1. Control and Status Registers (CSRs)

The SYSTEM major opcode is used to encode all privileged instructions in the RISC-V ISA. These can be divided into two main classes: those that atomically read-modify-write control and status registers (CSRs), which are defined in the Zicsr extension, and all other privileged instructions. The privileged architecture requires the Zicsr extension; which other privileged instructions are required depends on the privileged-architecture feature set.

In addition to the unprivileged state described in Volume I of this manual, an implementation may contain additional CSRs, accessible by some subset of the privilege levels using the CSR instructions described in Volume I. In this chapter, we map out the CSR address space. The following chapters describe the function of each of the CSRs according to privilege level, as well as the other privileged instructions which are generally closely associated with a particular privilege level. Note that although CSRs and instructions are associated with one privilege level, they are also accessible at all higher privilege levels.

Standard CSRs do not have side effects on reads but may have side effects on writes.

1.1. CSR Address Mapping Conventions

The standard RISC-V ISA sets aside a 12-bit encoding space (csr[11:0]) for up to 4,096 CSRs. By convention, the upper 4 bits of the CSR address (csr[11:8]) are used to encode the read and write accessibility of the CSRs according to privilege level as shown in Table 1. The top two bits (csr[11:10]) indicate whether the register is read/write (00,01, or 10) or read-only (11). The next two bits (csr[9:8]) encode the lowest privilege level that can access the CSR.

The CSR address convention uses the upper bits of the CSR address to encode default access privileges. This simplifies error checking in the hardware and provides a larger CSR space, but does constrain the mapping of CSRs into the address space. Implementations might allow a more-privileged level to trap otherwise permitted CSR accesses by a less-privileged level to allow these accesses to be intercepted. This change should be transparent to the less-privileged software.

Attempts to access a non-existent CSR raise an illegal-instruction exception. Attempts to access a CSR without appropriate privilege level or to write a read-only register also raise illegal-instruction exceptions. A read/write register might also contain some bits that are read-only, in which case writes to the read-only bits are ignored.

Table 1 also indicates the convention to allocate CSR addresses between standard and custom uses. The CSR addresses designated for custom uses will not be redefined by future standard extensions.

Machine-mode standard read-write CSRs 0x7A0-0x7BF are reserved for use by the debug system. Of these CSRs, 0x7A0-0x7AF are accessible to machine mode, whereas 0x7B0-0x7BF are only visible to debug mode. Implementations should raise illegal-instruction exceptions on machine-mode access to the latter set of registers.

Effective virtualization requires that as many instructions run natively as possible inside a virtualized environment, while any privileged accesses trap to the virtual machine monitor. (Goldberg, 1974) CSRs that are read-only at some lower privilege level are shadowed into separate CSR addresses if they are made read-write at a higher privilege level. This avoids trapping permitted lower-privilege accesses while still causing traps on illegal accesses. Currently, the counters are the only shadowed CSRs.

1.2. CSR Listing

Table 2-Table 6 list the CSRs that have currently been allocated CSR addresses. The timers, counters, and floating-point CSRs are standard unprivileged CSRs. The other registers are used by privileged code, as described in the following chapters. Note that not all registers are required on all implementations.

Table 1. Allocation of RISC-V CSR address ranges.

CSR Address			Hex	Use and Accessibility
[11:10]	[9:8]	[7:4]
Unprivileged and User-Level CSRs
00 01 10 11 11 11	00 00 00 00 00 00	XXXX XXXX XXXX 0XXX 10XX 11XX	0x000-0x0FF 0x400-0x4FF 0x800-0x8FF 0xC00-0xC7F 0xC80-0xCBF 0xCC0-0xCFF	Standard read/write Standard read/write Custom read/write Standard read-only Standard read-only Custom read-only
Supervisor-Level CSRs
00 01 01 01 10 10 10 11 11 11	01 01 01 01 01 01 01 01 01 01	XXXX 0XXX 10XX 11XX 0XXX 10XX 11XX 0XXX 10XX 11XX	0x100-0x1FF 0x500-0x57F 0x580-0x5BF 0x5C0-0x5FF 0x900-0x97F 0x980-0x9BF 0x9C0-0x9FF 0xD00-0xD7F 0xD80-0xDBF 0xDC0-0xDFF	Standard read/write Standard read/write Standard read/write Custom read/write Standard read/write Standard read/write Custom read/write Standard read-only Standard read-only Custom read-only
Hypervisor and VS CSRs
00 01 01 01 10 10 10 11 11 11	10 10 10 10 10 10 10 10 10 10	XXXX 0XXX 10XX 11XX 0XXX 10XX 11XX 0XXX 10XX 11XX	0x200-0x2FF 0x600-0x67F 0x680-0x6BF 0x6C0-0x6FF 0xA00-0xA7F 0xA80-0xABF 0xAC0-0xAFF 0xE00-0xE7F 0xE80-0xEBF 0xEC0-0xEFF	Standard read/write Standard read/write Standard read/write Custom read/write Standard read/write Standard read/write Custom read/write Standard read-only Standard read-only Custom read-only
Machine-Level CSRs
00 01 01 01 01 01 10 10 10 11 11 11	11 11 11 11 11 11 11 11 11 11 11 11	XXXX 0XXX 100X 1010 1011 11XX 0XXX 10XX 11XX 0XXX 10XX 11XX	0x300-0x3FF 0x700-0x77F 0x780-0x79F 0x7A0-0x7AF 0x7B0-0x7BF 0x7C0-0x7FF 0xB00-0xB7F 0xB80-0xBBF 0xBC0-0xBFF 0xF00-0xF7F 0xF80-0xFBF 0xFC0-0xFFF	Standard read/write Standard read/write Standard read/write Standard read/write debug CSRs Debug-mode-only CSRs Custom read/write Standard read/write Standard read/write Custom read/write Standard read-only Standard read-only Custom read-only

Table 2. Currently allocated RISC-V unprivileged CSR addresses.

Number	Privilege	Name	Description
Unprivileged Floating-Point CSRs
0x001 0x002 0x003	URW URW URW	fflags frm fcsr	Floating-Point Accrued Exceptions. Floating-Point Dynamic Rounding Mode. Floating-Point Control and Status Register (frm +fflags).
Unprivileged Counter/Timers
0xC00 0xC01 0xC02 0xC03 0xC04   0xC1F 0xC80 0xC81 0xC82 0xC83 0xC84   0xC9F	URO URO URO URO URO   URO URO URO URO URO URO   URO	cycle time instret hpmcounter3 hpmcounter4 ⋮ hpmcounter31 cycleh timeh instreth hpmcounter3h hpmcounter4h ⋮ hpmcounter31h	Cycle counter for RDCYCLE instruction. Timer for RDTIME instruction. Instructions-retired counter for RDINSTRET instruction. Performance-monitoring counter. Performance-monitoring counter.   Performance-monitoring counter. Upper 32 bits of cycle, RV32 only. Upper 32 bits of time, RV32 only. Upper 32 bits of instret, RV32 only. Upper 32 bits of hpmcounter3, RV32 only. Upper 32 bits of hpmcounter4, RV32 only.   Upper 32 bits of hpmcounter31, RV32 only.

Table 3. Currently allocated RISC-V supervisor-level CSR addresses.

Number	Privilege	Name	Description
Supervisor Trap Setup
0x100 0x104 0x105 0x106	SRW SRW SRW SRW	sstatus sie stvec scounteren	Supervisor status register. Supervisor interrupt-enable register. Supervisor trap handler base address. Supervisor counter enable.
Supervisor Configuration
0x10A	SRW	senvcfg	Supervisor environment configuration register.
Supervisor Trap Handling
0x140 0x141 0x142 0x143 0x144	SRW SRW SRW SRW SRW	sscratch sepc scause stval sip	Scratch register for supervisor trap handlers. Supervisor exception program counter. Supervisor trap cause. Supervisor bad address or instruction. Supervisor interrupt pending.
Supervisor Protection and Translation
0x180	SRW	satp	Supervisor address translation and protection.
Debug/Trace Registers
0x5A8	SRW	scontext	Supervisor-mode context register.

Table 4. Currently allocated RISC-V hypervisor and VS CSR addresses.

Number	Privilege	Name	Description
Hypervisor Trap Setup
0x600 0x602 0x603 0x604 0x606 0x607	HRW HRW HRW HRW HRW HRW	hstatus hedeleg hideleg hie hcounteren hgeie	Hypervisor status register. Hypervisor exception delegation register. Hypervisor interrupt delegation register. Hypervisor interrupt-enable register. Hypervisor counter enable. Hypervisor guest external interrupt-enable register.
Hypervisor Trap Handling
0x643 0x644 0x645 0x64A 0xE12	HRW HRW HRW HRW HRO	htval hip hvip htinst hgeip	Hypervisor bad guest physical address. Hypervisor interrupt pending. Hypervisor virtual interrupt pending. Hypervisor trap instruction (transformed). Hypervisor guest external interrupt pending.
Hypervisor Configuration
0x60A 0x61A	HRW HRM	henvcfg henvcfgh	Hypervisor environment configuration register. Upper 32 bits of henvcfg, RV32 only.
Hypervisor Protection and Translation
0x680	HRW	hgatp	Hypervisor guest address translation and protection.
Debug/Trace Registers
0x6A8	HRW	hcontext	Hypervisor-mode context register.
Hypervisor Counter/Timer Virtualization Registers
0x605 0x615	HRW HRW	htimedelta htimedeltah	Delta for VS/VU-mode timer. Upper 32 bits of htimedelta, RV32 only.
Virtual Supervisor Registers
0x200 0x204 0x205 0x240 0x241 0x242 0x243 0x244 0x280	HRW HRW HRW HRW HRW HRW HRW HRW HRW	vsstatus vsie vstvec vsscratch vsepc vscause vstval vsip vsatp	Virtual supervisor status register. Virtual supervisor interrupt-enable register. Virtual supervisor trap handler base address. Virtual supervisor scratch register. Virtual supervisor exception program counter. Virtual supervisor trap cause. Virtual supervisor bad address or instruction. Virtual supervisor interrupt pending. Virtual supervisor address translation and protection.

Table 5. Currently allocated RISC-V machine-level CSR addresses.

Number	Privilege	Name	Description
Machine Information Registers
0xF11 0xF12 0xF13 0xF14 0xF15	MRO MRO MRO MRO MRO	mvendorid marchid mimpid mhartid mconfigptr	Vendor ID. Architecture ID. Implementation ID. Hardware thread ID. Pointer to configuration data structure.
Machine Trap Setup
0x300 0x301 0x302 0x303 0x304 0x305 0x306 0x310	MRW MRW MRW MRW MRW MRW MRW MRW	mstatus misa medeleg mideleg mie mtvec mcounteren mstatush	Machine status register. ISA and extensions Machine exception delegation register. Machine interrupt delegation register. Machine interrupt-enable register. Machine trap-handler base address. Machine counter enable. Additional machine status register, RV32 only.
Machine Trap Handling
0x340 0x341 0x342 0x343 0x344 0x34A 0x34B	MRW MRW MRW MRW MRW MRW MRW	mscratch mepc mcause mtval mip mtinst mtval2	Scratch register for machine trap handlers. Machine exception program counter. Machine trap cause. Machine bad address or instruction. Machine interrupt pending. Machine trap instruction (transformed). Machine bad guest physical address.
Machine Configuration
0x30A 0x31A 0x747 0x757	MRW MRW MRW MRW	menvcfg menvcfgh mseccfg mseccfgh	Machine environment configuration register. Upper 32 bits of menvcfg, RV32 only. Machine security configuration register. Upper 32 bits of mseccfg, RV32 only.
Machine Memory Protection
0x3A0 0x3A1 0x3A2 0x3A3   0x3AE 0x3AF 0x3B0 0x3B1   0x3EF	MRW MRW MRW MRW   MRW MRW MRW MRW   MRW	pmpcfg0 pmpcfg1 pmpcfg2 pmpcfg3 ⋯ pmpcfg14 pmpcfg15 pmpaddr0 pmpaddr1 ⋯ pmpaddr63	Physical memory protection configuration. Physical memory protection configuration, RV32 only. Physical memory protection configuration. Physical memory protection configuration, RV32 only.   Physical memory protection configuration. Physical memory protection configuration, RV32 only. Physical memory protection address register. Physical memory protection address register.   Physical memory protection address register.

Table 6. Currently allocated RISC-V machine-level CSR addresses.

Number	Privilege	Name	Description
Machine Non-Maskable Interrupt Handling
0x740 0x741 0x742 0x744	MRW MRW MRW MRW	mnscratch mnepc mncause mnstatus	Resumable NMI scratch register. Resumable NMI program counter. Resumable NMI cause. Resumable NMI status.
Machine Counter/Timers
0xB00 0xB02 0xB03 0xB04   0xB1F 0xB80 0xB82 0xB83 0xB84   0xB9F	MRW MRW MRW MRW   MRW MRW MRW MRW MRW   MRW	mcycle minstret mhpmcounter3 mhpmcounter4 ⋮ mhpmcounter31 mcycleh minstreth mhpmcounter3h mhpmcounter4h ⋮ mhpmcounter31h	Machine cycle counter. Machine instructions-retired counter. Machine performance-monitoring counter. Machine performance-monitoring counter.   Machine performance-monitoring counter. Upper 32 bits of mcycle, RV32 only. Upper 32 bits of minstret, RV32 only. Upper 32 bits of mhpmcounter3, RV32 only. Upper 32 bits of mhpmcounter4, RV32 only.   Upper 32 bits of mhpmcounter31, RV32 only.
Machine Counter Setup
0x320 0x323 0x324   0x33F	MRW MRW MRW   MRW	mcountinhibit mhpmevent3 mhpmevent4 ⋮ mhpmevent31	Machine counter-inhibit register. Machine performance-monitoring event selector. Machine performance-monitoring event selector.   Machine performance-monitoring event selector.
Debug/Trace Registers (shared with Debug Mode)
0x7A0 0x7A1 0x7A2 0x7A3 0x7A8	MRW MRW MRW MRW MRW	tselect tdata1 tdata2 tdata3 mcontext	Debug/Trace trigger register select. First Debug/Trace trigger data register. Second Debug/Trace trigger data register. Third Debug/Trace trigger data register. Machine-mode context register.
Debug Mode Registers
0x7B0 0x7B1 0x7B2 0x7B3	DRW DRW DRW DRW	dcsr dpc dscratch0 dscratch1	Debug control and status register. Debug program counter. Debug scratch register 0. Debug scratch register 1.

1.3. CSR Field Specifications

The following definitions and abbreviations are used in specifying the behavior of fields within the CSRs.

1.3.1. Reserved Writes Preserve Values, Reads Ignore Values (WPRI)

Some whole read/write fields are reserved for future use. Software should ignore the values read from these fields, and should preserve the values held in these fields when writing values to other fields of the same register. For forward compatibility, implementations that do not furnish these fields must make them read-only zero. These fields are labeled WPRI in the register descriptions.

To simplify the software model, any backward-compatible future definition of previously reserved fields within a CSR must cope with the possibility that a non-atomic read/modify/write sequence is used to update other fields in the CSR. Alternatively, the original CSR definition must specify that subfields can only be updated atomically, which may require a two-instruction clear bit/set bit sequence in general that can be problematic if intermediate values are not legal.

1.3.2. Write/Read Only Legal Values (WLRL)

Some read/write CSR fields specify behavior for only a subset of possible bit encodings, with other bit encodings reserved. Software should not write anything other than legal values to such a field, and should not assume a read will return a legal value unless the last write was of a legal value, or the register has not been written since another operation (e.g., reset) set the register to a legal value. These fields are labeled WLRL in the register descriptions.

Hardware implementations need only implement enough state bits to differentiate between the supported values, but must always return the complete specified bit-encoding of any supported value when read.

Implementations are permitted but not required to raise an illegal-instruction exception if an instruction attempts to write a non-supported value to a WLRL field. Implementations can return arbitrary bit patterns on the read of a WLRL field when the last write was of an illegal value, but the value returned should deterministically depend on the illegal written value and the value of the field prior to the write.

1.3.3. Write Any Values, Reads Legal Values (WARL)

Some read/write CSR fields are only defined for a subset of bit encodings, but allow any value to be written while guaranteeing to return a legal value whenever read. Assuming that writing the CSR has no other side effects, the range of supported values can be determined by attempting to write a desired setting then reading to see if the value was retained. These fields are labeled WARL in the register descriptions.

Implementations will not raise an exception on writes of unsupported values to a WARL field. Implementations can return any legal value on the read of a WARL field when the last write was of an illegal value, but the legal value returned should deterministically depend on the illegal written value and the architectural state of the hart.

1.4. CSR Field Modulation

If a write to one CSR changes the set of legal values allowed for a field of a second CSR, then unless specified otherwise, the second CSR’s field immediately gets an UNSPECIFIED value from among its new legal values. This is true even if the field’s value before the write remains legal after the write; the value of the field may be changed in consequence of the write to the controlling CSR.

As a special case of this rule, the value written to one CSR may control whether a field of a second CSR is writable (with multiple legal values) or is read-only. When a write to the controlling CSR causes the second CSR’s field to change from previously read-only to now writable, that field immediately gets an UNSPECIFIED but legal value, unless specified otherwise. Some CSR fields are, when writable, defined as aliases of other CSR fields. Let x be such a CSR field, and let y be the CSR field it aliases when writable. If a write to a controlling CSR causes field x to change from previously read-only to now writable, the new value of x is not UNSPECIFIED but instead immediately reflects the existing value of its alias y, as required.

A change to the value of a CSR for this reason is not a write to the affected CSR and thus does not trigger any side effects specified for that CSR.

1.5. Implicit Reads of CSRs

Implementations sometimes perform implicit reads of CSRs. (For example, all S-mode instruction fetches implicitly read the satp CSR.) Unless otherwise specified, the value returned by an implicit read of a CSR is the same value that would have been returned by an explicit read of the CSR, using a CSR-access instruction in a sufficient privilege mode.

1.6. CSR Width Modulation

If the width of a CSR is changed (for example, by changing MXLEN or UXLEN, as described in [xlen-control]), the values of the writable fields and bits of the new-width CSR are, unless specified otherwise, determined from the previous-width CSR as though by this algorithm:

1. The value of the previous-width CSR is copied to a temporary register of the same width.

2. For the read-only bits of the previous-width CSR, the bits at the same positions in the temporary register are set to zeros.

3. The width of the temporary register is changed to the new width. If the new width W is narrower than the previous width, the least-significant W bits of the temporary register are retained and the more-significant bits are discarded. If the new width is wider than the previous width, the temporary register is zero-extended to the wider width.

4. Each writable field of the new-width CSR takes the value of the bits at the same positions in the temporary register.

Changing the width of a CSR is not a read or write of the CSR and thus does not trigger any side effects.

1.7. Explicit Accesses to CSRs Wider than XLEN

If a standard CSR is wider than XLEN bits, then an explicit read of the CSR returns the register’s least-significant XLEN bits, and an explicit write to the CSR modifies only the register’s least-significant XLEN bits, leaving the upper bits unchanged.

Some standard CSRs, such as the counter CSRs of extension Zicntr, are always 64 bits, even when XLEN=32 (RV32). For each such 64-bit CSR (for example, counter time), a corresponding 32-bit high-half CSR is usually defined with the same name but with the letter ‘h’ appended at the end (timeh). The high-half CSR aliases bits 63:32 of its namesake 64-bit CSR, thus providing a way for RV32 software to read and modify the otherwise-unreachable 32 bits.

Standard high-half CSRs are accessible only when the base RISC-V instruction set is RV32 (XLEN=32). For RV64 (when XLEN=64), the addresses of all standard high-half CSRs are reserved, so an attempt to access a high-half CSR typically raises an illegal-instruction exception.