|---|---|---|
2488 |
1807 |
7 |
4 |
150 MHz |
Exemplary Setups
Check out the neorv32-setups repository (on GitHub: https://github.com/stnolting/neorv32-setups),
which provides several demo setups and community projects for various FPGA boards and toolchains.
|
1.6. CPU Performance
The performance of the NEORV32 was tested and evaluated using the Core Mark CPU benchmark.
This benchmark focuses on testing the capabilities of the CPU core itself rather than the performance of the whole
system. The according sources can be found in the sw/example/coremark
folder.
Dhrystone
A very simple port of the Dhrystone benchmark is also available in sw/example/dhrystone .
|
The resulting CoreMark score is defined as CoreMark iterations per second.
The execution time is determined via the RISC-V [m]cycle[h]
CSRs. The relative CoreMark score is
defined as CoreMark score divided by the CPU’s clock frequency in MHz.
HW version: |
|
Hardware: |
32kB int. IMEM, 16kB int. DMEM, no caches, 100MHz clock |
CoreMark: |
2000 iterations, MEM_METHOD is MEM_STACK |
Compiler: |
RISCV32-GCC 10.2.0 (compiled with |
Compiler flags: |
default (with |
CPU | CoreMark Score | CoreMarks/MHz | Average CPI |
---|---|---|---|
small ( |
33.89 |
0.3389 |
4.04 |
medium ( |
62.50 |
0.6250 |
5.34 |
performance ( |
95.23 |
0.9523 |
3.54 |
The "performance" CPU configuration uses the FAST_MUL_EN and FAST_SHIFT_EN options. |
The NEORV32 CPU is based on a multi-cycle architecture. Each instruction is executed in a sequence of
several consecutive micro operations.
The average CPI (cycles per instruction) depends on the instruction mix of a specific applications and also on
the available CPU extensions. The average CPI is computed by dividing the total number of required clock cycles
(only the timed core to avoid distortion due to IO wait cycles) by the number of executed instructions
([m]instret[h]
CSRs). More information regarding the execution time of each implemented instruction can be found in
chapter Instruction Timing.
2. NEORV32 Processor (SoC)
The NEORV32 Processor is based on the NEORV32 CPU. Together with common peripheral interfaces and embedded memories it provides a RISC-V-based full-scale microcontroller-like SoC platform.

Section Structure
Key Features
-
optional processor-internal data and instruction memories (DMEM/IMEM) + cache (iCACHE)
-
optional internal bootloader (BOOTROM) with UART console & SPI flash boot option
-
optional machine system timer (MTIME), RISC-V-compatible
-
optional two independent universal asynchronous receivers and transmitters (UART0, UART1) with optional hardware flow control (RTS/CTS) and optional RX/TX FIFOs
-
optional 8/16/24/32-bit serial peripheral interface controller (SPI) with 8 dedicated CS lines
-
optional two wire serial interface controller (TWI), compatible to the I²C standard
-
optional general purpose parallel IO port (GPIO), 64xOut, 64xIn
-
optional 32-bit external bus interface, Wishbone b4 / AXI4-Lite compatible (WISHBONE)
-
optional 32-bit stream link interface with up to 8 independent links, AXI4-Stream compatible (SLINK)
-
optional watchdog timer (WDT)
-
optional PWM controller with up to 60 channels & 8-bit duty cycle resolution (PWM)
-
optional ring-oscillator-based true random number generator (TRNG)
-
optional custom functions subsystem for custom co-processor extensions (CFS)
-
optional NeoPixel™/WS2812-compatible smart LED interface (NEOLED)
-
optional external interrupt controller with up to 32 channels (XIRQ)
-
optional general purpose 32-bit timer (GPTMR)
-
optional execute in place module (XIP)
-
optional 1-wire serial interface controller (ONEWIRE), compatible to the 1-wire standard
-
optional on-chip debugger with JTAG TAP (OCD)
-
bus keeper to monitor processor-internal bus transactions (BUSKEEPER)
-
system configuration information memory to check HW configuration via software (SYSINFO)
2.1. Processor Top Entity - Signals
The following table shows all interface signals of the processor top entity (rtl/core/neorv32_top.vhd
).
The type of all signals is std_ulogic
or std_ulogic_vector
(or arrays of those) - the bi-directional signals are of type
std_logic
.
Default Values of Inputs
All input signals provide default values in case they are not explicitly assigned during instantiation.
For control signals the value L (weak pull-down) is used. For serial and parallel data signals
the value U (unknown) is used.
|
Configurable Amount of Channels
Some peripherals allow to configure the number of channels to-be-implemented by a generic (for example the number
of PWM channels). The according input/output signals have a fixed sized regardless of the actually configured
amount of channels. If less than the maximum number of channels is configured, only the LSB-aligned channels are used:
in case of an input port the remaining bits/channels are left unconnected; in case of an output port the remaining
bits/channels are hardwired to zero.
|
Name | Width | Direction | Function |
---|---|---|---|
Global Control (Processor Clocking and Processor Reset) |
|||
|
1 |
in |
global clock line, all registers triggering on rising edge |
|
1 |
in |
global reset, asynchronous, low-active |
JTAG Access Port for On-Chip Debugger (OCD) |
|||
|
1 |
in |
TAP reset, low-active (optional [3]) |
|
1 |
in |
serial clock |
|
1 |
in |
serial data input |
|
1 |
out |
serial data output [4] |
|
1 |
in |
mode select |
External Bus Interface (WISHBONE) |
|||
|
3 |
out |
tag (access type identifier) |
|
32 |
out |
destination address |
|
32 |
in |
write data |
|
32 |
out |
read data |
|
1 |
out |
write enable ('0' = read transfer) |
|
4 |
out |
byte enable |
|
1 |
out |
strobe |
|
1 |
out |
valid cycle |
|
1 |
out |
exclusive access request |
|
1 |
in |
transfer acknowledge |
|
1 |
in |
transfer error |
Advanced Memory Control Signals |
|||
|
1 |
out |
indicates an executed fence instruction |
|
1 |
out |
indicates an executed fencei instruction |
|
1 |
out |
chi select, low-active |
|
1 |
out |
serial clock |
|
1 |
in |
serial data input |
|
1 |
out |
serial data output |
Stream Link Interface (SLINK) |
|||
|
8x32 |
out |
TX link i data |
|
8 |
out |
TX link i data valid |
|
8 |
in |
TX link i allowed to send |
|
8 |
in |
TX link i end of packet |
|
8x32 |
in |
RX link i data |
|
8 |
in |
RX link i data valid |
|
8 |
out |
RX link i ready to receive |
|
8 |
out |
RX link i end of packet |
General Purpose Inputs & Outputs (GPIO) |
|||
|
64 |
out |
general purpose parallel output |
|
64 |
in |
general purpose parallel input |
Primary Universal Asynchronous Receiver/Transmitter (UART0) |
|||
|
1 |
out |
serial transmitter |
|
1 |
in |
serial receiver |
|
1 |
out |
RX ready to receive new char |
|
1 |
in |
TX allowed to start sending |
Primary Universal Asynchronous Receiver/Transmitter (UART1) |
|||
|
1 |
out |
serial transmitter |
|
1 |
in |
serial receiver |
|
1 |
out |
RX ready to receive new char |
|
1 |
in |
TX allowed to start sending |
Serial Peripheral Interface Controller (SPI) |
|||
|
1 |
out |
controller clock line |
|
1 |
out |
serial data output |
|
1 |
in |
serial data input |
|
8 |
out |
dedicated chip select (low-active) |
Two-Wire Interface Controller (TWI) |
|||
|
1 |
inout |
serial data line |
|
1 |
inout |
serial clock line |
1-Wire Interface Controller (ONEWIRE) |
|||
|
1 |
inout |
serial data line |
Pulse-Width Modulation Channels (PWM) |
|||
|
60 |
out |
pulse-width modulated channels |
Custom Functions Subsystem (CFS) |
|||
|
32 |
in |
custom CFS input signal conduit |
|
32 |
out |
custom CFS output signal conduit |
Smart LED Interface - NeoPixel™ compatible (NEOLED) |
|||
|
1 |
out |
asynchronous serial data output |
External Interrupts (XIRQ) |
|||
|
32 |
in |
external interrupt requests |
RISC-V Machine-Level CPU Interrupts |
|||
|
1 |
in |
machine timer interrupt (RISC-V), high-level-active |
|
1 |
in |
machine software interrupt (RISC-V), high-level-active |
|
1 |
in |
machine external interrupt (RISC-V), high-level-active |
2.2. Processor Top Entity - Generics
This section lists all configuration generics of the NEORV32 processor top entity (rtl/neorv32_top.vhd
).
The NEORV32 generics allow to configure the system according to your needs. The generics are
used to control implementation of certain CPU extensions and peripheral modules and even allow to
optimize the system for certain design goals like minimal area or maximum performance. More information can be found in the user guide section Application-Specific Processor Configuration. |
Software can determine the actual CPU and processor configuration via the misa and mxisa CSRs (CPU)
and the SYSINFO memory-mapped registers (processor).
|
If optional modules (like CPU extensions or peripheral devices) are not enabled the according circuitry will not be synthesized at all. Hence, the disabled modules do not increase area and power requirements and do not impact the timing. |
Not all configuration combinations are valid. The processor RTL code provides sanity checks to inform the user during synthesis/simulation if an invalid combination has been detected. |
Run a quick simulation using the provided simulation/GHDL scripts (https://stnolting.github.io/neorv32/ug/#_hello_world) to verify the configuration of the processor generics is valid. |
Generic Description
The description of each generic uses the following scheme:
Generic name |
type |
default value |
Short description and link(s) for further information. |
2.2.1. General
CLOCK_FREQUENCY
CLOCK_FREQUENCY |
natural |
none |
The clock frequency of the processor’s |
INT_BOOTLOADER_EN
INT_BOOTLOADER_EN |
boolean |
false |
Implement the processor-internal Bootloader ROM (BOOTROM), pre-initialized with the default Bootloader image when true This will also change the CPU’s boot address. See section Boot Configuration for more information. |
HW_THREAD_ID
HW_THREAD_ID |
natural |
0 |
The hart ID of the CPU. Software can retrieve this value from the |
CUSTOM_ID
CUSTOM_ID |
std_ulogic_vector(31 downto 0) |
0x00000000 |
User-defined identifier to identify a certain setup or to pass user-defined flags. Software can retrieve this value from the System Configuration Information Memory (SYSINFO) module. |
ON_CHIP_DEBUGGER_EN
ON_CHIP_DEBUGGER_EN |
boolean |
false |
Implement the on-chip debugger (OCD) and the CPU debug mode when true. This generic is directly passed to the CPU’s CPU_EXTENSION_RISCV_Sdext and CPU_EXTENSION_RISCV_Sdtrig generics. See section On-Chip Debugger (OCD) for more information. |
2.2.2. RISC-V CPU Extensions
Discovering ISA Extensions
The configuration of the RISC-V ISA extensions (like M ) can be determined via the misa CSR. The configuration of
ISA sub-extensions (like Zicsr ) and tuning options can be determined via the NEORV32-specific mxisa CSR.
|
CPU_EXTENSION_RISCV_B
CPU_EXTENSION_RISCV_B |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_C
CPU_EXTENSION_RISCV_C |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_E
CPU_EXTENSION_RISCV_E |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_M
CPU_EXTENSION_RISCV_M |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_U
CPU_EXTENSION_RISCV_U |
boolean |
false |
Implement the less-privileged |
CPU_EXTENSION_RISCV_Zfinx
CPU_EXTENSION_RISCV_Zfinx |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_Zicsr
CPU_EXTENSION_RISCV_Zicsr |
boolean |
true |
Implement the |
CPU_EXTENSION_RISCV_Zicntr
CPU_EXTENSION_RISCV_Zicntr |
boolean |
true |
Implement the |
CPU_EXTENSION_RISCV_Zihpm
CPU_EXTENSION_RISCV_Zihpm |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_Zifencei
CPU_EXTENSION_RISCV_Zifencei |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_Zmmul
CPU_EXTENSION_RISCV_Zmmul |
boolean |
false |
Implement the |
CPU_EXTENSION_RISCV_Zxcfu
CPU_EXTENSION_RISCV_Zxcfu |
boolean |
false |
Implement the NEORV32-specific |
2.2.3. Tuning Options
FAST_MUL_EN
FAST_MUL_EN |
boolean |
false |
If this generic is enabled, the multiplier of the |
FAST_SHIFT_EN
FAST_SHIFT_EN |
boolean |
false |
If this generic is enabled, the shifter unit of the CPU’s ALU is implemented as fast barrel shifter (requiring
more hardware resources but completing within two clock cycles). If disabled, the CPU uses a serial shifter
that only performs a single bit shift per cycle (requiring less hardware resources, but requires up to 32 clock
cycles). Note that this option also implements barrel shifters for all shift-related operations of the
|
CPU_IPB_ENTRIES
CPU_IPB_ENTRIES |
natural |
1 |
This generic configures the number of entries in the CPU’s instruction prefetch buffer. The value has to be a power of two and has to be greater than or equal to one (>= 1). The IPB can help improving memory access latency. Furthermore, long linear code sequences will benefit from an increased IPB size. |
If the compressed ISA extension CPU_EXTENSION_RISCV_C (CPU_EXTENSION_RISCV_C) is enabled and the IPB depth
is set to 1, this configuration is internally overridden and the IPB will be implemented with 2 entries. This is required
for handling unaligned 32-bit instructions.
|
2.2.4. Physical Memory Protection (PMP)
PMP_NUM_REGIONS
PMP_NUM_REGIONS |
natural |
0 |
Total number of implemented PMP regions (0..16). If this generics is zero no physical memory
protection logic will be implemented at all. See section |
PMP_MIN_GRANULARITY
PMP_MIN_GRANULARITY |
natural |
4 |
Minimal region granularity in bytes. Has to be a power of two and has to be at least 4 bytes. A larger granularity
will reduce hardware utilization and impact on critical path but will also reduce the minimal region size.
See section |
2.2.5. Hardware Performance Monitors (HPM)
HPM_NUM_CNTS
HPM_NUM_CNTS |
natural |
0 |
Total number of implemented hardware performance monitor counters (0..29). If this generics is zero, no
hardware performance monitor logic will be implemented at all. Only relevant if CPU_EXTENSION_RISCV_Zihpm is enabled.
See section |
HPM_CNT_WIDTH
HPM_CNT_WIDTH |
natural |
40 |
This generic defines the total LSB-aligned size of each HPM counter. The maximum value is 64, the minimal is 0.
If the size is less than 64-bit, the unused MSB-aligned counter bits are hardwired to zero. Only relevant if
CPU_EXTENSION_RISCV_Zihpm is enabled. See section |
2.2.6. Internal Instruction Memory
MEM_INT_IMEM_EN
MEM_INT_IMEM_EN |
boolean |
false |
Implement processor-internal Instruction Memory (IMEM) when true. See sections Address Space for more information. |
MEM_INT_IMEM_SIZE
MEM_INT_IMEM_SIZE |
natural |
16*1024 |
Size in bytes of the processor internal instruction memory (IMEM). Has no effect when MEM_INT_IMEM_EN is false. |
2.2.7. Internal Data Memory
MEM_INT_DMEM_EN
MEM_INT_DMEM_EN |
boolean |
false |
Implement processor-internal Data Memory (DMEM) when true. See sections Address Space for more information. |
MEM_INT_DMEM_SIZE
MEM_INT_DMEM_SIZE |
natural |
8*1024 |
Size in bytes of the processor-internal data memory (DMEM). Has no effect when MEM_INT_DMEM_EN is false. |
2.2.8. Internal Cache Memory
ICACHE_EN
ICACHE_EN |
boolean |
false |
Implement Processor-Internal Instruction Cache (iCACHE) when true. |
ICACHE_NUM_BLOCKS
ICACHE_NUM_BLOCKS |
natural |
4 |
Number of blocks (cache "pages" or "lines") in the instruction cache. Has to be a power of two. Has no effect when ICACHE_EN is false. Software can retrieve this value from the System Configuration Information Memory (SYSINFO) module. |
ICACHE_BLOCK_SIZE
ICACHE_BLOCK_SIZE |
natural |
64 |
Size in bytes of each block in the instruction cache. Has to be a power of two. Has no effect when ICACHE_EN is false. Software can retrieve this value from the System Configuration Information Memory (SYSINFO) module. |
ICACHE_ASSOCIATIVITY
ICACHE_ASSOCIATIVITY |
natural |
1 |
Associativity (= number of sets) of the instruction cache. Has to be a power of two. Allowed configurations:
|
2.2.9. External Memory Interface
MEM_EXT_EN
MEM_EXT_EN |
boolean |
false |
Implement Processor-External Memory Interface (WISHBONE) (AXI4-Lite) when true. |
MEM_EXT_TIMEOUT
MEM_EXT_TIMEOUT |
natural |
255 |
Clock cycles after which a pending external bus access will auto-terminate and raise a bus fault exception. If set to zero, there will be no auto-timeout and no bus fault exception (might permanently stall system!). |
MEM_EXT_PIPE_MODE
MEM_EXT_PIPE_MODE |
boolean |
false |
Use standard ("classic") Wishbone protocol for external bus when false. Use pipelined Wishbone protocol when true. |
MEM_EXT_BIG_ENDIAN
MEM_EXT_BIG_ENDIAN |
boolean |
false |
Use BIG endian interface for external bus when true. Use little endian interface when false. |
MEM_EXT_ASYNC_RX
MEM_EXT_ASYNC_RX |
boolen |
false |
By default, MEM_EXT_ASYNC_RX = false implements a registered read-back path (RX) for incoming data in the bus interface in order to shorten the critical path. By setting MEM_EXT_ASYNC_RX = true an asynchronous ("direct") read-back path is implemented reducing access latency by one cycle but eventually increasing the critical path. |
MEM_EXT_ASYNC_TX
MEM_EXT_ASYNC_TX |
boolen |
false |
By default, MEM_EXT_ASYNC_TX = false implements register for all outgoing (TX) signals in order to shorten the critical path. By setting MEM_EXT_ASYNC_TX = true an asynchronous ("direct") path is implemented reducing access latency by one cycle but eventually increasing the critical path. |
2.2.10. Stream Link Interface
SLINK_NUM_TX
SLINK_NUM_TX |
natural |
0 |
Number of TX (send) Stream Link Interface (SLINK) channels to implement. Valid values are 0..8. |
SLINK_NUM_RX
SLINK_NUM_RX |
natural |
0 |
Number of RX (receive) Stream Link Interface (SLINK) channels to implement. Valid values are 0..8. |
SLINK_TX_FIFO
SLINK_TX_FIFO |
natural |
1 |
Internal FIFO depth for all implemented TX links. Valid values are 1..32k and have to be a power of two. |
SLINK_RX_FIFO
SLINK_RX_FIFO |
natural |
1 |
Internal FIFO depth for all implemented RX links. Valid values are 1..32k and have to be a power of two. |
2.2.11. External Interrupt Controller
XIRQ_NUM_CH
XIRQ_NUM_CH |
natural |
0 |
Number of channels of the External Interrupt Controller (XIRQ). Valid values are 0..32. |
XIRQ_TRIGGER_TYPE
XIRQ_TRIGGER_TYPE |
std_ulogic_vector(31 downto 0) |
0xFFFFFFFF |
Interrupt trigger type configuration (one bit for each IRQ channel): |
XIRQ_TRIGGER_POLARITY
XIRQ_TRIGGER_POLARITY |
std_ulogic_vector(31 downto 0) |
0xFFFFFFFF |
Interrupt trigger polarity configuration (one bit for each IRQ channel): |
2.2.12. Processor Peripheral/IO Modules
IO_GPIO_EN
IO_GPIO_EN |
boolean |
false |
Implement General Purpose Input and Output Port (GPIO) module when true. |
IO_MTIME_EN
IO_MTIME_EN |
boolean |
false |
Implement Machine System Timer (MTIME) module when true. |
IO_UART0_EN
IO_UART0_EN |
boolean |
false |
Implement Primary Universal Asynchronous Receiver and Transmitter (UART0) module when true. |
IO_UART0_RX_FIFO
IO_UART0_RX_FIFO |
natural |
1 |
UART0 receiver FIFO depth, has to be a power of two, minimum value is 1 (implementing simple double-buffering). |
IO_UART0_TX_FIFO
IO_UART0_TX_FIFO |
natural |
1 |
UART0 transmitter FIFO depth, has to be a power of two, minimum value is 1 (implementing simple double-buffering). |
IO_UART1_EN
IO_UART1_EN |
boolean |
false |
Implement Secondary Universal Asynchronous Receiver and Transmitter (UART1) module when true. |
IO_UART1_RX_FIFO
IO_UART1_RX_FIFO |
natural |
1 |
UART1 receiver FIFO depth, has to be a power of two, minimum value is 1 (implementing simple double-buffering). |
IO_UART1_TX_FIFO
IO_UART1_TX_FIFO |
natural |
1 |
UART1 transmitter FIFO depth, has to be a power of two, minimum value is 1 (implementing simple double-buffering). |
IO_SPI_EN
IO_SPI_EN |
boolean |
false |
Implement Serial Peripheral Interface Controller (SPI) module when true. |
IO_SPI_FIFO
IO_SPI_FIFO |
natural |
0 |
Depth of the Serial Peripheral Interface Controller (SPI) FIFO. Has to be zero or a power of two. Maximum value is 32*1024. |
IO_TWI_EN
IO_TWI_EN |
boolean |
false |
Implement Two-Wire Serial Interface Controller (TWI) module when true. |
IO_PWM_NUM_CH
IO_PWM_NUM_CH |
natural |
0 |
Number of channels of the Pulse-Width Modulation Controller (PWM) to implement (0..60) The PWM controller is not implemented if zero. |
IO_WDT_EN
IO_WDT_EN |
boolean |
false |
Implement Watchdog Timer (WDT) module when true, |
IO_TRNG_EN
IO_TRNG_EN |
boolean |
false |
Implement True Random-Number Generator (TRNG) module when true. |
IO_TRNG_FIFO
IO_TRNG_FIFO |
natural |
1 |
Defines the depth of the TRNG data FIFO. Minimal value is 1;, has to be a power of two. |
IO_CFS_EN
IO_CFS_EN |
boolean |
false |
Implement Custom Functions Subsystem (CFS) module when true. |
IO_CFS_CONFIG
IO_CFS_CONFIG |
std_ulogic_vector(31 downto 0) |
0x"00000000" |
This is a "conduit" generic that can be used to pass user-defined Custom Functions Subsystem (CFS) implementation flags to the custom functions subsystem entity. |
IO_CFS_IN_SIZE
IO_CFS_IN_SIZE |
positive |
32 |
Defines the size of the Custom Functions Subsystem (CFS) input signal conduit ( |
IO_CFS_OUT_SIZE
IO_CFS_OUT_SIZE |
positive |
32 |
Defines the size of the Custom Functions Subsystem (CFS) output signal conduit ( |
IO_NEOLED_EN
IO_NEOLED_EN |
boolean |
false |
Implement Smart LED Interface (NEOLED) module (WS2812 / NeoPixel™-compatible) when true. |
IO_NEOLED_TX_FIFO
IO_NEOLED_TX_FIFO |
natural |
1 |
TX FIFO depth of the the Smart LED Interface (NEOLED) module. Minimal value is 1, maximal value is 32k, has to be a power of two. |
IO_GPTMR_EN
IO_GPTMR_EN |
boolean |
false |
Implement General Purpose Timer (GPTMR) module when true. |
IO_XIP_EN
IO_XIP_EN |
boolean |
false |
Implement the Execute In Place Module (XIP) module when true. |
IO_ONEWIRE_EN
IO_ONE_EN |
boolean |
false |
Implement the One-Wire Serial Interface Controller (ONEWIRE) module when true. |
2.3. Processor Clocking
The processor is implemented as fully-synchronous logic design using a single clock domain that is driven by the top’s
clk_i
signal. This clock signal is used by all internal registers and memories, which trigger on the rising edge of
this clock signal. External "clocks" like the OCD’s JTAG clock or the TWI’s serial clock are synchronized into the
processor’s clock domain before being further processed.
The registers of the Processor Reset system trigger on a falling clock edge. |
Many processor modules like the UARTs or the timers require a programmable time base for operations. In order to simplify the hardware, the processor implements a global "clock generator" that provides clock enables for certain frequencies. These clock enable signals are synchronous to the system’s main clock and will be high for only a single cycle of this main clock. Hence, processor modules can use these signals for sub-main-clock operations while still having a single clock domain only.
In total, 8 sub-main-clock signals are available. All processor modules, which feature a time-based configuration, provide a
programmable three-bit prescaler select in their according control register to select one of the 8 available clocks. The
mapping of the prescaler select bits to the according clock source is shown in the table below. Here, f represents the
processor main clock from the top entity’s clk_i
signal.
Prescaler bits: |
|
|
|
|
|
|
|
|
Resulting clock: |
f/2 |
f/4 |
f/8 |
f/64 |
f/128 |
f/1024 |
f/2048 |
f/4096 |
The software framework provides pre-defined aliases for the prescaler select bits:
neorv32.h
enum NEORV32_CLOCK_PRSC_enum {
CLK_PRSC_2 = 0, /**< CPU_CLK (from clk_i top signal) / 2 */
CLK_PRSC_4 = 1, /**< CPU_CLK (from clk_i top signal) / 4 */
CLK_PRSC_8 = 2, /**< CPU_CLK (from clk_i top signal) / 8 */
CLK_PRSC_64 = 3, /**< CPU_CLK (from clk_i top signal) / 64 */
CLK_PRSC_128 = 4, /**< CPU_CLK (from clk_i top signal) / 128 */
CLK_PRSC_1024 = 5, /**< CPU_CLK (from clk_i top signal) / 1024 */
CLK_PRSC_2048 = 6, /**< CPU_CLK (from clk_i top signal) / 2048 */
CLK_PRSC_4096 = 7 /**< CPU_CLK (from clk_i top signal) / 4096 */
};
If no peripheral modules requires a clock signal from the internal generator (all available modules disabled by clearing the enable bit in the according module’s control register), it is automatically deactivated to reduce dynamic power consumption. |
2.4. Processor Reset
Processor Reset Signal
Always make sure to connect the processor’s reset signal rstn_i to a valid reset source (a button, the "locked"
signal of a PLL, a dedicated reset controller, etc.). Do not assign a static value / connect a static signal to it!
|
The processor-wide reset can be triggered at any of the following sources:
-
the asynchronous low-active
rstn_i
top entity input signal
If any of these sources trigger a reset, the internal reset will be triggered for at least clock cycles resetting
the CPU, the Processor Clocking system and the IO/peripheral devices. The internal reset is asserted
aysynchronoulsy if triggered by the external rstn_i
signal. For internal sources, the global reset is asserted
synchronously. If the reset cause gets inactive the internal reset is de-asserted synchronously at a falling
clock edge.
Internally, all processor registers that actually do provide a hardware reset use an asynchronous reset. Using a synchronous reset might increase logic utilization (and might increase the critical path) for FPGAs that do not provide a "native" synchronous reset for their flip flops. Furthermore, an asynchronous reset ensures that the entire processor logic is reset to a defined state even if the main clock is not yet operational.
In order to reduce routing constraints (and by this the actual hardware requirements), some uncritical registers of the NEORV32 CPU as well as many registers of the entire NEORV32 Processor do not use a dedicated hardware reset. For example there are several pipeline registers and "buffer" registers that do not require a defined initial state to ensure correct operation.
The system reset will only reset the control registers of each implemented IO/peripheral module. This control register reset will also reset the according "module enable flag" to zero, which - in turn - will cause a synchronous module-internal reset of the remaining logic. |
2.5. Processor Interrupts
The NEORV32 Processor provides several interrupt request signals (IRQs) for custom platform use.
2.5.1. RISC-V Standard Interrupts
The processor setup features the standard machine-level RISC-V interrupt lines for "machine timer interrupt", "machine software interrupt" and "machine external interrupt". Their usage is defined by the RISC-V privileged architecture specifications. However, bare-metal system can also repurpose these interrupts. See CPU section Traps, Exceptions and Interrupts for more information.
Top signal | Width | Description |
---|---|---|
|
1 |
Machine timer interrupt from processor-external MTIME unit (MTI). This IRQ is only available if the processor-internal MTIME unit is not used (IO_MTIME_EN = false). |
|
1 |
Machine software interrupt (MSI). This interrupt is used for inter-processor interrupts in multi-core systems. However, it can also be used for any custom purpose. |
|
1 |
Machine external interrupt (MEI). This interrupt is used for any processor-external interrupt source (like a platform interrupt controller). |
Trigger Type
The RISC-V standard interrupts are level-triggered and high-active. Once set the signal has to stay high until
the interrupt request is explicitly acknowledged (e.g. writing to a memory-mapped register). The RISC-V standard interrupts
can NOT be acknowledged by writing zero to the according mip CSR bit.
|
2.5.2. NEORV32-Specific Fast Interrupt Requests
As part of the NEORV32-specific CPU extensions, the CPU core features 16 fast interrupt request signals
(FIRQ0
- FIRQ15
) with dedicated bits in the mip
and mie
CSRs and custom mcause
trap codes.
The FIRQ signals are reserved for processor-internal modules only (for example for the communication
interfaces to signal "available incoming data" or "ready to send new data").
The mapping of the 16 FIRQ channels and the according processor-internal modules is shown in the following table (the channel number also corresponds to the according FIRQ priority: 0 = highest, 15 = lowest):
Channel | Source | Description |
---|---|---|
0 |
watchdog timeout interrupt |
|
1 |
custom functions subsystem (CFS) interrupt (user-defined) |
|
2 |
UART0 data received interrupt (RX complete) |
|
3 |
UART0 sending done interrupt (TX complete) |
|
4 |
UART1 data received interrupt (RX complete) |
|
5 |
UART1 sending done interrupt (TX complete) |
|
6 |
SPI transmission done interrupt |
|
7 |
TWI transmission done interrupt |
|
8 |
External interrupt controller interrupt |
|
9 |
NEOLED TX buffer interrupt |
|
10 |
RX data buffer interrupt |
|
11 |
TX data buffer interrupt |
|
12 |
General purpose timer interrupt |
|
13 |
1-wire operation done interrupt |
|
14:15 |
- |
reserved, will never fire |
Trigger Type
The fast interrupt request channels become pending after being triggering by a rising edge. A pending FIRQ has to
be explicitly cleared by writing zero to the according mip CSR bit.
|
2.5.3. Platform External Interrupts
The processor provides an optional interrupt controller for up to 32 user-defined external interrupts (see section External Interrupt Controller (XIRQ)). These external IRQs are mapped to a single CPU fast interrupt request so a software handler is required to differentiate / prioritize these interrupts.
Top signal | Width | Description |
---|---|---|
|
up to 32 |
External platform interrupts (user-defined). |
Trigger Type
The trigger for these interrupt can be defined via generics. See section
External Interrupt Controller (XIRQ) for more information. Depending on the trigger type, users can
implement custom acknowledge mechanisms. All external interrupts are mapped to a single processor-internal
fast interrupt request (see below).
|
2.6. Address Space
As a 32-bit architecture the NEORV32 provides a 4GB physical address space. By default, this address space is divided into five main regions with each region having a specific function:
-
Instruction address space: memory address space for instructions (=code) and constants. A configurable section of this address space can used by the instruction memory (Instruction Memory (IMEM)).
-
Data address space: memory address space for application runtime data (heap, stack, etc.). A configurable section of this address space can be used by the data memory (Data Memory (DMEM)).
-
Bootloader address space: a fixed section of this address space is used by the internal bootloader memory (BOOTLDROM).
-
On-Chip Debugger address space: this fixed section is entirely used by the processor’s On-Chip Debugger (OCD).
-
IO/peripheral address space: also a fixed section used for the processor-internal memory-mapped IO/peripheral devices (e.g., UART).

Region Overlap
By default, there is no overlap between the different regions. However, the NEORV32 is a modified Harvard Architecture (same address space
for instructions and data) so the instruction and data address spaces may also overlap. See section Address Space Layout.
|
RAM Layout - Usage of the Data Address Space
The actual usage of the data address space by the software/executables (stack, heap, …) is
illustrated in section RAM Layout.
|
2.6.1. Physical Memory Attributes (PMAs)
Each default region of the NEORV32 address space provides specific physical memory attributes that define the allowed access types
to each of these regions. These "access permission" are enforced by the hardware and cannot be changed. If an access violates the
PMA’s permissions an exception is raised. The access permissions can be further constrained using the CPU’s PMP
Physical Memory Protection.
The following access types are checked by the hardware (if an access type is present in a region’s PMA the access is permitted):
-
r
- data read access -
w
- data write access -
x
- instruction fetch access ("execute")
# | Region Description | PMAs | Note |
---|---|---|---|
1 |
Instruction address space |
|
Write accesses to the the internal Instruction Memory (IMEM) can be disabled. |
2 |
Data address space |
|
Code can also be executed from data memory. |
3 |
Bootloader address space |
|
Read-only memory. |
4 |
On-Chip Debugger address space |
|
Not accessible at all by "normal" software - accessible only when the CPU is in CPU Debug Mode. |
5 |
IO/peripheral address space |
|
Read/write accesses only. |
2.6.2. CPU Data and Instruction Access
The CPU can access all of the 32-bit address space from the instruction fetch interface (I) and also from the
data access interface (D). These two CPU interfaces are multiplexed by a simple bus switch
(rtl/core/neorv32_busswitch.vhd
) into a single processor-internal bus. All processor-internal
memories, peripherals and also the external memory interface are connected to this bus. Hence, both CPU
interfaces (instruction fetch & data access) have access to the same (identical!) address space making the
setup a modified von-Neumann architecture.

The internal processor bus might appear as bottleneck. In order to reduce traffic jam on this bus (when instruction fetch and data interface access the bus at the same time) the instruction fetch of the CPU is equipped with a prefetch buffer. Instruction fetches can be further buffered using the i-cache. Furthermore, data accesses (loads and stores) have higher priority than instruction fetch accesses. |
See sections Architecture and Bus Interface for more information regarding the CPU bus accesses. |
2.6.3. Address Space Layout
The general address space layout consists of two main configuration constants: ispace_base_c
defining
the base address of the instruction memory address space and dspace_base_c
defining the base address of
the data memory address space. Both constants are defined in the NEORV32 VHDL package file
rtl/core/neorv32_package.vhd
:
-- Architecture Configuration ----------------------------------------------------
-- ----------------------------------------------------------------------------------
constant ispace_base_c : std_ulogic_vector(31 downto 0) := x"00000000";
constant dspace_base_c : std_ulogic_vector(31 downto 0) := x"80000000";
The default configuration assumes the instruction memory address space starting at address 0x00000000 and the data memory address space starting at 0x80000000. Both values can be modified for a specific setup and the address space may overlap or can be completely identical. Make sure that both base addresses are aligned to a 4-byte boundary.
The base address of the internal bootloader (at 0xFFFF0000) and the internal IO region (at 0xFFFFFE00) for peripheral devices are also defined in the package and are fixed. These address regions cannot not be used for other applications - even if the bootloader or all IO devices are not implemented - without modifying the core’s hardware sources. |
2.6.4. Memory Configuration
The NEORV32 Processor was designed to provide maximum flexibility for the memory configuration. The processor can populate the instruction address space and/or the data address space with internal memories for instructions (IMEM) and data (DMEM). Processor external memories can be used as an alternative or even in combination with the internal ones. The figure below show some exemplary memory configurations.

Internal Memories
The processor-internal memories (Instruction Memory (IMEM) and Data Memory (DMEM)) are enabled (=implemented) via the MEM_INT_IMEM_EN and MEM_INT_DMEM_EN generics. Their sizes are configures via the according MEM_INT_IMEM_SIZE and MEM_INT_DMEM_SIZE generics.
If the processor-internal IMEM is implemented, it is located right at the base address of the instruction
address space (default ispace_base_c
= 0x00000000). Vice versa, the processor-internal data memory is
located right at the beginning of the data address space (default dspace_base_c
= 0x80000000) when
implemented.
If the IMEM (internal or external) is less than the (default) maximum size (2GB), there is a "dead address space" between it and the DMEM. This provides an additional safety feature since data corrupting scenarios like stack overflow cannot directly corrupt the content of the IMEM: any access to the "dead address space" in between will raise an exception that can be caught by the runtime environment. |
External Memories
If external memories (or further IP modules) shall be connected via the processor’s external bus interface, the interface has to be enabled via MEM_EXT_EN generic (=true). More information regarding this interface can be found in section Processor-External Memory Interface (WISHBONE) (AXI4-Lite).
Any CPU access (data or instructions), which does not fulfill at least one of the following conditions, is forwarded via the processor’s bus interface to external components:
-
access to the processor-internal IMEM and processor-internal IMEM is implemented
-
access to the processor-internal DMEM and processor-internal DMEM is implemented
-
access to the bootloader ROM and beyond → addresses >= BOOTROM_BASE (default 0xFFFF0000) will never be forwarded to the external memory interface
If the Execute In Place module (XIP) is implemented accesses map to this module are not forwarded to the external memory interface. See section Execute In Place Module (XIP) for more information. |
If no (or not all) processor-internal memories are implemented, the according base addresses are mapped to external memories.
For example, if the processor-internal IMEM is not implemented (MEM_INT_IMEM_EN = false), the processor will forward
any access to the instruction address space (starting at ispace_base_c
) via the external bus interface to the external
memory system.
If the external interface is deactivated, any access exceeding the internal memory address space (instruction, data, bootloader) or the internal peripheral address space will trigger a bus access fault exception. |
2.6.5. Boot Configuration
Due to the flexible memory configuration concept, the NEORV32 Processor provides several different boot concepts. The figure below shows the exemplary concepts for the two most common boot scenarios.

The configuration of internal or external data memory (DMEM; MEM_INT_DMEM_EN = true / false) is not relevant for the boot configuration itself. Hence, it is not further illustrated here. |
There are two general boot scenarios: Indirect Boot (1a and 1b) and Direct Boot (2a and 2b) configured via the INT_BOOTLOADER_EN generic. If this generic is set true the indirect boot scenario is used. This is also the default boot configuration of the processor. If INT_BOOTLOADER_EN is set false the direct boot scenario is used.
Please note that the provided boot scenarios are just exemplary setups that (should) fit most common requirements. Much more sophisticated boot scenarios are possible by combining internal and external memories. For example, the default internal bootloader could be used as first-level bootloader that loads (from extern SPI flash) a second-level bootloader that is placed and execute in internal IMEM. This second-level bootloader could then fetch the actual application and store it to external data memory and transfers CPU control to that. |
Indirect Boot
The indirect boot scenarios 1a and 1b use the processor-internal Bootloader. This boot setup is enabled by setting the INT_BOOTLOADER_EN generic to true, which will implement the processor-internal Bootloader ROM (BOOTROM). This read-only memory is pre-initialized during synthesis with the default bootloader firmware. The bootloader provides several options to upload an executable (via UART or from external SPI flash) and copies it to the beginning of the instruction address space so the CPU can execute it.
Boot scenario 1a uses the processor-internal IMEM (MEM_INT_IMEM_EN = true). This scenario implements the internal Instruction Memory (IMEM) as non-initialized RAM so the bootloader can copy the actual executable to it.
Boot scenario 1b uses a processor-external IMEM (MEM_INT_IMEM_EN = false) that is connected via the processor’s bus interface. In this scenario the internal Instruction Memory (IMEM) is not implemented at all and the bootloader will copy the executable to the processor-external memory. Hence, the external memory has to be implemented as RAM.
Direct Boot
The direct boot scenarios 2a and 2b do not use the processor-internal bootloader since the INT_BOOTLOADER_EN generic is set false. In this configuration the Bootloader ROM (BOOTROM) is not implemented at all and the CPU will directly begin executing code from the beginning of the instruction address space after reset. An application-specific "pre-initialization" mechanism is required in order to provide an executable in memory.
Boot scenario 2a uses the processor-internal IMEM (MEM_INT_IMEM_EN = true) that is implemented as read-only memory in this scenario. It is pre-initialized (by the bitstream) with the actual application executable during synthesis.
In contrast, boot scenario 2b uses a processor-external IMEM (MEM_INT_IMEM_EN = false). In this scenario the system designer is responsible for providing an initialized external memory that contains the actual application to be executed. If the external memory is not already initialized after reset, a simple ROM containing a "polling loop" can be implemented that is exited as soon as the application logic has finished initializing the memory with the actual application code.
2.7. Processor-Internal Modules
Basically, the NEORV32 processor is a SoC consisting of the NEORV32 CPU, peripheral/IO devices, embedded memories, an external memory interface and a bus infrastructure to interconnect all units. Additionally, the system implements an internal reset generator (→ Processor Reset) and a global clock system (→ Processor Clocking).
Peripheral / IO Devices
The processor-internal peripheral/IO devices are located at the end of the 32-bit address space at base address 0xFFFFFE00. A region of 512 bytes is reserved for this devices. Hence, all peripheral/IO devices are accessed using a memory-mapped scheme. A special linker script as well as the NEORV32 core software library abstract the specific memory layout for the user.
Module Address Space Mapping
The base address of each component/module has to be aligned to the
total size of the module’s occupied address space! The occupied address space
has to be a power of two (minimum 4 bytes)! Address spaces must not overlap!
|
Full-Word Write Accesses Only
All peripheral/IO devices can only be written in full-word mode (i.e. 32-bit). Byte or half-word
(8/16-bit) writes will trigger a store access fault exception. Read accesses are not size constrained.
Processor-internal memories as well as modules connected to the external memory interface can still
be written with a byte-wide granularity.
|
Unimplemented Modules / "Address Holes"
When accessing an IO device that hast not been implemented (disabled via the according generic)
or when accessing an address that is unused, a load or store access fault exception is raise.
|
Module Reset
All processor-internal modules provide a dedicated hardware reset, which is triggered by the Processor Reset
system. When active, the system-wide reset will reset all module’s control registers to all-zero. Note that this
hardware reset does not directly reset the remaining module’s logic - the internal logic is reset synchronously when the
enable bit in the according unit’s control register is cleared. Software can trigger a module reset
by clearing the enable bit of the module’s control register. See section Processor Reset for more information.
|
Access Latency of Processor-Internal Modules
By default all processor internal modules (memories and peripherals) have a fixed access latency of one clock cycle.
However, a custom version of any module may also have higher access latency. See section Bus Interface
for more information.
|
Software Access
Use the provided Core Libraries to interact with the peripheral devices. This
prevents incompatibilities with future versions, since the hardware driver functions handle all the
register and register bit accesses.
|
CMSIS System Description View (SVD)
A CMSIS-SVD-compatible System View Description (SVD) file including all peripherals is available in sw/svd .
|
Interrupts of Processor-Internal Modules
Most peripheral/IO devices provide some kind of interrupt (for example to signal available incoming data). These interrupts are entirely mapped to the CPU’s Custom Fast Interrupt Request Lines. Note that all these interrupt lines are high-active and are permanently triggered until the IRQ-causing condition is resolved. See section Processor Interrupts for more information.
Nomenclature for Peripheral / IO Devices Listing
Each peripheral device chapter features a register map showing accessible control and data registers of the
according device including the implemented control and status bits. C-language code can directly interact with these
registers via pre-defined struct
. Each IO/peripheral module provides a unique struct
. All accessible
interface registers of this module are defined as members of this struct
. The pre-defined struct
are defined int the
main processor core library include file sw/lib/include/neorv32.h
.
The naming scheme of these low-level hardware access structs is NEORV32_<module_name>.<register_name>
.
struct
// Read from SYSINFO "CLK" register
uint32_t temp = NEORV32_SYSINFO.CLK;
The registers and/or register bits, which can be accessed directly using plain C-code, are marked with a "[C]". Not all registers or register bits can be arbitrarily read/written. The following read/write access types are available:
-
r/w
registers / bits can be read and written -
r/-
registers / bits are read-only; any write access to them has no effect -
-/w
these registers / bits are write-only; they auto-clear in the next cycle and are always read as zero
Bits / registers that are not listed in the register map tables are not (yet) implemented. These registers / bits are always read as zero. A write access to them has no effect, but user programs should only write zero to them to keep compatible with future extension. |
When writing to read-only registers, the access is nevertheless acknowledged, but no actual data is written. When reading data from a write-only register the result is undefined. |
2.7.1. Instruction Memory (IMEM)
Hardware source file(s): |
neorv32_imem.entity.vhd |
entity-only definition |
mem/neorv32_imem.default.vhd |
default platform-agnostic memory architecture |
|
Software driver file(s): |
none |
implicitly used |
Top entity port: |
none |
|
Configuration generics: |
MEM_INT_IMEM_EN |
implement processor-internal IMEM when true |
MEM_INT_IMEM_SIZE |
IMEM size in bytes |
|
INT_BOOTLOADER_EN |
use internal bootloader when true (implements IMEM as uninitialized RAM, otherwise the IMEM is implemented an pre-intialized ROM) |
|
CPU interrupts: |
none |
Implementation of the processor-internal instruction memory is enabled via the processor’s
MEM_INT_IMEM_EN generic. The size in bytes is defined via the MEM_INT_IMEM_SIZE generic. If the
IMEM is implemented, the memory is mapped into the instruction memory space and located right at the
beginning of the instruction memory space (default ispace_base_c
= 0x00000000).
By default the IMEM is implemented as true RAM so the content can be modified during run time. This is required when using a bootloader that can update the content of the IMEM at any time. If you do not need the bootloader anymore - since your application development has completed and you want the program to permanently reside in the internal instruction memory - the IMEM is automatically implemented as pre-intialized ROM when the processor-internal bootloader is disabled (INT_BOOTLOADER_EN = false).
When the IMEM is implemented as ROM, it will be initialized during synthesis (actually, by the bitstream)
with the actual application program image. The compiler toolchain will generate a VHDL initialization
file rtl/core/neorv32_application_image.vhd
, which is automatically inserted into the IMEM. If
the IMEM is implemented as RAM (default), the memory will not be initialized at all.
Access Latency
By default, the IMEM has a fixed access latency of one clock cycle (like all other processor-internal
modules). However, custom versions of this module may also have higher access latency. See section Bus Interface
for more information.
|
VHDL Source File
The actual IMEM is split into two design files: a plain entity definition (neorv32_imem.entity.vhd ) and the actual
architecture definition (mem/neorv32_imem.default.vhd ). This default architecture provides a generic and
platform independent memory design that (should) infers embedded memory block. You can replace/modify the architecture
source file in order to use platform-specific features (like advanced memory resources) or to improve technology mapping
and/or timing.
|
Read-Only Access
If the IMEM is implemented as true ROM any write attempt to it will raise a store access fault exception.
|
2.7.2. Data Memory (DMEM)
Hardware source file(s): |
neorv32_dmem.entity.vhd |
entity-only definition |
mem/neorv32_dmem.default.vhd |
default platform-agnostic memory architecture |
|
Software driver file(s): |
none |
implicitly used |
Top entity port: |
none |
|
Configuration generics: |
MEM_INT_DMEM_EN |
implement processor-internal DMEM when true |
MEM_INT_DMEM_SIZE |
DMEM size in bytes |
|
CPU interrupts: |
none |
Implementation of the processor-internal data memory is enabled via the processor’s MEM_INT_DMEM_EN
generic. The size in bytes is defined via the MEM_INT_DMEM_SIZE generic. If the DMEM is implemented,
the memory is mapped into the data memory space and located right at the beginning of the data memory
space (default dspace_base_c
= 0x80000000). The DMEM is always implemented as true RAM.
Access Latency
By default, the DMEM has a fixed access latency of one clock cycle (like all other processor-internal
modules). However, custom versions of this module may also have higher access latency. See section Bus Interface
for more information.
|
VHDL Source File
The actual DMEM is split into two design files: a plain entity definition (neorv32_dmem.entity.vhd ) and the actual
architecture definition (mem/neorv32_dmem.default.vhd ). This default architecture provides a generic and
platform independent memory design that (should) infers embedded memory block. You can replace/modify the architecture
source file in order to use platform-specific features (like advanced memory resources) or to improve technology mapping
and/or timing.
|
Execute from RAM
The CPU is capable of executing code also from DMEM.
|
2.7.3. Bootloader ROM (BOOTROM)
Hardware source file(s): |
neorv32_boot_rom.vhd |
|
Software driver file(s): |
none |
implicitly used |
Top entity port: |
none |
|
Configuration generics: |
INT_BOOTLOADER_EN |
implement processor-internal bootloader when true |
CPU interrupts: |
none |
The default neorv32_boot_rom.vhd HDL source file provides a generic memory design that infers embedded
memory for larger memory configurations. You might need to replace/modify the source file in order to use
platform-specific features (like advanced memory resources) or to improve technology mapping and/or timing.
|
This HDL modules provides a read-only memory that contain the executable code image of the bootloader. If the INT_BOOTLOADER_EN generic is true this module will be implemented and the CPU boot address is modified to directly execute the code from the bootloader ROM after reset.
The bootloader ROM is located at address 0xFFFF0000
and can occupy a address space of up to 32kB. The base
address as well as the maximum address space size are fixed and cannot (should not!) be modified as this
might address collision with other processor modules.
The bootloader memory is read-only and is automatically initialized with the bootloader executable image
rtl/core/neorv32_bootloader_image.vhd
during synthesis. The actual physical size of the ROM is also
determined via synthesis and expanded to the next power of two. For example, if the bootloader code requires
10kB of storage, a ROM with 16kB will be generated. The maximum size must not exceed 32kB.
Access Latency
By default, the bootloader ROM has a fixed access latency of one clock cycle (like all other processor-internal
modules). However, custom versions of this module may also have higher access latency. See section Bus Interface
for more information.
|
Read-Only Access
Any write access to the BOOTROM will raise a store access fault exception.
|
Bootloader - Software
See section Bootloader for more information regarding the actual bootloader software/executable itself.
|
Boot Configuration
See section Boot Configuration for more information regarding the processor’s different boot scenarios.
|
2.7.4. Processor-Internal Instruction Cache (iCACHE)
Hardware source file(s): |
neorv32_icache.vhd |
|
Software driver file(s): |
none |
implicitly used |
Top entity port: |
none |
|
Configuration generics: |
ICACHE_EN |
implement processor-internal instruction cache when true |
ICACHE_NUM_BLOCKS |
number of cache blocks (pages/lines) |
|
ICACHE_BLOCK_SIZE |
size of a cache block in bytes |
|
ICACHE_ASSOCIATIVITY |
associativity / number of sets |
|
CPU interrupts: |
none |
The processor features an optional cache for instructions to improve performance when using memories with high access latencies. The cache is directly connected to the CPU’s instruction fetch interface and provides full-transparent buffering of instruction fetch accesses to the entire address space.
The cache is implemented if the ICACHE_EN generic is true. The size of the cache memory is defined via ICACHE_BLOCK_SIZE (the size of a single cache block/page/line in bytes; has to be a power of two and >= 4 bytes), ICACHE_NUM_BLOCKS (the total amount of cache blocks; has to be a power of two and >= 1) and the actual cache associativity ICACHE_ASSOCIATIVITY (number of sets; 1 = direct-mapped, 2 = 2-way set-associative, has to be a power of two and >= 1). If the cache associativity (ICACHE_ASSOCIATIVITY) is greater than one the LRU replacement policy (least recently used) is used.
Cache Memory HDL
The default neorv32_icache.vhd HDL source file provides a generic memory design that infers embedded
memory. You might need to replace/modify the source file in order to use platform-specific features
(like advanced memory resources) or to improve technology mapping and/or timing. Also, keep the features
of the targeted FPGA’s memory resources (block RAM) in mind when configuring
the cache size/layout to maximize and optimize resource utilization.
|
Caching Internal Memories
The instruction cache is intended to accelerate instruction fetches from processor-external memories
(via the external bus interface or via the XIP module).
Since all processor-internal memories provide an access latency of one cycle (by default), caching
internal memories does not bring a relevant performance gain. However, it will slightly reduce traffic on the
processor-internal bus.
|
Manual Cache Clear/Reload
By executing the ifence.i instruction (Zifencei CPU extension) the cache is cleared and a reload from
main memory is triggered. This also allows to implement self-modifying code.
|
Retrieve Cache Configuration from Software
Software can retrieve the cache configuration/layout from the SYSINFO - Cache Configuration register.
|
Bus Access Fault Handling
The cache always loads a complete cache block (ICACHE_BLOCK_SIZE bytes; aligned to the block size) every time a cache miss is detected. Each cached word from this block provides a single status bit that indicates if the according bus access was successful or caused a bus error. Hence, the whole cache block remains valid even if certain addresses inside caused a bus error. If the CPU accesses any of the faulty cache words, an instruction access error exception is raised.
2.7.5. Processor-External Memory Interface (WISHBONE) (AXI4-Lite)
Hardware source file(s): |
neorv32_wishbone.vhd |
|
Software driver file(s): |
none |
implicitly used |
Top entity port: |
|
request tag output (3-bit) |
|
address output (32-bit) |
|
|
data input (32-bit) |
|
|
data output (32-bit) |
|
|
write enable (1-bit) |
|
|
byte enable (4-bit) |
|
|
strobe (1-bit) |
|
|
valid cycle (1-bit) |
|
|
acknowledge (1-bit) |
|
|
bus error (1-bit) |
|
|
an executed |
|
|
an executed |
|
Configuration generics: |
MEM_EXT_EN |
enable external memory interface when true |
MEM_EXT_TIMEOUT |
number of clock cycles after which an unacknowledged external bus access will auto-terminate (0 = disabled) |
|
MEM_EXT_PIPE_MODE |
when false (default): classic/standard Wishbone protocol; when true: pipelined Wishbone protocol |
|
MEM_EXT_BIG_ENDIAN |
byte-order (Endianness) of external memory interface; true=BIG, false=little (default) |
|
MEM_EXT_ASYNC_RX |
use registered RX path when false (default); use async/direct RX path when true |
|
MEM_EXT_ASYNC_TX |
use registered TX path when false (default); use async/direct TX path when true |
|
CPU interrupts: |
none |
The external memory interface provides a Wishbone b4-compatible on-chip bus interface. The bus interface is implemented if the MEM_EXT_EN generic is true. This interface can be used to attach external memories, custom hardware accelerators, additional IO devices or all other kinds of IP blocks to the processor.
The external interface is not mapped to a specific address space region. Instead, all CPU memory accesses that do not target a processor-internal module are delegated to the external memory interface. In summary, a CPU load/store access is delegated via the external bus interface if…
-
it does not target the internal instruction memory IMEM (if implemented at all).
-
and it does not target the internal data memory DMEM (if implemented at all).
-
and it does not target the internal bootloader ROM or any of the IO devices - regardless if one or more of these components are actually implemented or not.
Address Space Layout
See section Address Space for more information.
|
Execute-in-Place Module
If the Execute In Place module (XIP) is implemented accesses targeting the XIP memory-mapped-region will not be forwarded to the
external memory interface. See section Execute In Place Module (XIP) for more information.
|
Wishbone Bus Protocol
The external memory interface either uses the standard (also called "classic") Wishbone protocol (default) or pipelined Wishbone protocol. The protocol to be used is configured via the MEM_EXT_PIPE_MODE generic:
-
If MEM_EXT_PIPE_MODE is false, all bus control signals including
wb_stb_o
are active and remain stable until the transfer is acknowledged/terminated. -
If MEM_EXT_PIPE_MODE is true, all bus control except
wb_stb_o
are active and remain until the transfer is acknowledged/terminated. In this case,wb_stb_o
is asserted only during the very first bus clock cycle.
![]() |
![]() |
Classic Wishbone read access |
Pipelined Wishbone write access |
Wishbone Specs.
A detailed description of the implemented Wishbone bus protocol and the according interface signals
can be found in the data sheet "Wishbone B4 - WISHBONE System-on-Chip (SoC) Interconnection
Architecture for Portable IP Cores". A copy of this document can be found in the docs folder of this
project.
|
Bus Access
The NEORV32 Wishbone gateway does not support burst transfer yet, so there is always just a single transfer in "in fly".
Hence, the Wishbone STALL
signal is not implemented. An accessed Wishbone device does not have to respond immediately to a bus
request by sending an ACK. Instead, there is a time window where the device has to acknowledge the transfer. This time window
id configured by the MEM_EXT_TIMEOUT top generic that defines the maximum time (in clock cycles) a bus access can be pending
before it is automatically terminated with an error condition. If MEM_EXT_TIMEOUT is set to zero, the timeout disabled
an a bus access can take an arbitrary number of cycles to complete (this is not recommended!).
When MEM_EXT_TIMEOUT is greater than zero, the Wishbone gateway starts an internal countdown whenever the CPU
accesses an address via the external memory interface. If the accessed device does not acknowledge (via wb_ack_i
)
or terminate (via wb_err_i
) the transfer within MEM_EXT_TIMEOUT clock cycles, the bus access is automatically canceled
setting wb_cyc_o
low again and a CPU load/store/instruction fetch bus access fault exception is raised.
External "Address Space Holes"
Setting MEM_EXT_TIMEOUT to zero will permanently stall the CPU if the targeted Wishbone device never responds. Hence,
MEM_EXT_TIMEOUT should be always set to a value greater than zero.This feature can be used as safety guard if the external memory system does not check for "address space holes". That means that accessing addresses, which do not belong to a certain memory or device, do not permanently stall the processor due to an unacknowledged/unterminated bus access. If the external memory system can guarantee to acknowledge any bus accesses (even if targeting an unimplemented address) the timeout feature can be safely disabled (MEM_EXT_TIMEOUT = 0). |
Wishbone Tag
The 3-bit wishbone wb_tag_o
signal provides additional information regarding the access type. This signal
is compatible to the AXI4 AxPROT
signal.
-
wb_tag_o(0)
1: privileged access (CPU is in machine mode); 0: unprivileged access (CPU is not in machine mode) -
wb_tag_o(1)
always zero (indicating "secure access") -
wb_tag_o(2)
1: instruction fetch access, 0: data access
Endianness
The NEORV32 CPU and the Processor setup are little-endian architectures. To allow direct connection to a big-endian memory system the external bus interface provides an Endianness configuration. The Endianness of the external memory interface can be configured via the MEM_EXT_BIG_ENDIAN generic. By default, the external memory interface uses little-endian byte-order.
Application software can check the Endianness configuration of the external bus interface via the SYSINFO module (see section System Configuration Information Memory (SYSINFO) for more information).
Access Latency
By default, the Wishbone gateway introduces two additional latency cycles: processor-outgoing (*_o
) and
processor-incoming (*_i
) signals are fully registered. Thus, any access from the CPU to a processor-external devices
via Wishbone requires 2 additional clock cycles. This can ease timing closure when using large (combinatorial) Wishbone
interconnection networks.
Optionally, the latency of the Wishbone gateway can be reduced by removing the input and output register stages. Enabling the MEM_EXT_ASYNC_RX option will remove the input register stage; enabling MEM_EXT_ASYNC_TX option will remove the output register stages. Each enabled option reduces access latency by 1 cycle.
Output Gating
All outgoing Wishbone signals use a "gating mechanism" so they only change if there is a actual Wishbone transaction being in
progress. This can reduce dynamic switching activity in the external bus system and also simplifies simulation-based
inspection of the Wishbone transactions. Note that this output gating is only available if the output register buffer is not
disabled (MEM_EXT_ASYNC_TX = false).
|
AXI4-Lite Connectivity
The AXI4-Lite wrapper (rtl/system_integration/neorv32_SystemTop_axi4lite.vhd
) provides a Wishbone-to-
AXI4-Lite bridge, compatible with Xilinx Vivado (IP packager and block design editor). All entity signals of
this wrapper are of type std_logic or std_logic_vector, respectively. See The USer Guide for more
information: https://stnolting.github.io/neorv32/ug/#_packaging_the_processor_as_ip_block_for_xilinx_vivado_block_designer
Using the auto-termination timeout feature (MEM_EXT_TIMEOUT greater than zero) is not AXI4 compliant as
the AXI protocol does not support "aborting" bus transactions. Therefore, the NEORV32 top wrapper with AXI4-Lite interface
(rtl/system_integration/neorv32_SystemTop_axi4lite ) configures MEM_EXT_TIMEOUT = 0 by default.
|
2.7.6. Internal Bus Monitor (BUSKEEPER)
Hardware source file(s): |
neorv32_buskeeper.vhd |
|
Software driver file(s): |
none |
|
Top entity port: |
none |
|
Configuration generics: |
none |
|
Package constants: |
|
Access time window (#cycles) |
CPU interrupts: |
none |
Theory of Operation
The Bus Keeper is a fundamental component of the processor’s internal bus system that ensures correct bus operations to maintain execution safety. The Bus Keeper monitors every single bus transactions that is intimated by the CPU. If an accessed device responds with an error condition or do not respond within a specific access time window, the according bus access fault exception is raised. The following exceptions can be raised by the Bus Keeper (see section Traps, Exceptions and Interrupts for all available CPU traps):
-
TRAP_CODE_I_ACCESS
: error during instruction fetch bus access -
TRAP_CODE_S_ACCESS
: error during data store bus access -
TRAP_CODE_L_ACCESS
: error during data load bus access
The access time window, in which an accessed device has to respond, is defined by the max_proc_int_response_time_c
constant from the processor’s VHDL package file (rtl/neorv32_package.vhd
). The default value is 15 clock cycles.
In case of a bus access fault exception application software can evaluate the Bus Keeper’s control register
NEORV32_BUSKEEPER.CTRL
to retrieve further details of the bus exception. The BUSKEEPER_ERR_FLAG bit indicates
that an actual bus access fault has occurred. The bit is sticky once set and is automatically cleared when reading or
writing the NEORV32_BUSKEEPER.CTRL
register. The BUSKEEPER_ERR_TYPE bit defines the type of the bus fault:
-
0
- "Device Error": The bus access exception was cause by the memory-mapped device that has been accessed (the device asserted it’serr_o
). -
1
- "Timeout Error": The bus access exception was caused by the Bus Keeper because the accessed memory-mapped device did not respond within the access time window. Note that this error type can also be raised by the optional timeout feature of the Processor-External Memory Interface (WISHBONE) (AXI4-Lite)).
Bus access fault exceptions are also raised if a physical memory protection (PMP) rule is violated. In this case the BUSKEEPER_ERR_FLAG bit remains zero (since the error signal is not triggered by the BUSKEEPER but by the CPU’s PMP logic). |
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/- |
Bus error type, valid if BUSKEEPER_ERR_FLAG |
|
r/c |
Sticky error flag, clears after read or write access |
||
|
- |
reserved |
r/c |
reserved (mirrored access to |
2.7.7. Stream Link Interface (SLINK)
Hardware source file(s): |
neorv32_slink.vhd |
|
Software driver file(s): |
neorv32_slink.c |
|
neorv32_slink.h |
||
Top entity port: |
|
TX link data (8x32-bit) |
|
TX link data valid (8x1-bit) |
|
|
TX link allowed to send (8x1-bit) |
|
|
TX link end of packet (8x1-bit) |
|
|
RX link data (8x32-bit) |
|
|
RX link data valid (8x1-bit) |
|
|
RX link ready to receive (8x1-bit) |
|
|
RX link end of packet (8x1-bit) |
|
Configuration generics: |
SLINK_NUM_TX |
Number of TX links to implement (0..8) |
SLINK_NUM_RX |
Number of RX links to implement (0..8) |
|
SLINK_TX_FIFO |
FIFO depth (1..32k) of TX links, has to be a power of two |
|
SLINK_RX_FIFO |
FIFO depth (1..32k) of RX links, has to be a power of two |
|
CPU interrupts: |
fast IRQ channel 10 |
SLINK RX IRQ (see Processor Interrupts) |
fast IRQ channel 11 |
SLINK TX IRQ (see Processor Interrupts) |
Overview
The SLINK component provides up to 8 independent RX (receiving) and TX (sending) links for moving stream data. The interface provides higher bandwidth and less latency than the external memory bus interface, which makes it ideally suited to couple custom stream processing units.
Each link provides an individual internal FIFO for data buffering. The FIFO depth is globally defined for all TX links via the SLINK_TX_FIFO generic and for all RX links via the SLINK_RX_FIFO generic. The FIFO depth has to be at least 1, which will implement a simple input/output register. The maximum value is limited to 32768 entries. Note that the FIFO depth has to be a power of two.
The actual number of implemented RX/TX links is configured by the SLINK_NUM_RX and SLINK_NUM_TX generics, respectively. The SLINK module will be synthesized only if at least one of these generics is greater than zero. All unimplemented links are internally terminated and their according output signals are set to zero.
The NEORV32 stream link interfaces are compatible to the AXI Stream specs. |
Example Program
An example program for the SLINK module is available in sw/example/demo_slink .
|
Theory of Operation
The SLINK provides eight data registers (DATA[i]
) to access the links (read accesses will access the RX link FIFOs,
write accesses will access the TX link FIFOs), one control register (CTRL
), one interrupt configuration register (IRQ
)
and two status registers - one for the RX links (RX_STATUS
) and one for the TX links (TX_STATUS
).
The SLINK is globally activated by setting the control register’s enable bit SLINK_CTRL_EN. Clearing this
bit will reset all internal logic and will also clear all FIFOs. The actual data links are accessed by
reading or writing the according link data registers DATA[0]
to DATA[7]
. For example, writing to DATA[0]
will put the according data into the FIFO of TX link 0. Accordingly, reading from DATA[0]
will return one data
word from the FIFO of RX link 0.
The current link status of each RX and TX channel is accessible via the *X_STATUS
registers. The FIFO’s status
signals that represent the fill level (empty, at least half full, full) are exposed as read-only flags via those two
registers.
Writing to a TX link’s FIFO that is full will have no effect. Reading data from a RX link’s FIFO that is empty will have no effect and will return the last valid data word. |
The TX link’s "end of packet" signal slink_tx_lst_o
is controlled by the TX_STATUS
register’s SLINK_TX_STATUS_LAST
bits. Note that these bits are also buffered by the internal TX FIFOs, so setting one of these bits before writing data to
DATA
will set the slink_tx_lst_o
signal when the written data word is actually send from the FIFO. Vice versa, the
SLINK_RX_STATUS_LAST bits in RX_STATUS
represent the level of the according slink_rx_lst_i
input when a new data word
was samples. These bits are also buffered in the internal RX FIFOs.
Data Transmission
To send (TX) data the program should ensure there is at least one left in the according link’s FIFO by checking
SLINK_CTRL_TX_FREE. To mark the current data word to-be-send as "end of packet" the according SLINK_TX_STATUS_LAST
bit has to be set before writing DATA
.
Received data (RX) is available when the according link’s SLINK_RX_STATUS_EMPTY bit is cleared. To check if the received
data is marked as "end of packet" the according SLINK_RX_STATUS_LAST bit has to be examined before reading DATA
.
Interface & Protocol
The SLINK interface consists of four signals dat
, val
, rdy
and lst
for each RX and TX link.
Each signal is constructed as an "array" with eight entries - one for each link. Note that an entry in slink_*x_dat
is 32-bit
wide while entries in slink_*x_val
, slink_*x_rdy
and slink_*x_lst
are are just 1-bit wide.
-
dat
contains the actual data word -
val
marks the current transmission cycle as valid -
rdy
indicates that the receiving part is ready to receive -
lst
marks the current data word as "end of packet"

SLINK Interrupts
The stream interface provides two independent CPU interrupt channels - one for RX conditions and one
for TX conditions. These IRQs can be used to signal specific FIFO conditions (e.g. "data available") to the
CPU. The specific interrupt conditions are programmed per-link via the IRQ
register.
A 2-bit-coded value is used to enable the according link’s interrupt and to specify the actual condition.
Note that all enabled interrupt configurations are logically OR-ed for the CPU RX and TX interrupts, respectively. Hence, if any link fulfills the according interrupt configuration the according RX/TX interrupt request is sent to the CPU. |
For the TX links (in IRQ
SLINK_IRQ_TX) the following interrupt conditions are supported:
-
0-
: off, no interrupt from link -
10
: interrupt fires if FIFO becomes not empty -
11
: interrupt fires if FIFO becomes at least half full
For the RX links (in IRQ
SLINK_IRQ_RX) the following interrupt conditions are supported:
-
0-
: off, no interrupt from link -
10
: interrupt fires if FIFO becomes empty -
11
: interrupt fires if FIFO becomes less than half full
Once the SLINK’s RX or TX CPU interrupt has become pending, it has to be explicitly cleared again by writing
zero to the according mip
CSR bit(s).
Register Map
Address | Name [C] | Bit(s) | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
SLINK global enable/reset |
|
r/- |
reserved, returns zero |
||
|
r/- |
Number of RX links (SLINK_NUM_RX) |
||
|
r/- |
Number of TX links (SLINK_NUM_TX) |
||
|
r/- |
RX FIFO depth, log2(SLINK_RX_FIFO) |
||
|
r/- |
TX FIFO depth, log2(SLINK_TX_FIFO) |
||
|
|
|
r/w |
RX link i interrupt configuration (2 bits per link) |
|
r/w |
TX link i interrupt configuration (2 bits per link) |
||
|
|
|
r/- |
RX link i FIFO empty |
|
r/- |
RX link i FIFO at least half full |
||
|
r/- |
RX link i FIFO full |
||
|
r/- |
Current data word of RX link i is marked as "end of packet" |
||
|
|
|
r/- |
TX link i FIFO empty |
|
r/- |
TX link i FIFO at least half full |
||
|
r/- |
TX link i FIFO full |
||
|
r/w |
Set to mark next data word of TX link i is "end of packet" |
||
|
- |
|
r/- |
reserved, returns zero |
|
|
|
r/w |
Link 0 RX/TX data |
|
|
|
r/w |
Link 1 RX/TX data |
|
|
|
r/w |
Link 2 RX/TX data |
|
|
|
r/w |
Link 3 RX/TX data |
|
|
|
r/w |
Link 4 RX/TX data |
|
|
|
r/w |
Link 5 RX/TX data |
|
|
|
r/w |
Link 6 RX/TX data |
|
|
|
r/w |
Link 7 RX/TX data |
2.7.8. General Purpose Input and Output Port (GPIO)
Hardware source file(s): |
neorv32_gpio.vhd |
|
Software driver file(s): |
neorv32_gpio.c |
|
neorv32_gpio.h |
||
Top entity port: |
|
64-bit parallel output port |
|
64-bit parallel input port |
|
Configuration generics: |
IO_GPIO_EN |
implement GPIO port when true |
CPU interrupts: |
none |
The general purpose parallel IO port unit provides a simple 64-bit parallel input port and a 64-bit parallel
output port. These ports can be used chip-externally (for example to drive status LEDs, connect buttons, etc.)
or chip-internally to provide control signals for other IP modules. The component is disabled for
implementation when the IO_GPIO_EN generic is set false. In this case the GPIO output port gpio_o
is tied to all-zero.
Access Atomicity
The GPIO modules uses two memory-mapped registers (each 32-bit) each for accessing the input and
output signals. Since the CPU can only process 32-bit "at once" updating the entire output cannot
be performed within a single clock cycle.
|
INPUT is read-only
Write accesses to the NEORV32_GPIO.INPUT_LO and NEORV32_GPIO.INPUT_HI registers will raise a store bus
error exception. The BUSKEEPER will indicate a "DEVICE_ERR" in this case.
|
Register Map
Address | Name [C] | Bit(s) | R/W | Function |
---|---|---|---|---|
|
|
31:0 |
r/- |
parallel input port pins 31:0 |
|
|
31:0 |
r/- |
parallel input port pins 63:32 |
|
|
31:0 |
r/w |
parallel output port pins 31:0 |
|
|
31:0 |
r/w |
parallel output port pins 63:32 |
2.7.9. Watchdog Timer (WDT)
Hardware source file(s): |
neorv32_wdt.vhd |
|
Software driver file(s): |
neorv32_wdt.c |
|
neorv32_wdt.h |
||
Top entity port: |
none |
|
Configuration generics: |
IO_WDT_EN |
implement watchdog when true |
CPU interrupts: |
fast IRQ channel 0 |
watchdog timeout (see Processor Interrupts) |
Theory of Operation
The watchdog (WDT) provides a last resort for safety-critical applications. The WDT provides a "bark and bite" concept. The timeout counter first triggers an optional CPU interrupt ("bark") when reaching half of the programmed interval to inform the application of the imminent timeout. When the full timeout value is reached a system-wide hardware reset is generated ("bite"). The internal counter has to be reset explicitly by the application program every now and then to prevent a timeout.
Configuration
The watchdog is enabled by setting the control register’s `WDT_CTRL_EN_ bit. When this bit is cleared, the internal timeout counter is reset to zero and no interrupt and no system reset can be triggered.
The internal 32-bit timeout counter is clocked at 1/4096th of the processor’s main clock (fWDT[Hz] = fmain[Hz] / 4096). Whenever this counter reaches the programmed timeout value (WDT_CTRL_TIMEOUT bits in the control register) a hardware reset is triggered. In order to inform the application of an imminent timeout, an optional CPU interrupt is triggered when the timeout counter reaches half of the programmed timeout value.
The watchdog is "fed" by writing 1
to the WDT_CTRL_RESET control register bit, which
will reset the internal timeout counter back to zero.
Writing all-zero to the WDT_CTRL_TIMEOUT bits will immediately trigger a system-wide reset. |
Watchdog Interrupt
A watchdog interrupt occurs when the watchdog is enabled and the internal counter reaches half of the programmed
timeout value. A triggered interrupt has to be explicitly cleared by writing zero to the according mip CSR bit.
|
Watchdog Operation during Debugging
By default the watchdog stops operation when the CPU enters debug mode and will resume normal operation after
the CPU has left debug mode again. This will prevent an unintended watchdog timeout during a debug session. However,
the watchdog can also be configured to keep operating even when the CPU is in debug mode by setting the control
register’s WDT_CTRL_DBEN bit.
|
Watchdog Operation during CPU Sleep
By default the watchdog stops operating when the CPU enters sleep mode. However, the watchdog can also be configured
to keep operating even when the CPU is in sleep mode by setting the control register’s WDT_CTRL_SEN bit.
|
Configuration Lock
The watchdog control register can be locked to protect the current configuration from being modified. The lock is activated by setting the WDT_CTRL_LOCK bit. In the locked state any write access to the control register is entirely ignored (see table below, "writable if locked"). Read accesses to the control register as well as watchdog resets (by setting the WDT_CTRL_RESET flag) are not affected.
The lock bit can only be set if the WDT is already enabled (WDT_CTRL_EN is set). The lock bit can only be cleared again by a system-wide hardware reset.
Cause of last Hardware Reset
The cause of the last system hardware reset can be determined via the WDT_CTRL_RCAUSE flag. If this flag is zero, the processor has been reset via the external reset signal (or the on-chip debugger). If this flag is set, the last system reset was caused by the watchdog itself.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Reset value | Writable if locked | Function |
---|---|---|---|---|---|---|
|
|
|
r/w |
|
no |
watchdog enable |
`1 WDT_CTRL_LOCK |
r/w |
|
no |
lock configuration when set, clears only on system reset, can only be set if enable bit is set already |
||
|
r/w |
|
no |
set to allow WDT to continue operation even when CPU is in debug mode |
||
|
r/w |
|
no |
set to allow WDT to continue operation even when CPU is in sleep mode |
||
|
-/w |
- |
yes |
reset watchdog when set, auto-clears |
||
|
r/- |
|
- |
cause of last system reset: |
||
|
r/- |
- |
- |
reserved, reads as zero |
||
|
r/w |
0 |
no |
24-bit watchdog timeout value |
2.7.10. Machine System Timer (MTIME)
Hardware source file(s): |
neorv32_mtime.vhd |
|
Software driver file(s): |
neorv32_mtime.c |
|
neorv32_mtime.h |
||
Top entity port: |
|
RISC-V machine timer IRQ if internal MTIME is not implemented |
Configuration generics: |
IO_MTIME_EN |
implement MTIME when true |
CPU interrupts: |
|
machine timer interrupt (see Processor Interrupts) |
The MTIME module implements a memory-mapped MTIME machine system timer that is compatible to the RISC-V
privileged specifications. The 64-bit system time is accessed via the memory-mapped TIME_LO
and
TIME_HI`registers. A 64-bit time compare register, which is accessible via the memory-mapped `TIMECMP_LO
and TIMECMP_HI
registers, can be used to configure the CPU’s MTI (machine timer interrupt). The interrupt
is triggered whenever TIME
(high & low part) is greater than or equal to TIMECMP
(high & low part).
The interrupt remains active (=pending) until TIME
becomes less TIMECMP
again (either by modifying
TIME
or TIMECMP
).
Reset
After a hardware reset the TIME and TIMECMP register are reset to all-zero.
|
External MTIME Interrupt
The mtime_irq_i signal is level-triggered and high-active. Once set the signal has to stay high until
the interrupt request is explicitly acknowledged (e.g. writing to a memory-mapped register). All RISC-V standard interrupts
can NOT be acknowledged by writing zero to the according mip CSR bit. |
Register Map
Address | Name [C] | Bits | R/W | Function |
---|---|---|---|---|
|
|
31:0 |
r/w |
machine system time, low word |
|
|
31:0 |
r/w |
machine system time, high word |
|
|
31:0 |
r/w |
time compare, low word |
|
|
31:0 |
r/w |
time compare, high word |
2.7.11. Primary Universal Asynchronous Receiver and Transmitter (UART0)
Hardware source file(s): |
neorv32_uart.vhd |
|
Software driver file(s): |
neorv32_uart.c |
|
neorv32_uart.h |
||
Top entity port: |
|
serial transmitter output UART0 |
|
serial receiver input UART0 |
|
|
flow control: RX ready to receive |
|
|
flow control: TX allowed to send |
|
Configuration generics: |
IO_UART0_EN |
implement UART0 when true |
UART0_RX_FIFO |
RX FIFO depth (power of 2, min 1) |
|
UART0_TX_FIFO |
TX FIFO depth (power of 2, min 1) |
|
CPU interrupts: |
fast IRQ channel 2 |
RX interrupt |
fast IRQ channel 3 |
TX interrupt (see Processor Interrupts) |
The UART is a standard serial interface mainly used to establish a communication channel between a host computer computer/user and an application running on the embedded processor.
The NEORV32 UARTs feature independent transmitter and receiver with a fixed frame configuration of 8 data bits, an optional parity bit (even or odd) and a fixed stop bit. The actual transmission rate - the Baudrate - is programmable via software. Optional FIFOs with custom sizes can be configured for the transmitter and receiver independently.
The UART features two memory-mapped registers CTRL
and DATA
, which are used for configuration, status
check and data transfer.
Standard Console(s)
Please note that all default example programs and software libraries of the NEORV32 software
framework (including the bootloader and the runtime environment) use the primary UART
(UART0) as default user console interface. Furthermore, UART0 is used to implement all the standard
input, output and error consoles (STDIN , STDOUT and STDERR ).
|
Theory of Operation
UART0 is enabled by setting the UART_CTRL_EN bit in the UART0 control register CTRL
. The Baud rate
is configured via a 12-bit UART_CTRL_BAUDxx baud prescaler (baud_prsc
) and a 3-bit UART_CTRL_PRSCx
clock prescaler (clock_prescaler
) that scales the processor’s primary clock (fmain).
UART_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
Baud rate = (fmain[Hz] / clock_prescaler
) / (baud_prsc
+ 1)
A new transmission is started by writing the data byte to be send to the lowest byte of the DATA
register. The
transfer is completed when the UART_CTRL_TX_BUSY control register flag returns to zero. A new received byte
is available when the UART_DATA_AVAIL flag of the DATA
register is set. A "frame error" in a received byte
(invalid stop bit) is indicated via the UART_DATA_FERR flag in the DATA
register. The flag is cleared by
reading the DATA
register.
A transmission (RX or TX) can be terminated at any time by disabling the UART module by clearing the UART_CTRL_EN control register bit. |
RX and TX FIFOs
UART0 provides optional FIFO buffers for the transmitter and the receiver. The UART0_RX_FIFO generic defines
the depth of the RX FIFO (for receiving data) while the UART0_TX_FIFO defines the depth of the TX FIFO
(for sending data). Both generics have to be a power of two with a minimal allowed value of 1. This minimal
value will implement simple "double-buffering" instead of full-featured FIFOs.
Both FIFOs are cleared whenever UART0 is disabled (clearing UART_CTRL_EN in CTRL
).
The state of both FIFO (empty, at lest half-full, full) is available via the UART_CTRL?X_EMPTY_,
UART_CTRL?X_HALF_ and UART_CTRL*X_FULL_ flags in the CTRL
register.
If the RX FIFO is already full and new data is received by the receiver unit, the UART_DATA_OVERR flag
in the DATA
register is set indicating an "overrun". This flag is cleared by reading the DATA
register.
In contrast to other FIFO-equipped peripherals, software cannot determine the UART’s FIFO size configuration by reading specific control register bits (simply because there are no bits left in the control register). |
Hardware Flow Control - RTS/CTS
UART0 supports optional hardware flow control using the standard CTS (clear to send) and/or RTS (ready to send / ready to receive "RTR") signals. Both hardware control flow mechanisms can be enabled individually.
-
If RTS hardware flow control is enabled by setting the UART_CTRL_RTS_EN control register flag, the UART will drive the
uart0_rts_o
signal low if the UART RX FIFO is less than half full. As long as this signal is low, the connected device can send new data.uart0_rts_o
is always low if the UART is disabled.
If the UART0_RX_FIFO configuration generic is set to it’s minimum (=1), the RTS signal already goes low when a single character has been received by the UART that has not yet been read by the software. |
-
If CTS hardware flow control is enabled by setting the UART_CTRL_CTS_EN control register flag, the UART’s transmitter will not start sending a new data until the
uart0_cts_i
signal goes low. During this time, the UART busy flag UART_CTRL_TX_BUSY remains set. Ifuart0_cts_i
is asserted, no new data transmission will be started by the UART. The state of theuart0_cts_i
signal has no effect on a transmission being already in progress. Application software can check the current state of theuart0_cts_o
input signal via the UART_CTRL_CTS control register flag.
Parity Modes
An optional parity bit can be added to the data stream if the UART_CTRL_PMODE1 flag is set.
When UART_CTRL_PMODE0 is zero, the UART operates in "even parity" mode. If this flag is set, the UART operates in "odd parity" mode.
Parity errors in received data are indicated via the UART_DATA_PERR flag in the DATA
register. This flag is updated with each new
received character and is cleared by reading the DATA
register.
UART Interrupts
UART0 features two independent interrupt for signaling certain RX and TX conditions. The behavior of these conditions differs
based on the configured FIFO sizes. If the according FIFO size is greater than 1, the UART_CTRL_RX_IRQ and UART_CTRL_TX_IRQ
CTRL
flags allow a more fine-grained IRQ configuration. An interrupt can only become pending if the according interrupt
condition is fulfilled and the UART is enabled at all.
-
If UART0_RX_FIFO is exactly 1, the RX interrupt goes pending when data becomes available in the RX FIFO (→ UART_CTRL_RX_EMPTY clears). UART_CTRL_RX_IRQ is hardwired to
0
in this case. -
If UART0_TX_FIFO is exactly 1, the TX interrupt goes pending when at least one entry in the TX FIFO becomes free (→ UART_CTRL_TX_FULL clears). UART_CTRL_TX_IRQ is hardwired to
0
in this case. -
If UART0_RX_FIFO is greater than 1: If UART_CTRL_RX_IRQ is
0
the RX interrupt goes pending when data becomes available in the RX FIFO (→ UART_CTRL_RX_EMPTY clears). If UART_CTRL_RX_IRQ is1
the RX interrupt becomes pending the RX FIFO becomes at least half-full (→ UART_CTRL_RX_HALF sets). -
If UART0_TX_FIFO is greater than 1: If UART_CTRL_TX_IRQ is
0
the TX interrupt goes pending when at least one entry in the TX FIFO becomes free (→ UART_CTRL_TX_FULL clears). If UART_CTRL_TX_IRQ is1
the TX interrupt goes pending when the RX FIFO becomes less than half-full (→ UART_CTRL_TX_HALF clears).
Once the RX or TX interrupt has become pending, it has to be explicitly cleared again by
writing zero to the according mip
CSR bit.
Simulation Mode
The default UART0 operation will transmit any data written to the DATA
register via the serial TX line at
the defined baud rate via the physical link. To accelerate UART0 output during simulation
(and also to dump large amounts of data) the UART0 features a simulation mode.
Simulation mode is enabled by setting the UART_CTRL_SIM_MODE bit in the UART0’s control register
CTRL
. Any other UART0 configuration bits are irrelevant for this mode but UART0 has to be enabled via the
UART_CTRL_EN bit. There will be no physical UART0 transmissions via uart0_txd_o
at all when
simulation mode is enabled. Furthermore, no interrupts (RX & TX) will be triggered.
When the simulation mode is enabled any data written to DATA[7:0]
is
directly output as ASCII char to the simulator console. Additionally, all chars are also stored to a text file
neorv32.uart0.sim_mode.text.out
in the simulation home folder.
Furthermore, the whole 32-bit word written to DATA[31:0]
is stored as plain 8-char hexadecimal value to a
second text file neorv32.uart0.sim_mode.data.out
also located in the simulation home folder.
More information regarding the simulation-mode of the UART0 can be found in the User Guide section Simulating the Processor. |
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
12-bit BAUD value configuration value |
|
r/w |
enable simulation mode |
||
|
r/- |
RX FIFO is empty |
||
|
r/- |
RX FIFO is at least half-full |
||
|
r/- |
RX FIFO is full |
||
|
r/- |
TX FIFO is empty |
||
|
r/- |
TX FIFO is at least half-full |
||
|
r/- |
TX FIFO is full |
||
|
r/- |
reserved, read as zero |
||
|
r/w |
enable RTS hardware flow control |
||
|
r/w |
enable CTS hardware flow control |
||
|
r/w |
parity bit enable and configuration ( |
||
|
r/w |
|||
|
r/w |
3-bit baudrate clock prescaler select |
||
|
r/w |
|||
|
r/w |
|||
|
r/- |
current state of UART’s CTS input signal |
||
|
r/w |
UART enable |
||
|
r/w |
RX IRQ mode: |
||
|
r/w |
TX IRQ mode: |
||
|
r/- |
transmitter busy flag |
||
|
|
|
r/w |
receive/transmit data (8-bit) |
|
-/w |
simulation data output |
||
|
r/- |
RX parity error |
||
|
r/- |
RX data frame error (stop bit nt set) |
||
|
r/- |
RX data overrun |
||
|
r/- |
RX data available when set |
2.7.12. Secondary Universal Asynchronous Receiver and Transmitter (UART1)
Hardware source file(s): |
neorv32_uart.vhd |
|
Software driver file(s): |
neorv32_uart.c |
|
neorv32_uart.h |
||
Top entity port: |
|
serial transmitter output UART1 |
|
serial receiver input UART1 |
|
|
flow control: RX ready to receive |
|
|
flow control: TX allowed to send |
|
Configuration generics: |
IO_UART1_EN |
implement UART1 when true |
UART1_RX_FIFO |
RX FIFO depth (power of 2, min 1) |
|
UART1_TX_FIFO |
TX FIFO depth (power of 2, min 1) |
|
CPU interrupts: |
fast IRQ channel 4 |
RX interrupt |
fast IRQ channel 5 |
TX interrupt (see Processor Interrupts) |
Theory of Operation
The secondary UART (UART1) is functional identical to the primary UART (Primary Universal Asynchronous Receiver and Transmitter (UART0)).
Obviously, UART1 has different addresses for the control register (CTRL
) and the data register (DATA
) - see the register map below.
The register’s bits/flags use the same bit positions and naming as for the primary UART. The RX and TX interrupts of UART1 are
mapped to different CPU fast interrupt (FIRQ) channels.
Simulation Mode
The secondary UART (UART1) provides the same simulation options as the primary UART. However,
output data is written to UART1-specific files: neorv32.uart1.sim_mode.text.out
is used to store
plain ASCII text and neorv32.uart1.sim_mode.data.out
is used to store full 32-bit hexadecimal
data words.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
12-bit BAUD value configuration value |
|
r/w |
enable simulation mode |
||
|
r/- |
RX FIFO is empty |
||
|
r/- |
RX FIFO is at least half-full |
||
|
r/- |
RX FIFO is full |
||
|
r/- |
TX FIFO is empty |
||
|
r/- |
TX FIFO is at least half-full |
||
|
r/- |
TX FIFO is full |
||
|
r/- |
reserved, read as zero |
||
|
r/w |
enable RTS hardware flow control |
||
|
r/w |
enable CTS hardware flow control |
||
|
r/w |
parity bit enable and configuration ( |
||
|
r/w |
|||
|
r/w |
3-bit baudrate clock prescaler select |
||
|
r/w |
|||
|
r/w |
|||
|
r/- |
current state of UART’s CTS input signal |
||
|
r/w |
UART enable |
||
|
r/w |
RX IRQ mode: |
||
|
r/w |
TX IRQ mode: |
||
|
r/- |
transmitter busy flag |
||
|
|
|
r/w |
receive/transmit data (8-bit) |
|
-/w |
simulation data output |
||
|
r/- |
RX parity error |
||
|
r/- |
RX data frame error (stop bit nt set) |
||
|
r/- |
RX data overrun |
||
|
r/- |
RX data available when set |
2.7.13. Serial Peripheral Interface Controller (SPI)
Hardware source file(s): |
neorv32_spi.vhd |
|
Software driver file(s): |
neorv32_spi.c |
|
neorv32_spi.h |
||
Top entity port: |
|
1-bit serial clock output |
|
1-bit serial data output |
|
|
1-bit serial data input |
|
|
8-bit dedicated chip select (low-active) |
|
Configuration generics: |
IO_SPI_EN |
implement SPI controller when true |
IO_SPI_FIFO |
data FIFO size, has to be zero or a power of two |
|
CPU interrupts: |
fast IRQ channel 6 |
transmission done interrupt (see Processor Interrupts) |
Overview
SPI is a synchronous serial transmission interface for fast on-board communications.
The NEORV32 SPI transceiver module supports 8-, 16-, 24- and 32-bit wide transmissions, all 4 standard clock modes
and 8 dedicated chip select signals via the top entity’s spi_csn_o
signal, which are
directly controlled by the SPI module (no additional GPIOs required). An optional receive/transmit FIFO can be
implemented via the IO_SPI_FIFO generic to support block-based transmissions without CPU interaction.
Host-Mode Only
The NEORV32 SPI module only supports host mode. Transmission are initiated only by the processor’s SPI module
and not by an external SPI module.
|
The SPI module provides a single control register CTRL
to configure the module and to check it’s status
and a single data register DATA
for receiving/transmitting data. If the data FIFO is implemented, this register
is used to interface the FIFO.
Theory of Operation
The SPI module is enabled by setting the SPI_CTRL_EN bit in the CTRL
control register. No transfer can be initiated
and no interrupt request will be triggered if this bit is cleared. Clearing this bit will reset the module (also clearing
the FIFO if implemented) and will also terminate any transfer being in process.
The data quantity to be transferred within a single data transmission is defined via the SPI_CTRL_SIZEx bits.
The SPI module supports 8-bit (00
), 16-bit (01
), 24-bit (10
) and 32-bit (11
) transfers.
A transmission is started when writing data to the DATA
register. The data must be LSB-aligned. So if
the SPI transceiver is configured for less than 32-bit transfer data quantity, the transmit data must be placed
into the lowest 8/16/24 bits of DATA
. Vice versa, the received data is also always LSB-aligned. Application
software should only process the amount of bits that was configured using SPI_CTRL_SIZEx when
reading DATA
.
The SPI operation is completed as soon as the SPI_CTRL_BUSY flag clears. If a FIFO size greater than zero is configured, the busy flag clears when the current serial engine operation is completed and there is no data left in the send buffer.
MSB-first Only
The NEORV32 SPI module only support MSB-first mode. Data can be reversed before writing DATA (for TX) / after
reading DATA (for RX) to implement LSB-first transmissions. Note that in both cases data in DATA still
needs to be LSB-aligned.
|
Arbitrary Transmission Length
The total transmission length, which can be an arbitrary number of individual data transfers, is left to the user:
after asserting chip-select an arbitrary amount of transmission with arbitrary data quantity (SPI_CTRL_SIZEx) can
be made before de-asserting chip-select again.
|
The SPI controller features 8 dedicated chip-select lines. These lines are controlled via the control register’s SPI_CTRL_CS_SELx and SPI_CTRL_CS_EN bits. The 3-bit SPI_CTRL_CSx bits are used to select one out of the eight dedicated chip select line. As soon as SPI_CTRL_CS_EN is set the selected chip select line is activated (driven low). Note that disabling the SPI module via the SPI_CTRL_EN bit will also deactivate any currently activated chip select line.
SPI Clock Configuration
The SPI module supports all standard SPI clock modes (0, 1, 2, 3), which are configured via the two control register bits SPI_CTRL_CPHA and SPI_CTRL_CPOL. The SPI_CTRL_CPHA bit defines the clock phase and the SPI_CTRL_CPOL bit defines the clock polarity.

Mode 0 | Mode 1 | Mode 2 | Mode 3 | |
---|---|---|---|---|
SPI_CTRL_CPOL |
|
|
|
|
SPI_CTRL_CPHA |
|
|
|
|
The SPI clock frequency (spi_sck_o
) is programmed by the 3-bit SPI_CTRL_PRSCx clock prescaler for a coarse selection
and a 4-bit clock divider SPI_CTRL_CDIVx for a fine selection.
The following pre-scalers (SPI_CTRL_PRSCx) are available:
SPI_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
Based on the SPI_CTRL_PRSCx and SPI_CTRL_CDIVx configuration, the actual SPI clock frequency fSPI is derived from the processor’s main clock fmain according to the following equation:
fSPI = fmain[Hz] / (2 * clock_prescaler
* (1 + SPI_CTRL_CDIVx))
Hence, the maximum SPI clock is fmain / 4 and the lowest SPI clock is fmain / 131072. The SPI clock is always symmetric having a duty cycle of exactly 50%.
SPI FIFO
An optional FIFO buffer can be implemented by setting the IO_SPI_FIFO generic to a value greater than zero. Implementing a data FIFO allows (more) CPU-independent operation of the SPI module.
Internally, two FIFOs are implemented: one for TX data and one for RX data. However, these two FIFOs are transparent for the software and operate as a single, unified "ring buffer". The status signals of the TX FIFO ("empty", "at least half full", "full") are exposed as read-only signals via the SPI control register. In contrast, the RX FIFO only provides a "data available" flag (= RX FIFO not empty) also exposed via the SPI control register.
Double-Buffering
Application programs can implement "double buffering" when using the "FIFO less than half full" interrupt configuration
option (see below).
|
SPI Interrupt
The SPI module provides a single interrupt that can be used to signal certain transmission states to the CPU. The actual interrupt condition is configured by the two SPI_CTRL_IRQx bits in the SPI module’s control register:
-
00
,01
: trigger interrupt when SPI serial engine completes current transmission -
10
: trigger interrupt when TX FIFO becomes less than half full; this mode is not available if IO_SPI_FIFO is zero -
11
: trigger interrupt when TX FIFO becomes empty; this mode is not available if IO_SPI_FIFO is zero
Once the SPI CPU is triggered it has to be explicitly cleared again by writing zero to the according
mip
CSR bit inside the SPI trap handler.
If no FIFO is implemented (IO_SPI_FIFO = 0) the SPI_CTRL_IRQx are hardwired to 00 statically configuring
"SPI serial engine completes current transmission" as interrupt condition.
|
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
SPI module enable |
|
r/w |
clock phase ( |
||
|
r/w |
clock polarity |
||
|
r/w |
transfer size ( |
||
|
r/w |
Direct chip-select 0..7 |
||
|
r/w |
Direct chip-select enable; setting |
||
|
r/w |
3-bit clock prescaler select |
||
|
r/w |
4-bit clock divider |
||
|
r/w |
interrupt configuration ( |
||
|
r/- |
reserved, read as zero |
||
|
r/- |
FIFO depth; log2(IO_SPI_FIFO) |
||
|
r/- |
RX FIFO data available (RX FIFO not empty); zero if FIFO not implemented |
||
|
r/- |
TX FIFO empty; zero if FIFO not implemented |
||
|
r/- |
TX FIFO at least half full; zero if FIFO not implemented |
||
|
r/- |
TX FIFO full; zero if FIFO not implemented |
||
|
r/- |
SPI module busy when set (serial engine operation in progress and TX FIFO not empty yet) |
||
|
|
|
r/w |
receive/transmit data (FIFO), LSB-aligned |
2.7.14. Two-Wire Serial Interface Controller (TWI)
Hardware source file(s): |
neorv32_twi.vhd |
|
Software driver file(s): |
neorv32_twi.c |
|
neorv32_twi.h |
||
Top entity port: |
|
1-bit bi-directional serial data |
|
1-bit bi-directional serial clock |
|
Configuration generics: |
IO_TWI_EN |
implement TWI controller when true |
CPU interrupts: |
fast IRQ channel 7 |
transmission done interrupt (see Processor Interrupts) |
Theory of Operation
The two wire interface - also called "I²C" - is a quite famous interface for connecting several on-board
components. Since this interface only needs two signals (the serial data line twi_sda_io
and the serial
clock line twi_scl_io
) for an arbitrarily number of devices it allows easy interconnections of
several peripheral nodes.
The NEORV32 TWI implements a TWI controller. Currently, no multi-controller support is available. Furthermore, the NEORV32 TWI unit cannot operate in peripheral mode.
The serial clock (SCL) and the serial data (SDA) lines can only be actively driven low by the controller. Hence, external pull-up resistors are required for these lines. |
TWI Clock Speed
The TWI clock frequency is programmed by the 3-bit TWI_CTRL_PRSCx clock prescaler for a coarse selection and a 4-bit clock divider TWI_CTRL_CDIVx for a fine selection.
The following pre-scalers (TWI_CTRL_PRSCx) are available:
TWI_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
Based on the TWI_CTRL_PRSCx and TWI_CTRL_CDIVx configuration, the actual TWI clock frequency fSCL is derived from the processor’s main clock fmain according to the following equation:
fSCL = fmain[Hz] / (4 * clock_prescaler
* (1 + TWI_CTRL_CDIV))
Hence, the maximum TWI clock is fmain / 8 and the lowest TWI clock is fmain / 262144. The generated TWI clock is
always symmetric having a duty cycle of exactly 50%. However, an accessed peripheral can "slow down" the bus clock
by using clock stretching (= actively driving the SCL line low). The controller will pause operation in this case
if clock stretching is enabled via the TWI_CTRL_CSEN bit of the unit’s control register CTRL
TWI Transfers
The TWI is enabled via the TWI_CTRL_EN bit in the CTRL
control register. The user program can start / stop a
transmission by issuing a START or STOP condition. These conditions are generated by setting the
according bits (TWI_CTRL_START or TWI_CTRL_STOP) in the control register.
Data is transferred via the TWI bus by writing a byte to the DATA
register. The written byte is send via the TWI bus
and the received byte from the bus is also available in this register after the transmission is completed.
The TWI operation (transmitting data or performing a START or STOP condition) is in progress as long as the control register’s TWI_CTRL_BUSY bit is set.
TWI ACK/NACK and MACK
An accessed TWI peripheral has to acknowledge each transferred byte. When the TWI_CTRL_ACK bit is set after a completed transmission the accessed peripheral has send an acknowledge. If this bit is cleared after a completed transmission, the peripheral has send a not-acknowledge (NACK).
The NEORV32 TWI controller can also send an ACK generated by itself ("controller acknowledge MACK") right after transmitting a byte by driving SDA low during the ACK time slot. Some TWI modules require this MACK to acknowledge certain data movement operations.
The control register’s TWI_CTRL_MACK bit has to be set to make the TWI module automatically generate a MACK after the byte transmission has been completed. If this bit is cleared, the ACK/NACK generated by the peripheral is sampled in this time slot instead (normal mode).
TWI Bus Status
The TWI controller can check if the TWI bus is currently claimed (SCL and SDA both low). The bus can be claimed by the NEORV32 TWI itself or by any other controller. Bit TWI_CTRL_CLAIMED of the control register will be set if the bus is currently claimed.
Summary
In summary, a complete TWI transfer is based on the following elementary operation:
-
generate START condition by setting TWI_CTRL_START
-
wait until TWI_CTRL_BUSY has cleared (start condition completed)
-
transfer one byte while also sampling one byte from the bus (this also samples ACK/NACK or generates a controller ACK "MACK" if TWI_CTRL_MACK is set) by writing data to
NEORV32_TWI.DATA
; this step can be repeated to send/receive an arbitrary number of bytes -
wait until TWI_CTRL_BUSY has cleared (data transfer completed)
-
optionally generate another START condition (as REPEATED-START condition) by setting TWI_CTRL_START again
-
wait until TWI_CTRL_BUSY has cleared (repeated-start condition completed)
-
generate STOP condition by setting TWI_CTRL_STOP
-
wait until TWI_CTRL_BUSY has cleared (stop condition completed)
A transmission can be terminated at any time by disabling the TWI module by clearing the TWI_CTRL_EN control register bit. This will also reset the whole module. |
When reading data from a device, an all-one byte (0xFF ) has to be written to TWI data register NEORV32_TWI.DATA
so the accessed device can actively pull-down SDA when required.
|
TWI Interrupt
The TWI module provides a single interrupt to signal "transmission done" to the CPU. Whenever the TWI
module completes the current transmission of one byte the interrupt is triggered. Note the the interrupt
is not triggered when completing a START or STOP condition. Once triggered, the interrupt has to be
explicitly cleared again by writing zero to the according mip
CSR bit.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
TWI enable, reset if cleared |
|
-/w |
generate START condition, auto-clears |
||
|
-/w |
generate STOP condition, auto-clears |
||
|
r/w |
generate controller-ACK for each transmission ("MACK") |
||
|
r/w |
allow clock stretching when set |
||
|
r/w |
3-bit clock prescaler select |
||
|
r/w |
4-bit clock divider |
||
|
r/- |
reserved, read as zero |
||
|
r/- |
set if the TWI bus is claimed by any controller |
||
|
r/- |
ACK received when set, NACK received when cleared |
||
|
r/- |
transfer/START/STOP in progress when set |
|
|
2.7.15. One-Wire Serial Interface Controller (ONEWIRE)
Hardware source file(s): |
neorv32_onewire.vhd |
|
Software driver file(s): |
neorv32_onewire.c |
|
neorv32_onewire.h |
||
Top entity port: |
|
1-bit bi-directional serial data |
Configuration generics: |
IO_ONEWIRE_EN |
implement ONEWIRE interface controller when true |
CPU interrupts: |
fast IRQ channel 13 |
operation done interrupt (see Processor Interrupts) |
Overview
The NEORV32 ONEWIRE module implements a single-wire interface controller that is compatible to the
Dallas/Maxim 1-Wire protocol, which is an asynchronous half-duplex bus requiring only a single signal wire
connected to onewire_io
(plus ground).
The 1-Wire protocol allows an (nearly) arbitrary number of devices but only a single controller that initiates all transfers.
The bus is based on a single tristate signal. The controller and all the devices can only pull-down the bus actively.
Hence, an external pull-up resistor is required. Recommended values are between 1kΩ and 4kΩ depending on the bus
characteristics (wire length, number of devices, etc.). Furthermore, a series resistor (~100Ω) at the controller side
is recommended to control the slew rate and to reduce signal reflections. Also, additional external ESD protection clamp diodes
should be added to the onewire_io
bus line.
For more information regarding the 1-Wire bus and the device access mechanism see the Application Notes provided by Maxim Integrated. |
Theory of Operation
The ONEWIRE controller provides two interface registers: CTRL
and DATA.
The control registers (CTRL
)
is used to configure the module, to trigger bus transactions and to monitor the current state of the module.
The DATA
register is used to read/write data from/to the bus.
The module is enabled by setting the ONEWIRE_CTRL_EN bit in the control register. If this bit is cleared, the module is automatically reset and the bus is brought to high-impedance (tristate) state. The basic timing configuration is programmed via the clock prescaler bits ONEWIRE_CTRL_PRSCx and the clock divider bits ONEWIRE_CTRL_CLKDIVx (see next section).
The controller can execute three basic bus operations, which are triggered by setting one out of three specific control register bits (the bits auto-clear):
-
generate reset pulse and check for device presence; triggered when setting ONEWIRE_CTRL_TRIG_RST
-
transfer a single-bit (read-while-write); triggered when setting ONEWIRE_CTRL_TRIG_BIT
-
transfer a full-byte (read-while-write); triggered when setting ONEWIRE_CTRL_TRIG_BYTE
Only one trigger bit may be set at once, otherwise undefined behavior might occur. |
When a single-bit operation has been triggered, the data previously written to DATA[0]
will be send to the bus
and DATA[7]
will be sampled from the bus. Accordingly, a full-byte transmission will send the previously
byte written to DATA[7:0]
to the bus and will update DATA[7:0]
with the data read from the bus (LSB-first).
The triggered operation has completed when the module’s busy flag ONEWIRE_CTRL_BUSY has cleared again.
Read from Bus
In order to read a single bit from the bus DATA[0] has to set to 1 before triggering the bit transmission
operation to allow the accessed device to pull-down the bus. Accordingly, DATA has to be set to 0xFF before
triggering the byte transmission operation when the controller shall read a byte from the bus.
|
The ONEWIRE_CTRL_PRESENCE bit gets set if at least one device has send a "presence" signal right after the reset pulse.
Bus Timing
The control register provides a 2-bit clock prescaler select (ONEWIRE_CTRL_PRSCx) and a 8-bit clock divider (ONEWIRE_CTRL_CLKDIVx) for timing configuration. Both are used to define the elementary base time Tbase. All bus operations are timed using multiples of this elementary base time.
The following clock prescalers are available:
ONEWIRE_CTRL_PRSCx |
0b00 |
0b01 |
0b10 |
0b11 |
---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
Together with the clock divider value (ONEWIRE_CTRL_PRSCx bits = clock_divider
) the base time is defined by the
following formula:
Tbase = (1 / fmain[Hz]) * clock_prescaler
* (clock_divider
+ 1)
Example:
-
fmain = 100MHz
-
clock prescaler select =
0b01
→clock_prescaler
= 4 -
clock divider
clock_divider
= 249
Tbase = (1 / 100000000Hz) * 4 * (249 + 1) = 10000ns = 10µs
The base time is used to coordinate all bus interactions. Hence, all delays, time slots and points in time are quantized as multiples of the base time. The following images show the two basic operations of the ONEWIRE controller: single-bit (0 or 1) transaction and reset with presence detect. The relevant points in time are shown as absolute time (in multiples of the time base) with the bus' falling edge as reference point.
![]() |
![]() |
Single-bit data transmission (not to scale) |
Reset pulse and presence detect (not to scale) |
Symbol | Description | Multiples of Tbase | Time when Tbase = 10µs |
---|---|---|---|
Single-bit data transmission |
|||
|
Time until end of active low-phase when writing a |
1 |
10µs |
|
Time until controller samples bus state (read operation) |
2 |
20µs |
|
Time until end of bit time slot (when writing a |
7 |
70µs |
|
Time until end of inter-slot pause (= total duration of one bit) |
9 |
90µs |
Reset pulse and presence detect |
|||
|
Time until end of active reset pulse |
48 |
480µs |
|
Time until controller samples bus presence |
55 |
550µs |
|
Time until end of presence phase |
96 |
960µs |
The default values for base time multiples were chosen to for stable and reliable bus operation (not for maximum throughput). |
The absolute points in time are hardwired by the VHDL code and cannot be changed during runtime. However, the timing parameter can be customized by editing the ONEWIRE’s VHDL source file:
neorv32_onewire.vhd
-- timing configuration (absolute time in multiples of the base tick time t_base) --
constant t_write_one_c : unsigned(6 downto 0) := to_unsigned( 1, 7); -- t0
constant t_read_sample_c : unsigned(6 downto 0) := to_unsigned( 2, 7); -- t1
constant t_slot_end_c : unsigned(6 downto 0) := to_unsigned( 7, 7); -- t2
constant t_pause_end_c : unsigned(6 downto 0) := to_unsigned( 9, 7); -- t3
constant t_reset_end_c : unsigned(6 downto 0) := to_unsigned(48, 7); -- t4
constant t_presence_sample_c : unsigned(6 downto 0) := to_unsigned(55, 7); -- t5
constant t_presence_end_c : unsigned(6 downto 0) := to_unsigned(96, 7); -- t6
Overdrive
The ONEWIRE controller does not support the overdrive mode. However, it can be implemented by reducing the base
time Tbase (and by eventually changing the hardwired timing configuration in the VHDL source file).
|
Interrupt
A single interrupt is provided by the ONEWIRE module to signal "operation done" condition to the CPU. Whenever the
controller completes a "generate reset pulse", a "transfer single-bit" or a "transfer full-byte" operation the
interrupt is triggered. Once triggered, the interrupt has to be explicitly cleared again by writing zero to the
according mip
CSR FIRQ bit.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
ONEWIRE enable, reset if cleared |
|
r/w |
2-bit clock prescaler select |
||
|
r/w |
8-bit clock divider value |
||
|
-/w |
trigger reset pulse, auto-clears |
||
|
-/w |
trigger single bit transmission, auto-clears |
||
|
-/w |
trigger full-byte transmission, auto-clears |
||
|
r/- |
reserved, read as zero |
||
|
r/- |
current state of the bus line |
||
|
r/- |
device presence detected after reset pulse |
||
|
r/- |
operation in progress when set |
||
|
|
|
r/w |
receive/transmit data (8-bit) |
2.7.16. Pulse-Width Modulation Controller (PWM)
Hardware source file(s): |
neorv32_pwm.vhd |
|
Software driver file(s): |
neorv32_pwm.c |
|
neorv32_pwm.h |
||
Top entity port: |
|
up to 60 PWM output channels (60-bit, fixed) |
Configuration generics: |
IO_PWM_NUM_CH |
number of PWM channels to implement (0..60) |
CPU interrupts: |
none |
The PWM controller implements a pulse-width modulation controller with up to 60 independent channels and 8- bit resolution per channel. The actual number of implemented channels is defined by the IO_PWM_NUM_CH generic. Setting this generic to zero will completely remove the PWM controller from the design.
The pwm_o has a static size of 60-bit. Is less than 60 PWM channels are configured, only the LSB-aligned channels
(bits) are used while the remaining bits are hardwired to zero.
|
The PWM controller is based on an 8-bit base counter with a programmable threshold comparators for each channel that defines the actual duty cycle. The controller can be used to drive fancy RGB-LEDs with 24- bit true color, to dim LCD back-lights or even for "analog" control. An external integrator (RC low-pass filter) can be used to smooth the generated "analog" signals.
Theory of Operation
The PWM controller is activated by setting the PWM_CTRL_EN bit in the module’s control register CTRL
. When this
bit is cleared, the unit is reset and all PWM output channels are set to zero.
The 8-bit duty cycle for each channel, which represents the channel’s "intensity", is defined via an 8-bit value. The module
provides up to 15 duty cycle registers DUTY[0]
to DUTY[14]
(depending on the number of implemented channels).
Each register contains the duty cycle configuration for 4 consecutive channels. For example, the duty cycle of channel 0
is defined via bits 7:0 in DUTY[0]
. The duty cycle of channel 2 is defined via bits 15:0 in DUTY[0]
.
Channel 4’s duty cycle is defined via bits 7:0 in DUTY[1]
and so on.
Regardless of the configuration of IO_PWM_NUM_CH all module registers can be accessed without raising an exception. Software can discover the number of available channels by writing 0xff to all duty cycle configuration bytes and reading those values back. The duty-cycle of channels that were not implemented always reads as zero. |
Based on the configured duty cycle the according intensity of the channel can be computed by the following formula:
Intensityx = DUTY[y](i*8+7 downto i*8)
/ (28)
The base frequency of the generated PWM signals is defined by the PWM core clock. This clock is derived from the main processor clock and divided by a prescaler via the 3-bit PWM_CTRL_PRSCx in the unit’s control register. The following pre-scalers are available:
PWM_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
The resulting PWM base frequency is defined by:
fPWM = fmain[Hz] / (28 * clock_prescaler
)
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
PWM enable |
|
r/w |
3-bit clock prescaler select |
||
|
r/w |
|||
|
r/w |
|||
|
|
|
r/w |
8-bit duty cycle for channel 0 |
|
r/w |
8-bit duty cycle for channel 1 |
||
|
r/w |
8-bit duty cycle for channel 2 |
||
|
r/w |
8-bit duty cycle for channel 3 |
||
… |
… |
… |
r/w |
… |
|
|
|
r/w |
8-bit duty cycle for channel 56 |
|
r/w |
8-bit duty cycle for channel 57 |
||
|
r/w |
8-bit duty cycle for channel 58 |
||
|
r/w |
8-bit duty cycle for channel 59 |
2.7.17. True Random-Number Generator (TRNG)
Hardware source file(s): |
neorv32_trng.vhd |
|
Software driver file(s): |
neorv32_trng.c |
|
neorv32_trng.h |
||
Top entity port: |
none |
|
Configuration generics: |
IO_TRNG_EN |
implement TRNG when true |
IO_TRNG_FIFO |
data FIFO depth, min 1, has to be a power of two |
|
CPU interrupts: |
none |
Theory of Operation
The NEORV32 true random number generator provides physically true random numbers. Instead of using a pseudo RNG like a LFSR, the TRNG uses a simple, straight-forward ring oscillator concept as physical entropy source. Hence, voltage, thermal and also semiconductor manufacturing fluctuations are used to provide a true physical entropy source.
The TRNG features a platform independent architecture without FPGA-specific primitives, macros or attributes so it can be synthesized for any FPGA. Ir is based on the neoTRNG V2, which is a "spin-off project" of the NEORV32 processor. More detailed information about the neoTRNG, its architecture and a detailed evaluation of the random number quality can be found it the neoTRNG repository: https://github.com/stnolting/neoTRNG
Inferring Latches
The synthesis tool might emit a warning like "inferring latches for … neorv32_trng …". This is no problem
as this is what we actually want: the TRNG is based on latches, which implement the inverters of the ring oscillators.
|
Simulation
When simulating the processor the NEORV32 TRNG is automatically set to "simulation mode". In this mode, the physical entropy
sources (= the ring oscillators) are replaced by a simple pseudo RNG (LFSR) providing weak pseudo-random data only.
The TRNG_CTRL_SIM_MODE flag of the control register is set if simulation mode is active.
|
Using the TRNG
The TRNG features a single control register CTRL
for control, status check and data access. When the TRNG_CTRL_EN
bit is set, the TRNG is enabled and starts operation.
TRNG Reset
The TRNG core does not provide a dedicated reset. In order to ensure correct operations, the TRNG should be
disabled (=reset) by clearing the TRNG_CTRL_EN and waiting some 1000s clock cycles before re-enabling it.
|
As soon as the TRNG_CTRL_VALID bit is set a new random data byte is available and can be obtained from the lowest 8 bits
of the CTRL
register (TRNG_CTRL_DATA_MSB : TRNG_CTRL_DATA_LSB). If this bit is cleared, there is no valid data available
and the lowest 8 bit of the CTRL
register are set to all-zero.
Read Access Security
The random data byte (TRNG_CTRL_DATA) in the control register is automatically cleared after each read access
to prevent software from reading the same random data byte more than once.
|
An optional random data FIFO can be configured using the IO_TRNG_FIFO generic. This FIFO automatically samples new random data from the TRNG to provide some kind of random data pool for applications, which require a large number of RND data in a short time. The minimal and default value for IO_TRNG_FIFO is 1 (implementing a register rather than a real FIFO); the generic has to be a power of two.
The random data FIFO can be cleared at any time either by disabling the TRNG via the TRNG_CTRL_EN flag or by setting the TRNG_CTRL_FIFO_CLR flag. Note that this flag is write-only and auto clears after being set.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/- |
8-bit random data |
|
-/w |
flush random data FIFO when set (auto clears) |
||
|
r/- |
simulation mode (PRNG!) |
||
|
r/w |
TRNG enable |
||
|
r/- |
random data is valid when set |
2.7.18. Custom Functions Subsystem (CFS)
Hardware source file(s): |
neorv32_cfs.vhd |
|
Software driver file(s): |
neorv32_cfs.c |
|
neorv32_cfs.h |
||
Top entity port: |
|
custom input conduit |
|
custom output conduit |
|
Configuration generics: |
IO_CFS_EN |
implement CFS when true |
IO_CFS_CONFIG |
custom generic conduit |
|
IO_CFS_IN_SIZE |
size of |
|
IO_CFS_OUT_SIZE |
size of |
|
CPU interrupts: |
fast IRQ channel 1 |
CFS interrupt (see Processor Interrupts) |
Theory of Operation
The custom functions subsystem is meant for implementing custom and application-specific logic.
The CFS provides up to 32x 32-bit memory-mapped read/write
registers (REG
, see register map below) that can be accessed by the CPU via normal load/store operations.
The actual functionality of these register has to be defined by the hardware designer. Furthermore, the CFS
provides two IO conduits to implement custom on-chip or off-chip interfaces.
In contrast to connecting custom hardware accelerators via external memory interfaces (like SPI or the processor’s external bus interface), the CFS provide a convenient, low-latency and tightly-coupled extension and customization option.
Just like any other externally-connected IP, logic implemented within the custom functions subsystem can operate independently of the CPU providing true parallel processing capabilities. Potential use cases might include dedicated hardware accelerators for en-/decryption (AES), signal processing (FFT) or AI applications (CNNs) as well as custom IO systems like fast memory interfaces (DDR) and mass storage (SDIO), networking (CAN) or real-time data transport (I2S).
If you like to implement custom instructions that are executed right within the CPU’s ALU
see the Zxcfu Custom Instructions Extension (CFU) and the according Custom Functions Unit (CFU).
|
Take a look at the template CFS VHDL source file (rtl/core/neorv32_cfs.vhd ). The file is highly
commented to illustrate all aspects that are relevant for implementing custom CFS-based co-processor designs.
|
The CFS can also be used to replicate existing NEORV32 modules - for example to implement several TWI controllers. |
CFS Software Access
The CFS memory-mapped registers can be accessed by software using the provided C-language aliases (see
register map table below). Note that all interface registers are declared as 32-bit words of type uint32_t
.
// C-code CFS usage example
NEORV32_CFS.REG[0] = (uint32_t)some_data_array(i); // write to CFS register 0
int temp = (int)NEORV32_CFS.REG[20]; // read from CFS register 20
A very simple example program that uses the default CFS hardware module can be found in sw/example/cfs_demo .
|
CFS Interrupt
The CFS provides a single high-level-triggered interrupt request signal mapped to the CPU’s fast interrupt channel 1.
Once triggered, the interrupt becomes pending (if enabled in the mis
CSR) and has to be explicitly cleared again by
writing zero to the according mip
CSR bit. See section Processor Interrupts for more information.
CFS Configuration Generic
By default, the CFS provides a single 32-bit std_(u)logic_vector
configuration generic IO_CFS_CONFIG
that is available in the processor’s top entity. This generic can be used to pass custom configuration options
from the top entity directly down to the CFS. The actual definition of the generic and it’s usage inside the
CFS is left to the hardware designer.
CFS Custom IOs
By default, the CFS also provides two unidirectional input and output conduits cfs_in_i
and cfs_out_o
.
These signals are directly propagated to the processor’s top entity. These conduits can be used to implement
application-specific interfaces like memory or peripheral connections. The actual use case of these signals
has to be defined by the hardware designer.
The size of the input signal conduit cfs_in_i
is defined via the top’s IO_CFS_IN_SIZE configuration
generic (default = 32-bit). The size of the output signal conduit cfs_out_o
is defined via the top’s
IO_CFS_OUT_SIZE configuration generic (default = 32-bit). If the custom function subsystem is not implemented
(IO_CFS_EN = false) the cfs_out_o
signal is tied to all-zero.
Register Map
Address | Name [C] | Bit(s) | R/W | Function |
---|---|---|---|---|
|
|
|
(r)/(w) |
custom CFS interface register 0 |
|
|
|
(r)/(w) |
custom CFS interface register 1 |
… |
… |
|
(r)/(w) |
… |
|
|
|
(r)/(w) |
custom CFS interface register 30 |
|
|
|
(r)/(w) |
custom CFS interface register 31 |
2.7.19. Smart LED Interface (NEOLED)
Hardware source file(s): |
neorv32_neoled.vhd |
|
Software driver file(s): |
neorv32_neoled.c |
|
neorv32_neoled.h |
||
Top entity port: |
|
1-bit serial data output |
Configuration generics: |
IO_NEOLED_EN |
implement NEOLED when true |
IO_NEOLED_TX_FIFO |
TX FIFO depth (1..32k, has to be a power of two) |
|
CPU interrupts: |
fast IRQ channel 9 |
NEOLED interrupt (see Processor Interrupts) |
Theory of Operation
The NEOLED module provides a dedicated interface for "smart RGB LEDs" like the WS2812 or WS2811. These LEDs provide a single interface wire that uses an asynchronous serial protocol for transmitting color data. Basically, data is transferred via LED-internal shift registers, which allows to cascade an unlimited number of smart LEDs. The protocol provides a RESET command to strobe the transmitted data into the LED PWM driver registers after data has shifted throughout all LEDs in a chain.
The NEOLED interface is compatible to the "Adafruit Industries NeoPixel" products, which feature WS2812 (or older WS2811) smart LEDs (see link:https://learn.adafruit.com/adafruit-neopixel-uberguide). |
The interface provides a single 1-bit output neoled_o
to drive an arbitrary number of cascaded LEDs. Since the
NEOLED module provides 24-bit and 32-bit operating modes, a mixed setup with RGB LEDs (24-bit color)
and RGBW LEDs (32-bit color including a dedicated white LED chip) is possible.
Theory of Operation - NEOLED Module
The NEOLED modules provides two accessible interface registers: the control register CTRL
and the
TX data register DATA
. The NEOLED module is globally enabled via the control register’s
NEOLED_CTRL_EN bit. Clearing this bit will terminate any current operation, clear the TX buffer, reset the module
and set the neoled_o
output to zero. The precise timing (implementing the WS2812 protocol) and transmission
mode are fully programmable via the CTRL
register to provide maximum flexibility.
RGB / RGBW Configuration
NeoPixel are available in two "color" version: LEDs with three chips providing RGB color and LEDs with four chips providing RGB color plus a dedicated white LED chip (= RGBW). Since the intensity of every LED chip is defined via an 8-bit value the RGB LEDs require a frame of 24-bit per module and the RGBW LEDs require a frame of 32-bit per module.
The data transfer quantity of the NEOLED module can be configured via the NEOLED_MODE_EN control
register bit. If this bit is cleared, the NEOLED interface operates in 24-bit mode and will transmit bits 23:0
of
the data written to DATA
to the LEDs. If NEOLED_MODE_EN is set, the NEOLED interface operates in 32-bit
mode and will transmit bits 31:0
of the data written to DATA
to the LEDs.
The mode bit can be configured before writing each new data word in order to support an arbitrary setup of RGB and RGBW LEDs.
Protocol
The interface of the WS2812 LEDs uses an 800kHz carrier signal. Data is transmitted in a serial manner starting with LSB-first. The intensity for each R, G & B (& W) LED chip (= color code) is defined via an 8-bit value. The actual data bits are transferred by modifying the duty cycle of the signal (the timings for the WS2812 are shown below). A RESET command is "send" by pulling the data line LOW for at least 50μs.

Ttotal (Tcarrier) |
1.25μs +/- 300ns |
period for a single bit |
T0H |
0.4μs +/- 150ns |
high-time for sending a |
T0L |
0.8μs +/- 150ns |
low-time for sending a |
T1H |
0.85μs +/- 150ns |
high-time for sending a |
T1L |
0.45μs +/- 150 ns |
low-time for sending a |
RESET |
Above 50μs |
low-time for sending a RESET command |
Timing Configuration
The basic carrier frequency (800kHz for the WS2812 LEDs) is configured via a 3-bit main clock prescaler (NEOLED_CTRL_PRSCx, see table below) that scales the main processor clock fmain and a 5-bit cycle multiplier NEOLED_CTRL_T_TOT_x.
NEOLED_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
The duty-cycles (or more precisely: the high- and low-times for sending either a '1' bit or a '0' bit) are defined via the 5-bit NEOLED_CTRL_T_ONE_H_x and NEOLED_CTRL_T_ZERO_H_x values, respectively. These programmable timing constants allow to adapt the interface for a wide variety of smart LED protocol (for example WS2812 vs. WS2811).
Timing Configuration - Example (WS2812)
Generate the base clock fTX for the NEOLED TX engine:
-
processor clock fmain = 100 MHz
-
NEOLED_CTRL_PRSCx =
0b001
= fmain / 4
fTX = fmain[Hz] / clock_prescaler
= 100MHz / 4 = 25MHz
TTX = 1 / fTX = 40ns
Generate carrier period (Tcarrier) and high-times (duty cycle) for sending 0
(T0H) and 1
(T1H) bits:
-
NEOLED_CTRL_T_TOT =
0b11110
(= decimal 30) -
NEOLED_CTRL_T_ZERO_H =
0b01010
(= decimal 10) -
NEOLED_CTRL_T_ONE_H =
0b10100
(= decimal 20)
Tcarrier = TTX * NEOLED_CTRL_T_TOT = 40ns * 30 = 1.4µs
T0H = TTX * NEOLED_CTRL_T_ZERO_H = 40ns * 10 = 0.4µs
T1H = TTX * NEOLED_CTRL_T_ONE_H = 40ns * 20 = 0.8µs
The NEOLED SW driver library (neorv32_neoled.h ) provides a simplified configuration
function that configures all timing parameters for driving WS2812 LEDs based on the processor
clock frequency.
|
TX Data FIFO
The interface features a TX data buffer (a FIFO) to allow more CPU-independent operation. The buffer depth is configured via the IO_NEOLED_TX_FIFO top generic (default = 1 entry). The FIFO size configuration can be read via the NEOLED_CTRL_BUFS_x control register bits, which result log2(IO_NEOLED_TX_FIFO).
When writing data to the DATA
register the data is automatically written to the TX buffer. Whenever
data is available in the buffer the serial transmission engine will take it and transmit it to the LEDs.
The data transfer size (NEOLED_MODE_EN) can be modified at every time since this control register bit is also buffered
in the FIFO. This allows to arbitrarily mixing RGB and RGBW LEDs in the chain.
Software can check the FIFO fill level via the control register’s NEOLED_CTRL_TX_EMPTY, NEOLED_CTRL_TX_HALF and NEOLED_CTRL_TX_FULL flags. The NEOLED_CTRL_TX_BUSY flags provides additional information if the the TX unit is still busy sending data.
Please note that the timing configurations (NEOLED_CTRL_PRSCx, NEOLED_CTRL_T_TOT_x, NEOLED_CTRL_T_ONE_H_x and NEOLED_CTRL_T_ZERO_H_x) are NOT stored to the buffer. Changing these value while the buffer is not empty or the TX engine is still busy will cause data corruption. |
Strobe Command ("RESET")
According to the WS2812 specs the data written to the LED’s shift registers is strobed to the actual PWM driver registers when the data line is low for 50μs ("RESET" command, see table above). This can be implemented using busy-wait for at least 50μs. Obviously, this concept wastes a lot of processing power.
To circumvent this, the NEOLED module provides an option to automatically issue an idle time for creating the RESET
command. If the NEOLED_CTRL_STROBE control register bit is set, all data written to the data FIFO (via DATA
,
the actually written data is irrelevant) will trigger an idle phase (neoled_o
= zero) of 127 periods (= Tcarrier).
This idle time will cause the LEDs to strobe the color data into the PWM driver registers.
Since the NEOLED_CTRL_STROBE flag is also buffered in the TX buffer, the RESET command is treated just as another data word being written to the TX buffer making busy wait concepts obsolete and allowing maximum refresh rates.
NEOLED Interrupt
The NEOLED modules features a single interrupt that becomes pending based on the current TX buffer fill level. The interrupt can only become pending if the NEOLED module is enabled. The specific interrupt condition is configured via the NEOLED_CTRL_IRQ_CONF bit in the unit’s control register.
If NEOLED_CTRL_IRQ_CONF is cleared, an interrupt is generated whenever the TX FIFO becomes less than half-full.
In this case software can write up to IO_NEOLED_TX_FIFO/2 new data words to DATA
without checking the FIFO
status flags. If NEOLED_CTRL_IRQ_CONF is set, an interrupt is generated whenever the TX FIFO becomes empty.
One the NEOLED interrupt has been triggered and became pending, it has to explicitly cleared again by
writing zero to according mip
CSR bit.
The NEOLED_CTRL_IRQ_CONF is hardwired to one if IO_NEOLED_TX_FIFO = 1 (→ IRQ if FIFO is empty). If the FIFO is configured to contain only a single entry (IO_NEOLED_TX_FIFO = 1) the interrupt will become pending if the FIFO (which is just a single register providing simple double-buffering) is empty. |
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
NEOLED enable |
|
r/w |
data transfer size; |
||
|
r/w |
|
||
|
r/w |
3-bit clock prescaler, bit 0 |
||
|
r/w |
3-bit clock prescaler, bit 1 |
||
|
r/w |
3-bit clock prescaler, bit 2 |
||
|
r/- |
4-bit log2(IO_NEOLED_TX_FIFO) |
||
|
r/- |
|||
|
r/- |
|||
|
r/- |
|||
|
r/w |
5-bit pulse clock ticks per total single-bit period (Ttotal) |
||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
5-bit pulse clock ticks per high-time for sending a zero-bit (T0H) |
||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
5-bit pulse clock ticks per high-time for sending a one-bit (T1H) |
||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
|||
|
r/w |
TX FIFO interrupt configuration: |
||
|
r/- |
TX FIFO is empty |
||
|
r/- |
TX FIFO is at least half full |
||
|
r/- |
TX FIFO is full |
||
|
r/- |
TX serial engine is busy when set |
||
|
|
|
-/w |
TX data (32-/24-bit) |
2.7.20. External Interrupt Controller (XIRQ)
Hardware source file(s): |
neorv32_xirq.vhd |
|
Software driver file(s): |
neorv32_xirq.c |
|
neorv32_xirq.h |
||
Top entity port: |
|
IRQ input (32-bit, fixed) |
Configuration generics: |
XIRQ_NUM_CH |
Number of IRQs to implement (0..32) |
XIRQ_TRIGGER_TYPE |
IRQ trigger type configuration |
|
XIRQ_TRIGGER_POLARITY |
IRQ trigger polarity configuration |
|
CPU interrupts: |
fast IRQ channel 8 |
XIRQ (see Processor Interrupts) |
The eXternal interrupt controller provides a simple mechanism to implement up to 32 processor-external interrupt request signals. The external IRQ requests are prioritized, queued and signaled to the CPU via a single CPU fast interrupt request.
Theory of Operation
The XIRQ provides up to 32 interrupt channels (configured via the XIRQ_NUM_CH generic). Each bit in the xirq_i
input signal vector represents one interrupt channel. If less than 32 channels are configure, only the LSB-aligned channels
are used while the remaining bits are left unconnected. An interrupt channel is enabled by setting the according bit in the
interrupt enable register IER
.
If the configured trigger (see below) of an enabled channel fires, the request is stored into an internal buffer.
This buffer is available via the interrupt pending register IPR
. A 1
in this register indicates that the
corresponding interrupt channel has fired but has not yet been serviced (so it is pending). An interrupt channel can
become pending if the according IER
bit is set. Pending IRQs can be cleared by writing 0
to the according IPR
bit. As soon as there is a least one pending interrupt in the buffer, an interrupt request is send to the CPU.
A disabled interrupt channel can still be pending if it has been triggered before clearing the according IER bit.
|
The CPU can determine active external interrupt request either by checking the bits in the IPR
register, which show all
pending interrupt channels, or by reading the interrupt source register SCR
.
This register provides a 5-bit wide ID (0..31) that shows the interrupt request with highest priority.
Interrupt channel xirq_i(0)
has highest priority and xirq_i(XIRQ_NUM_CH-1)
has lowest priority.
This priority assignment is fixed and cannot be altered by software.
The CPU can use the ID from SCR
to service IRQ according to their priority. To acknowledge the according
interrupt the CPU can write 1 << SCR
to IPR
.
In order to clear a pending FIRQ interrupt from the external interrupt controller again, the according mip
CSR bit has
to be cleared. Additionally, the XIRQ interrupt has to be acknowledged by writing any
value to the interrupt source register SRC
.
An interrupt handler should clear the interrupt pending bit that caused the interrupt first before
acknowledging the interrupt by writing the SCR register.
|
IRQ Trigger Configuration
The controller does not provide a configuration option to define the IRQ triggers during runtime. Instead, two generics are provided to configure the trigger of each interrupt channel before synthesis: the XIRQ_TRIGGER_TYPE and XIRQ_TRIGGER_POLARITY generic. Both generics are 32 bit wide representing one bit per interrupt channel. If less than 32 interrupt channels are implemented the remaining configuration bits are ignored.
XIRQ_TRIGGER_TYPE is used to define the general trigger type. This can be either level-triggered (0
) or
edge-triggered (1
). XIRQ_TRIGGER_POLARITY is used to configure the polarity of the trigger: a 0
defines
low-level or falling-edge and a 1
defines high-level or rising-edge.
XIRQ_TRIGGER_TYPE => x"00000001";
XIRQ_TRIGGER_POLARITY => x"ffffffff";
Register Map
Address | Name [C] | Bit(s) | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
Interrupt enable register (one bit per channel, LSB-aligned) |
|
|
|
r/w |
Interrupt pending register (one bit per channel, LSB-aligned); writing 0 to a bit clears according pending interrupt |
|
|
|
r/w |
Channel id (0..31) of firing IRQ (prioritized!); writing any value will acknowledge the current interrupt |
|
- |
|
r/- |
reserved, read as zero |
2.7.21. General Purpose Timer (GPTMR)
Hardware source file(s): |
neorv32_gptmr.vhd |
|
Software driver file(s): |
neorv32_gptmr.c |
|
neorv32_gptmr.h |
||
Top entity port: |
none |
|
Configuration generics: |
IO_GPTMR_EN |
implement general purpose timer when true |
CPU interrupts: |
fast IRQ channel 12 |
timer interrupt (see Processor Interrupts) |
Theory of Operation
The general purpose timer module provides a simple yet universal 32-bit timer. The timer is implemented if
IO_GPTMR_EN top generic is set true. It provides a 32-bit counter register (COUNT
) and a 32-bit threshold
register (THRES
). An interrupt is generated whenever the value of the counter registers matches the one from
threshold register.
The timer is enabled by setting the GPTMR_CTRL_EN bit in the device’s control register CTRL
. The COUNT
register will start incrementing at a programmable rate, which scales the main processor clock. The
pre-scaler value is configured via the three GPTMR_CTRL_PRSCx control register bits:
GPTMR_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
The timer provides two operation modes that are configured by the GPTMR_CTRL_MODE control register bit:
if GPTMR_CTRL_MODE is cleared (0
) the timer operates in single-shot mode. As soon as COUNT
matches
THRES
an interrupt request is generated and the timer stops operation (i.e. it stops incrementing). If
GPTMR_CTRL_MODE is set (1
) the timer operates in continuous mode. When COUNT
matches THRES
an interrupt
request is generated and COUNT
is automatically reset to all-zero before continuing to increment.
Disabling the timer will not clear the COUNT register. However, it can be manually reset at any time by
writing zero to it.
|
Timer Interrupt
The timer interrupt is triggered when the timer is enabled and COUNT
matches THRES
. The interrupt
remains pending until explicitly cleared by writing zero to the according mip
CSR bit.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
Timer enable flag |
|
r/w |
3-bit clock prescaler select |
||
|
r/w |
|||
|
r/w |
|||
|
r/w |
Counter mode: |
||
|
|
|
r/w |
Threshold value register |
|
|
|
r/w |
Counter register |
2.7.22. Execute In Place Module (XIP)
Hardware source file(s): |
neorv32_xip.vhd |
|
Software driver file(s): |
neorv32_xip.c |
|
neorv32_xip.h |
||
Top entity port: |
|
1-bit chip select, low-active |
|
1-bit serial clock output |
|
|
1-bit serial data input |
|
|
1-bit serial data output |
|
Configuration generics: |
IO_XIP_EN |
implement XIP module when true |
CPU interrupts: |
none |
Overview
The execute in place (XIP) module is probably one of the more complicated modules of the NEORV32. The module allows to execute code (and read constant data) directly from a SPI flash memory. Hence, it uses the standard serial peripheral interface (SPI) as transfer protocol under the hood.
The XIP flash is not mapped to a specific region of the processor’s address space. Instead, the XIP module provides a programmable mapping scheme to allow a flexible user-defined mapping of the flash to any section of the address space.
From the CPU side, the modules provides two different interfaces: one for transparently accessing the XIP flash and another one for accessing the module’s control and status registers. The first interface provides a transparent gateway to the SPI flash, so the CPU can directly fetch and execute instructions (and/or read constant data). Note that this interface is read-only. Any write access will raise a bus error exception. The second interface is mapped to the processor’s IO space and allows data accesses to the XIP module’s configuration registers.
Example Program
An example program for the XIP module is available in sw/example/demo_xip .
|
Compiling a Program for XIP Execution
If you want to compile a program that shall be executed using the XIP module, the default NEORV32 linker script
(sw/common/neorv32.ld ) has to be modified: the ORIGIN attribute of the rom section needs to be adapted to
the XIP page base address and the flash base address. For example if the XIP page is set to 0x20000000 and the
executable is placed in the flash as offset 0x00400000 the ORIGIN attribute has to be set to the sum of both
address offsets (0x20000000 + 0x00400000 = 0x20400000 → rom (rx) : ORIGIN = DEFINED(make_bootloader) ? 0xFFFF0000 : 0x20400000 ).
See sections Linker Script, Application Makefile and Executable Image Generator for more information.
|
SPI Protocol
The XIP module accesses external flash using the standard SPI protocol. The module always sends data MSB-first and
provides all of the standard four clock modes (0..3), which are configured via the XIP_CTRL_CPOL (clock polarity)
and XIP_CTRL_CPHA (clock phase) control register bits, respectively. The clock speed of the interface (xip_clk_o
)
is defined by a three-bit clock pre-scaler configured using the XIP_CTRL_PRSCx bits:
XIP_CTRL_PRSCx |
0b000 |
0b001 |
0b010 |
0b011 |
0b100 |
0b101 |
0b110 |
0b111 |
---|---|---|---|---|---|---|---|---|
Resulting |
2 |
4 |
8 |
64 |
128 |
1024 |
2048 |
4096 |
Based on the XIP_CTRL_PRSCx configuration the actual XIP SPI clock frequency fXIP is derived from the processor’s main clock fmain and is determined by:
fXIP = fmain[Hz] / (2 * clock_prescaler
)
Hence, the maximum XIP clock speed is fmain / 4.
High-Speed SPI mode
The module provides a "high-speed" SPI mode. In this mode the clock prescaler configuration (XIP_CTRL_PRSCx) is ignored
and the SPI clock operates at fmain / 2 (half of the processor’s main clock). High speed SPI mode is enabled by setting
the control register’s XIP_CTRL_HIGHSPEED bit.
|
The flash’s "read command", which initiates a read access, is defined by the XIP_CTRL_RD_CMD control register bits.
For most SPI flash memories this is 0x03
for normal SPI mode.
Direct SPI Access
The XIP module allows to initiate direct SPI transactions. This feature can be used to configure the attached SPI
flash or to perform direct read and write accesses to the flash memory. Two data registers NEORV32_XIP.DATA_LO
and
NEORV32_XIP.DATA_HI
are provided to send up to 64-bit of SPI data. The NEORV32_XIP.DATA_HI
register is write-only,
so a total of 32-bit receive data is provided. Note that the module handles the chip-select
line (xip_csn_o
) by itself so it is not possible to construct larger consecutive transfers.
The actual data transmission size in bytes is defined by the control register’s XIP_CTRL_SPI_NBYTES bits. Any configuration from 1 byte to 8 bytes is valid. Other value will result in unpredictable behavior.
Since data is always transferred MSB-first, the data in DATA_HI:DATA_LO
also has to be MSB-aligned. Receive data is
available in DATA_LO
only - DATA_HI
is write-only. Writing to DATA_HI
triggers the actual SPI transmission.
The XIP_CTRL_PHY_BUSY control register flag indicates a transmission being in progress.
The chip-select line of the XIP module (xip_csn_o
) will only become asserted (enabled, pulled low) if the
XIP_CTRL_SPI_CSEN control register bit is set. If this bit is cleared, xip_csn_o
is always disabled
(pulled high).
Direct SPI mode is only possible when the module is enabled (setting XIP_CTRL_EN) but before the actual XIP mode is enabled via XIP_CTRL_XIP_EN. |
When the XIP mode is not enabled, the XIP module can also be used as additional general purpose SPI controller with a transfer size of up to 64 bits per transmission. |
Address Mapping
The address mapping of the XIP flash is not fixed by design. It can be mapped to any section within the processor’s
address space. A section refers to one out of 16 naturally aligned 256MB wide memory segments. This segment
is defined by the four most significant bits of the address (31:28
) and the XIP’s segment is programmed by the
four XIP_CTRL_XIP_PAGE bits in the unit’s control register. All accesses within this page will be mapped to the XIP flash.
Care must be taken when programming the page mapping to prevent access collisions with other modules (like internal memories or modules attached to the external memory interface). |
Example: to map the XIP flash to the address space starting at 0x20000000
write a "2" (0b0010
) to the XIP_CTRL_XIP_PAGE
control register bits. Any access within 0x20000000 .. 0x2fffffff
will be forwarded to the XIP flash.
Note that the SPI access address might wrap around.
Using the FPGA Bitstream Flash also for XIP
You can also use the FPGA’s bitstream SPI flash for storing XIP programs. To prevent overriding the bitstream,
a certain offset needs to be added to the executable (which might require linker script modifications).
To execute the program stored in the SPI flash simply jump to the according base address. For example
if the executable starts at flash offset 0x8000 and the XIP flash is mapped to the base address 0x20000000
then add the offset to the base address and use that as jump/call destination (=0x20008000 ).
|
Using the XIP Mode
The XIP module is globally enabled by setting the XIP_CTRL_EN bit in the device’s CTRL
control register.
Clearing this bit will reset the whole module and will also terminate any pending SPI transfer.
Since there is a wide variety of SPI flash components with different sizes, the XIP module allows to specify
the address width of the flash: the number of address bytes used for addressing flash memory content has to be
configured using the control register’s XIP_CTRL_XIP_ABYTES bits. These two bits contain the number of SPI
address bytes (minus one). For example for a SPI flash with 24-bit addresses these bits have to be set to
0b10
.
The transparent XIP accesses are transformed into SPI transmissions with the following format (starting with the MSB):
-
8-bit command: configured by the XIP_CTRL_RD_CMD control register bits ("SPI read command")
-
8 to 32 bits address: defined by the XIP_CTRL_XIP_ABYTES control register bits ("number of address bytes")
-
32-bit data: sending zeros and receiving the according flash word (32-bit)
Hence, the maximum XIP transmission size is 72-bit, which has to be configured via the XIP_CTRL_SPI_NBYTES control register bits. Note that the 72-bit transmission size is only available in XIP mode. The transmission size of the direct SPI accesses is limited to 64-bit.
When using four SPI flash address bytes, the most significant 4 bits of the address are always hardwired to zero allowing a maximum accessible flash size of 256MB. |
The XIP module always fetches a full naturally aligned 32-bit word from the SPI flash. Any sub-word data masking or alignment will be performed by the CPU core logic. |
The XIP mode requires the 4-byte data words in the flash to be ordered in little-endian byte order. |
After the SPI properties (including the amount of address bytes and the total amount of SPI transfer bytes)
and XIP address mapping are configured, the actual XIP mode can be enabled by setting
the control register’s XIP_CTRL_XIP_EN bit. This will enable the "transparent SPI access port" of the module and thus,
the transparent conversion of access requests into proper SPI flash transmissions. Make sure XIP_CTRL_SPI_CSEN
is also set so the module can actually select/enable the attached SPI flash.
No more direct SPI accesses via DATA_HI:DATA_LO
are possible when the XIP mode is enabled. However, the
XIP mode can be disabled at any time.
If the XIP module is disabled (XIP_CTRL_EN = 0 ) any accesses to the programmed XIP memory segment are ignored
by the module and might be forwarded to the processor’s external memory interface (if implemented) or will cause a bus
exception. If the XIP module is enabled (XIP_CTRL_EN = 1 ) but XIP mode is not enabled yet (XIP_CTRL_XIP_EN = '0')
any access to the programmed XIP memory segment will raise a bus exception.
|
It is highly recommended to enable the Processor-Internal Instruction Cache (iCACHE) to cover some of the SPI access latency. |
XIP Burst Mode
By default, every XIP access to the flash transmits the read command and the word-aligned address before reading four consecutive data bytes. Obviously, this introduces a certain transmission overhead. To reduces this overhead, the XIP mode allows to utilize the flash’s incrmental read function, which will return consecutive bytes when continuing to send clock cycles after a read command. Hence, the XIP module provides an optional "burst mode" to accelerate consecutive read accesses.
The XIP burst mode is enabled by setting the XIP_CTRL_BURST_EN bit in the module’s control register. The burst mode only affects the actual XIP mode and not the direct SPI mode. Hence, it should be enabled right before enabling XIP mode only. By using the XIP burst mode flash read accesses can be accelerated by up to 50%.
Register Map
Address | Name [C] | Bit(s), Name [C] | R/W | Function |
---|---|---|---|---|
|
|
|
r/w |
XIP module enable |
|
r/w |
3-bit SPI clock prescaler select |
||
|
r/w |
|||
|
r/w |
|||
|
r/w |
SPI clock polarity |
||
|
r/w |
SPI clock phase |
||
|
r/w |
Number of bytes in SPI transaction (1..9) |
||
|
r/w |
XIP mode enable |
||
|
r/w |
Number of address bytes for XIP flash (minus 1) |
||
|
r/w |
Flash read command |
||
|
r/w |
XIP memory page |
||
|
r/w |
Allow SPI chip-select to be actually asserted when set |
||
|
r/w |
enable SPI high-speed mode (ignoring XIP_CTRL_PRSC) |
||
|
r/w |
Enable XIP burst mode |
||
|
r/- |
reserved, read as zero |
||
|
r/- |
SPI PHY busy when set |
||
|
r/- |
XIP access in progress when set |
||
|
reserved |
|
r/- |
reserved, read as zero |
|
|
|
r/w |
Direct SPI access - data register low |
|
|
|
-/w |
Direct SPI access - data register high; write access triggers SPI transfer |
2.7.23. System Configuration Information Memory (SYSINFO)
Hardware source file(s): |
neorv32_sysinfo.vhd |
|
Software driver file(s): |
neorv32.h |
|
Top entity port: |
none |
|
Configuration generics: |
* |
most of the top’s configuration generics |
CPU interrupts: |
none |
Theory of Operation
The SYSINFO allows the application software to determine the setting of most of the processor’s top entity generics that are related to processor/SoC configuration. All registers of this unit are read-only.
This device is always implemented - regardless of the actual hardware configuration. The bootloader as well as the NEORV32 software runtime environment require information from this device (like memory layout and default clock speed) for correct operation.
Any write access to the SYSINFO module will raise a store bus error exception. The Internal Bus Monitor (BUSKEEPER) will signal a "DEVICE ERROR" in this case. |
Register Map
Address | Name [C] | Function |
---|---|---|
|
|
clock speed in Hz (via top’s CLOCK_FREQUENCY generic) |
|
`NEORV32_SYSINFO.CUSTOM_ID |
custom user-defined ID (via top’s CUSTOM_ID generic) |
|
|
specific SoC configuration (see SYSINFO - SoC Configuration) |
|
|
cache configuration information (see SYSINFO - Cache Configuration) |
|
|
instruction address space base (via package’s |
|
|
internal IMEM size in bytes (via top’s MEM_INT_IMEM_SIZE generic) |
|
|
data address space base (via package’s |
|
|
internal DMEM size in bytes (via top’s MEM_INT_DMEM_SIZE generic) |
SYSINFO - SoC Configuration
Bit | Name [C] | Function |
---|---|---|
|
SYSINFO_SOC_BOOTLOADER |
set if the processor-internal bootloader is implemented (via top’s INT_BOOTLOADER_EN generic) |
|
SYSINFO_SOC_MEM_EXT |
set if the external Wishbone bus interface is implemented (via top’s MEM_EXT_EN generic) |
|
SYSINFO_SOC_MEM_INT_IMEM |
set if the processor-internal DMEM implemented (via top’s MEM_INT_DMEM_EN generic) |
|
SYSINFO_SOC_MEM_INT_DMEM |
set if the processor-internal IMEM is implemented (via top’s MEM_INT_IMEM_EN generic) |
|
SYSINFO_SOC_MEM_EXT_ENDIAN |
set if external bus interface uses BIG-endian byte-order (via top’s MEM_EXT_BIG_ENDIAN generic) |
|
SYSINFO_SOC_ICACHE |
set if processor-internal instruction cache is implemented (via top’s ICACHE_EN generic) |
|
- |
reserved, read as zero |
|
SYSINFO_SOC_IS_SIM |
set if processor is being simulated (⚠️ not guaranteed) |
|
SYSINFO_SOC_OCD |
set if on-chip debugger implemented (via top’s ON_CHIP_DEBUGGER_EN generic) |
|
- |
reserved, read as zero |
|
SYSINFO_SOC_IO_GPIO |
set if the GPIO is implemented (via top’s IO_GPIO_EN generic) |
|
SYSINFO_SOC_IO_MTIME |
set if the MTIME is implemented (via top’s IO_MTIME_EN generic) |
|
SYSINFO_SOC_IO_UART0 |
set if the primary UART0 is implemented (via top’s IO_UART0_EN generic) |
|
SYSINFO_SOC_IO_SPI |
set if the SPI is implemented (via top’s IO_SPI_EN generic) |
|
SYSINFO_SOC_IO_TWI |
set if the TWI is implemented (via top’s IO_TWI_EN generic) |
|
SYSINFO_SOC_IO_PWM |
set if the PWM is implemented (via top’s IO_PWM_NUM_CH generic) |
|
SYSINFO_SOC_IO_WDT |
set if the WDT is implemented (via top’s IO_WDT_EN generic) |
|
SYSINFO_SOC_IO_CFS |
set if the custom functions subsystem is implemented (via top’s IO_CFS_EN generic) |
|
SYSINFO_SOC_IO_TRNG |
set if the TRNG is implemented (via top’s IO_TRNG_EN generic) |
|
SYSINFO_SOC_IO_SLINK |
set if the SLINK is implemented (via top’s SLINK_NUM_TX and/or SLINK_NUM_RX generics) |
|
SYSINFO_SOC_IO_UART1 |
set if the secondary UART1 is implemented (via top’s IO_UART1_EN generic) |
|
SYSINFO_SOC_IO_NEOLED |
set if the NEOLED is implemented (via top’s IO_NEOLED_EN generic) |
|
SYSINFO_SOC_IO_XIRQ |
set if the XIRQ is implemented (via top’s XIRQ_NUM_CH generic) |
|
SYSINFO_SOC_IO_GPTMR |
set if the GPTMR is implemented (via top’s IO_GPTMR_EN generic) |
|
SYSINFO_SOC_IO_XIP |
set if the XIP module is implemented (via top’s IO_XIP_EN generic) |
|
SYSINFO_SOC_IO_ONEWIRE |
set if the ONEWIRE interface is implemented (via top’s IO_ONEWIRE_EN generic) |
SYSINFO - Cache Configuration
Bit fields in this register are set to all-zero if the according cache is not implemented. |
Bit | Name [C] | Function |
---|---|---|
|
SYSINFO_CACHE_IC_BLOCK_SIZE_3 : SYSINFO_CACHE_IC_BLOCK_SIZE_0 |
log2(i-cache block size in bytes), via top’s ICACHE_BLOCK_SIZE generic |
|
SYSINFO_CACHE_IC_NUM_BLOCKS_3 : SYSINFO_CACHE_IC_NUM_BLOCKS_0 |
log2(i-cache number of cache blocks), via top’s ICACHE_NUM_BLOCKS generic |
|
SYSINFO_CACHE_IC_ASSOCIATIVITY_3 : SYSINFO_CACHE_IC_ASSOCIATIVITY_0 |
log2(i-cache associativity), via top’s ICACHE_ASSOCIATIVITY generic |
|
SYSINFO_CACHE_IC_REPLACEMENT_3 : SYSINFO_CACHE_IC_REPLACEMENT_0 |
i-cache replacement policy ( |
|
- |
zero, reserved for d-cache |
3. NEORV32 Central Processing Unit (CPU)

Section Structure
Key Features
-
32-bit little-endian, multi-cycle, in-order
rv32
RISC-V CPU -
Compatible to the RISC-V. Privileged Architecture - Machine ISA Version 1.13 specifications
-
Available Instruction Sets and Extensions:
-
B
- bit-manipulation instructions -
C
- 16-bit compressed instructions -
I
- integer base ISA (always enabled) -
E
- embedded CPU version (reduced register file size) -
M
- integer multiplication and division hardware -
U
- less-privileged user mode -
Zfinx
- single-precision floating-point unit -
Zicsr
- control and status register access (privileged architecture) -
Zicntr
- CPU base counters -
Zihpm
- hardware performance monitors -
Zifencei
- instruction stream synchronization -
Zmmul
- integer multiplication hardware -
Zxcfu
- custom instructions extension -
PMP
- physical memory protection -
Sdext
- external debug support -
Sdtrig
- trigger module
-
-
RISC-V Compatibility: Compatible to the RISC-V user specifications and a subset of the RISC-V privileged architecture specifications - passes the official RISC-V Architecture Tests (v2+)
-
Official RISC-V open source architecture ID: decimal 19; hexadecimal
0x00000013
-
Supports all of the machine-level Traps, Exceptions and Interrupts from the RISC-V specifications (including bus access exceptions and all unimplemented/illegal/malformed instructions)
-
This is a special aspect on execution safety by Full Virtualization
-
Standard RISC-V interrupts (external, timer, software) plus 16 custom fast interrupts
-
-
Optional physical memory configuration (PMP)
-
Optional hardware performance monitors (HPM) for application benchmarking
-
Separated Bus Interfaces for instruction fetch and data access
It is recommended to use the NEORV32 Processor as default top instance even if you only want to use the actual CPU. Simply disable all the processor-internal modules via the generics and you will get a "CPU wrapper" that provides a minimal CPU environment and an external bus interface (like AXI4). This setup also allows to further use the default bootloader and software framework. From this base you can start building your own SoC. Of course you can also use the CPU in it’s true stand-alone mode. |
This documentation assumes the reader is familiar with the official RISC-V "User" and "Privileged Architecture" specifications. |
3.1. RISC-V Compatibility
RISCOF
The NEORV32 CPU passes the tests of the official RISCOF RISC-V Architecture Test Framework. This framework is used to check RISC-V implementations for compatibility to the official RISC-V use/privileged ISA specifications. The NEORV32 port of this test framework is available in a separate repository: https://github.com/stnolting/neorv32-riscof |
3.1.1. RISC-V Incompatibility Issues and Limitations
This list shows the currently identified issues regarding full RISC-V-compatibility.
Pending Interrupts
An interrupt can only become pending (bit in mip becomes set) if the interrupt channel is enabled
via the according mie bit. Clearing a bit in mie will also clear the according mip bit.
|
Physical Memory Protection (PMP)
The RISC-V-compatible NEORV32 Machine Physical Memory Protection CSRs only implements the TOR
(top of region) mode and only up to 16 PMP regions.
|
No Hardware Support of Misaligned Memory Accesses
The CPU does not support resolving unaligned memory access by the hardware (this is not a
RISC-V-incompatibility issue but an important thing to know!). Any kind of unaligned memory access
will raise an exception to allow a software-based emulation provided by the application.
|
3.2. Architecture
The NEORV32 CPU was designed from scratch based only on the official base and privileged ISA specifications. The following figure shows the simplified data path of the CPU.

The CPU implements a pipelined multi-cycle architecture: each instruction is executed as a series of consecutive micro-operations. In order to increase performance, the CPU’s front-end (instruction fetch) and back-end (instruction execution) are de-couples via a FIFO. Therefore, the front-end can already fetch new instructions while the back-end is still processing the previously-fetched instruction.
Basically, the CPU’s micro architecture is somewhere between a classical pipelined architecture, where each stage requires exactly one processing cycle (if not stalled) and a classical multi-cycle architecture, which executes every single instruction (including fetch) in a series of consecutive micro-operations. The combination of these two design paradigms allows an increased instruction execution in contrast to a pure multi-cycle approach (due to overlapping operation of fetch and execute) at a reduced hardware footprint (due to the multi-cycle concept).
As a Von-Neumann machine, the CPU provides independent interfaces for instruction fetch and data access. However, these two bus interfaces are merged into a single processor-internal bus via a prioritizing bus switch (data accesses have higher priority). Hence, all memory addresses including peripheral devices are mapped to a single unified 32-bit address space.
The CPU does not perform any out-of-order operations. Hence, it is not vulnerable to security issues caused by speculative execution (e.g. Spectre an Meltdown). |
3.2.1. CPU Register File
The data register file contains the general purpose “x” architecture registers. For rv32i
ISA there are 32 32-bit registers
(= 1024 bit total capacity) and for the rv32e
ISA there are 16 32-bit registers (= 512 bit total capacity). Register zero (x0
/zero
)
always read as zero and any write access to it is discarded.
The register file is implemented as synchronous memory with synchronous read and write accesses. Register zero
is also mapped to
a physical memory in the register file. By this, there is no need to add a further multiplexer to "insert" zero if reading from
zero
reducing logic requirements and shortening the critical path. Furthermore, the whole register file can be mapped to FPGA
block RAM(s).
The memory of the register file uses two access ports: a read-only port for reading register rs2
(second source operand) and a
read/write port reading registers rs1
(first source operand) or for writing processing results to register rd
(destination register).
Hence, a simple dual-port RAM can be used to implement the register file. From a functional point of view, read and write accesses to
the register file do never occur in the same clock cycle, so no bypass logic is required at all.
3.2.2. CPU Arithmetic Logic Unit
The arithmetic/logic unit (ALU) is used for processing data from the register file and also for memory and branch address computations.
All simple I
- Base Integer ISA data processing operations (add
, and
, …) are implemented as combinatorial logic requiring only a single cycle to
complete. More sophisticated instructions (shift operations from the base ISA and all further ISA extensions) are processed by so-called
"ALU co-processors".
The co-processors are implemented as iterative units that require several cycles to complete processing. Besides the base ISA’s shift instructions,
the co-processors are used to implement all further processing-based ISA extensions (e.g. M
- Integer Multiplication and Division and
B
- Bit-Manipulation Operations). Custom RISC-V instructions (Custom Functions Unit (CFU)) are also implemented as ALU co-processor.
3.2.3. CPU Bus Unit
The bus unit takes care of handling data memory accesses via the load and store instructions. It handles data adjustment when accessing
sub-word (16-bit or 8-bit) and performs sign-extension for singed load operations. The bus unit also includes the optional includes
PMP
Physical Memory Protection that performs permission checks for any data and instruction (!) access.
A list of the bus interface signals and a detailed description of the protocol can be found in section Bus Interface. All bus interface signals are driven/buffered by registers; so even a complex SoC interconnection bus network will not effect maximal operation frequency.
Unaligned Accesses
The CPU does not support a hardware-based handling of unaligned memory accesses! Any unaligned access will raise a bus load/store unaligned
address exception. The exception handler can be used to emulate unaligned memory accesses in software.
|
3.2.4. CPU Control Unit
The CPU control unit is the actual brain of the processor core as it generated all the control signals for the different CPU modules. The control unit is based on several modules (also called "engines").
Front-End
The front-end is responsible for fetching instruction data in chunks of 32-bits. This can be a single aligned 32-bit instruction, two aligned 16-bit instructions or a mixture of those. The instruction data including control and exception information is stored to a FIFO queue - the instruction prefetch buffer (IPB). The depth of this FIFO can be configured by the CPU_IPB_ENTRIES top generic.
The FIFO allows the front-end to do "speculative" instruction fetches, as it keeps fetching the next consecutive instruction all the time. This also allows to decouple front-end (instruction fetch) and back-end (instruction execution) so both modules can operate in parallel to increase performance. However, all potential side effects that are caused by this "speculative" instruction fetch are already handled by the CPU front-end ensuring a defined execution stage while preventing security side attacks (like Spectre and Meltdown).
Branch Prediction
The front-end implements a very simple branch prediction (predict = always taken) that stops fetching further instruction while
a branch/jump/call operation is in progress.
|
Back-End
Instruction data from the instruction prefetch buffer is decompressed (if the C
ISA extension is enabled) and sent to the
CPU back-end for actual execution. Execution is conducted by a state-machine that controls all of the CPU modules. The execution
time of a instruction depends on the complexity of required operations. The minimal time for executing is 2 cycles (simple ALU
operations) but can be significantly higher. The table in section Instruction Timing list the required execution times for
all instructions and extensions.
Trap Controller
The trap controller handles all exceptions (synchronous events caused by an instruction like an illegal instruction word) and interrupts (asynchronous events triggered by hart-external hardware). A detailed overview of all traps can be found in section Traps, Exceptions and Interrupts.
CSR System
The CSR system implements all the control and status registers and also all hardware counters. See section Control and Status Registers (CSRs) for a full overview of all available CSRs.
3.3. Sleep Mode
The NEORV32 CPU provides a single sleep mode that can be entered to power-down the core by reducing dynamic switching activity.
Sleep mode in entered by executing the wfi
instruction from the Zicsr
Control and Status Register Access / Privileged Architecture
ISA extension. When the CPU is in sleep mode, all CPU-internal operations are stopped (execution, instruction fetch, …).
Note that this does not affect the operation of any peripheral/IO modules like interfaces and timers. Furthermore,
the CPU will continue to buffer/enqueue all incoming interrupt requests.
The CPU will leave sleep mode as soon as any interrupt source becomes pending.
If sleep mode is entered without at least one enabled interrupt source the CPU will be permanently halted. |
The CPU automatically wakes up from sleep mode if a debug session via the on-chip debugger is started. |
3.4. Full Virtualization
Just like the RISC-V ISA the NEORV32 aims to provide maximum virtualization capabilities on CPU and SoC level to allow a high standard of execution safety. The CPU supports all traps specified by the official RISC-V specifications. [5] Thus, the CPU provides defined hardware fall-backs via traps for any expected and unexpected situation (e.g. executing a malformed instruction or accessing a non-allocated memory address). For any kind of trap the core is always in a defined and fully synchronized state throughout the whole architecture (i.e. there are no out-of-order operations that might have to be reverted). This allows a defined and predictable execution behavior at any time improving overall execution safety.
Execution Safety - NEORV32 Virtualization Features
-
Due to the acknowledged memory accesses the CPU is always sync with the memory system (i.e. there is no speculative execution / no out-of-order states).
-
The CPU supports all RISC-V compatible bus exceptions including access exceptions, which are triggered if an accessed address does not respond or encounters an internal device error during access.
-
Accessed memory addresses (plain memory, but also memory-mapped devices) need to respond within a fixed time window. Otherwise a bus access exception is raised.
-
The RISC-V specs. state that executing an malformed instruction results in unpredictable behavior. As an additional execution safety feature the NEORV32 CPU ensures that all unimplemented/malformed/illegal instructions do raise an illegal instruction exceptions and do not commit any state-changing operation (like writing registers or triggering memory operations).
-
To be continued…
3.5. CPU Top Entity - Signals
The following table shows all interface signals of the CPU top entity rtl/core/neorv32_cpu.vhd
. The
type of all signals is std_ulogic or std_ulogic_vector, respectively. The "Dir." column shows the signal
direction seen from the CPU.
Signal | Width | Dir. | Description |
---|---|---|---|
Global Signals |
|||
|
1 |
in |
global clock line, all registers triggering on rising edge |
|
1 |
in |
global reset, low-active |
|
1 |
out |
CPU is in sleep mode when set |
|
1 |
out |
CPU is in debug mode when set |
Instruction Bus Interface |
|||
|
32 |
out |
access address |
|
32 |
in |
read data |
|
1 |
out |
read request (one-shot) |
|
1 |
in |
bus transfer acknowledge from accessed peripheral |
|
1 |
in |
bus transfer terminate from accessed peripheral |
|
1 |
out |
indicates an executed |
|
1 |
out |
current effective CPU privilege level ( |
Data Bus Interface |
|||
|
32 |
out |
access address |
|
32 |
in |
read data |
|
32 |
out |
write data |
|
4 |
out |
byte enable |
|
1 |
out |
write request (one-shot) |
|
1 |
out |
read request (one-shot) |
|
1 |
in |
bus transfer acknowledge from accessed peripheral |
|
1 |
in |
bus transfer terminate from accessed peripheral |
|
1 |
out |
indicates an executed |
|
1 |
out |
current effective CPU privilege level ( |
Interrupts, RISC-V-compatible (Traps, Exceptions and Interrupts) |
|||
|
1 |
in |
RISC-V machine software interrupt |
|
1 |
in |
RISC-V machine external interrupt |
|
1 |
in |
RISC-V machine timer interrupt |
Interrupts, NEORV32-specific (Traps, Exceptions and Interrupts) |
|||
|
16 |
in |
fast interrupt request signals |
Enter Debug Mode Request (On-Chip Debugger (OCD)) |
|||
|
1 |
in |
request CPU to halt and enter debug mode |
Protocol
See section Bus Interface for the instruction fetch and data access protocol.
|
3.6. CPU Top Entity - Generics
Most of the CPU configuration generics are a subset of the actual Processor configuration generics (see section Processor Top Entity - Generics). and are not listed here. However, the CPU provides some specific generics that are used to configure the CPU for the NEORV32 processor setup. These generics are assigned by the processor setup only and are not available for user defined configuration. The specific generics are listed below.
CPU_BOOT_ADDR
CPU_BOOT_ADDR |
std_ulogic_vector(31 downto 0) |
no default value |
This address defines the reset address at which the CPU starts fetching instructions after reset. In terms of the NEORV32 processor, this generic is configured with the base address of the bootloader ROM (default) or with the base address of the processor-internal instruction memory (IMEM) if the bootloader is disabled (INT_BOOTLOADER_EN = false). See section Address Space for more information. |
CPU_DEBUG_PARK_ADDR
CPU_DEBUG_PARK_ADDR |
std_ulogic_vector(31 downto 0) |
no default value |
This address defines the "park loop" entry address for the "execution based" on-chip debugger. See section On-Chip Debugger (OCD) for more information. |
CPU_DEBUG_EXC_ADDR
CPU_DEBUG_EXC_ADDR |
std_ulogic_vector(31 downto 0) |
no default value |
This address defines the "exception" entry address for the "execution based" on-chip debugger. See section On-Chip Debugger (OCD) for more information. |
CPU_EXTENSION_RISCV_Sdext
CPU_EXTENSION_RISCV_Sdext |
boolean |
no default value |
Implement RISC-V-compatible "debug" CPU operation mode required for the on-chip debugger. See section CPU Debug Mode for more information. |
CPU_EXTENSION_RISCV_Sdtrig
CPU_EXTENSION_RISCV_Sdtrig |
boolean |
no default value |
Implement RISC-V-compatible trigger module. See section CPU Debug Mode for more information. |
3.7. Instruction Sets and Extensions
The basic NEORV32 is a RISC-V rv32i
architecture that provides several optional RISC-V CPU and ISA
(instruction set architecture) extensions. For more information regarding the RISC-V ISA extensions please
see the the RISC-V Instruction Set Manual - Volume I: Unprivileged ISA and The RISC-V Instruction Set Manual
Volume II: Privileged Architecture, which are available in the projects docs/references
folder.
Discovering ISA Extensions
The CPU can discover available ISA extensions via the misa & mxisa CSRs
or by executing an instruction and checking for an illegal instruction exception
(→ Full Virtualization).Executing an instruction from an extension that is not supported yet or that is currently not enabled (via the according top entity generic) will raise an illegal instruction exception. |
3.7.1. B
- Bit-Manipulation Operations
The B
ISA extension adds instructions for bit-manipulation operations. This extension is enabled if the
CPU_EXTENSION_RISCV_B configuration generic is true.
The official RISC-V specifications can be found here: https://github.com/riscv/riscv-bitmanip
The NEORV32 B
ISA extension includes the following sub-extensions (according to the RISC-V
bit-manipulation spec. v.093) and their corresponding instructions:
-
Zba
- Address-generation instructions-
sh1add
sh2add
sh3add
-
-
Zbb
- Basic bit-manipulation instructions-
andn
orn
xnor
-
clz
ctz
cpop
-
max
maxu
min
minu
-
sext.b
sext.h
zext.h
-
rol
ror
rori
-
orc.b
rev8
-
-
Zbc
- Carry-less multiplication instructions-
clmul
clmulh
clmulr
-
-
Zbs
- Single-bit instructions-
bclr
bclri
-
bext
bexti
-
bext
binvi
-
bset
bseti
-
By default, the bit-manipulation unit uses an iterative approach to compute shift-related operations
like clz and rol . To increase performance (at the cost of additional hardware resources) the
FAST_SHIFT_EN generic can be enabled to implement full-parallel logic (like barrel shifters) for all
shift-related B instructions.
|
3.7.2. C
- Compressed Instructions
The compressed ISA extension provides 16-bit encodings of commonly used instructions to reduce code space size.
The C
extension is available when the CPU_EXTENSION_RISCV_C configuration generic is true.
In this case the following instructions are available:
-
c.addi4spn
c.lw
c.sw
c.nop
c.addi
c.jal
c.li
c.addi16sp
c.lui
c.srli
c.srai
c.andi
c.sub
c.xor
c.or
c.and
c.j
c.beqz
c.bnez
c.slli
c.lwsp
c.jr
c.mv
c.ebreak
c.jalr
c.add
c.swsp
When the compressed instructions extension is enabled, branches to an unaligned and uncompressed instruction require
an additional instruction fetch to load the according second half-word of that instruction. The performance can be increased
again by forcing a 32-bit alignment of branch target addresses. By default, this is enforced via the GCC -falign-functions=4 ,
-falign-labels=4 , -falign-loops=4 and -falign-jumps=4 compile flags (via the makefile).
|
3.7.3. E
- Embedded CPU
The embedded CPU extensions reduces the size of the general purpose register file from 32 entries to 16 entries to
decrease physical hardware requirements (for example block RAM). This extensions is enabled when the CPU_EXTENSION_RISCV_E
configuration generic is true. Accesses to registers beyond x15
will raise and illegal instruction exception.
This extension does not add any additional instructions or features.
Due to the reduced register file size an alternate toolchain ABI (ilp32e ) is required.
|
3.7.4. I
- Base Integer ISA
The CPU always supports the complete rv32i
base integer instruction set. This base set is always enabled
regardless of the setting of the remaining exceptions. The base instruction set includes the following
instructions:
-
immediate:
lui
auipc
-
jumps:
jal
jalr
-
branches:
beq
bne
blt
bge
bltu
bgeu
-
memory:
lb
lh
lw
lbu
lhu
sb
sh
sw
-
alu:
addi
slti
sltiu
xori
ori
andi
slli
srli
srai
add
sub
sll
slt
sltu
xor
srl
sra
or
and
-
environment:
ecall
ebreak
fence
In order to keep the hardware footprint low, the CPU’s shift unit uses a bit-serial approach. Hence, shift operations
take up to 32 cycles (plus overhead) depending on the actual shift amount. Alternatively, the shift operations can be processed
completely in parallel by a fast (but large) barrel shifter if the FAST_SHIFT_EN generic is true. In that case, shift operations
complete within 2 cycles (plus overhead) regardless of the actual shift amount.
|
Internally, the fence instruction does not perform any operation inside the CPU. It only sets the
top’s d_bus_fence_o signal high for one cycle to inform the memory system a fence instruction has been
executed. Any flags within the fence instruction word are ignore by the hardware.
|
3.7.5. M
- Integer Multiplication and Division
Hardware-accelerated integer multiplication and division operations are available when the CPU_EXTENSION_RISCV_M configuration generic is true. In this case the following instructions are available:
-
multiplication:
mul
mulh
mulhsu
mulhu
-
division:
div
divu
rem
remu
By default, multiplication and division operations are executed in a bit-serial approach. Alternatively, the multiplier core can be implemented using DSP blocks if the FAST_MUL_EN generic is true allowing faster execution. Multiplications and divisions always require a fixed amount of cycles to complete - regardless of the input operands. |
Regardless of the setting of the FAST_MUL_EN generic multiplication and division instructions operate independently of the input operands. Hence, there is no early completion of multiply by one/zero and divide by zero operations. |
3.7.6. Zmmul
- Integer Multiplication
This is a sub-extension of the M
ISA extension. It implements the multiplication-only operations
of the M
extensions and is intended for size-constrained setups that require hardware-based
integer multiplications but not hardware-based divisions, which will be computed entirely in software.
This extension requires only ~50% of the hardware utilization of the "full" M
extension.
It is implemented if the CPU_EXTENSION_RISCV_Zmmul configuration generic is true.
-
multiplication:
mul
mulh
mulhsu
mulhu
If Zmmul
is enabled, executing any division instruction from the M
ISA extension (div
, divu
, rem
, remu
)
will raise an illegal instruction exception.
Note that M
and Zmmul
extensions cannot be enabled at the same time.
If your RISC-V GCC toolchain does not (yet) support the _Zmmul ISA extensions, it can be "emulated"
using a rv32im machine architecture and setting the -mno-div compiler flag
(example $ make MARCH=rv32im USER_FLAGS+=-mno-div clean_all exe ).
|
3.7.7. U
- Less-Privileged User Mode
In addition to the basic (and highest-privileged) machine-mode, the user-mode ISA extensions adds a second less-privileged operation mode. It is implemented if the CPU_EXTENSION_RISCV_U configuration generic is true. Code executed in user-mode cannot access machine-mode CSRs. Furthermore, user-mode access to the address space (like peripheral/IO devices) can be constrained via the physical memory protection (PMP). Any kind of privilege rights violation will raise an exception to allow Full Virtualization.
Additional CSRs:
-
mcounteren
- machine counter enable to constrain user-mode access to timer/counter CSRs
3.7.8. X
- NEORV32-Specific (Custom) Extensions
The NEORV32-specific extensions are always enabled and are indicated by the set X
bit in the misa
CSR.
The most important points of the NEORV32-specific extensions are:
* The CPU provides 16 fast interrupt interrupts (FIRQ
), which are controlled via custom bits in the mie
and mip
CSRs. These extensions are mapped to CSR bits, that are available for custom use according to the
RISC-V specs. Also, custom trap codes for mcause
are implemented.
* All undefined/unimplemented/malformed/illegal instructions do raise an illegal instruction exception (see Full Virtualization).
* There are NEORV32-Specific CSRs.
3.7.9. Zfinx
Single-Precision Floating-Point Operations
The Zfinx
floating-point extension is an alternative of the standard F
floating-point ISA extension.
The Zfinx
extensions also uses the integer register file x
to store and operate on floating-point data
instead of a dedicated floating-point register file (hence, F-in-x
). Thus, the Zfinx
extension requires
less hardware resources and features faster context changes. This also implies that there are NO dedicated f
register file-related load/store or move instructions.
The official RISC-V specifications can be found here: https://github.com/riscv/riscv-zfinx
The NEORV32 floating-point unit used by the Zfinx extension is compatible to the IEEE-754 specifications.
|
The Zfinx
extensions only supports single-precision (.s
instruction suffix), so it is a direct alternative
to the F
extension. The Zfinx
extension is implemented when the CPU_EXTENSION_RISCV_Zfinx configuration
generic is true. In this case the following instructions and CSRs are available:
-
conversion:
fcvt.s.w
fcvt.s.wu
fcvt.w.s
fcvt.wu.s
-
comparison:
fmin.s
fmax.s
feq.s
flt.s
fle.s
-
computational:
fadd.s
fsub.s
fmul.s
-
sign-injection:
fsgnj.s
fsgnjn.s
fsgnjx.s
-
number classification:
fclass.s
-
compressed instructions:
c.flw
c.flwsp
c.fsw
c.fswsp
Additional CSRs:
Fused multiply-add instructions f[n]m[add/sub].s are not supported!
Division fdiv.s and square root fsqrt.s instructions are not supported yet!
|
Subnormal numbers ("de-normalized" numbers) are not supported by the NEORV32 FPU.
Subnormal numbers (exponent = 0) are flushed to zero setting them to +/- 0 before entering the
FPU’s processing core. If a computational instruction (like fmul.s ) generates a subnormal result, the
result is also flushed to zero during normalization.
|
The Zfinx extension is not yet officially ratified, but is expected to stay unchanged. There is no
software support for the Zfinx extension in the upstream GCC RISC-V port yet. However, an
intrinsic library is provided to utilize the provided Zfinx floating-point extension from C-language
code (see sw/example/floating_point_test ).
|
3.7.10. Zicsr
Control and Status Register Access / Privileged Architecture
The CSR access instructions as well as the exception and interrupt system (= the privileged architecture) is implemented when the CPU_EXTENSION_RISCV_Zicsr configuration generic is true.
If the Zicsr extension is disabled the CPU does not provide any privileged architecture features at all!
In order to provide the full set of privileged functions that are required to run more complex tasks like
operating system and to allow a secure execution environment the Zicsr extension should be always enabled.
|
In this case the following instructions are available:
-
CSR access:
csrrw
csrrs
csrrc
csrrwi
csrrsi
csrrci
-
environment:
mret
wfi
If rd=x0 for the csrrw[i] instructions there will be no actual read access to the according CSR.
However, access privileges are still enforced so these instruction variants do cause side-effects
(the RISC-V spec. state that these combinations "shall not cause any side-effects").
|
wfi Instructionwfi instruction is used to enter Sleep Mode. Executing the wfi instruction in user-mode
will raise an illegal instruction exception if mstatus `.TW` is set.
|
3.7.11. Zicntr
CPU Base Counters
The Zicntr
ISA extension adds the basic cycle [m]cycle[h]
) and instruction-retired ([m]instret[h]
) counters.
This extensions is stated as mandatory by the RISC-V spec. However, area-constrained setups may remove support for
these counters. Section (Machine) Counter and Timer CSRs shows a list of all Zicntr
-related CSRs.
These are available if the Zicntr
ISA extensions is enabled via the CPU_EXTENSION_RISCV_Zicntr generic.
Additional CSRs:
-
instret[h]
,minstret[h]
- instructions-retired counter
The Zicntr ISA extension does not include the time[h] CSRs.
|
If the Zicntr
ISA extension is disabled, all accesses to the according counter CSRs will raise an illegal instruction exception.
3.7.12. Zihpm
Hardware Performance Monitors
In additions to the base cycle, instructions-retired and time counters the NEORV32 CPU provides up to 29 hardware performance monitors (HPM 3..31), which can be used to benchmark applications. Each HPM consists of an N-bit wide counter (split in a high-word 32-bit CSR and a low-word 32-bit CSR), where N is defined via the top’s HPM_CNT_WIDTH generic (0..64-bit) and a corresponding event configuration CSR. The event configuration CSR defines the architectural events that lead to an increment of the associated HPM counter. See the HPM_NUM_CNTS documentation for a list of available trigger events.
The HPM counters are available if the Zihpm
ISA extensions is enabled via the CPU_EXTENSION_RISCV_Zihpm generic.
The actual number of implemented HPM counters is defined by the HPM_NUM_CNTS generic.
Additional CSRs:
-
mhpmevent
3..31 (depending on HPM_NUM_CNTS) - event configuration CSRs -
mhpmcounter[h]
3..31 (depending on HPM_NUM_CNTS) - machine-level counter CSRs -
hpmcounter[h]
3..31 (depending on HPM_NUM_CNTS) - user-level counter CSRs
Auto-increment of the HPMs can be deactivated individually via the mcountinhibit CSR.
|
3.7.13. Zifencei
Instruction Stream Synchronization
The Zifencei
CPU extension is implemented if the CPU_EXTENSION_RISCV_Zifencei configuration
generic is true. It allows manual synchronization of the instruction stream via the following instruction:
-
fence.i
The fence.i
instruction resets the CPU’s front-end (instruction fetch) and flushes the prefetch buffer.
This allows a clean re-fetch of modified instructions from memory. Also, the top’s i_bus_fencei_o
signal is set
high for one cycle to inform the memory system (like the i-cache to perform a flush/reload.
Any additional flags within the fence.i
instruction word are ignore by the hardware.
3.7.14. Zxcfu
Custom Instructions Extension (CFU)
The Zxcfu
presents a NEORV32-specific extension to the RISC-V ISA (Z
= sub-extension, x
= platform-specific
custom extension, cfu
= name of the custom extension). When enabled via the CPU_EXTENSION_RISCV_Zxcfu configuration
generic, this ISA extensions adds the Custom Functions Unit (CFU) to the CPU core. The CFU is a module that
allows to add custom RISC-V instructions to the processor core.
The CPU is implemented as additional ALU co-processor and is integrated right into the CPU’s pipeline providing minimal
data transfer latency as it has direct access to the core’s register file. The CFU utilizes the RISC-V custom
opcodes
that have been explicitly reserved by the RISC-V spec for custom extensions.
Software can utilize the custom instructions by using intrinsic, which are basically inline assembly functions that behave like regular C functions but that evaluate to a single custom instruction word (not calling overhead at all).
For more detailed information regarding the CFU, it’s hardware and the according software interface see section Custom Functions Unit (CFU). |
The CFU module / Zxcfu ISA extension is intended for user-defined instructions.
If you like to add more complex accelerators or interfaces that can also operate independently of
the CPU take a look at the memory-mapped Custom Functions Subsystem (CFS).
|
3.7.15. PMP
Physical Memory Protection
The NEORV32 physical memory protection (PMP) provides an elementary memory protection mechanism that can be used to constrain read, write and execute rights of arbitrary memory regions. The NEORV32 PMP is partly compatible to the RISC-V Privileged Architecture Specifications.
In general, the PMP can grant permissions to U mode, which by default have none, and can revoke permissions from M-mode, which by default has full permissions.
The NEORV32 PMP only supports TOR (top of region) mode, which basically is a "base-and-bound" concept, and only up to 16 PMP regions. |
The physical memory protection logic is implemented if the PMP_NUM_REGIONS configuration generic is greater than zero. This generic also defines the total number of implemented configurable region registers. The minimal granularity of a protected region is defined by the PMP_MIN_GRANULARITY generic. Larger granularity will reduce hardware complexity but will also decrease the resolution. The default value is 4 bytes, which allows a minimal region size of 4 bytes.
If implemented the PMP provides the following additional CSRs:
PMP Example Program
A simple PMP example program can be found in sw/example/demo_pmp .
|
Hardware Optimization
Reducing the minimal PMP region size / granularity via the PMP_MIN_GRANULARITY top entity generic
will reduce hardware utilization and also reduces impact on critical path.
|
PMP Rules when in Debug Mode
When in debug-mode all PMP rules are ignored making the debugger have maximum access rights.
|
3.8. `Sdext External Debug Support
This ISA extension enables the RISC-V-compatible "external debug support" by implementing the CPU "debug mode", which is required for the on-chip debugger. See section On-Chip Debugger (OCD) / CPU Debug Mode for more information.
3.9. Sdtrig
Trigger Module
This ISA extension implements the RISC-V-compatible trigger module. See section On-Chip Debugger (OCD) / Trigger Module for more information.
3.10. Custom Functions Unit (CFU)
The Custom Functions Unit is the central part of the Zxcfu
Custom Instructions Extension (CFU) and represents
the actual hardware module, which is used to implement custom RISC-V instructions. The concept of the NEORV32
CFU has been highly inspired by Google’s CFU-Playground.
The CFU is intended for operations that are inefficient in terms of performance, latency, energy consumption or program memory requirements when implemented entirely in software. Some potential application fields and exemplary use-cases might include:
-
AI: sub-word / vector / SIMD operations like processing all four bytes of a 32-bit data word in parallel
-
Cryptographic: bit substitution and permutation
-
Communication: conversions like binary to gray-code; multiply-add operations
-
Image processing: look-up-tables for color space transformations
-
implementing instructions from other RISC-V ISA extensions that are not yet supported by the NEORV32
The CFU is not intended for complex and CPU-independent functional units that implement complete accelerators (like block-based AES encryption). These kind of accelerators should be implemented as memory-mapped Custom Functions Subsystem (CFS). A comparison of all NEORV32-specific chip-internal hardware extension options is provided in the user guide section Adding Custom Hardware Modules. |
3.10.1. CFU Instruction Formats
The custom instructions executed by the CFU utilize a specific opcode space in the rv32
32-bit instruction
space that has been explicitly reserved for user-defined extensions by the RISC-V specifications ("Guaranteed Non-Standard
Encoding Space"). The NEORV32 CFU uses the custom-x
opcodes to identify the instructions implemented
by the CFU and to differentiate between the different instruction formats.
The according binary encoding of these opcodes is shown below:
-
custom-0
:0001011
(R3-type instructions, RISC-V standard) -
custom-1
:0101011
(R4-type instructions, RISC-V standard) -
custom-2
:1011011
(R5-type instruction A, NEORV32-specific) -
custom-3
:1111011
(R5-type instruction B, NEORV32-specific)
CFU Instructions - Exceptions
The CPU control logic only analyzes the opcode of the custom instructions to check if the entire
instruction word is valid. All remaining bit-fields are not checked at all.
This also means that the MSBs of the register fields are not checked even if the E ISA extension
is enabled (for standard RISC-V instructions this would cause an exception).
Hence, a custom CFU instruction can never raise an illegal instruction exception. If the CFU is not
implemented at all (Zxcfu ISA extension is not enabled) any instruction with custom-x opcode
will raise an illegal instruction exception.
|
3.10.2. CFU R3-Type Instructions
The R3-type CFU instructions operate on two source registers and return the processing result to the destination register.
The actual operation can be defined by using the funct7
and funct3
bit fields. These immediates can also be used to
pass additional data to the CFU like offsets, look-up-tables addresses or shift-amounts. However, the actual
functionality is entirely user-defined.
Example operation: rd ⇐ rs1 xnor rs2

-
funct7
: 7-bit immediate (further operand data or function select) -
rs2
: address of second source register (32-bit source data) -
rs1
: address of first source register (32-bit source data) -
funct3
: 3-bit immediate (further operand data or function select) -
rd
: address of destination register (for the 32-bit processing result) -
opcode
:0001011
(RISC-V "custom-0" opcode)
RISC-V compatibility
The CFU R3-type instruction format is compliant to the RISC-V ISA specification.
|
Instruction encoding space
By using the funct7 and funct3 bit fields entirely for selecting the actual operation a total of 1024 custom R3-type
instructions can be implemented (7-bit + 3-bit = 10 bit → 1024 different values).
|
3.10.3. CFU R4-Type Instructions
The R4-type CFU instructions operate on three source registers and return the processing result to the destination register.
The actual operation can be defined by using the funct3
bit field. Alternatively, this immediate can also be used to
pass additional data to the CFU like offsets, look-up-tables addresses or shift-amounts. However, the actual
functionality is entirely user-defined.
Example operation: rd ⇐ (rs1 * rs2 + rs3)[31:0]

-
rs3
: address of third source register (32-bit source data) -
rs2
: address of second source register (32-bit source data) -
rs1
: address of first source register (32-bit source data) -
funct3
: 3-bit immediate (further operand data or function select) -
rd
: address of destination register (for the 32-bit processing result) -
opcode
:0101011
(RISC-V "custom-1" opcode)
RISC-V compatibility
The CFU R4-type instruction format is compliant to the RISC-V ISA specification.
|
Unused instruction bits
The RISC-V ISA specification defines bits [26:25] of the R4-type instruction word to be all-zero. These bits are ignored
by the hardware (CFU and illegal instruction check logic) and should be set to all-zero to preserve compatibility with
future implementations.
|
Instruction encoding space
By using the funct3 bit field entirely for selecting the actual operation a total of 8 custom R4-type instructions
can be implemented (3-bit → 8 different values).
|
3.10.4. CFU R5-Type Instructions
The R5-type CFU instructions operate on three source registers and return the processing result to the destination register. As all bits of the instruction word are used to encode the five registers and the opcode, no further immediate bits are available to specify the actual operation. There are two different R5-type instruction with two different opcodes available. Hence, only two R5-type operations can be implemented out of the box.
Example operation: rd ⇐ rs1 & rs2 & rs3 & rs4


-
rs4.hi
&rs4.lo
: address of fourth source register (32-bit source data) -
rs3
: address of third source register (32-bit source data) -
rs2
: address of second source register (32-bit source data) -
rs1
: address of first source register (32-bit source data) -
rd
: address of destination register (for the 32-bit processing result) -
opcode
:1011011
(RISC-V "custom-2" opcode) and/or1111011
(RISC-V "custom-3" opcode)
RS4 bit field
The rs4 bit-field is split into two instruction word fields rs4.hi and rs4.lo . This allows a simple
decoding logic as the location of the remaining register fields is identical to other R-type instructions.
|
RISC-V compatibility
The RISC-V ISA specifications does not specify a R5-type instruction format. Hence, this instruction
layout is NEORV32-specific.
|
Instruction encoding space
There are no immediate fields in the CFU R5-type instruction so the actual operation is specified entirely
by the opcode resulting in just two different operations out of the box. However, another CFU instruction
(like a R3-type instruction) can be used to "program" the actual operation of a R5-type instruction by
writing operation information to a CFU-internal "command" register.
|
3.10.5. Using Custom Instructions in Software
The custom instructions provided by the CFU can be used in plain C code by using intrinsics. Intrinsics behave like "normal" functions but under the hood they are a set of macros that hide the complexity of inline assembly. Using intrinsics removes the need to modify the compiler, built-in libraries or the assembler when including custom instructions. Each intrinsic will result in a single 32-bit instruction word providing maximum code efficiency.
The NEORV32 software framework provides four pre-defined prototypes for custom instructions, which are defined in
sw/lib/include/neorv32_cpu_cfu.h
:
neorv32_cfu_r3_instr(funct7, funct3, rs1, rs2) // R3-type instructions
neorv32_cfu_r4_instr(funct3, rs1, rs2, rs3) // R4-type instructions
neorv32_cfu_r5_instr_a(rs1, rs2, rs3, rs4) // R5-type instruction A
neorv32_cfu_r5_instr_b(rs1, rs2, rs3, rs4) // R5-type instruction B
The intrinsic functions always return a 32-bit value of type uint32_t
(the processing result), which can be discarded
when not needed. Each intrinsic function requires several arguments depending on the instruction type/format:
-
funct7
- 7-bit immediate (R3-type only) -
funct3
- 3-bit immediate (R3-type, R4-type) -
rs1
- source operand 1, 32-bit (R3-type, R4-type) -
rs2
- source operand 2, 32-bit (R3-type, R4-type) -
rs3
- source operand 2, 32-bit (R3-type, R4-type, R5-type) -
rs4
- source operand 2, 32-bit (R4-type, R4-type, R5-type)
The funct3
and funct7
bit-fields are used to pass 3-bit or 7-bit literals to the CFU. The rs1
, rs2
and rs3
arguments pass the actual data to the CFU. These register arguments can be populated with variables or literals.
The following example shows how to pass arguments when executing both CFU instruction types:
uint32_t tmp = some_function();
...
uint32_t res = neorv32_cfu_r3_instr(0b0000000, 0b101, tmp, 123);
uint32_t foo = neorv32_cfu_r4_instr(0b011, tmp, res, some_array[i]);
uint32_t bar = neorv32_cfu_r5_instr_a(tmp, res, foo, tmp);
CFU Example Program
There is an example program for the CFU, which shows how to use the default CFU hardware module.
This example program is located in sw/example/demo_cfu .
|
3.10.6. Custom Instructions Hardware
The actual functionality of the CFU’s custom instructions is defined by the user-defined logic inside
the CFU hardware module rtl/core/neorv32_cpu_cp_cfu.vhd
.
CFU Hardware Example & More Details
The default CFU hardware module already implement some exemplary instructions that are used for illustration
by the CFU example program. See the CFU’s VHDL source file (rtl/core/neorv32_cpu_cp_cfu.vhd ), which
is highly commented to explain the available signals and the handshake with the CPU pipeline.
|
CFU hardware resource requirements
Enabling the CFU and actually implementing R4-type and/or R5-type instructions (or more precisely, using
the according operands for the CFU hardware) will add one or two additional read ports to the core’s
register file increasing resource requirements.
|
CFU operations can be entirely combinatorial (like bit-reversal) so the result is available at the end of the current clock cycle. Operations can also take several clock cycles to complete (like multiplications) and may also include internal states and memories. The CFU’s internal controller unit takes care of interfacing the custom user logic to the CPU’s pipeline.
CFU Execution Time
The CFU is not required to finish processing within a bound time. However, you should keep in mind that the
CPU is stalled until the CFU has finished processing. This also means the CPU cannot react to pending
interrupts during this time affecting real-time behavior (interrupt requests will still be queued).
|
3.11. Instruction Timing
The instruction timing listed in the table below shows the required clock cycles for executing a certain instruction. These instruction cycles assume a bus access without additional wait states (memory Latency = 1) and a filled pipeline.
Average CPI (cycles per instructions) values for "real applications" like for executing the CoreMark benchmark for different CPU configurations are presented in CPU Performance.
Class | ISA | Instruction(s) | Execution cycles |
---|---|---|---|
ALU |
|
|
2 |
ALU |
|
|
2 |
ALU |
|
|
3 + shift_amount; FAST_SHIFT: 4 |
ALU |
|
|
3 + shift_amount; FAST_SHIFT: 4 |
Branches |
|
|
Taken: 6; not taken: 3 |
Branches |
|
|
Taken: 6; not taken: 3 |
Jumps / Calls |
|
|
6 |
Jumps / Calls |
|
|
6 |
Memory access |
|
|
4 |
Memory access |
|
|
4 |
Memory access |
|
|
4 |
MulDiv |
|
|
36; FAST_MUL: 4 |
MulDiv |
|
|
36 |
System |
|
|
3 |
System |
|
|
3 |
System |
|
|
3 |
System |
|
|
3 |
System |
|
|
5 |
Fence |
|
|
5 |
Fence |
|
|
5 |
Floating-point - artihmetic |
|
|
110 |
Floating-point - artihmetic |
|
|
112 |
Floating-point - artihmetic |
|
|
22 |
Floating-point - compare |
|
|
13 |
Floating-point - misc |
|
|
12 |
Floating-point - conversion |
|
|
47 |
Floating-point - conversion |
|
|
48 |
Bit-manipulation - arithmetic/logic |
|
|
4 |
Bit-manipulation - shifts |
|
|
4 + 1..32; FAST_SHIFT: 4 |
Bit-manipulation - shifts |
|
|
36; FAST_SHIFT: 4 |
Bit-manipulation - shifts |
|
|
4 + shift_amount; FAST_SHIFT: 4 |
Bit-manipulation - shifted-add |
|
|
4 |
Bit-manipulation - single-bit |
|
|
4 |
Bit-manipulation - carry-less multiply |
|
|
36 |
Custom instructions (CFU) |
|
- |
custom (min. 4) |
Illegal instructions |
|
- |
2 |
The presented values of the floating-point execution cycles are average values - obtained from 4096 instruction executions using pseudo-random input values. The execution time for emulating the instructions (using pure-software libraries) is ~17..140 times higher. |
3.12. Control and Status Registers (CSRs)
The following table shows a summary of all available NEORV32 CSRs. The address field defines the CSR address for the CSR access instructions. The [ASM] name can be used for (inline) assembly code and is directly understood by the assembler/compiler. The [C] names are defined by the NEORV32 core library and can be used as immediate in plain C code. The R/W column shows whether the CSR can be read and/or written.
CSRs that are not Implemented
All CSR bits that are unused / not implemented / not shown are hardwired to zero. All CSRs that are not
implemented, not supported or disabled will raise an illegal instruction exception when being accessed.
|
WARL Behavior
All writable CSRs provide WARL behavior (write all values; read only legal values). Application software
should always read back a CSR after writing to check if the targeted bits can actually be modified (or are
just read-only).
|
Address | Name [ASM] | Name [C] | R/W | Function |
---|---|---|---|---|
0x001 |
CSR_FFLAGS |
r/w |
Floating-point accrued exceptions |
|
0x002 |
CSR_FRM |
r/w |
Floating-point dynamic rounding mode |
|
0x003 |
CSR_FCSR |
r/w |
Floating-point control and status ( |
|
0x30A |
CSR_MENVCFG |
r/- |
Machine environment configuration register - low word |
|
0x31A |
CSR_MENVCFGH |
r/- |
Machine environment configuration register - low word |
|
0x300 |
CSR_MSTATUS |
r/w |
Machine status register - low word |
|
0x301 |
CSR_MISA |
r/- |
Machine CPU ISA and extensions |
|
0x304 |
CSR_MIE |
r/w |
Machine interrupt enable register |
|
0x305 |
CSR_MTVEC |
r/w |
Machine trap-handler base address for ALL traps |
|
0x306 |
CSR_MCOUNTEREN |
r/- |
Machine counter-enable register |
|
0x310 |
CSR_MSTATUSH |
r/- |
Machine status register - high word |
|
0x340 |
CSR_MSCRATCH |
r/w |
Machine scratch register |
|
0x341 |
CSR_MEPC |
r/w |
Machine exception program counter |
|
0x342 |
CSR_MCAUSE |
r/w |
Machine trap cause |
|
0x343 |
CSR_MTVAL |
r/w |
Machine bad address or instruction |
|
0x344 |
CSR_MIP |
r/w |
Machine interrupt pending register |
|
0x3A0 .. 0x3A3 |
CSR_PMPCFG0 .. CSR_PMPCFG3 |
r/w |
Physical memory protection configuration for region 0..15 |
|
0x3B0 .. 0x3BF |
CSR_PMPADDR0 .. CSR_PMPADDR15 |
r/w |
Physical memory protection address register region 0..15 |
|
0x7A0 |
CSR_TSELECT |
r/w |
Trigger select register |
|
0x7A1 |
CSR_TDATA1 |
r/w |
Trigger data register 1 |
|
0x7A2 |
CSR_TDATA2 |
r/w |
Trigger data register 2 |
|
0x7A3 |
CSR_TDATA3 |
r/w |
Trigger data register 3 |
|
0x7A4 |
CSR_TINFO |
r/w |
Trigger information register |
|
0x7A5 |
CSR_TCONTROL |
r/w |
Trigger control register |
|
0x7A8 |
CSR_MCONTEXT |
r/w |
Machine context register |
|
0x7AA |
CSR_SCONTEXT |
r/w |
Supervisor context register |
|
0x7B0 |
- |
r/w |
Debug control and status register |
|
0x7B1 |
- |
r/w |
Debug program counter |
|
0x7B2 |
- |
r/w |
Debug scratch register 0 |
|
0xB00 |
CSR_MCYCLE |
r/w |
Machine cycle counter low word |
|
0xB02 |
CSR_MINSTRET |
r/w |
Machine instruction-retired counter low word |
|
0xB80 |
CSR_MCYCLEH |
r/w |
Machine cycle counter high word |
|
0xB82 |
CSR_MINSTRETH |
r/w |
Machine instruction-retired counter high word |
|
0xC00 |
CSR_CYCLE |
r/- |
Cycle counter low word |
|
0xC02 |
CSR_INSTRET |
r/- |
Instruction-retired counter low word |
|
0xC80 |
CSR_CYCLEH |
r/- |
Cycle counter high word |
|
0xC82 |
CSR_INSTRETH |
r/- |
Instruction-retired counter high word |
|
0x323 .. 0x33F |
CSR_MHPMEVENT3 .. CSR_MHPMEVENT31 |
r/w |
Machine performance-monitoring event select for counter 3..31 |
|
0xB03 .. 0xB1F |
CSR_MHPMCOUNTER3 .. CSR_MHPMCOUNTER3H |
r/w |
Machine performance-monitoring counter 3..31 low word |
|
0xB83 .. 0xB9F |
CSR_MHPMCOUNTER3H .. CSR_MHPMCOUNTER31H |
r/w |
Machine performance-monitoring counter 3..31 high word |
|
0xC03 .. 0xC1F |
CSR_HPMCOUNTER3 .. CSR_HPMCOUNTER3H |
r/- |
User performance-monitoring counter 3..31 low word |
|
0xC83 .. 0xC9F |
CSR_HPMCOUNTER3H .. CSR_HPMCOUNTER31H |
r/- |
User performance-monitoring counter 3..31 high word |
|
0x320 |
CSR_MCOUNTINHIBIT |
r/w |
Machine counter-enable register |
|
0xF11 |
CSR_MVENDORID |
r/- |
Machine vendor ID |
|
0xF12 |
CSR_MARCHID |
r/- |
Machine architecture ID |
|
0xF13 |
CSR_MIMPID |
r/- |
Machine implementation ID / version |
|
0xF14 |
CSR_MHARTID |
r/- |
Machine thread ID |
|
0xF15 |
CSR_MCONFIGPTR |
r/- |
Machine configuration pointer register |
|
0xFC0 |
CSR_MXISA |
r/- |
NEORV32-specific "extended" machine CPU ISA and extensions |
The following CSR sections provide a "headline" for each CSRs. It shows the 12-bit CSR address, the register’s ISA/assembly name, a short description, the reset value and all ISA extension(s) that are required for implementing the according CSR. |
3.12.1. Floating-Point CSRs
fflags
0x001 |
|
|
Reset value: |
The fflags
CSR gives access to the FPU status flags.
Bit | R/W | Function |
---|---|---|
31:5 |
r/- |
reserved, writes are ignored; reads always return 0 |
4 |
r/w |
NV: invalid operation |
3 |
r/w |
DZ: division by zero |
2 |
r/w |
OF: overflow |
1 |
r/w |
UF: underflow |
0 |
r/w |
NX: inexact |
frm
0x002 |
|
|
Reset value: |
The frm
CSR is used to configure the rounding mode of the FPU.
Bit | R/W | Function |
---|---|---|
31:3 |
r/- |
reserved, writes are ignored; reads always return 0 |
2:0 |
r/w |
Rounding mode |
3.12.2. Machine Configuration CSRs
menvcfg
0x30a |
|
|
Reset value: |
The features of this CSR are not implemented yet. The register is read-only and always returns zero. |
menvcfgh
0x31a |
|
|
Reset value: |
The features of this CSR are not implemented yet. The register is read-only and always returns zero. |
3.12.3. Machine Trap Setup CSRs
mstatus
0x300 |
|
|
Reset value: |
The mstatus
is used to configure general machine environment parameters.
Bit | Name [C] | R/W | Function |
---|---|---|---|
21 |
CSR_MSTATUS_TW |
r/w |
TW: Trap on execution of |
17 |
CSR_MSTATUS_MPRV |
r/w |
MPRV: Effective privilege level for load/stores in machine mode; use `MPP’s as effective privilege level when set; hardwired to zero if user-mode not implemented |
12:11 |
CSR_MSTATUS_MPP_H : CSR_MSTATUS_MPP_L |
r/w |
MPP: Previous machine privilege level, 11 = machine (M) level, 00 = user (U) level |
7 |
CSR_MSTATUS_MPIE |
r/w |
MPIE: Previous machine global interrupt enable flag state |
3 |
CSR_MSTATUS_MIE |
r/w |
MIE: Machine global interrupt enable flag |
If the core is in user-mode, machine-mode interrupts are globally enabled even if mstatus.mie is cleared:
"Interrupts for higher-privilege modes, y>x, are always globally enabled regardless of the setting of the global yIE
bit for the higher-privilege mode." - RISC-V ISA Spec.
|
misa
0x301 |
|
|
Reset value: |
The misa
CSR provides information regarding the availability of baic RISC-V ISa extensions.
The NEORV32 misa CSR is read-only. Hence, active CPU extensions are entirely defined by pre-synthesis configurations
and cannot be switch on/off during runtime. For compatibility reasons any write access to this CSR is simply ignored and
will not cause an illegal instruction exception.
|
Bit | Name [C] | R/W | Function |
---|---|---|---|
31:30 |
CSR_MISA_MXL_HI_EXT : CSR_MISA_MXL_LO_EXT |
r/- |
MXL: 32-bit architecture indicator (always 01) |
23 |
CSR_MISA_X_EXT |
r/- |
X: extension bit is always set to indicate custom non-standard extensions |
20 |
CSR_MISA_U_EXT |
r/- |
U: CPU extension (user mode) available, set when CPU_EXTENSION_RISCV_U enabled |
12 |
CSR_MISA_M_EXT |
r/- |
M: CPU extension (mul/div) available, set when CPU_EXTENSION_RISCV_M enabled |
8 |
CSR_MISA_I_EXT |
r/- |
I: CPU base ISA, cleared when CPU_EXTENSION_RISCV_E enabled |
4 |
CSR_MISA_E_EXT |
r/- |
E: CPU extension (embedded) available, set when CPU_EXTENSION_RISCV_E enabled |
2 |
CSR_MISA_C_EXT |
r/- |
C: CPU extension (compressed instruction) available, set when CPU_EXTENSION_RISCV_C enabled |
Machine-mode software can discover available Z* sub-extensions (like Zicsr or Zfinx ) by checking the NEORV32-specific
mxisa CSR.
|
mie
0x304 |
|
|
Reset value: |
The mie
CSR is used to enable/disable individual interrupt sources.
Bit | Name [C] | R/W | Function |
---|---|---|---|
31:16 |
CSR_MIE_FIRQ15E : CSR_MIE_FIRQ0E |
r/w |
Fast interrupt channel 15..0 enable |
11 |
CSR_MIE_MEIE |
r/w |
MEIE: Machine external interrupt enable |
7 |
CSR_MIE_MTIE |
r/w |
MTIE: Machine timer interrupt enable (from Machine System Timer (MTIME)) |
3 |
CSR_MIE_MSIE |
r/w |
MSIE: Machine software interrupt enable |
Clearing a bit in mie will also clear the according mip bit (if the according interrupt channel was pending).
|
mtvec
0x305 |
|
|
Reset value: |
The mtvec
CSR contain the address of the primary trap handler, which gets executed whenever an
interrupt is triggered or an exception is raised.
Bit | R/W | Function |
---|---|---|
31:2 |
r/w |
BASE: 4-byte aligned base address of trap base handler |
1:0 |
r/- |
MODE: always zero; BASE defines entry for all traps |
mcounteren
0x306 |
|
|
Reset value: see below |
The mcounteren
CSR is used to constrain user-level access to the CPU’s counter CSRs.
Bit | R/W | Function |
---|---|---|
31:3 |
r/- |
HPM = all |
2 |
r/- |
IR = |
1 |
r/- |
TM = |
0 |
r/- |
CY = |
If User mode is not implemented this register is read-only and always return zero when read. |
This CSR is read-only. Any write access will be ignored and will not raise an illegal instruction exception. |
mstatush
0x310 |
|
|
Reset value: |
The features of this CSR are not implemented yet. The register is read-only and always returns zero. |
3.12.4. Machine Trap Handling CSRs
mscratch
0x340 |
|
|
Reset value: |
The mscratch
is a general machine-mode scratch register.
mepc
0x341 |
|
|
Reset value: |
The mepc
CSR provides the instruction address where execution has stopped/failed when
an instruction is triggered / an exception is raised.
See section Traps, Exceptions and Interrupts for more information. |
mcause
0x342 |
|
|
Reset value: |
The mcause
CSRs shows the exact cause of a trap.
See section Traps, Exceptions and Interrupts for more information. |
Bit | R/W | Function |
---|---|---|
31 |
r/w |
Interrupt: |
30:5 |
r/- |
Reserved, read as zero |
4:0 |
r/w |
Exception code: see NEORV32 Trap Listing |
mtval
0x343 |
|
|
Reset value: |
The mtval
CSR provides additional information why a trap was entered.
Trap cause | mtval content |
---|---|
misaligned instruction fetch address or instruction fetch access fault |
address of faulting instruction fetch |
misaligned load address, load access fault, misaligned store address or store access fault |
program counter (= address) of faulting instruction |
everything else (including all interrupts) |
0x00000000 (all-zero) |
In case an invalid compressed instruction raised an illegal instruction exception, mtval will show the
according de-compressed instruction word. To get the actually 16-bit instruction that caused the exception
perform a memory load using the address stored in mepc .
|
See section Traps, Exceptions and Interrupts for more information. |
mip
0x344 |
|
|
Reset value: |
The mip
CSR shows the currently pending machine-level interrupts.
The bits for the standard RISC-V interrupts are read-only. Hence, these interrupts cannot be cleared using the
mip
register and must be cleared/acknowledged within the according interrupt-generating device.
The upper 16 bits represent the status of the CPU’s fast interrupt request lines (FIRQ). Once triggered, these
bit have to be cleared manually by writing zero to the according mip
bits (in the interrupt handler routine)
to clear the current interrupt request.
Bit | Name [C] | R/W | Function |
---|---|---|---|
31:16 |
CSR_MIP_FIRQ15P : CSR_MIP_FIRQ0P |
r/c |
FIRQxP: Fast interrupt channel 15..0 pending; has to be cleared manually by writing zero |
11 |
CSR_MIP_MEIP |
r/- |
MEIP: Machine external interrupt pending; cleared by platform-defined mechanism |
7 |
CSR_MIP_MTIP |
r/- |
MTIP: Machine timer interrupt pending; cleared by platform-defined mechanism |
3 |
CSR_MIP_MSIP |
r/- |
MSIP: Machine software interrupt pending; cleared by platform-defined mechanism |
An interrupt can only become pending (bit in mip becomes set) if the interrupt channel is enabled
via the according mie bit.
|
FIRQ Channel Mapping
See section NEORV32-Specific Fast Interrupt Requests for the mapping of the FIRQ channels and the according
interrupt-triggering processor module.
|
3.12.5. Machine Physical Memory Protection CSRs
The available physical memory protection logic is configured via the PMP_NUM_REGIONS and
PMP_MIN_GRANULARITY top entity generics. PMP_NUM_REGIONS defines the number of implemented
protection regions and thus, the implementation of the available PMP entries.
See section PMP
Physical Memory Protection for more information.
If trying to access an PMP-related CSR beyond PMP_NUM_REGIONS no illegal instruction
exception is triggered. The according CSRs are read-only (writes are ignored) and always return zero.
However, any access beyond pmpcfg3
or pmpaddr15
, which are the last physically implemented registers if
PMP_NUM_REGIONS == 16, will raise an illegal instruction exception as these CSRs are not implemented at all.
pmpcfg
0x3a0 |
|
|
… |
||
0x3a3 |
|
|
Reset value: all |
The pmpcfg*
CSRs are used to configure the different PMP regions. Each region features an independent 8-bit array
in these CSRs.
Bit | Name [C] | R/W | Function |
---|---|---|---|
7 |
PMPCFG_L |
r/w |
L: Lock bit, prevents further write accesses, also enforces access rights in machine-mode, can only be cleared by CPU reset |
6:5 |
- |
r/- |
reserved, read as zero |
4 |
PMPCFG_A_MSB |
r/- |
A: Mode configuration; only OFF ( |
3 |
PMPCFG_A_LSB |
r/w |
|
2 |
PMPCFG_X |
r/w |
X: Execute permission |
1 |
PMPCFG_W |
r/w |
W: Write permission |
0 |
PMPCFG_R |
r/w |
R: Read permission |
Setting the lock bit L and setting TOR mode in pmpcfg(i) will also lock write access to pmpaddr(i-1) .
See the RISC-V specs. for more information.
|
pmpaddr
The pmpaddr*
CSRs are used to configure the region’s address boundaries.
0x3b0 |
|
|
… |
||
0x3bf |
|
|
Reset value: all |
Physical Address Size
The two MSBs of each pmpaddr are hardwired to zero (= bits 33:32 of the physical address).
|
3.12.6. (Machine) Counter and Timer CSRs
Counter Size
When implemented (by enabling the Zicntr ISA extension) the standard CPU counters are always 64-bit wide (low-word + high-word).
|
Instruction Retired Counter Increment
The [m]instret[h] counter always increments when a instruction enters the pipeline’s execute stage no matter
if this instruction is actually going to retire or if it causes an exception.
|
cycle[h]
0xc00 |
|
|
0xc80 |
|
|
Reset value: all |
The cycle[h]
are user-mode shadow copies of the according mcycle[h]
CSRs. The user-level
counter are read-only. Any write access will raise an illegal instruction exception.
instret[h]
0xc02 |
|
|
0xc82 |
|
|
Reset value: all |
The instret[h]
are user-mode shadow copies of the according minstret[h]
CSRs. The user-level
counter are read-only. Any write access will raise an illegal instruction exception.
mcycle[h]
0xb00 |
|
|
0xb80 |
|
|
Reset value: all |
If not halted via the mcountinhibit
CSR the cycle[h]
CSR will increment with every active CPU clock
cycle (CPU not in sleep mode). These registers are read/write only for machine-mode software.
minstret[h]
0xb02 |
|
|
0xb82 |
|
|
Reset value: all |
If not halted via the mcountinhibit
CSR the minstret[h]
CSRs will increment with every retired instruction.
These registers are read/write only for machine-mode software.
3.12.7. Hardware Performance Monitors (HPM) CSRs
The actual number of implemented hardware performance monitors is configured via the HPM_NUM_CNTS top entity generic,
Note that always all 28 HPM counter and configuration registers (mhpmcounter*[h]
and mhpmevent*
) are implemented, but
only the actually configured ones are implemented as "real" physical registers - the remaining ones will be hardwired to zero.
If trying to access an HPM-related CSR beyond HPM_NUM_CNTS no illegal instruction exception is triggered. These CSRs are read-only (writes are ignored) and always return zero.
The total counter width of the HPMs can be configured before synthesis via the HPM_CNT_WIDTH generic (0..64-bit). If HPM_NUM_CNTS is less than 64, all remaining MSB-aligned bits are hardwired to zero.
mhpmevent
0x232 |
|
|
… |
||
0x33f |
|
|
Reset value: all |
The value in these CSRs define the architectural events that cause an increment of the according mhpmcounter*[h]
counter(s).
All available events are listed in the table below. If more than one event is selected, the according counter will increment if any of
the enabled events is observed (logical OR). Note that the counter will only increment by 1 step per clock
cycle even if more than one trigger event is observed.
Bit | Name [C] | R/W | Event |
---|---|---|---|
31:15 |
- |
r/- |
reserved, writes are ignored, read always return zero |
14 |
HPMCNT_EVENT_ILLEGAL |
r/w |
illegal instruction exception |
13 |
HPMCNT_EVENT_TRAP |
r/w |
entered trap (synchronous exception or interrupt) |
12 |
HPMCNT_EVENT_TBRANCH |
r/w |
taken conditional branch |
11 |
HPMCNT_EVENT_BRANCH |
r/w |
conditional branch (taken or not taken) |
10 |
HPMCNT_EVENT_JUMP |
r/w |
unconditional jump |
9 |
HPMCNT_EVENT_WAIT_LS |
r/w |
load/store memory wait cycle: if more than 1 cycle memory latency or high bus traffic |
8 |
HPMCNT_EVENT_STORE |
r/w |
memory data store operation |
7 |
HPMCNT_EVENT_LOAD |
r/w |
memory data load operation |
6 |
HPMCNT_EVENT_WAIT_MC |
r/w |
multi-cycle ALU operation wait cycle (like iterative shift operation) |
5 |
HPMCNT_EVENT_WAIT_II |
r/w |
instruction issue pipeline wait cycle: if more than 1 cycle latency, pipelines flush (like taken branches) / cache miss or high bus traffic |
4 |
HPMCNT_EVENT_WAIT_IF |
r/w |
instruction fetch memory wait cycle: if more than 1 cycle memory latency, cache miss or high bus traffic |
3 |
HPMCNT_EVENT_CIR |
r/w |
retired compressed instruction |
2 |
HPMCNT_EVENT_IR |
r/w |
retired instruction (compressed or uncompressed) |
1 |
- |
r/- |
not implemented, always read as zero |
0 |
HPMCNT_EVENT_CY |
r/w |
active clock cycle (CPU not in sleep mode) |
mhpmcounter[h]
0xb03 |
|
|
… |
||
0xb1f |
|
|
0xb83 |
|
|
… |
||
0xb9f |
|
|
Reset value: all |
If not halted via the mcountinhibit
CSR the mhpmcounter*[h]
counter CSR increment whenever a configured
event from the according mhpmevent
CSR occurs. The counter registers are read/write for machine mode and
are not accessible for lower-privileged software.
hpmcounter[h]
0xc03 |
|
|
… |
||
0xc1f |
|
|
0xc83 |
|
|
… |
||
0xc9f |
|
|
Reset value: all |
The hpmcounter*[h]
are user-level shadow copies of the according mhpmcounter[h]
CSRs. The user level
counter CSRs are read-only. Any write access will raise an illegal instruction exception.
3.12.8. Machine Counter Setup CSRs
mcountinhibit
The mcountinhibit
CSR can be used to halt specific counter CSRs.
0x320 |
|
|
Reset value: |
Bit | Name [C] | R/W | Event |
---|---|---|---|
3:31 |
CSR_MCOUNTINHIBIT_HPM3 : CSR_MCOUNTINHIBIT_HPM31 |
r/w |
HPMx: Set to |
2 |
CSR_MCOUNTINHIBIT_CY |
r/w |
CY: Set to |
0 |
CSR_MCOUNTINHIBIT_IR |
r/w |
IR: Set to |
3.12.9. Machine Information CSRs
All machine information registers can only be accessed in machine mode and are read-only. |
mvendorid
0xf11 |
|
|
Reset value: |
The features of this CSR are not implemented yet. The register is read-only and always returns zero. |
marchid
0xf12 |
|
|
Reset value: |
The marchid
CSR is read-only and provides the NEORV32 official RISC-V open-source architecture ID
(decimal: 19, 32-bit hexadecimal: 0x00000013).
mimpid
0xf13 |
|
|
Reset value: |
The mimpid
CSR is read-only and provides the version of the
NEORV32 as BCD-coded number (example: mimpid
= 0x01020312 → 01.02.03.12 → version 1.2.3.12).
mhartid
0xf14 |
|
|
Reset value: |
The mhartid
CSR is read-only and provides the core’s hart ID,
which is assigned via the HW_THREAD_ID top generic.
mconfigptr
0xf15 |
|
|
Reset value: |
The features of this CSR are not implemented yet. The register is read-only and always returns zero. |
3.12.10. NEORV32-Specific CSRs
All NEORV32-specific CSRs are mapped to addresses that are explicitly reserved for custom Machine-Mode, read-only CSRs (assured by the RISC-V privileged specifications). Hence, these CSRs can only be accessed when in machine-mode. Any access outside of machine-mode will raise an illegal instruction exception. |
mxisa
0x7c0 |
|
|
Reset value: |
The mxisa
CSRs is a NEORV32-specific read-only CSR that helps machine-mode software to
discover ISA sub-extensions and CPU configuration options.
Bit | Name [C] | R/W | Function |
---|---|---|---|
31 |
CSR_MXISA_FASTSHIFT |
r/- |
fast shifts available when set (via top’s FAST_SHIFT_EN generic) |
30 |
CSR_MXISA_FASTMUL |
r/- |
fast multiplication available when set (via top’s FAST_MUL_EN generic) |
31:21 |
- |
r/- |
reserved, read as zero |
20 |
CSR_MXISA_IS_SIM |
r/- |
set if CPU is being simulated (⚠️ not guaranteed) |
19:11 |
- |
r/- |
reserved, read as zero |
11 |
CSR_MXISA_SDTRIG |
r/- |
|
10 |
CSR_MXISA_SDEXT |
r/- |
|
9 |
CSR_MXISA_ZIHPM |
r/- |
|
8 |
CSR_MXISA_PMP |
r/- |
|
7 |
CSR_MXISA_ZICNTR |
r/- |
|
6 |
- |
r/- |
reserved, read as zero |
5 |
CSR_MXISA_ZFINX |
r/- |
|
4 |
- |
r/- |
reserved, read as zero |
3 |
CSR_MXISA_ZXCFU |
r/- |
|
2 |
CSR_MXISA_ZMMUL |
r/- |
|
1 |
CSR_MXISA_ZIFENCEI |
r/- |
|
0 |
CSR_MXISA_ZICSR |
r/- |
|
3.12.11. Traps, Exceptions and Interrupts
In this document the following terminology is used (derived from the RISC-V trace specification available at https://github.com/riscv-non-isa/riscv-trace-spec):
-
exception: an unusual condition occurring at run time associated (i.e. synchronous) with an instruction in a RISC-V hart
-
interrupt: an external asynchronous event that may cause a RISC-V hart to experience an unexpected transfer of control
-
trap: the transfer of control to a trap handler caused by either an exception or an interrupt
Whenever an exception or interrupt is triggered, the CPU switches to machine-mode (if not already in machine-mode)
and transfers control to the address stored in mtvec
CSR. The cause of the this trap can
be determined via the mcause
CSR. A list of all implement mcause
values and the according description
can be found below in section NEORV32 Trap Listing. The address that reflects the current program counter when a trap
was taken is stored to mepc
CSR. This might be the address of the instruction that actually caused the trap
or that has not been executed yet as it was interrupted by a trap. Additional information regarding the cause
of the trap can be retrieved from the mtval
CSR and the processor’s Internal Bus Monitor (BUSKEEPER)
(for bus access exceptions).
The traps are prioritized. If several exceptions occur at once only the one with highest priority is triggered while all remaining exceptions are ignored. If several interrupts trigger at once, the one with highest priority is serviced first while the remaining ones stay pending. After completing the interrupt handler the interrupt with the second highest priority will get serviced and so on until no further interrupts are pending.
Interrupts when in User-Mode
If the core is currently operating in less privileged user-mode, (machine-mode) interrupts are globally enabled
even if mstatus `.mie` is cleared.
|
Interrupt Signal Requirements - Standard RISC-V Interrupts
All standard RISC-V interrupts request signals are high-active. A request has to stay at high-level (=asserted)
until it is explicitly acknowledged by the CPU software (for example by writing to a specific memory-mapped register).
|
Interrupt Signal Requirements - Fast Interrupt Requests
The NEORV32-specific FIRQ request lines are triggered by a one-shot high-level (i.e. rising edge). Each request is buffered in the CPU control
unit until the channel is either disabled (by clearing the according mie CSR bit) or the request is explicitly cleared (by writing
zero to the according mip CSR bit).
|
Instruction Atomicity
All instructions execute as atomic operations - interrupts can only trigger between two instructions.
So even if there is a permanent interrupt request, exactly one instruction from the interrupt program will be executed before
another interrupt handler can start. This allows program progress even if there are permanent interrupt requests.
|
Memory Access Exceptions
If a load operation causes any exception, the instruction’s destination register is not written at all. Load exceptions caused by a misalignment or a physical memory protection fault do not trigger a bus/memory read-operation at all. Vice versa, exceptions caused by a store address misalignment or a store physical memory protection fault do not trigger a bus/memory write-operation at all.
Custom Fast Interrupt Request Lines
As a custom extension, the NEORV32 CPU features 16 fast interrupt request (FIRQ) lines via the firq_i
CPU top
entity signals. These interrupts have custom configuration and status flags in the mie
and mip
CSRs and also
provide custom trap codes in mcause
. These FIRQs are reserved for NEORV32 processor-internal usage only.
NEORV32 Trap Listing
The following table shows all traps that are currently supported by the NEORV32 CPU. It also shows the prioritization and the CSR side-effects. A more detailed description of the actual trap triggering events is provided in a further table.
Asynchronous exceptions (= interrupts) set the MSB of mcause while synchronous exception (= "software exception")
clear the MSB.
|
Table Annotations
The "Prio." column shows the priority of each trap. The highest priority is 1. The “mcause” column shows the
cause ID of the according trap that is written to mcause
CSR. The "ID [C]" names are defined by the NEORV32
core library (the runtime environment RTE) and can be used in plain C code. The mepc
and mtval
columns
show the values written to the according CSRs when a trap is triggered:
-
I-PC - address of interrupted instruction (instruction has not been executed yet)
-
PC - address of instruction that caused the trap (instruction has been executed)
-
ADR - bad memory access address that caused the trap
-
0 - zero
Prio. | mcause |
ID [C] | Cause | mepc |
mtval |
---|---|---|---|---|---|
Exceptions (synchronous to instruction execution) |
|||||
1 |
|
TRAP_CODE_I_MISALIGNED |
instruction address misaligned |
PC |
ADR |
2 |
|
TRAP_CODE_I_ACCESS |
instruction access bus fault |
I-PC |
ADR |
3 |
|
TRAP_CODE_I_ILLEGAL |
illegal instruction |
PC |
0 |
4 |
|
TRAP_CODE_MENV_CALL |
environment call from M-mode ( |
PC |
0 |
5 |
|
TRAP_CODE_UENV_CALL |
environment call from U-mode ( |
PC |
0 |
6 |
|
TRAP_CODE_BREAKPOINT |
software breakpoint ( |
PC |
0 |
7 |
|
TRAP_CODE_S_MISALIGNED |
store address misaligned |
PC |
ADR |
8 |
|
TRAP_CODE_L_MISALIGNED |
load address misaligned |
PC |
ADR |
9 |
|
TRAP_CODE_S_ACCESS |
store access bus fault |
PC |
ADR |
10 |
|
TRAP_CODE_L_ACCESS |
load access bus fault |
PC |
ADR |
Interrupts (asynchronous to instruction execution) |
|||||
11 |
|
TRAP_CODE_FIRQ_0 |
fast interrupt request channel 0 |
I-PC |
0 |
12 |
|
TRAP_CODE_FIRQ_1 |
fast interrupt request channel 1 |
I-PC |
0 |
13 |
|
TRAP_CODE_FIRQ_2 |
fast interrupt request channel 2 |
I-PC |
0 |
14 |
|
TRAP_CODE_FIRQ_3 |
fast interrupt request channel 3 |
I-PC |
0 |
15 |
|
TRAP_CODE_FIRQ_4 |
fast interrupt request channel 4 |
I-PC |
0 |
16 |
|
TRAP_CODE_FIRQ_5 |
fast interrupt request channel 5 |
I-PC |
0 |
17 |
|
TRAP_CODE_FIRQ_6 |
fast interrupt request channel 6 |
I-PC |
0 |
18 |
|
TRAP_CODE_FIRQ_7 |
fast interrupt request channel 7 |
I-PC |
0 |
19 |
|
TRAP_CODE_FIRQ_8 |
fast interrupt request channel 8 |
I-PC |
0 |
20 |
|
TRAP_CODE_FIRQ_9 |
fast interrupt request channel 9 |
I-PC |
0 |
21 |
|
TRAP_CODE_FIRQ_10 |
fast interrupt request channel 10 |
I-PC |
0 |
22 |
|
TRAP_CODE_FIRQ_11 |
fast interrupt request channel 11 |
I-PC |
0 |
23 |
|
TRAP_CODE_FIRQ_12 |
fast interrupt request channel 12 |
I-PC |
0 |
24 |
|
TRAP_CODE_FIRQ_13 |
fast interrupt request channel 13 |
I-PC |
0 |
25 |
|
TRAP_CODE_FIRQ_14 |
fast interrupt request channel 14 |
I-PC |
0 |
26 |
|
TRAP_CODE_FIRQ_15 |
fast interrupt request channel 15 |
I-PC |
0 |
27 |
|
TRAP_CODE_MEI |
machine external interrupt (MEI) |
I-PC |
0 |
28 |
|
TRAP_CODE_MSI |
machine software interrupt (MSI) |
I-PC |
0 |
29 |
|
TRAP_CODE_MTI |
machine timer interrupt (MTI) |
I-PC |
0 |
The following table provides a summarized description of the actual events for triggering a specific trap.
Trap ID [C] | Triggered when … |
---|---|
TRAP_CODE_I_MISALIGNED |
fetching a 32-bit instruction word that is not 32-bit-aligned (see note below) |
TRAP_CODE_I_ACCESS |
bus timeout or bus access error during instruction word fetch |
TRAP_CODE_I_ILLEGAL |
trying to execute an invalid instruction word (malformed or not supported) or on a privilege violation |
TRAP_CODE_MENV_CALL |
executing |
TRAP_CODE_UENV_CALL |
executing |
TRAP_CODE_BREAKPOINT |
executing |
TRAP_CODE_S_MISALIGNED |
storing data to an address that is not naturally aligned to the data size (byte, half, word) |
TRAP_CODE_L_MISALIGNED |
loading data from an address that is not naturally aligned to the data size (byte, half, word) |
TRAP_CODE_S_ACCESS |
bus timeout or bus access error during load data operation |
TRAP_CODE_L_ACCESS |
bus timeout or bus access error during store data operation |
TRAP_CODE_FIRQ_0 … TRAP_CODE_FIRQ_15 |
caused by interrupt-condition of processor-internal modules, see NEORV32-Specific Fast Interrupt Requests |
TRAP_CODE_MEI |
machine external interrupt (via dedicated top-entity signal) |
TRAP_CODE_MSI |
machine software interrupt (via dedicated top-entity signal) |
TRAP_CODE_MTI |
machine timer interrupt (internal machine timer or via dedicated top-entity signal) |
Resumable Exceptions
Note that not all exceptions are resumable. For example, the "instruction access fault" exception or the "instruction address misaligned"
exception are not resumable in most cases. These exception might indicate a fatal memory hardware failure.
|
Interrupt Trigger Type
The RISC-V standard interrupts (MEI, MSI and MTI) are level-triggered and high-active. Once set the signal has to stay high until
the interrupt request is explicitly acknowledged (e.g. writing to a memory-mapped register). The RISC-V standard interrupts
can NOT be acknowledged by writing zero to the according mip CSR bit. |
+
In contrast, the NEORV32 fast interrupt request channels become pending after being triggering by a rising edge. A pending FIRQ has to
be explicitly cleared by writing zero to the according mip
CSR bit.
Misaligned Instruction Address Exception
For 32-bit-only instructions (= no C extension) the misaligned instruction exception
is raised if bit 1 of the fetch address is set (i.e. not on a 32-bit boundary). If the C extension is implemented
there will never be a misaligned instruction exception at all.
In both cases bit 0 of the program counter (and all related CSRs) is hardwired to zero.
|
3.12.12. Bus Interface
The NEORV32 CPU implements a 32-bit machine with separated instruction and data interfaces making the CPU a
Harvard Architecture: the instruction fetch interface (i_bus_*
) is used for fetching instructions and the
data access interface (d_bus_*
) is used to access data via load and store operations.
Each of these interfaces can access an address space of up to 232 bytes (4GB).
The following table shows the signals of the data and instruction interfaces as seen from the CPU (*_o
signals are driven
by the CPU / outputs, *_i
signals are read by the CPU / inputs). Both interfaces use the same Protocol.
Signal | Width | Direction | Description |
---|---|---|---|
|
32 |
out |
access address |
|
32 |
in |
data input for read operations |
|
32 |
out |
data output for write operations |
|
4 |
out |
byte enable signal for write operations |
|
1 |
out |
bus write access request (one-shot) |
|
1 |
out |
bus read access request (one-shot) |
|
1 |
in |
accessed peripheral indicates a successful completion of the bus transaction |
|
1 |
in |
accessed peripheral indicates an error during the bus transaction |
|
1 |
out |
this signal is set for one cycle when the CPU executes an instruction/data fence command |
|
1 |
out |
shows the effective privilege level of the bus access |
Pipelined Transfers
Currently, there a no pipelined or overlapping operations (within the same bus interface) implemented.
So only a single transfer request can be "in fly" (pending) at once. However, this is no real drawback. The
minimal possible latency for a single access is two cycles, which is equal to the CPU’s minimal execution latency
for a single instruction.
|
Unaligned Memory Accesses
Please note that the NEORV32 CPU does not support the handling of unaligned memory accesses in hardware. Any
unaligned memory access will raise an exception that can be used to handle unaligned accesses in software
(via emulation).
|
Signal Stability
All outgoing bus interface signals (driven by the CPU) remain stable until the bus access is completed. This simplifies
the design of the bus interconnection network as well as the architecture of the individual processor modules.
|
Protocol
A new bus request is triggered either by the *_bus_re_o
signal (for reading data) or by the *_bus_we_o
signal
(for writing data). In case of a request, one of these signals is high for exactly one cycle. The transaction is
completed when the accessed peripheral/memory either sets the *_bus_ack_i
signal (→ successful completion) or the
*_bus_err_i
signal (→ failed completion). These bus response signals have to be also set only for one cycle.
If a bus request is terminated by the *_bus_err_i
signal the CPU will raise the according "instruction bus access fault" or
"load/store bus access fault" exception.
Minimal Response Latency
The transfer can be completed within in the same cycle as it was initiated (asynchronous response) if the accessed module
directly sets *_bus_ack_i
or *_bus_err_i
high for one cycle. However, in order to shorten the
critical path such an "asynchronous" response should be avoided. The default NEORV32 processor-internal modules use a registered
response with exactly one cycle delay between initiation and completion of transfers.
Maximal Response Latency
The processor-internal modules do not have to respond within one cycle after a bus request has been initiated.
However, the bus transaction has to be completed (= acknowledged) within a certain response time window. This time window
is defined by the global max_proc_int_response_time_c
constant (default = 15 cycles; defined in the processor’s VHDL package file
rtl/neorv32_package.vhd
). It defines the maximum number of cycles after which an unacknowledged (*bus_ack_i
or *_bus_err_i
signals both not set) transfer will time out and will raise a bus fault exception. The Internal Bus Monitor (BUSKEEPER) keeps
track of all _internal bus transactions to enforce this time window.
If any bus operations times out - for example when accessing "address space holes" - the BUSKEEPER will issue a bus
error to the CPU (via the according *bus_err_i
signal) that will raise the according instruction fetch or data access bus exception.
Note that the bus keeper does not track external accesses via the external memory bus interface. However,
the external memory bus interface also provides an _optional bus timeout
(see section Processor-External Memory Interface (WISHBONE) (AXI4-Lite)).
Interface Response
Please note that any CPU access via the data or instruction interface has to be terminated either by asserting the
CPU’s *_bus_ack_i` or *_bus_err_i signal. Otherwise the CPU will be stalled permanently. The BUSKEEPER ensures that
any kind of access is always properly terminated.
|
Exemplary Bus Accesses
![]() |
![]() |
Read access |
Write access |
Write Access
For a write access the according access address (bus_addr_o
), the data to-be-written (bus_wdata_o
) and the byte
enable identifier (bus_ben_o
) are set when bus_we_o
goes high. These three signals are kept stable until the
transaction is completed. In the example the accessed peripheral cannot answer directly within the next
cycle. Here, the transaction is successful and the peripheral sets the bus_ack_i
signal several
cycles after issuing.
Read Access
For a read access the according access address (bus_addr_o
) is set when bus_re_o
goes high. The address is kept
stable until the transaction is completed. In the example the accessed peripheral cannot answer
directly within the next cycle. The peripheral hast to apply the read data right in the same cycle as
the bus transaction is completed (here, the transaction is successful and the peripheral sets the bus_ack_i
signal).
Access Boundaries
The instruction interface will always access memory on word (= 32-bit) boundaries even if fetching compressed (16-bit) instructions. The data interface can access memory on byte (= 8-bit), half-word (= 16- bit) and word (= 32-bit) boundaries, but not all processor module support sub-word accesses.
Memory Barriers
Whenever the CPU executes a fence
instruction, the according interface signal is set high for one cycle
(d_bus_fence_o
for a fence
instruction; i_bus_fence_o
for a fence.i
instruction). It is the task of the
memory system to perform the necessary operations (for example a cache flush/reload).
4. Software Framework
To make actual use of the NEORV32 processor, the project comes with a complete software ecosystem. This ecosystem is based on the RISC-V port of the GCC GNU Compiler Collection and consists of the following elementary parts:
A summarizing list of the most important elements of the software framework and their according files and folders is shown below:
Application start-up code |
|
Application linker script |
|
Core hardware driver libraries ("HAL") |
|
Central application makefile |
|
Tool for generating NEORV32 executables |
|
Default bootloader |
|
Example programs |
|
Software Documentation
All core libraries and example programs are documented "in-code" using Doxygen.
The documentation is automatically built and deployed to GitHub pages and is available online
at https://stnolting.github.io/neorv32/sw/files.html.
|
Example Programs
A collection of annotated example programs, which show how to use certain CPU functions
and peripheral/IO modules, can be found in sw/example .
|
4.1. Compiler Toolchain
The toolchain for this project is based on the free RISC-V GCC-port. You can find the compiler sources and build instructions on the official RISC-V GNU toolchain GitHub page: https://github.com/riscv/riscv-gnutoolchain.
The NEORV32 implements a 32-bit RISC-V architecture and uses a 32-bit integer and soft-float ABI by default. Make sure the toolchain / toolchain build is configured accordingly.
-
MARCH=rv32i
-
MABI=ilp32
-
RISCV_PREFIX=riscv32-unknown-elf-
These default configurations can be override at any times using Application Makefile variables.
More information regarding the toolchain (building from scratch or downloading the prebuilt ones) can be found in the user guides' section Software Toolchain Setup. |
4.2. Core Libraries
The NEORV32 project provides a set of pre-defined C libraries that allow an easy integration of the processor/CPU features
(also called "HAL" - hardware abstraction layer). All driver and runtime-related files are located in
sw/lib
. These are automatically included and linked by adding the following include statement:
#include <neorv32.h> // NEORV32 HAL, core and runtime libraries
C source file | C header file | Description |
---|---|---|
- |
|
main NEORV32 definitions and library file |
|
|
HW driver (stubs) functions for the custom functions subsystem [6] |
|
|
HW driver functions for the NEORV32 CPU |
|
|
HW driver functions for the NEORV32 CFU (custom instructions) |
|
|
HW driver functions for the GPIO |
|
|
HW driver functions for the GPTRM |
- |
|
macros for intrinsics & custom instructions |
|
|
HW driver functions for the MTIME |
|
|
HW driver functions for the NEOLED |
|
|
HW driver functions for the ONEWIRE |
|
|
HW driver functions for the PWM |
|
|
NEORV32 runtime environment and helper functions |
|
|
HW driver functions for the SLINK |
|
|
HW driver functions for the SPI |
|
|
HW driver functions for the TRNG |
|
|
HW driver functions for the TWI |
|
|
HW driver functions for the UART0 and UART1 |
|
|
HW driver functions for the WDT |
|
|
HW driver functions for the XIP |
|
|
HW driver functions for the XIRQ |
|
- |
newlib "system calls" |
- |
|
backwards compatibility wrappers and functions (do not use for new designs) |
Core Library Documentation
The doxygen-based documentation of the software framework including all core libraries is available online at
https://stnolting.github.io/neorv32/sw/files.html.
|
CMSIS System View Description File (SVD)
A CMSIS-SVD-compatible System View Description (SVD) file including all peripherals is available in sw/svd .
|
4.3. Application Makefile
Application compilation is based on a single, centralized GNU makefile (sw/common/common.mk
). Each project in the
sw/example
folder provides a makefile that just includes this central makefile.
When creating a new project, copy an existing project folder or at least the makefile to the new project folder.
It is recommended to create new projects also in sw/example to keep the file dependencies. However, these
dependencies can be manually configured via makefile variables if the new project is located somewhere else.
|
Before the makefile can be used to compile applications, the RISC-V GCC toolchain needs to be installed and
the compiler’s bin folder has to be added to the system’s PATH variable. More information can be found in
User Guide: Software Toolchain Setup.
|
The makefile is invoked by simply executing make
in the console. For example:
neorv32/sw/example/demo_blink_led$ make
4.3.1. Targets
Just executing make
(or executing make help
) will show the help menu listing all available targets.
$ make
<<< NEORV32 SW Application Makefile >>>
Make sure to add the bin folder of RISC-V GCC to your PATH variable.
=== Targets ===
help - show this text
check - check toolchain
info - show makefile/toolchain configuration
asm - compile and generate <main.asm> assembly listing file for manual debugging
elf - compile and generate <main.elf> ELF file
bin - compile and generate <neorv32_raw_exe.bin> RAW executable file (binary file, no header)
hex - compile and generate <neorv32_raw_exe.hex> RAW executable file (hex char file, no header)
image - compile and generate VHDL IMEM boot image (for application, no header) in local folder
install - compile, generate and install VHDL IMEM boot image (for application, no header)
sim - in-console simulation using default/simple testbench and GHDL
all - exe + install + hex + bin + asm
elf_info - show ELF layout info
clean - clean up project home folder
clean_all - clean up whole project, core libraries and image generator
bl_image - compile and generate VHDL BOOTROM boot image (for bootloader only, no header) in local folder
bootloader - compile, generate and install VHDL BOOTROM boot image (for bootloader only, no header)
=== Variables ===
USER_FLAGS - Custom toolchain flags [append only], default ""
EFFORT - Optimization level, default "-Os"
MARCH - Machine architecture, default "rv32i"
MABI - Machine binary interface, default "ilp32"
APP_INC - C include folder(s) [append only], default "-I ."
ASM_INC - ASM include folder(s) [append only], default "-I ."
RISCV_PREFIX - Toolchain prefix, default "riscv32-unknown-elf-"
NEORV32_HOME - NEORV32 home folder, default "../../.."
4.3.2. Configuration
The compilation flow is configured via variables right at the beginning of the central
makefile (sw/common/common.mk
):
The makefile configuration variables can be overridden or extended directly when invoking the makefile. For
example $ make MARCH=rv32ic clean_all exe overrides the default MARCH variable definitions.
Permanent modifications/definitions can be made in the project-local makefile
(e.g., sw/example/demo_blink_led/makefile ).
|
# *****************************************************************************
# USER CONFIGURATION
# *****************************************************************************
# User's application sources (*.c, *.cpp, *.s, *.S); add additional files here
APP_SRC ?= $(wildcard ./*.c) $(wildcard ./*.s) $(wildcard ./*.cpp) $(wildcard ./*.S)
# User's application include folders (don't forget the '-I' before each entry)
APP_INC ?= -I .
# User's application include folders - for assembly files only (don't forget the '-I' before each
entry)
ASM_INC ?= -I .
# Optimization
EFFORT ?= -Os
# Compiler toolchain
RISCV_PREFIX ?= riscv32-unknown-elf-
# CPU architecture and ABI
MARCH ?= rv32i
MABI ?= ilp32
# User flags for additional configuration (will be added to compiler flags)
USER_FLAGS ?=
# Relative or absolute path to the NEORV32 home folder
NEORV32_HOME ?= ../../..
# *****************************************************************************
|
The source files of the application ( |
|
Include file folders; separated by white spaces; must be defined with |
|
Include file folders that are used only for the assembly source files ( |
|
Optimization level, optimize for size ( |
|
The toolchain prefix to be used; follows the triplet naming convention |
|
The targeted RISC-V architecture/ISA; enable compiler support of optional CPU extension by adding the according extension
name (e.g. |
|
Application binary interface (default: 32-bit integer ABI |
|
Additional flags that will be forwarded to the compiler tools |
|
Relative or absolute path to the NEORV32 project home folder; adapt this if the makefile/project is not in the project’s
default |
4.3.3. Default Compiler Flags
The following default compiler flags are used for compiling an application. These flags are defined via the
CC_OPTS
variable.
|
Enable all compiler warnings. |
|
Put functions and data segment in independent sections. This allows a code optimization as dead code and unused data can be easily removed. |
|
Do not use the default start code. Instead, the NEORV32-specific start-up code ( |
|
Make the linker perform dead code elimination. |
|
Include/link with |
|
Search for the standard C library when linking. |
|
Make sure we have no unresolved references to internal GCC library subroutines. |
|
Use built-in software functions for floating-point divisions and square roots (since the according instructions are not supported yet). |
|
Include debugging information/symbols in ELF. |
4.3.4. Custom (Compiler) Flags
Custom flags can be appended to the USER_FLAGS
variable. This allows to customize the entire software framework while
calling make
without the need to change the makefile(s) or the linker script.
The following example will add debug symbols to the executable (-g
) and will also define the linker script’s
__neorv32_heap_size
setting the maximal heap size to 4096 bytes:
USER_FLAGS
variable for customization$ make USER_FLAGS+="-g -Wl,--__neorv32_heap_size,__heap_size=4096" clean_all exe
4.4. Executable Image Format
In order to generate an executable for th processors all source files have to be compiled, linked and packed into a final executable.
4.4.1. Linker Script
After all the application sources have been compiled, they need to be linked.
For this purpose the makefile uses the NEORV32-specific linker script sw/common/neorv32.ld
for
linking all object files that were generated during compilation. In general, the linker script defines
three memory sections: rom
, ram
and iodev
.
Memory section | Description |
---|---|
|
Data memory address space (processor-internal/external DMEM) |
|
Instruction memory address space (processor-internal/external IMEM) or internal bootloader ROM |
|
Processor-internal memory-mapped IO/peripheral devices address space |
The iodev section is entirely defined by the processor hardware layout and should not be modified at all.
|
The rom section is automatically re-mapped to the processor-internal Bootloader ROM (BOOTROM) when (re-)compiling the
bootloader
|
Each section has two main attributes: ORIGIN
and LENGTH
. ORIGIN
defines the base address of the according section
while LENGTH
defines its size in bytes. The attributes are configured indirectly via variables that provide default values.
/* Default rom/ram (IMEM/DMEM) sizes */
__neorv32_rom_size = DEFINED(__neorv32_rom_size) ? __neorv32_rom_size : 2048M;
__neorv32_ram_size = DEFINED(__neorv32_ram_size) ? __neorv32_ram_size : 8K;
/* Default section base addresses - do not change this unless the hardware-defined address space layout is changed! */
__neorv32_rom_base = DEFINED(__neorv32_rom_base) ? __neorv32_rom_base : 0x00000000; /* = VHDL package's "ispace_base_c" */
__neorv32_ram_base = DEFINED(__neorv32_ram_base) ? __neorv32_ram_base : 0x80000000; /* = VHDL package's "dspace_base_c" */
Only the region sizes should be modified by the user. The base addresses are defined by the processor’s hardware (see section
Address Space) and should not be altered at all. The size (and base) configuration can be edited by the user - either by explicitly
changing the default values in the linker script or by overriding them when invoking make
:
$ make USER_FLAGS+="-Wl,--defsym,__neorv32_rom_size=4096" clean_all exe
neorv32_rom_base (= ORIGIN of the ram section) has to be always identical to the processor’s dspace_base_c hardware configuration.
Also, neorv32_ram_base (= ORIGIN of the rom section) has to be always identical to the processor’s ispace_base_c hardware configuration.
|
The default configuration for the rom section assumes a maximum of 2GB logical memory address space. This size does not have
to reflect the actual physical size of the instruction memory (internal IMEM and/or processor-external memory). It just provides a maximum
limit. When uploading a new executable via the bootloader, the bootloader itself checks if sufficient physical instruction memory is available.
If a new executable is embedded right into the internal-IMEM the synthesis tool will check, if the configured instruction memory size
is sufficient (e.g., via the MEM_INT_IMEM_SIZE generic).
|
The linker maps all the regions from the compiled object files into five final sections: .text
, .rodata
, .data
, .bss
and .heap
.
These regions contain everything required for the application to run:
Region | Description |
---|---|
|
Executable instructions generated from the start-up code and all application sources. |
|
Constants (like strings) from the application; also the initial data for initialized variables. |
|
This section is required for the address generation of fixed (= global) variables only. |
|
This section is required for the address generation of dynamic memory constructs only. |
|
This section is required for the address generation of dynamic memory constructs only. |
The .text
and .rodata
sections are mapped to processor’s instruction memory space and the .data
,
.bss
and heap
sections are mapped to the processor’s data memory space. Finally, the .text
, .rodata
and .data
sections are extracted and concatenated into a single file main.bin
.
Section Alignment
The default NEORV32 linker script aligns all regions so they start and end on a 32-bit (word) boundary. The default
NEORV32 start-up code (crt0) makes use of this alignment by using word-level memory instructions to initialize the .data
section and to clear the .bss section (faster!).
|
4.4.2. RAM Layout
The default NEORV32 linker script uses all of the defined RAM (linker script memory section ram
) to create four areas.
Note that depending on the application some areas might not be existent at all.

-
Constant data (
.data
): The constant data section is placed right at the beginning of the RAM. For example, this section contains explicitly initialized global variables. This section is initialized by the executable. -
Dynamic data (
.bss
): The constant data section is followed by the dynamic data section, which contains uninitialized data like global variables without explicit initialization. This section is cleared by the start-up codecrt0.S
. -
Heap (
.heap
): The heap is used for dynamic memory that is managed by functions likemalloc()
andfree()
. The heap grows upwards. This section is not initialized at all. -
Stack: The stack starts at the very end of the RAM at address
ORIGIN(ram) + LENGTH(ram) - 4
. The stack grows downwards.
There is no explicit limit for the maximum stack size as this is hard to check. However, a physical memory protection rule could be used to configure a maximum size by adding a "protection area" between stack and heap (a PMP region without any access rights).
Heap Size
The maximum size of the heap is defined by the linker script’s neorv32_heap_size variable. This variable has to be
explicitly defined in order to define a heap size (and to use dynamic memory allocation at all) other than zero. The user
can define the heap size while invoking the application makefile: $ USER_FLAGS+="-Wl,--defsym,neorv32_heap_size=4k" make clean_all exe
(defines a heap size of 4*1024 bytes).
|
Heap-Stack Collisions
Take care when using dynamic memory to avoid collision of the heap and stack memory areas. There is no compile-time protection
mechanism available as the actual heap and stack size are defined by runtime data. Also beware of fragmentation when
using dynamic memory allocation.
|
4.4.3. C Standard Library
The NEORV32 is a processor for embedded applications, which is not capable of running desktop OSs like Linux (at least not without emulation). Hence, the default software framework relies on newlib as default C standard library.
RTOS Support
The NEORV32 CPU and processor do support embedded RTOS like FreeRTOS and Zephyr. See the User guide section
Zephyr RTOS Support and
FreeRTOS Support
for more information.
|
Newlib provides stubs for common "system calls" (like file handling and standard input/output) that are used by other
C libraries like stdio
. These stubs are available in sw/source/syscalls.c
and were adapted for the NEORV32 processor.
Standard Console(s)
UART0
is used to implement all the standard input, output and error consoles (STDIN , STDOUT and STDERR ).
|
Constructors and Destructors
Constructors and destructors for plain C code or for C++ applications are supported by the software framework.
See sw/example/hellp_cpp for a minimal example.
|
Newlib Test/Demo Program
A simple test and demo program, which uses some of newlib’s core functions (like malloc /free and read /write )
is available in sw/example/demo_newlib
|
4.4.4. Executable Image Generator
The main.bin
file is packed by the NEORV32 image generator (sw/image_gen
) to generate the final executable file.
The image generator can generate several types of executables selected by a flag when calling the generator:
|
Generates an executable binary file |
|
Generates an executable VHDL memory initialization image (no header) for the processor-internal IMEM. This option generates the |
|
Generates a plain ASCII hex-char file |
|
Generates a plain binary file |
|
Generates an executable VHDL memory initialization image (no header) for the processor-internal BOOT ROM. This option generates the |
All these options are managed by the makefile. The "normal application2 compilation flow will generate the neorv32_exe.bin
executable for uploading via UART to the default NEORV32 bootloader.
Image Generator Compilation
The sources of the image generator are automatically compiled when invoking the makefile (requiring a native GCC installation).
|
Executable Header
The image generator add a small header to the neorv32_exe.bin executable, which consists of three 32-bit words located right at the
beginning of the file. The first word of the executable is the signature word and is always 0x4788cafe . Based on this word the bootloader
can identify a valid image file. The next word represents the size in bytes of the actual program
image in bytes. A simple "complement" checksum of the actual program image is given by the third word. This
provides a simple protection against data transmission or storage errors. Note that this executable format cannot be used for direct
execution (e.g. via XIP or direct memory access).
|
4.4.5. Start-Up Code (crt0)
The CPU and also the processor require a minimal start-up and initialization code to bring the CPU (and the SoC)
into a stable and initialized state and to initialize the C runtime environment before the actual application can be executed.
This start-up code is located in sw/common/crt0.S
and is automatically linked every application program
and placed right before the actual application code so it gets executed right after reset.
The crt0.S
start-up performs the following operations:
-
Clear
mstatus
. -
Clear
mie
disabling all interrupt sources. -
Install an early-boot dummy trap handler to
mtvec
. -
Initialize the global pointer
gp
and the stack pointersp
according to the RAM Layout provided by the linker script. -
Initialize all integer register
x1 - x31
(onlyx1 - x15
if theE
CPU extension is enabled). -
Setup
.data
section to configure initialized variables. -
Clear the
.bss
section. -
Call all constructors (if there are any).
-
Call the application’s
main
function (with no arguments:argc
=argv
= 0). -
If
main
returns:-
Tnterrupts are disabled by clearing
mie
. -
`mains’s return value is copied to the
mscratch
CSR to allow inspection by the debugger. -
Call all destructors (if there are any).
-
An optional After-Main Handler is called (if defined at all).
-
The CPU enters sleep mode (using the
wfi
instruction) or remains in an endless loop (ifwfi
"returns").
-
Bootloader Start-Up Code
The bootloader uses the same start-up code as any "usual" application. However, certain parts are omitted when compiling
crt0 for the bootloader (like calling constructors and destructors). See the crt0 source code for more information.
|
After-Main Handler
If the application’s main()
function actually returns, an after main handler can be executed. This handler is a "normal" function
as the C runtime is still available when executed. If this handler uses any kind of peripheral/IO modules make sure these are
already initialized within the application. Otherwise you have to initialize them inside the handler.
void __neorv32_crt0_after_main(int32_t return_code);
The function has exactly one argument (return_code
) that provides the return value of the application’s main function.
For instance, this variable contains -1
if the main function returned with return -1;
. The after-main handler itself does
not provide a return value.
A simple UART output can be used to inform the user when the application’s main function returns (this example assumes that UART0 has been already properly configured in the actual application):
void __neorv32_crt0_after_main(int32_t return_code) {
neorv32_uart0_printf("\n<RTE> main function returned with exit code %i. </RTE>\n", return_code); (1)
}
1 | Use <RTE> here to make clear this is a message comes from the runtime environment. |
The after-main handler is executed after executing all destructor functions (if there are any at all). |
4.5. Bootloader
This section refers to the default bootloader from the repository. The bootloader can be customized to target application-specific scenarios using pre-defined options (see User Guide section Customizing the Internal Bootloader ) or it can be completely rewritten/replaced for custom purpose. |
The NEORV32 bootloader (source code sw/bootloader/bootloader.c
) provides an optional build-in firmware that
allows to upload new application executables at any time without the need to re-synthesize the FPGA’s bitstream.
A UART connection is used to provide a simple text-based user interface that allows to upload executables.
Furthermore, the bootloader provides options to store an executable to a processor-external SPI flash. An "auto boot" feature can optionally fetch this executable right after reset if there is no user interaction via UART. This allows to build processor setups with non-volatile application storage, which can still be updated at any time.
4.5.1. Bootloader SoC/CPU Requirements
The bootloader relies on certain CPU and SoC extensions and modules to be enabled to allow full functionality.
REQUIRED |
The bootloader is implemented only if the INT_BOOTLOADER_EN is true (default). This will automatically select the CPU’s Indirect Boot boot configuration. |
REQUIRED |
The bootloader requires the privileged architecture CPU extension ( |
REQUIRED |
At least 512 bytes of data memory (processor-internal DMEM or processor-external DMEM) are required for the bootloader’s stack. |
RECOMMENDED |
For user interaction via UART (like uploading executables) the primary UART (Primary Universal Asynchronous Receiver and Transmitter (UART0)) has to be implemented. Without UART0 the auto-boot via SPI is still supported but the bootloader should be customized (see User Guide). |
RECOMMENDED |
The default bootloader uses bit 0 of the General Purpose Input and Output Port (GPIO) output port to drive a high-active "heart beat" status LED. |
RECOMMENDED |
The Machine System Timer (MTIME) is used to control blinking of the status LED and also to automatically trigger the auto-boot sequence. |
OPTIONAL |
The SPI controller (Serial Peripheral Interface Controller (SPI)) is needed to store/load executable from external flash (for the auto boot feature). |
OPTIONAL |
The XIP controller (Execute In Place Module (XIP)) is needed to execute code directly from a pre-programmed SPI flash. |
4.5.2. Bootloader Flash Requirements
The bootloader can access an SPI-compatible flash via the processor’s top entity SPI port. By default, the flash
chip-select line is driven by spi_csn_o(0)
and the SPI clock uses 1/8 of the processor’s main clock as clock frequency.
The SPI flash has to support single-byte read and write operations, 24-bit addresses and at least the following standard commands:
-
0x02
: Program page (write byte) -
0x03
: Read data (byte) -
0x04
: Write disable (for volatile status register) -
0x05
: Read (first) status register -
0x06
: Write enable (for volatile status register) -
0xD8
: Block erase (64kB)
Custom Configuration
Most properties (like chip select line, flash address width, SPI clock frequency, …) of the default bootloader can be reconfigured
without the need to change the source code. Custom configuration can be made using command line switches when recompiling the bootloader.
See the User Guide https://stnolting.github.io/neorv32/ug/#_customizing_the_internal_bootloader for more information.
|
4.5.3. Bootloader Console
To interact with the bootloader, connect the primary UART (UART0) signals (uart0_txd_o
and
uart0_rxd_o
) of the processor’s top entity via a serial port (-adapter) to your computer (hardware flow control is
not used so the according interface signals can be ignored.), configure your
terminal program using the following settings and perform a reset of the processor.
Terminal console settings (19200-8-N-1
):
-
19200 Baud
-
8 data bits
-
no parity bit
-
1 stop bit
-
newline on
\r\n
(carriage return, newline) -
no transfer protocol / control flow protocol - just raw bytes
Any terminal program that can connect to a serial port should work. However, make sure the program can transfer data in raw byte mode without any protocol overhead (e.g. XMODEM). Some terminal programs struggle with transmitting files larger than 4kB (see https://github.com/stnolting/neorv32/pull/215). Try a different terminal program if uploading of a binary does not work. |
The bootloader uses the LSB of the top entity’s gpio_o
output port as high-active status LED. All other
output pins are set to low level and won’t be altered. After reset, the status LED will start blinking at 2Hz and the
following intro screen shows up:
<< NEORV32 Bootloader >>
BLDV: Jul 11 2022
HWV: 0x01070307
CID: 0x00000000
CLK: 0x05f5e100
ISA: 0x40901104 + 0xc0000783
SOC: 0x7c5f400f
IMEM: 0x00004000 bytes @0x00000000
DMEM: 0x00002000 bytes @0x80000000
Autoboot in 8s. Press any key to abort.
The start-up screen gives some brief information about the bootloader and several system configuration parameters:
|
Bootloader version (built date). |
|
Processor hardware version (the |
|
Custom user-defined ID (via the |
|
Processor clock speed in Hz (via the |
|
|
|
Processor configuration (via the |
|
IMEM memory base address and size in byte (via the |
|
DMEM memory base address and size in byte (via the |
Now you have 8 seconds to press any key. Otherwise, the bootloader starts the Auto Boot Sequence. When you press any key within the 8 seconds, the actual bootloader user console starts:
<< NEORV32 Bootloader >>
BLDV: Jul 11 2022
HWV: 0x01070307
CLK: 0x05f5e100
ISA: 0x40901104 + 0xc0000783
SOC: 0x7c5f400f
IMEM: 0x00004000 bytes @0x00000000
DMEM: 0x00002000 bytes @0x80000000
Autoboot in 8s. Press any key to abort.
Aborted. (1)
Available commands:
h: Help
r: Restart
u: Upload
s: Store to flash
l: Load from flash
x: Boot from flash (XIP)
e: Execute
CMD:>
1 | Auto boot sequence aborted due to user console input. |
The auto boot countdown is stopped and the bootloader’s user console is ready to receive one of the following commands:
-
h
: Show the help text (again) -
r
: Restart the bootloader and the auto-boot sequence -
u
: Upload new program executable (neorv32_exe.bin
) via UART into the instruction memory -
s
: Store executable to SPI flash atspi_csn_o(0)
(little-endian byte order) -
l
: Load executable from SPI flash atspi_csn_o(0)
(little-endian byte order) -
x
: Boot program directly from flash via XIP (requires a pre-programmed image) -
e
: Start the application, which is currently stored in the instruction memory (IMEM)
A new executable can be uploaded via UART by executing the u
command. After that, the executable can be directly
executed via the e
command. To store the recently uploaded executable to an attached SPI flash press s
. To
directly load an executable from the SPI flash press l
. The bootloader and the auto-boot sequence can be
manually restarted via the r
command.
Booting via XIP
The bootloader allows to execute an application right from flash using the Execute In Place Module (XIP) module.
This requires a pre-programmed flash. The bootloader’s "store" option can not be used to program an XIP image.
|
Default Configuration
More information regarding the default SPI, GPIO, XIP, etc. configuration can be found in the User Guide
section https://stnolting.github.io/neorv32/ug/#_customizing_the_internal_bootloader.
|
SPI Flash Programming
For detailed information on using an SPI flash for application storage see User Guide section
Programming an External SPI Flash via the Bootloader.
|
4.5.4. Auto Boot Sequence
When you reset the NEORV32 processor, the bootloader waits 8 seconds for a UART console input before it
starts the automatic boot sequence. This sequence tries to fetch a valid boot image from the external SPI
flash, connected to SPI chip select spi_csn_o(0)
. If a valid boot image is found that can be successfully
transferred into the instruction memory, it is automatically started. If no SPI flash is detected or if there
is no valid boot image found, and error code will be shown.
4.5.5. Bootloader Error Codes
If something goes wrong during bootloader operation an error code and a short message is shown. In this case the processor is halted, the bootloader status LED is permanently activated and the processor has to be reset manually.
In many cases the error source is just temporary (like some HF spike during an UART upload). Just try again. |
|
If you try to transfer an invalid executable (via UART or from the external SPI flash), this error message shows up. There might be a transfer protocol configuration error in the terminal program or maybe just the wrong file was selected. Also, if no SPI flash was found during an auto-boot attempt, this message will be displayed. |
|
Your program is way too big for the internal processor’s instructions memory. Increase the memory size or reduce your application code. |
|
This indicates a checksum error. Something went wrong during the transfer of the program image (upload via UART or loading from the external SPI flash). If the error was caused by a UART upload, just try it again. When the error was generated during a flash access, the stored image might be corrupted. |
|
This error occurs if the attached SPI flash cannot be accessed. Make sure you have the right type of flash and that it is properly connected to the NEORV32 SPI port using chip select #0. |
|
The bootloader encountered an unexpected exception during operation. This might be caused when it tries to access peripherals that were not implemented during synthesis. Example: executing commands |
4.6. NEORV32 Runtime Environment
The NEORV32 software framework provides a minimal runtime environment (RTE) that takes care of a stable
and safe execution environment by handling all traps (= exceptions & interrupts). The RTE simplifies trap handling
by wrapping the CPU’s privileged architecture (i.e. trap-related CSRs) into a unified software API.
The NEORV32 RTE is a software library (sw/lib/source/neorv32_rte.c
) that is part of the default processor library set.
It provides public functions via sw/lib/include/neorv32_rte.h
for application interaction.
Once initialized, the RTE provides Default RTE Trap Handlers that catch all possible traps. These default handlers just output a message via UART to inform the user when a certain trap has been triggered. The default handlers can be overridden by the application code to install application-specific handler functions for each trap.
Using the RTE is optional but highly recommended. The RTE provides a simple and comfortable way of delegating traps to application-specific handlers while making sure that all traps (even though they are not explicitly used by the application) are handled correctly. Performance-optimized applications or embedded operating systems should not use the RTE for delegating traps. |
For the C standard runtime library see section [c_standard_library]. |
4.6.1. RTE Operation
The RTE handles the trap-related CSRs of the CPU’s privileged architecture (Machine Trap Handling CSRs).
It initializes the mtvec
CSR, which provides the base entry point for all trap
handlers. The address stored to this register reflects the first-level trap handler, which is provided by the
NEORV32 RTE. Whenever an exception or interrupt is triggered this first-level handler is executed.
The first-level handler performs a complete context save, analyzes the source of the trap and calls the according second-level trap handler, which takes care of the actual exception/interrupt handling. For this, the RTE manages a private look-up table to store the addresses of the according trap handlers.
After the initial RTE setup, each entry in the RTE’s trap handler look-up table is initialized with a Default RTE Trap Handlers. These default handler do not execute any trap-related operations - they just output a message via the primary UART (UART0) to inform the user that a trap has occurred, that is not handled by the actual application. After sending this message, the RTE tries to continue executing the user program.
4.6.2. Using the RTE
The NEORV32 is enabled by calling the RTE’s setup function:
void neorv32_rte_setup(void);
The RTE should be enabled right at the beginning of the application’s main function.
|
As mentioned above, all traps will only trigger execution of the RTE’s Default RTE Trap Handlers. To use application-specific handlers, which actually handle a trap, the default handlers can be overridden by installing user-defined ones:
int neorv32_rte_handler_install(uint8_t id, void (*handler)(void));
The first argument id
defines the "trap ID" (for example a certain interrupt request) that shall be handled
by the user-defined handler. The second argument *handler
is the actual function that implements the trap
handler. The function return zero on success and a non-zero value if an error occurred (invalid id
). In this
case no modifications to the RTE’s trap look-up-table will be made.
The custom handler functions need to have a specific format without any arguments an with no return value:
void custom_trap_handler_xyz(void) {
// handle trap...
}
Custom Trap Handler Attributes
Do NOT use the interrupt attribute for the application trap handler functions! This
will place a mret instruction to the end of it making it impossible to return to the first-level
trap handler of the RTE core, which will cause stack corruption.
|
The trap identifier id
specifies the according trap cause. These can be an asynchronous trap like
an interrupt from one of the processor modules or a synchronous trap triggered by software-caused events
like an illegal instruction or an environment call instruction. The sw/lib/include/neorv32_rte.h
library files
provides aliases for trap events supported by the CPU (see NEORV32 Trap Listing) that can be used when
installing custom trap handler functions:
ID alias [C] | Description / trap causing event |
---|---|
|
instruction address misaligned |
|
instruction (bus) access fault |
|
illegal instruction |
|
breakpoint ( |
|
load address misaligned |
|
load (bus) access fault |
|
store address misaligned |
|
store (bus) access fault |
|
environment call from machine mode ( |
|
environment call from user mode ( |
|
machine timer interrupt |
|
machine external interrupt |
|
machine software interrupt |
|
fast interrupt channel 0 |
|
fast interrupt channel 1 |
|
fast interrupt channel 2 |
|
fast interrupt channel 3 |
|
fast interrupt channel 4 |
|
fast interrupt channel 5 |
|
fast interrupt channel 6 |
|
fast interrupt channel 7 |
|
fast interrupt channel 8 |
|
fast interrupt channel 9 |
|
fast interrupt channel 10 |
|
fast interrupt channel 11 |
|
fast interrupt channel 12 |
|
fast interrupt channel 13 |
|
fast interrupt channel 14 |
|
fast interrupt channel 15 |
The following example shows how to install a custom handler (custom_mtime_irq_handler
) for handling
the RISC-V machine timer (MTIME) interrupt:
neorv32_rte_handler_install(RTE_TRAP_MTI, custom_mtime_irq_handler);
User-defined trap handlers can also be un-installed. This will remove the users trap handler from the RTE core and will re-install the Default RTE Trap Handlers for the specific trap.
int neorv32_rte_handler_uninstall(uint8_t id);
The argument id
defines the identifier of the according trap that shall be un-installed. The function return zero
on success and a non-zero value if an error occurred (invalid id
). In this case no modifications to the RTE’s trap
look-up-table will be made.
The following example shows how to un-install the custom handler custom_mtime_irq_handler
from the
RISC-V machine timer (MTIME) interrupt:
neorv32_rte_handler_uninstall(RTE_TRAP_MTI);
4.6.3. Default RTE Trap Handlers
The default RTE trap handlers are executed when a certain trap is triggered that is not (yet) handled by a user-defined application-specific trap handler. The default handler will output a message giving additional debug information via UART0 to inform the user and will try to resume normal program execution.
Continuing Execution
In most cases the RTE can successfully continue operation - for example if it catches an interrupt request that is not handled
by the actual application program. However, if the RTE catches an un-handled trap like a bus access fault
continuing execution will most likely fail making the CPU crash.
|
<RTE> Illegal instruction @ PC=0x000002d6, INST=0x000000FF </RTE> (1)
<RTE> Illegal instruction @ PC=0x00000302, INST=0x0000 </RTE> (2)
<RTE> Load address misaligned @ PC=0x00000440, ADDR=0x80000101 </RTE> (3)
<RTE> Fast IRQ 0x00000003 @ PC=0x00000820 </RTE> (4)
1 | Illegal 32-bit instruction at address 0x000002d6. |
2 | Illegal 16-bit instruction at address 0x00000302. |
3 | Misaligned load access at address 0x00000440 (trying to load a full word from 0x80000101). |
4 | Fast interrupt request from channel 3 before executing instruction at address 0x00000820. |
The specific message right at the beginning of the debug trap handler message corresponds to the trap code from the
mcause
CSR (see NEORV32 Trap Listing). A full list of all messages and the according mcause
trap codes is shown below.
Trap identifier | According mcause CSR value |
---|---|
"Instruction address misaligned" |
|
"Instruction access fault" |
|
"Illegal instruction" |
|
"Breakpoint" |
|
"Load address misaligned" |
|
"Load access fault" |
|
"Store address misaligned" |
|
"Store access fault" |
|
"Environment call from U-mode" |
|
"Environment call from M-mode" |
|
"Machine software IRQ" |
|
"Machine timer IRQ" |
|
"Machine external IRQ" |
|
"Fast IRQ 0x00000000" |
|
"Fast IRQ 0x00000001" |
|
"Fast IRQ 0x00000002" |
|
"Fast IRQ 0x00000003" |
|
"Fast IRQ 0x00000004" |
|
"Fast IRQ 0x00000005" |
|
"Fast IRQ 0x00000006" |
|
"Fast IRQ 0x00000007" |
|
"Fast IRQ 0x00000008" |
|
"Fast IRQ 0x00000009" |
|
"Fast IRQ 0x0000000a" |
|
"Fast IRQ 0x0000000b" |
|
"Fast IRQ 0x0000000c" |
|
"Fast IRQ 0x0000000d" |
|
"Fast IRQ 0x0000000e" |
|
"Fast IRQ 0x0000000f" |
|
"Unknown trap cause" |
unknown |
Bus Access Faults
For bus access faults the RTE default trap handlers also output the error code from the Internal Bus Monitor (BUSKEEPER) to show the cause of the bus fault. One example is shown below.
<RTE> Load access fault [TIMEOUT_ERR] @ PC=0x00000150, MTVAL=0xFFFFFF70 </RTE>
The additional message encapsulated in [ ]
shows the actual cause of the bus access fault.
Three different messages are possible here:
-
[TIMEOUT_ERR]
: The accessed memory-mapped module did not respond within the valid access time window. In Most cases this is caused by accessing a module that has not been implemented or when accessing "address space holes" (unused/unmapped addresses). -
[DEVICE_ERR]
: The accesses memory-mapped module asserted it’s error signal to indicate an invalid access. For example this can be caused by trying to write to read-only registers or by writing data quantities (like a byte) to devices that do not support sub-word write accesses. -
[PMP_ERR]
: This indicates an access right violation caused by thePMP
Physical Memory Protection.
5. On-Chip Debugger (OCD)
The NEORV32 Processor features an on-chip debugger (OCD) implementing execution-based debugging compatible
to the Minimal RISC-V Debug Specification Version 1.0. Please refer to this spec for in-deep information.
A copy of the specification is available in docs/references
.
Section Structure
The NEORV32 OCD provides the following key features:
-
JTAG access port
-
run-control of the CPU: halting, single-stepping and resuming
-
executing arbitrary programs during debugging
-
indirect access to all core registers (via program buffer)
-
indirect access to the whole processor address space (via program buffer)
-
trigger module for hardware breakpoints
-
compatible with upstream OpenOCD and GDB
OCD Security Note
Access via the OCD is always authenticated (dmstatus.authenticated = 1 ). Hence, the
whole system can always be accessed via the on-chip debugger. Currently, there is no option
to disable the OCD via software - the OCD can only be disabled by disabling implementation
(setting ON_CHIP_DEBUGGER_EN generic to false).
|
Hands-On Tutorial
A simple example on how to use NEORV32 on-chip debugger in combination with OpenOCD and the GNU debugger
is shown in section Debugging using the On-Chip Debugger
of the User Guide.
|
The NEORV32 on-chip debugger complex is based on four hardware modules:

-
Debug Transport Module (DTM) (
rtl/core/neorv32_debug_dtm.vhd
): JTAG access tap to allow an external adapter to interface with the debug module(DM) using the debug module interface (dmi) - this interface is compatible to the interface description shown in Appendix 3 of the "RISC-V debug stable" specification. -
Debug Module (DM) (
rtl/core/neorv32_debug_tm.vhd
): Debugger control unit that is configured by the DTM via the the dmi. From the CPU’s "point of view" this module behaves as another memory-mapped "peripheral" that can be accessed via the processor-internal bus. The memory-mapped registers provide an internal data buffer for data transfer from/to the DM, a code ROM containing the "park loop" code, a program buffer to allow the debugger to execute small programs defined by the DM and a status register that is used to communicate exception, _halt, resume and execute requests/acknowledges from/to the DM. -
CPU CPU Debug Mode extension (part of
rtl/core/neorv32_cpu_control.vhd
): This extension provides the "debug execution mode" which executes the "park loop" code from the DM. The mode also provides additional CSRs. -
CPU Trigger Module (also part of
rtl/core/neorv32_cpu_control.vhd
): This module provides a single hardware breakpoint, which allows to debug code executed from ROM.
Theory of Operation
When debugging the system using the OCD, the debugger issues a halt request to the CPU (via the CPU’s
db_halt_req_i
signal) to make the CPU enter debug mode. In this state, the application-defined architectural
state of the system/CPU is "frozen" so the debugger can monitor if without interfering the actual application.
However, the OCD can also modify the entire architectural state at any time.
While in debug mode, the CPU executes the "park loop" code from the code ROM of the DM. This park loop implements an endless loop, in which the CPU polls the memory-mapped status register that is controlled by the debug module (DM). The flags in this register are used to communicate requests from the DM and to acknowledge them by the CPU: trigger execution of the program buffer or resume the halted application. Furthermore, the CPU uses this register to signal that the CPU has halted after a halt request and to signal that an exception has fired while in debug mode.
5.1. Debug Transport Module (DTM)
The debug transport module (VHDL module: rtl/core/neorv32_debug_dtm.vhd
) provides a JTAG test access port (TAP).
The DTM is the first entity in the debug system, which connects and external debugger via JTAG to the next debugging
entity - the debug module (DM).
External JTAG access is provided by the following top-level ports.
Name | Width | Direction | Description |
---|---|---|---|
|
1 |
in |
TAP reset (low-active); this signal is optional, make sure to pull it high if it is not used by the JTAG adapter |
|
1 |
in |
serial clock |
|
1 |
in |
serial data input |
|
1 |
out |
serial data output |
|
1 |
in |
mode select |
Maximum JTAG Clock
All JTAG signals are synchronized to the processor clock domain by oversampling them in the DTM. Hence, no additional
clock domain is required for the DTM. However, this constraints the maximal JTAG clock frequency (jtag_tck_i ) to be less
than or equal to 1/5 of the processor clock frequency (clk_i ).
|
If the on-chip debugger is disabled (ON_CHIP_DEBUGGER_EN = false) the JTAG serial input jtag_tdi_i is directly
connected to the JTAG serial output jtag_tdo_o to maintain the JTAG chain.
|
The NEORV32 JTAG TAP does not provide a boundary check function (yet?). Hence, physical device pins cannot be accessed. |
The DTM uses the "debug module interface (dmi)" to access the actual debug module (DM).
The accesses are controlled by TAP-internal registers, which are selected by the JTAG instruction register (IR
)
and accessed through the JTAG data register (DR
).
The DTM’s instruction and data registers can be accessed using OpenOCD’s irscan and drscan commands.
OpenOCD also provides low-level RISC-V-specific commands for direct DMI accesses (riscv dmi_read & riscv dmi_write ).
|
JTAG accesses are based on a single instruction register IR
, which is 5 bit wide, and several data registers DR
with different sizes. The individual data registers are accessed by writing the according address to the instruction
register. The following table shows the available data registers and their addresses:
Address (via IR ) |
Name | Size [bits] | Description |
---|---|---|---|
|
|
32 |
identifier, default: |
|
|
32 |
debug transport module control and status register |
|
|
40 |
debug module interface (dmi); 6-bit address, 32-bit read/write data, 2-bit operation ( |
others |
|
1 |
default JTAG bypass register |
Bit(s) | Name | R/W | Description |
---|---|---|---|
31:18 |
- |
r/- |
reserved, hardwired to zero |
17 |
|
r/w |
setting this bit will reset the debug module interface; this bit auto-clears |
16 |
|
r/w |
setting this bit will clear the sticky error state; this bit auto-clears |
15 |
- |
r/- |
reserved, hardwired to zero |
14:12 |
|
r/- |
recommended idle states (= 0, no idle states required) |
11:10 |
|
r/- |
DMI status: |
9:4 |
|
r/- |
number of address bits in |
3:0 |
|
r/- |
|
See the RISC-V debug specification for more information regarding the data
registers and operations. A local copy can be found in docs/references
.
Most FPGAs are programmed over a JTAG connection itself and support the use of it in user designs with instantiation of
platform-specific entities. So instead of two JTAG connections, one to program the FPGA and one to debug the core,
only one connection is needed. See the setups in [neorv32-setups ](https://github.com/stnolting/neorv32-setups)
for example implementations.
|
5.2. Debug Module (DM)
According to the RISC-V debug specification, the DM (VHDL module: rtl/core/neorv32_debug_dm.vhd
)
acts as a translation interface between abstract operations issued by the debugger (application) and the
platform-specific debugger (circuit) implementation. It supports the following features (excerpt from the debug spec):
-
Gives the debugger necessary information about the implementation.
-
Allows the hart to be halted and resumed and provides status of the current state.
-
Provides abstract read and write access to the halted hart’s GPRs.
-
Provides access to a reset signal that allows debugging from the very first instruction after reset.
-
Provides a mechanism to allow debugging the hart immediately out of reset. (still experimental)
-
Provides a Program Buffer to force the hart to execute arbitrary instructions.
-
Allows memory access from a hart’s point of view.
The NEORV32 DM follows the "Minimal RISC-V External Debug Specification" to provide full debugging capabilities while keeping resource/area requirements at a minimum level. It implements the execution based debugging scheme for a single hart and provides the following hardware features:
-
program buffer with 2 entries and implicit
ebreak
instruction afterwards -
no direct bus access; indirect bus access via the CPU using the program buffer
-
abstract commands: "access register" plus auto-execution
-
no dedicated halt-on-reset capabilities yet (but can be emulated)
The DM provides two access "point of views": accesses from the DTM via the debug module interface (dmi) and accesses from the CPU via the processor-internal bus. From the DTM’s point of view, the DM implements a set of DM Registers that are used to control and monitor the actual debugging. From the CPU’s point of view, the DM implements several memory-mapped registers (within the normal address space) that are used for communicating debugging control and status (DM CPU Access).
5.2.1. DM Registers
The DM is controlled via a set of registers that are accessed via the DTM’s dmi. The "Minimal RISC-V Debug Specification" requires only a subset of the registers specified in the spec. The following registers are implemented:
Write accesses to registers that are not implemented are simply ignored and read accesses will always return zero. Register names that are encapsulated in "( )" are not actually implemented; however, they are listed to explicitly show their functionality. |
Address | Name | Description |
---|---|---|
|
|
Abstract data 0, used for data transfer between debugger and processor |
|
|
Debug module control |
|
|
Debug module status |
|
|
Hart information |
|
|
Abstract control and status |
|
|
Abstract command |
|
|
Abstract command auto-execution |
|
( |
Base address of next DM; reads as zero to indicate there is only one DM |
|
|
Program buffer 0 |
|
|
Program buffer 1 |
|
( |
System bus access control and status; reads as zero to indicate there is no direct system bus access |
data
0x04 |
Abstract data 0 |
|
Reset value: |
||
Basic read/write registers to be used with abstract commands (for example to read/write data from/to CPU GPRs). |
dmcontrol
0x10 |
Debug module control register |
|
Reset value: |
||
Control of the overall debug module and the hart. The following table shows all implemented bits. All remaining bits/bit-fields are configured as "zero" and are read-only. Writing '1' to these bits/fields will be ignored. |
Bit | Name [RISC-V] | R/W | Description |
---|---|---|---|
31 |
|
-/w |
set/clear hart halt request |
30 |
|
-/w |
request hart to resume |
28 |
|
-/w |
write |
1 |
|
r/w |
put whole processor into reset when |
0 |
|
r/w |
DM enable; writing |
dmstatus
0x11 |
Debug module status register |
|
Reset value: |
||
Current status of the overall debug module and the hart. The entire register is read-only. |
Bit | Name [RISC-V] | Description |
---|---|---|
31:23 |
reserved |
reserved; always zero |
22 |
|
always |
21:20 |
reserved |
reserved; always zero |
19 |
|
|
18 |
|
|
17 |
|
|
16 |
|
|
15 |
|
always zero to indicate the hart is always existent |
14 |
|
|
13 |
|
|
12 |
|
|
11 |
|
|
10 |
|
|
9 |
|
|
8 |
|
|
7 |
|
always |
6 |
|
always |
5 |
|
always |
4 |
|
always |
3:0 |
|
|
hartinfo
0x12 |
Hart information |
|
Reset value: see below |
||
This register gives information about the hart. The entire register is read-only. |
Bit | Name [RISC-V] | Description |
---|---|---|
31:24 |
reserved |
reserved; always zero |
23:20 |
|
|
19:17 |
reserved |
reserved; always zero |
16 |
|
|
15:12 |
|
|
11:0 |
|
= |
abstracts
0x16 |
Abstract control and status |
|
Reset value: |
||
Command execution info and status. |
Bit | Name [RISC-V] | R/W | Description |
---|---|---|---|
31:29 |
reserved |
r/- |
reserved; always zero |
28:24 |
|
r/- |
always |
23:11 |
reserved |
r/- |
reserved; always zero |
12 |
|
r/- |
|
11 |
|
r/- |
always |
10:8 |
|
r/w |
error during command execution (see below); has to be cleared by writing |
7:4 |
reserved |
r/- |
reserved; always zero |
3:0 |
|
r/- |
always |
Error codes in cmderr
(highest priority first):
-
000
- no error -
100
- command cannot be executed since hart is not in expected state -
011
- exception during command execution -
010
- unsupported command -
001
- invalid DM register read/write while command is/was executing
PMP Rules
When in debug-mode all PMP rules are ignored making the debugger have maximum access rights.
|
command
0x17 |
Abstract command |
|
Reset value: |
||
Writing this register will trigger the execution of an abstract command. New command can only be executed if
|
The NEORV32 DM only supports Access Register abstract commands. These commands can only access the
hart’s GPRs (abstract command register index 0x1000 - 0x101f ).
|
Bit | Name [RISC-V] | R/W | Description / required value |
---|---|---|---|
31:24 |
|
-/w |
|
23 |
reserved |
-/w |
reserved, has to be |
22:20 |
|
-/w |
|
21 |
|
-/w |
|
18 |
|
-/w |
if set the program buffer is executed after the command |
17 |
|
-/w |
if set the operation in |
16 |
|
-/w |
|
15:0 |
|
-/w |
GPR-access only; has to be |
abstractauto
0x18 |
Abstract command auto-execution |
|
Reset value: |
||
Register to configure when a read/write access to a DM repeats execution of the last abstract command. |
Bit | Name [RISC-V] | R/W | Description |
---|---|---|---|
17 |
|
r/w |
when set reading/writing from/to |
16 |
|
r/w |
when set reading/writing from/to |
0 |
|
r/w |
when set reading/writing from/to |
progbuf
0x20 |
Program buffer 0 |
|
0x21 |
Program buffer 1 |
|
Reset value: |
||
Program buffer (two entries) for the DM. Note that this register is read-only for the DM (allowed since spec. version 1.0)! |
5.2.2. DM CPU Access
From the CPU’s perspective, the DM behaves as a memory-mapped peripheral that includes the following sub-modules:
-
a small ROM that contains the code for the "park loop", which is executed when the CPU is in debug mode
-
a program buffer populated by the debugger host to execute small programs
-
a data buffer to transfer data between the processor and the debugger host
-
a status register to communicate debugging requests and status (see
sw/ocd-firmware/README.md
).
The DM occupies 256 bytes of the CPU’s address space starting at address dm_base_c
(see table below).
This address space is divided into four sections of 64 bytes each to provide access to the park loop code ROM,
the program buffer, the data buffer and the status register. The program buffer, the data buffer and the
status register do not fully occupy the 64-byte-wide sections. However, the according registers are mirrored
to fill the entire section.
Base address | Name [VHDL package] | Actual size | Description |
---|---|---|---|
|
|
64 bytes |
ROM for the "park loop" code |
|
|
16 bytes |
Program buffer, provided by DM |
|
|
4 bytes |
Data buffer ( |
|
|
4 bytes |
Control and status register |
DM Register Access
All memory-mapped registers of the DM can only be accessed by the CPU if it is actually in debug mode.
Hence, the DM registers are not "visible" for normal CPU operations.
Any CPU access outside of debug mode will raise a bus access fault exception.
|
Park Loop Code Sources ("OCD Firmware")
The assembly sources of the park loop code are available in sw/ocd-firmware/park_loop.S . Please note, that
these sources are not intended to be changed by the user. Hence, the makefile does not provide an automatic option
to compile and "install" the debugger ROM code into the HDL sources and require a manual copy
|
Code ROM Entry Points
The park loop code provides two entry points, where the actual code execution can start. These are used to enter the park loop either when an explicit request has been issued (for example a halt request) or when an exception has occurred while executing the park loop itself.
Address | Description |
---|---|
|
Exception entry address |
|
Normal entry address |
When the CPU enters or re-enters debug mode (for example via an ebreak
in the DM’s program buffer), it jumps to
address of the normal entry point for the park loop code defined by the CPU_DEBUG_PARK_ADDR generic.
By default, this generic is set to dm_park_entry_c
, which is defined in main package file.
If an exception is encountered during debug mode, the CPU jumps to the address of the exception entry point
defined by the CPU_DEBUG_EXC_ADDR generic. By default, this generic is set to dm_exc_entry_c
, which is
also defined in main package file.
Status Register
The status register provides a direct communication channel between the CPU’s debug mode executing the park loop and the host-controlled debug module (DM). This register is used to communicate requests, which are issued by the DM. and the according acknowledges, which are generated by the CPU.
There are only 4 bits in this register that are used to implement the requests/acknowledges. Each bit is left-aligned in one sub-byte of the entire 32-bit register. Thus, the CPU can access each bit individually using store-byte and load-byte instruction. This eliminates the need to perform bit-masking in the park loop code leading to less code size and faster execution.
Bit | Name | CPU access | Description |
---|---|---|---|
0 |
|
read |
this bit is write-only |
- |
write |
Set by the CPU while it is halted (and executing the park loop) |
|
8 |
|
read |
Set by the DM to request the CPU to resume normal operation |
|
write |
Set by the CPU before it starts resuming |
|
16 |
|
read |
Set by the DM to request execution of the program buffer |
|
write |
Set by the CPU before it starts executing the program buffer |
|
24 |
- |
read |
this bit is write-only |
|
write |
Set by the CPU if an exception occurs while being in debug mode |
Access Details
The underlaying hardware to implement the CPU access to the status register is highly optimized to provide
fastest access times while requiring minimal code and hardware size: the actual data written by the CPU is irrelevant
as only the sub-byte accesses (so, the actual bus transactions) are tracked by the status register hardware.
|
5.3. CPU Debug Mode
The NEORV32 CPU Debug Mode DB
or DEBUG
is compatible to the Minimal RISC-V Debug Specification 1.0
Sdext
(external debug) ISA extension. When enabled via the CPU_EXTENSION_RISCV_Sdext generic (CPU) and/or
the ON_CHIP_DEBUGGER_EN (Processor) it adds a new CPU operation mode ("debug mode"), three additional CSRs
(section CPU Debug Mode CSRs) and one additional instruction (dret
) to the core.
The CPU debug mode requires the Zicsr and Zifencei CPU extension to be implemented (top generics
CPU_EXTENSION_RISCV_Zicsr and CPU_EXTENSION_RISCV_Zifencei = true).
|
The CPU debug-mode is entered when one of the following events appear:
-
executed
ebreak
instruction (when in machine-mode anddcsr.ebreakm
is set OR when in user-mode anddcsr.ebreaku
is set) -
debug halt request from external DM (via CPU signal
db_halt_req_i
, high-active, triggering on rising-edge) -
finished executing of a single instruction while in single-step debugging mode (enabled via
dcsr.step
) -
hardware trigger by the Trigger Module
From a hardware point of view, these "entry conditions" are special traps that are handled transparently by the control logic.
Whenever the CPU enters debug-mode it performs the following operations:
-
wake-up CPU if it was send to sleep mode by the
wfi
instruction -
move
pc
todpc
-
copy the hart’s current privilege level to
dcsr.prv
-
set
dcrs.cause
according to the cause why debug mode is entered -
no update of
mtval
,mcause
,mtval
andmstatus
CSRs -
load the address configured via the CPU’s CPU_DEBUG_PARK_ADDR generic to the
pc
to jump to the "debugger park loop" code stored in the debug module (DM)
When the CPU is in debug-mode the following things are important:
-
while in debug mode, the CPU executes the parking loop and - if requested by the DM - the program buffer
-
effective CPU privilege level is
machine
mode; any active physical memory protection (PMP) configuration is bypassed -
the
wfi
instruction acts as anop
(also during single-stepping) -
if an exception occurs while being in debug mode:
-
if the exception was caused by any debug-mode entry action the CPU jumps to the normal entry point (defined by CPU_DEBUG_PARK_ADDR generic) of the park loop again (for example when executing
ebreak
while in debug-mode) -
for all other exception sources the CPU jumps to the exception entry point (defined by CPU_DEBUG_EXC_ADDR generic) to signal an exception to the DM; the CPU restarts the park loop again afterwards
-
-
interrupts are disabled; however, they will remain pending and will get executed after the CPU has left debug mode
-
if the DM makes a resume request, the park loop exits and the CPU leaves debug mode (executing
dret
) -
the standard counters (Machine) Counter and Timer CSRs
[m]cycle[h]
and[m]instret[h]
are stopped; note that the Machine System Timer (MTIME) keep running as well as it’s shadowed copies in the[m]time[h]
CSRs -
all Hardware Performance Monitors (HPM) CSRs are stopped
Debug mode is left either by executing the dret
instruction or by performing
a hardware reset of the CPU. Executing dret
outside of debug mode will raise an illegal instruction exception.
Whenever the CPU leaves debug mode it performs the following operations:
-
set the hart’s current privilege level according to
dcsr.prv
-
restore
pc
fromdpcs
-
resume normal operation at
pc
5.3.1. CPU Debug Mode CSRs
Two additional CSRs are required by the Minimal RISC-V Debug Specification: the debug mode control and status register
dcsr
and the debug program counter dpc
. An additional general purpose scratch register for debug mode only
(dscratch0
) allows faster execution by having a fast-accessible backup register.
The debug-mode CSRs are only accessible when the CPU is in debug mode. If these CSRs are accessed outside of debug mode an illegal instruction exception is raised. |
dcsr
0x7b0 |
Debug control and status register |
|
Reset value: |
||
The |
Bit | Name [RISC-V] | R/W | Description |
---|---|---|---|
31:28 |
|
r/- |
|
27:16 |
- |
r/- |
|
15 |
|
r/w |
|
14 |
|
r/- |
|
13 |
|
r/- |
|
12 |
|
r/w |
|
11 |
|
r/- |
|
10 |
|
r/- |
|
9 |
|
r/- |
|
8:6 |
|
r/- |
cause identifier - why debug mode was entered (see below) |
5 |
- |
r/- |
|
4 |
|
r/- |
|
3 |
|
r/- |
|
2 |
|
r/w |
enable single-stepping when set |
1:0 |
|
r/w |
CPU privilege level before/after debug mode |
Cause codes in dcsr.cause
(highest priority first):
-
010
- trigger by hardware Trigger Module -
001
- executedEBREAK
instruction -