CPU

The SMC CPU subsystem contains four Rocket RV64GC cores, each with private instruction and data caches. The cores share a 1 MiB scratchpad and a 128 KiB boot ROM through the Chipyard-generated TileLink interconnect. AXI4 bridges connect the cluster to the SMC fabric.

This chapter describes the generated configuration, memory interfaces and CPU reset boundary. The Rocket Chip documentation provides background on the core and generator.

Figure 1 shows the CPU cluster, memory hierarchy, and fabric bridge.

SMC CPU cluster: four Rocket tiles on the TileLink system bus, the control, front and memory buses, and the AXI4 bridges and isolation at the cluster boundary, with the scratchpad SRAM and boot ROM macros outside the SMC
Figure 1. SMC CPU cluster and TileLink-to-AXI integration

The figure separates three implementation boundaries:

  • u_digital_top contains the generated cluster and TileLink buses.

  • u_smc_cpu adds AXI isolation, reset sequencing and scratchpad zero-fill.

  • u_smc_cpu_wrapper adds the front-port demultiplexer, cpu_ctrl registers and boot ROM bridge.

Each tile connects to the system bus (sbus) as a manager and to the control bus (cbus) through its Bus Error Unit (BEU) subordinate port. Debug system bus accesses and the L2 frontend port enter sbus through the front bus (fbus). The coherence manager (coh_wrapper, a TileLink broadcast hub) connects to the memory bus (mbus), which serves the scratchpad and boot ROM. The PLIC receives four watchdog and four BEU interrupt sources; these paths are omitted from the figure.

Thick lines denote AXI4; thin dark lines denote TileLink, except for the AXI-Lite link to cpu_ctrl. The scratchpad contains 32 TLRAM banks with SECDED encode/decode logic. The SRAM macros, L1 tag/data arrays and boot ROM macro sit outside SMC. Memory interface ports carry their requests through the SMC boundary, including one 72-bit port for each scratchpad bank.

1. Processor Core

Table 1 summarizes the processor configuration.

Table 1. SMC processor core features
Attribute Description

Cores

4, Rocket RV64GC

Base ISA

RV64GC (I, M, A, F, D, C extensions)

Additional configured extensions

Zba, Zbb, Zbs and conditional-zero instructions

Microarchitecture

In-order, 5-stage pipeline

Privilege Levels

M/S/U

Phys. Address

56 bits

Reset Vector

Per-core, independently configurable (56b)

2. Local Memory

Table 2 lists the memory geometry in the generated cluster and the associated macro controls.

Table 2. SMC cache and memory hierarchy
Component Configured Size Protection / role Macro controls

L1 I-Cache per core

4 KiB (32 sets × 2 ways)

Read-only instruction cache; tag/data parity

icache_tag_cfg / icache_data_cfg

L1 D-Cache per core

4 KiB (32 sets × 2 ways)

Write-back data cache; tag/data SECDED ECC

dcache_tag_cfg / dcache_data_cfg

Local SRAM/Scratchpad

1 MiB (32 banks)

Shared local memory; SECDED ECC

scratch_ram_cfg

Boot ROM

128 KiB

Read-only, stores boot firmware

rom_cfg

The sizes and associativity above are set by the Chipyard configuration and its generated memory interfaces. Changing them requires a matching generated cluster and memory implementation. The *_cfg signals configure the external memory macros; they are passed unchanged to each macro and do not resize caches or the scratchpad. Macro-specific repair and power controls depend on the selected memory implementation.

The cluster uses TileLink internally for the scratchpad and boot ROM, for the PLIC, CLINT and BEUs on the control bus, and for watchdog timers on the peripheral bus. At its boundary, the MMIO manager bridge converts TileLink to AXI4; the L2 frontend bridge converts incoming AXI4 to TileLink. The front-port branch serving cpu_ctrl uses AXI4-Lite. Both AXI4 ports connect to the SMC Fabric.

3. Reset and Boot

CPU_CTRL.RESET_CTRL provides per-core reset controls and reset-pulse requests, plus separate uncore and debug-module reset controls. Each core has a 56-bit RESET_VECTOR register, reset to the boot ROM base 0xC004_0000. The wrapper supplies these values to the generated cluster. While warm reset is asserted, it selects 0xC004_0000 instead of the programmed vectors.

Individual core reset clears the core’s private L1 cache and TileLink client state without resetting the shared coherence manager. The current SMC Rocket integration provides no reset-aware coherence mechanism to drain outstanding transactions or preserve dirty cache data. The AXI boundary drain described below does not remove this limitation.

The scratchpad zero-fill sequencer starts when its memory-initialization reset releases. It writes zeros across the scratchpad banks and holds the cores in reset until initialization completes. smc_disable_sram_auto_init_i bypasses this operation. smc_init_mem_done_o reports either completion or bypass; it does not certify memory repair, MBIST success or initialized contents when zero-fill is skipped. The integrator must provide suitable memory contents and ECC state before use when bypassing initialization.

4. Memory Repair

Memory repair and memory built-in self-test (MBIST) are external DFT responsibilities. The external repair controller applies redundant memory elements as required by the selected SRAM implementation. The SMC fuse map provides no repair-data storage; the integrator supplies the repair data and its storage location.

The intended cold-boot sequence is fuse sensing, external repair, then MBIST before normal CPU use. SMC supplies the following sequencing and status interfaces; it does not implement the external repair algorithm.

smc_fuse_sense_done_o

Signals completion of fuse sensing into shadow registers. External DFT logic can use it to begin the repair/MBIST sequence.

ext_boot_seq_done_i

Reports completion of the external boot sequence. Its qualified value gates fuse-reset release together with fuse sensing; the repair and MBIST status bits themselves are not this handshake.

skip_mem_repair_o

Asserted by the synchronized isolation pin or the FLR-set ISOLATE_REQ_SMC_REG latch. Software writes can clear this latch but cannot set it. A request through the separate ISOLATE_REQ_REG register does not assert this output. External logic determines how it bypasses repair/MBIST.

BYPASS_SRAM_REPAIR (STRAPS_LO[13])

Requests repair bypass. The ROM skips its repair-status check when this strap is set; the external integration owns the repair bypass behavior.

mem_repair_done / mem_repair_success

External completion and success status, visible in DFX_CTRL_STATUS.STATUS_SMU at 0xC000_B800.

The ROM checks repair status during early startup, before normal stack use. It treats a clear mem_repair_done as repair not required rather than waiting for completion. When repair reports done, the ROM checks success; the SMC_CONFIG DFT-ignore-error setting can permit boot to continue after a reported failure. These firmware checks do not establish that repair has completed successfully. The external sequencer must enforce the platform’s repair and MBIST requirements before reporting boot-sequence completion.

5. System Interfaces

Table 3 identifies the protocols and roles of the CPU cluster interfaces.

Table 3. SMC CPU system interfaces
Interface Protocol Description

MMIO

AXI4

Manager port to the SMC fabric; 56-bit address, 64-bit data, 3-bit ID

L2 Frontend

AXI4

Subordinate port into the cluster through the front bus; 32-bit SMC-local address, 64-bit data, 8-bit ID

Debug

JTAG

JTAG debug transport module into the debug module on the control bus; system bus access through the front bus

6. CPU AXI Isolation

The cluster is reset independently of the surrounding SMC fabric. If the cluster were reset while a transaction on one of its AXI ports was still in flight, the fabric on the other side would be left waiting on a response that never returns, hanging the bus, and could sample boundary signals while they glitch through reset. To avoid this, each AXI port is wrapped in an axi_isolate block that drains the outstanding transactions and holds the boundary at safe values before the reset is allowed to take effect.

Two instances wrap the AXI ports listed above, each sized for up to four outstanding transactions:

  • the L2 frontend slave port, which blocks new transactions rather than terminating them, and

  • the MMIO master port, which terminates new transactions presented while isolated with SLVERR responses to keep reset-time X values from propagating into the fabric.

The non-AXI status crossings (wb_pc_valid, wb_reg_pc, and the per-core wdt_reset) are clamped to constants over the same window so they cannot leak glitches either. The boundary also self-isolates on cold boot, releasing four cycles after SRAM initialization completes and the cores and uncore are out of reset.

The boundary is shared by all cores and stays isolated while any core or the uncore is in reset. Holding one core in reset therefore also terminates the other cores' MMIO accesses with SLVERR and stalls L2 frontend traffic until every core is released.

6.1. Drain Handshake

The per-core reset sequence in the Programmer’s Guide gives the firmware steps. A software reset through CPU_CTRL.RESET_CTRL, whether a core or uncore reset bit or a core reset pulse, proceeds as follows:

  1. Firmware writes RESET_CTRL.

  2. The control logic (smc_cpu_ctrl_wrap) raises isolate_req_i and withholds the reset.

  3. Both axi_isolate instances drain their outstanding transactions and isolate.

  4. The cluster raises drained_o, and the control logic applies the reset.

  5. isolate_req_i stays high until every reset bit is released and every pulse completes. The boundary then reconnects.

6.2. Timeout Recovery

CPU_CTRL.RESET_TIMEOUT limits how long a software-requested reset waits for the drain handshake. A timeout_value of zero disables the timer. When the timer expires, timeout_mode=0 reports the timeout and continues to withhold the reset until the drain completes, then applies it. timeout_mode=1 forces the reset and flushes both AXI isolation blocks.

reset_timeout remains high until the software reset request is removed, including after a recovery flush completes. reset_applied is high once the reset is applied by a completed drain or a force-mode timeout.

The flush clears outstanding-transaction records at the cluster boundary and discards late responses and write data until isolation is released. This lets the reset complete when the CPU cluster is unresponsive but the surrounding fabric remains operational.

The flush cannot cancel an address request or write-data beat while VALID is high and READY is low. It waits for that transfer before flushing the channel. If READY never goes high, isolation cannot complete.

The flush clears only the CPU isolation blocks. It does not clear state elsewhere in the SMC fabric. The cluster reset may complete while another block remains unresponsive or holds a response, leaving that route or AXI ID blocked, so that block must be recovered separately or through the eventual cold reset.

6.3. Reset-Domain Crossing

The flops driving the isolate-control logic are held by the cluster’s uncore/core reset, while the flops inside axi_isolate are held by the Primary Reset (see Clock and Reset Management ). The uncore/core reset is driven from two sources:

  • a Warm Reset from a watchdog timeout, which is asynchronous to the isolate logic, and

  • a CPU CSR write (the reset-control register in smc_cpu_ctrl_wrap), which is synchronous.

Because the two sets of flops sit in different reset domains, the asynchronous warm-reset path is a reset-domain crossing into axi_isolate. This is acceptable: only the watchdog asserts the warm reset asynchronously, and a watchdog timeout is followed by a cold reset, so the brief crossing window has no functional consequence. The CSR path is synchronous and crosses no domains.

7. Interrupt Integration

All interrupt wiring—MMIO bases for PLIC, CLINT, watchdog, and bus-error units; the authoritative cpu_interrupts_o map; PLIC/CLINT register documentation; and BEU direct interrupt delivery—is documented in Interrupts.

8. Watchdog Interface

Each core has a watchdog. See Watchdog Timers for operation and the register reference.

9. Bus Error Reporting

Each core has a Bus Error Unit (BEU) at 0xC801_0000 + N * 0x1000, for N = 0 through 3. It reports errors seen by that core’s L1 caches:

  • instruction-cache correctable errors,

  • instruction-cache bus errors,

  • data-cache correctable errors,

  • data-cache uncorrectable errors, and

  • data-cache bus errors.

An error response from the SMC fabric reaches the BEU only as a cache bus error; the BEU does not distinguish decode, slave or timeout errors. It is not a general AXI transaction monitor and has no independent AXI timeout detector or transaction-data log.

ENABLE selects events that capture CAUSE and PHYS_ADDR while CAUSE is zero. Instruction-cache correctable errors capture a physical address of zero. The register named ACCRUED_ENABLE is instead sticky event status: events accumulate independently of ENABLE, and ordinary software writes replace the bits. PLIC_ENABLE and LOCAL_ENABLE select from that accrued status for the PLIC and direct-core interrupt paths. Capture the diagnostic state before clearing status or rearming cause capture. The generated register map below lists the implemented fields. Delivery and clearing are described in Bus Error Units.

10. Debug

The generated memory map below describes the hart-facing Debug Module memory region. Only the harts of the CPU cluster reach it, over the cluster’s own control bus. The SMC fabric does not route it, so system, SEP and other SMC initiators receive DECERR at every address in the region. Debugger-facing registers such as dmcontrol, dmstatus, abstractcs and sbcs are accessed through the Debug Module Interface (DMI), not through that memory region. Section 10.1 describes them.

JTAG reaches the cluster’s debug transport module and debug module. The configured debug facilities provide per-core register access, program-buffer execution, breakpoints and system bus access. Debug system bus transactions enter through fbus and use the cluster’s interconnect and reset/isolation conditions.

Debug-module reset is separately controlled by CPU_CTRL.RESET_CTRL; its reset value holds the debug module in reset. Separate control does not make debug memory accesses independent of cluster reset or boundary isolation. Per-core boot addresses are controlled by the RESET_VECTOR registers described above.

10.1. Debug Module Configuration

The Debug Module implements version 0.13 of the RISC-V External Debug Support specification for the four harts of the CPU cluster. A debugger discovers its configuration by reading DMI registers. Table 4 lists the fixed capability values those registers return, and Table 5 lists which DMI registers are implemented.

Table 4. SMC Debug Module capability readbacks
Register Field Value Meaning

dmstatus

version

2

Debug Specification 0.13

dmstatus

authenticated

1

No authentication is required

dmstatus

hasresethaltreq

1

Halt-on-reset is supported

dmstatus

confstrptrvalid

0

No configuration string

dmstatus

impebreak

1

An implicit ebreak follows the program buffer

dmcontrol

hartsello

2 bits

Harts 0 to 3; hartselhi reads 0

abstractcs

progbufsize

16

progbuf0 to progbuf15

abstractcs

datacount

4

data0 to data3

abstractauto

autoexecdata

4 bits

Auto-execution from data0 to data3

abstractauto

autoexecprogbuf

16 bits

Auto-execution from progbuf0 to progbuf15

sbcs

sbversion

1

System bus access as defined by Debug Specification 0.13

sbcs

sbasize

56

System bus address width in bits

sbcs

sbaccess8, sbaccess16, sbaccess32, sbaccess64

1

8-, 16-, 32- and 64-bit system bus accesses

sbcs

sbaccess128

0

No 128-bit system bus access

The command register accepts only the Access Register command (cmdtype 0). With transfer set, Access Register reaches the general-purpose registers x0 to x31 (regno 0x1000 to 0x101F) with an aarsize of 2 or 3 (32 or 64 bits). With transfer clear, any regno and size is accepted. Any other command type, and any transfer outside those registers and sizes, sets abstractcs.cmderr to 2 (not supported). The debugger reaches CSRs and floating-point registers by executing instructions from the program buffer. Reading command returns the last value written.

hawindowsel reads 0 and ignores writes, so hawindow bits 3:0 hold the hart array mask for harts 0 to 3. setresethaltreq and clrresethaltreq in dmcontrol set and clear halt-on-reset for the selected harts.

DMI address 0x32 provides the halt-group fields of the dmcs2 register, which later versions of the specification define. A write with hgwrite set, hgselect clear and haltgroup 0 or 1 removes the selected harts from halt group 1 or adds them to it. When one hart in halt group 1 halts, the Debug Module halts the other harts in that group. A read returns the group of the hart selected by hartsel in haltgroup. External trigger groups (hgselect set) are not supported.

DMI registers that the Debug Module does not implement read as 0 and ignore writes.

Table 5. SMC Debug Module DMI register inventory
DMI address Register Implementation

0x04-0x07

data0-data3

Implemented

0x08-0x0F

data4-data11

Not implemented

0x10

dmcontrol

Implemented; hartsello bits 17:16 only, hartselhi reads 0

0x11

dmstatus

Implemented

0x12

hartinfo

Not implemented

0x13

haltsum1

Implemented; bit 0 only

0x14

hawindowsel

Reads 0

0x15

hawindow

Implemented; bits 3:0 only

0x16

abstractcs

Implemented

0x17

command

Implemented; Access Register only

0x18

abstractauto

Implemented; autoexecdata bits 3:0 only

0x19-0x1C

confstrptr0-confstrptr3

Not implemented

0x1D

nextdm

Not implemented; this is the only Debug Module

0x20-0x2F

progbuf0-progbuf15

Implemented

0x30

authdata

Not implemented

0x32

dmcs2

Implemented; halt groups 0 and 1 only

0x34

haltsum2

Not implemented

0x35

haltsum3

Not implemented

0x37

sbaddress3

Not implemented

0x38

sbcs

Implemented

0x39-0x3A

sbaddress0-sbaddress1

Implemented

0x3B

sbaddress2

Not implemented

0x3C-0x3D

sbdata0-sbdata1

Implemented

0x3E-0x3F

sbdata2-sbdata3

Not implemented

0x40

haltsum0

Implemented; bits 3:0 only

10.2. Abstract Command Writes While cmderr Is Set

The Debug Module departs from the RISC-V External Debug Support specification (version 0.13) for writes to command while abstractcs.cmderr is nonzero. The specification ignores those writes. In this Debug Module, a command write made while no abstract command is executing (abstractcs.busy is 0) has two effects:

  • the written value replaces the stored command, whatever cmderr holds, and

  • a command type other than Access Register (cmdtype other than 0) sets cmderr to 2 (not supported), replacing the error code it held.

No abstract command executes while cmderr is nonzero. Once cmderr is cleared, an access that abstractauto selects re-executes the stored command, which is the last value written to command.

A command write therefore discards the error code of a failed command unless abstractcs was read first. The Programmer’s Guide gives the debugger sequence for clearing cmderr.

11. Memory Map and Register Reference

11.1. Memory Map

Register offsets are relative to the block base in the subsystem memory map. The detailed map below defines each register and its fields.

11.2. Detailed Register Map

CPU Control Address Map

Per-core reset control and status, reset timing, chip configuration, mailbox, and boot-ROM stub registers for the SMC CPU cluster.

Register Arrays:

  • RESET_VECTOR[4]: 4 registers, base 0x0, stride 0x8
  • SCRATCH[16]: 16 registers, base 0x80, stride 0x8
  • WB_PC_CORE0[8]: 8 registers, base 0x100, stride 0x8
  • WB_PC_CORE1[8]: 8 registers, base 0x140, stride 0x8
  • WB_PC_CORE2[8]: 8 registers, base 0x180, stride 0x8
  • WB_PC_CORE3[8]: 8 registers, base 0x1C0, stride 0x8
  • MUTEX[4]: 4 registers, base 0x240, stride 0x8
  • SEMA[4]: 4 registers, base 0x260, stride 0x8
  • DUMMY_ROM_NULL[4]: 4 registers, base 0x2A0, stride 0x8

Register List:

Table 6. CPU Control Address Map register list
AddressNameAccessDescription
0x0 - 0x18RESET_VECTOR[4]RW-
0x20RESET_CTRLRW-
0x28CORE_RESET_PULSE_COUNTRW-
0x30RESET_TIMEOUTRW-
0x40REFERENCE_COUNTERRW-
0x50WDT_TIMEOUTRW-
0x58WDT_TIMEOUT_RESETRW-
0x60TEST_CTRLR-
0x80 - 0xF8SCRATCH[16]RW-
0x100 - 0x138WB_PC_CORE0[8]R-
0x140 - 0x178WB_PC_CORE1[8]R-
0x180 - 0x1B8WB_PC_CORE2[8]R-
0x1C0 - 0x1F8WB_PC_CORE3[8]R-
0x200SMC_ATTRIBUTESR-
0x240 - 0x258MUTEX[4]RW-
0x260 - 0x278SEMA[4]RW-
0x280DUMMY_ROM_0RW-
0x288DUMMY_ROM_1RW-
0x290DUMMY_ROM_2RW-
0x298DUMMY_ROM_3RW-
0x2A0 - 0x2B8DUMMY_ROM_NULL[4]RW-

Register Details:

RESET_VECTOR[4]

Table 7. cpu_ctrl.RESET_VECTOR[4] fields
BitsFieldAccessResetDescription
63:56Reserved--Reserved
55:0vectorRW0xC0040000-

RESET_CTRL

Table 8. cpu_ctrl.RESET_CTRL fields
BitsFieldAccessResetDescription
63:25Reserved--Reserved
24debug_reset_n_n0_scanRW0x0Debug Module Reset, active low
23:9Reserved--Reserved
8uncore_reset_n_n0_scanRW0x1Cluster Uncore Reset, active low. Writing this register will only reset the uncore portion in the chipyard cluster.
WARNING: using this can cause any outstanding axi requests to and from the cluster to cause timeouts/exceptions.
7core3_reset_pulse_start_n0_scanRW0x0Writing a 1 to this register triggers a core reset pulse on core 3, timed by CORE_RESET_PULSE_COUNT.
A 0 in core3_reset_n_n0_scan holds the core in reset for the whole pulse.
6core2_reset_pulse_start_n0_scanRW0x0Writing a 1 to this register triggers a core reset pulse on core 2, timed by CORE_RESET_PULSE_COUNT.
A 0 in core2_reset_n_n0_scan holds the core in reset for the whole pulse.
5core1_reset_pulse_start_n0_scanRW0x0Writing a 1 to this register triggers a core reset pulse on core 1, timed by CORE_RESET_PULSE_COUNT.
A 0 in core1_reset_n_n0_scan holds the core in reset for the whole pulse.
4core0_reset_pulse_start_n0_scanRW0x0Writing a 1 to this register triggers a core reset pulse on core 0, timed by CORE_RESET_PULSE_COUNT.
A 0 in core0_reset_n_n0_scan holds the core in reset for the whole pulse.
3core3_reset_n_n0_scanRW0x1Reset control for the CPU, active low.
2core2_reset_n_n0_scanRW0x1Reset control for the CPU, active low.
1core1_reset_n_n0_scanRW0x1Reset control for the CPU, active low.
0core0_reset_n_n0_scanRW0x1Reset control for the CPU, active low.

CORE_RESET_PULSE_COUNT

Table 9. cpu_ctrl.CORE_RESET_PULSE_COUNT fields
BitsFieldAccessResetDescription
63:36Reserved--Reserved
35:32core_resets_doneR0xFLogic low while performing core reset, logic high otherwise.
31:16post_reset_countRW0x10Cycles (clk_smc), minus one, that a core reset pulse holds the core in reset.
15:0pre_reset_countRW0x8Cycles (clk_smc), minus one, from the start of a core reset pulse to reset assertion.

RESET_TIMEOUT

Table 10. cpu_ctrl.RESET_TIMEOUT fields
BitsFieldAccessResetDescription
63:37Reserved--Reserved
36reset_timeoutR0x0Status for the active software reset request: high after the request exceeds
timeout_value and remains high until the request is deasserted. Set in both modes.
35:33Reserved--Reserved
32reset_appliedR0x0Live status: high while a requested software reset is applied at the cluster,
either after drain completes or after a force-mode timeout.
31:17Reserved--Reserved
16timeout_modeRW0x0Timeout mode: 0 = report the timeout and keep withholding the reset until
the drain completes, then apply it; 1 = force the reset on timeout.
15:0timeout_valueRW0x0Cycles (clk_smc) a software reset may stay pending (withheld, waiting
for drain) before timeout. 0 = disabled, wait indefinitely.

REFERENCE_COUNTER

Table 11. cpu_ctrl.REFERENCE_COUNTER fields
BitsFieldAccessResetDescription
63:0rcRW0x0Reference counter for the CPU. Write once, then poll this register until
the readback reflects the written value before writing again. The counter
keeps advancing, so the readback is at or just above the written value
rather than equal to it.

WDT_TIMEOUT

Table 12. cpu_ctrl.WDT_TIMEOUT fields
BitsFieldAccessResetDescription
31:0dataRW0x4000Cycle count value that 2nd stage watchdog timer timeout should occur at. Defaults to 16384 cycles

WDT_TIMEOUT_RESET

Table 13. cpu_ctrl.WDT_TIMEOUT_RESET fields
BitsFieldAccessResetDescription
31:4Reserved--Reserved
3reset_cycle_count_3RW 1P0x0Reset current cycle count value in 2nd stage watchdog timer
2reset_cycle_count_2RW 1P0x0Reset current cycle count value in 2nd stage watchdog timer
1reset_cycle_count_1RW 1P0x0Reset current cycle count value in 2nd stage watchdog timer
0reset_cycle_count_0RW 1P0x0Reset current cycle count value in 2nd stage watchdog timer

TEST_CTRL

Table 14. cpu_ctrl.TEST_CTRL fields
BitsFieldAccessResetDescription
63:32Reserved--Reserved
31:0dataR0x0Test control register for the CPU

SCRATCH[16]

Table 15. cpu_ctrl.SCRATCH[16] fields
BitsFieldAccessResetDescription
63:32Reserved--Reserved
31:0dataRW0x0Scratch register for the CPU

WB_PC_CORE0[8]

Table 16. cpu_ctrl.WB_PC_CORE0[8] fields
BitsFieldAccessResetDescription
63:58Reserved--Reserved
57:0pcR0x0Writeback PC value

WB_PC_CORE1[8]

Table 17. cpu_ctrl.WB_PC_CORE1[8] fields
BitsFieldAccessResetDescription
63:58Reserved--Reserved
57:0pcR0x0Writeback PC value

WB_PC_CORE2[8]

Table 18. cpu_ctrl.WB_PC_CORE2[8] fields
BitsFieldAccessResetDescription
63:58Reserved--Reserved
57:0pcR0x0Writeback PC value

WB_PC_CORE3[8]

Table 19. cpu_ctrl.WB_PC_CORE3[8] fields
BitsFieldAccessResetDescription
63:58Reserved--Reserved
57:0pcR0x0Writeback PC value

SMC_ATTRIBUTES

Table 20. cpu_ctrl.SMC_ATTRIBUTES fields
BitsFieldAccessResetDescription
63:46Reserved--Reserved
45:40num_mailboxesR--
39:36mailbox_depthR--
35:33num_coresR--
32no_output_remapR--
31:26sram_sizeR-Total SRAM size is 2 ^ value bytes
25:17num_cpu_interruptsR--
16:8num_ext_interruptsR--
7:1Reserved--Reserved
0chiplet_is_primaryR-Indicates if this chiplet is primary (1) or secondary (0). Driven by strap.

MUTEX[4]

Table 21. cpu_ctrl.MUTEX[4] fields
BitsFieldAccessResetDescription
63:1Reserved--Reserved
0mutexRW0x1HW mutex. Reads will attempt to acquire mutex, 1 on success. If the mutex is already acquired, the read will return 0. To release the mutex, write any value to the register.

SEMA[4]

Table 22. cpu_ctrl.SEMA[4] fields
BitsFieldAccessResetDescription
63:16Reserved--Reserved
15:0semaRW0x016-bit semaphore value to inc/dec. Writing to this register will inc/dec the semaphore value.
The written value is treated as a signed number using 2s compliment.

DUMMY_ROM_0

Table 23. cpu_ctrl.DUMMY_ROM_0 fields
BitsFieldAccessResetDescription
63:0dummy_rom_word_0RW0x145051300000517Word 0 of WFI loop

DUMMY_ROM_1

Table 24. cpu_ctrl.DUMMY_ROM_1 fields
BitsFieldAccessResetDescription
63:0dummy_rom_word_1RW0xFFF0069330551073Word 1 of WFI loop

DUMMY_ROM_2

Table 25. cpu_ctrl.DUMMY_ROM_2 fields
BitsFieldAccessResetDescription
63:0dummy_rom_word_2RW0x105000733046B073Word 2 of WFI loop

DUMMY_ROM_3

Table 26. cpu_ctrl.DUMMY_ROM_3 fields
BitsFieldAccessResetDescription
63:0dummy_rom_word_3RW0xFFDFF06FWord 3 of WFI loop

DUMMY_ROM_NULL[4]

Table 27. cpu_ctrl.DUMMY_ROM_NULL[4] fields
BitsFieldAccessResetDescription
63:0dummy_rom_nullRW0x0Cache line size is 64 bytes so want to ensure no random data is read when reading dummy rom

CLINT Address Map

Core-Local Interruptor: software-interrupt, timer-compare, and machine-time registers.

Register Arrays:

  • MSIP[4]: 4 registers, base 0x0, stride 0x4
  • MTIMECMP[4]: 4 registers, base 0x4000, stride 0x8

Register List:

Table 28. CLINT Address Map register list
AddressNameAccessDescription
0x0 - 0xCMSIP[4]RW-
0x4000 - 0x4018MTIMECMP[4]RW-
0xBFF8MTIMERW-

Register Details:

MSIP[4]

Table 29. clint.MSIP[4] fields
BitsFieldAccessResetDescription
31:1rsvd0R0x0Reserved
0valueRW0x0MSIP bit for core

MTIMECMP[4]

Table 30. clint.MTIMECMP[4] fields
BitsFieldAccessResetDescription
63:0countRW-Timer compare value. The core's machine timer interrupt is asserted while MTIME is greater than or equal to this value, and deasserts when software sets this value above MTIME.

MTIME

Table 31. clint.MTIME fields
BitsFieldAccessResetDescription
63:0countRW-Cycle count (time) value

Debug Module Hart Interface

Memory region through which a hart in Debug Mode exchanges state with the Debug Module: handshake mailboxes, generated instructions, program buffer, data registers, per-hart flags and the debug ROM. Only the harts of the CPU cluster reach this region; SMC bus initiators outside the cluster do not. The debugger-facing Debug Module registers (dmcontrol, dmstatus, abstractcs, sbcs, ...) are reached over the Debug Module Interface and do not appear in this map.

Register Arrays:

  • ABSTRACT[5]: 5 registers, base 0x328, stride 0x4
  • PROGBUF[16]: 16 registers, base 0x33C, stride 0x4
  • DATA[4]: 4 registers, base 0x380, stride 0x4
  • ROM[26]: 26 registers, base 0x800, stride 0x4

Register List:

Table 32. Debug Module Hart Interface register list
AddressNameAccessDescription
0x100HALTEDW-
0x104GOINGW-
0x108RESUMINGW-
0x10CEXCEPTIONW-
0x300WHERETOR-
0x328 - 0x338ABSTRACT[5]R-
0x33C - 0x378PROGBUF[16]RW-
0x37CIMPEBREAKR-
0x380 - 0x38CDATA[4]RW-
0x400FLAGSROne flag byte per hart, at byte offset equal to the hart ID. Bit 0 is go (execute the command at WHERETO); bit 1 is resume (leave Debug Mode). Bits 7:2 read as 0.
0x800 - 0x864ROM[26]R-

Register Details:

HALTED

Table 33. debug_module.HALTED fields
BitsFieldAccessResetDescription
31:10Reserved--Reserved
9:0hartidW-Debug ROM causes the hart to write its hart ID here when it is in Debug Mode.

GOING

Table 34. debug_module.GOING fields
BitsFieldAccessResetDescription
31:10Reserved--Reserved
9:0hartidW-Debug ROM causes the hart to write 0 here when it begins executing Debug Mode instructions.

RESUMING

Table 35. debug_module.RESUMING fields
BitsFieldAccessResetDescription
31:10Reserved--Reserved
9:0hartidW-Debug ROM causes the hart to write its hart ID here when it leaves Debug Mode.

EXCEPTION

Table 36. debug_module.EXCEPTION fields
BitsFieldAccessResetDescription
31:10Reserved--Reserved
9:0hartidW-Debug ROM causes the hart to write 0 here if it takes an exception in Debug Mode.

WHERETO

Table 37. debug_module.WHERETO fields
BitsFieldAccessResetDescription
31:0instrR-Jump instruction filled in by the Debug Module to direct the hart in Debug Mode.

ABSTRACT[5]

Table 38. debug_module.ABSTRACT[5] fields
BitsFieldAccessResetDescription
31:0instrR-Instruction generated by the Debug Module for the current abstract command.

PROGBUF[16]

Table 39. debug_module.PROGBUF[16] fields
BitsFieldAccessResetDescription
31:0dataRW0x0Program buffer word shared with the debugger. Byte accesses are supported.

IMPEBREAK

Table 40. debug_module.IMPEBREAK fields
BitsFieldAccessResetDescription
31:0instrR0x100073Implicit EBREAK instruction following the program buffer.

DATA[4]

Table 41. debug_module.DATA[4] fields
BitsFieldAccessResetDescription
31:0dataRW0x0Abstract command data word shared with the debugger. Byte accesses are supported.

FLAGS

Table 42. debug_module.FLAGS fields
BitsFieldAccessResetDescription
31:24flags_3R-Hart 3 go/resume flags.
23:16flags_2R-Hart 2 go/resume flags.
15:8flags_1R-Hart 1 go/resume flags.
7:0flags_0R-Hart 0 go/resume flags.

ROM[26]

Table 43. debug_module.ROM[26] fields
BitsFieldAccessResetDescription
31:0dataR-Debug ROM word. Holds the fixed Debug Mode entry, exception and resume handlers.

Bus Error Unit Address Map

Status registers reporting correctable and uncorrectable I-cache, D-cache, and TileLink bus errors.

Register List:

Table 44. Bus Error Unit Address Map register list
AddressNameAccessDescription
0x0CAUSERW-
0x8PHYS_ADDRRW-
0x10ENABLERW-
0x18PLIC_ENABLERW-
0x20ACCRUED_ENABLERWSticky accrued error status. The legacy name ACCRUED_ENABLE does not denote an enable mask. Error events set these bits independently of ENABLE. Ordinary software writes replace the bits (write zero to clear) and take priority over simultaneous events. PLIC_ENABLE and LOCAL_ENABLE mask this status for interrupt delivery.
0x28LOCAL_ENABLERW-

Register Details:

CAUSE

Table 45. bus_error_unit.CAUSE fields
BitsFieldAccessResetDescription
63:3Reserved--Reserved
2:0dataRW0x0Cause register. Enumerates different kinds of errors

PHYS_ADDR

Table 46. bus_error_unit.PHYS_ADDR fields
BitsFieldAccessResetDescription
63:56Reserved--Reserved
55:0valueRW-Physical address captured with CAUSE when an enabled error arrives and CAUSE is zero. Software may overwrite the value; writes take priority over capture. No reset value

ENABLE

Table 47. bus_error_unit.ENABLE fields
BitsFieldAccessResetDescription
63:8Reserved--Reserved
7dcache_uncorrectableRW0x1Enable recording error information for DCache ECC uncorrectable bus error. Enabled on reset.
6dcache_correctableRW0x1Enable recording error information for DCache ECC correctable bus error. Enabled on reset.
5dcache_tlbusRW0x1Enable recording error information for DCache Tilelink bus error. Enabled on reset.
4rsvd4RW0x0Reserved
3rsvd3RW0x0Reserved
2icache_correctableRW0x1Enable recording error information for ICache ECC correctable bus error. Enabled on reset.
1icache_tlbusRW0x1Enable recording error information for ICache Tilelink bus error. Enabled on reset.
0rsvd0RW0x0Reserved

PLIC_ENABLE

Table 48. bus_error_unit.PLIC_ENABLE fields
BitsFieldAccessResetDescription
63:8Reserved--Reserved
7dcache_uncorrectableRW0x0PLIC interrupt enable mask for DCache ECC uncorrectable bus error.
6dcache_correctableRW0x0PLIC interrupt enable mask for DCache ECC correctable bus error.
5dcache_tlbusRW0x0PLIC interrupt enable mask for DCache Tilelink bus error.
4rsvd4RW0x0Reserved
3rsvd3RW0x0Reserved
2icache_correctableRW0x0PLIC interrupt enable mask for ICache ECC correctable bus error.
1icache_tlbusRW0x0PLIC interrupt enable mask for ICache Tilelink bus error.
0rsvd0RW0x0Reserved

ACCRUED_ENABLE

Table 49. bus_error_unit.ACCRUED_ENABLE fields
BitsFieldAccessResetDescription
63:8Reserved--Reserved
7dcache_uncorrectableRW0x0Sticky accrued status for DCache ECC uncorrectable bus error.
6dcache_correctableRW0x0Sticky accrued status for DCache ECC correctable bus error.
5dcache_tlbusRW0x0Sticky accrued status for DCache Tilelink bus error.
4rsvd4RW0x0Reserved
3rsvd3RW0x0Reserved
2icache_correctableRW0x0Sticky accrued status for ICache ECC correctable bus error.
1icache_tlbusRW0x0Sticky accrued status for ICache Tilelink bus error.
0rsvd0RW0x0Reserved

LOCAL_ENABLE

Table 50. bus_error_unit.LOCAL_ENABLE fields
BitsFieldAccessResetDescription
63:8Reserved--Reserved
7dcache_uncorrectableRW0x0Core local interrupt enable mask for DCache ECC uncorrectable bus error.
6dcache_correctableRW0x0Core local interrupt enable mask for DCache ECC correctable bus error.
5dcache_tlbusRW0x0Core local interrupt enable mask for DCache Tilelink bus error.
4rsvd4RW0x0Reserved
3rsvd3RW0x0Reserved
2icache_correctableRW0x0Core local interrupt enable mask for ICache ECC correctable bus error.
1icache_tlbusRW0x0Core local interrupt enable mask for ICache Tilelink bus error.
0rsvd0RW0x0Reserved