CVA6-RT: an Open-Source Time-Predictable RV64 Processor for Mixed-Criticality Systems
Abstract: This work presents CVA6-RT, a real-time micro-architectural extension of the CVA6 core to bound worst-case latency and reduce task's timing execution variability. CVA6-RT implements the rv64gch ISA and features advanced support for real-time execution, including TLB partitioning and locking for predictable address translation, a dynamically reconfigurable scratchpad mode in the L1 caches for deterministic memory access, and low-latency interrupt handling via an enhanced interrupt controller combined with hardware-assisted context stacking. With real-time features enabled, CVA6-RT achieves an interrupt latency of 12 cycles, comparable to that of simpler Arm Cortex-M microcontrollers, and 10x lower than the baseline CVA6 core.
Paper Prompts
Sign up for free to create and run prompts on this paper using GPT-5.
Top Community Prompts
Explain it Like I'm 14
Overview
This paper introduces CVA6-RT, a new version of an open-source 64-bit RISC-V processor (called CVA6) that is designed to run time-critical tasks more predictably. In simple terms, it makes sure certain important jobs on a computer chip always finish fast enough and with very little timing surprise, which is crucial in things like cars and robots.
What the researchers wanted to achieve
The researchers aimed to solve a common problem in modern systems that handle different kinds of jobs at the same time (called mixed-criticality systems). Some jobs are flexible (like playing music), while others must be fast and consistent (like a brake controller). They wanted to:
- Make the processor’s timing predictable, so critical tasks don’t get delayed by other tasks.
- Keep everything on one powerful 64-bit processor instead of splitting tasks across different, separate chips.
- Provide open-source, RISC-V–based hardware features similar to what real-time ARM processors offer.
How they approached it (with simple explanations)
To make timing predictable, they added three main hardware features to the CVA6 core:
- Predictable memory access with a hybrid cache/scratchpad:
- Think of the processor’s cache like a backpack that automatically swaps items in and out. It’s fast, but sometimes you don’t get what you expect because the backpack replaces items on its own.
- A scratchpad is like a special pocket you control yourself. You decide exactly what goes in there, and it never gets replaced automatically.
- CVA6-RT lets you turn parts of the L1 caches into scratchpad memory. This means critical code and data can be stored where access time is always the same and never a surprise.
- Predictable address translation with TLB partitioning and locking:
- A TLB is like a phone book that translates “nicknames” for memory locations (virtual addresses) into real ones (physical addresses). If this phone book keeps changing, looking up numbers can take unpredictable time.
- Partitioning is like giving each task its own section of the phone book, so they don’t push each other’s entries out.
- Locking entries is like taping important pages so they can’t be removed. This makes sure certain lookups are always fast and steady.
- Fast, low-jitter interrupts with hardware help:
- An interrupt is like a very important phone call that makes you drop what you’re doing to respond immediately (for example, a sensor saying “Brake now!”).
- Normally, before answering, you need to neatly save your current work (“registers”) so you can return later. Doing that in software takes time and can vary.
- CVA6-RT uses an enhanced interrupt controller (called CLIC) and hardware-assisted “context save,” which automatically and quickly saves the important registers for you. This reduces both the delay and the variability.
- It also supports prioritizing and nesting interrupts, and even works predictably when the system is virtualized (running multiple OS environments).
Main findings and why they matter
The team measured how long it takes to respond to an interrupt (interrupt latency) and how much that time can vary (jitter):
- CVA6-RT achieves about 12 cycles of interrupt latency, which is around 10 times faster than the standard CVA6 (about 140 cycles).
- The biggest improvement comes from hardware automatically saving registers, which removes a large and variable software delay.
- Other tweaks, like how interrupts are detected and how quickly the processor “jumps” to the interrupt handler, also cut time and reduce jitter.
- With predictable memory access and address translation, the system can guarantee steady timing for critical tasks, not just on average but in the worst case too.
Why this matters: In real systems like cars, drones, and factory robots, timing predictability is as important as speed. These improvements mean the processor can respond quickly and consistently to important events, helping keep systems safe and reliable.
What this could change
- Safer, more reliable mixed-criticality systems: You can run both complex applications (like perception or planning) and hard real-time control tasks on the same 64-bit RISC-V processor without unexpected slowdowns.
- Lower cost and more flexibility: Instead of using multiple specialized chips, a single open-source processor can handle diverse workloads with predictable timing.
- Stronger RISC-V ecosystem for real-time: CVA6-RT brings ARM-like real-time features to an open platform, encouraging innovation in automotive, robotics, and industrial control.
- Better support for virtualization: Predictable interrupts and memory behavior make it easier to isolate and manage critical tasks even when multiple software environments share the hardware.
In short, CVA6-RT shows that you can combine the power and flexibility of a modern 64-bit processor with the steady, predictable timing needed for safety-critical jobs—open-source and ready for real-world use.
Knowledge Gaps
Unresolved gaps, limitations, and open questions
Below is a concise list of concrete knowledge gaps and open questions that the paper leaves unexplored; each item is phrased to enable actionable follow-up research.
- Quantify hardware costs: area, timing (max frequency), and power/energy overheads of TLB partitioning/locking, hybrid cache–scratchpad (SPM) logic, enhanced CLIC, and hardware context stacking across relevant technology nodes.
- Provide end-to-end real-time evidence beyond microbenchmarks: demonstrate deadline miss rates and jitter for representative automotive/robotics control workloads under mixed-criticality co-execution.
- Establish hard real-time bounds: derive and validate formal worst-case execution time (WCET) and worst-case interrupt response bounds, including all microarchitectural contributors (e.g., page walks, bus arbitration, cache states).
- Characterize interrupt behavior under stress: measure worst-case latency/jitter with nested interrupts, tail-chaining, interrupt storms, and preemption depth limits; specify configuration-dependent guarantees.
- Clarify determinism of hardware context stacking:
- Bound the time to complete register spills/restore when the target memory is in SPM vs. regular memory.
- Quantify interference with the ISR itself and with other agents on the memory/bus.
- Specify back-pressure behavior if the spill target is not immediately serviceable.
- Evaluate sensitivity to pipeline state: quantify interrupt response when interrupts arrive during long-latency/divide/AMO operations, CSR/serialization points, fences, mispredictions, and memory ordering events.
- System-level interference not addressed: analyze and bound effects from shared L2, interconnect/NoC, last-level caches, and DRAM controller arbitration; propose complementary QoS mechanisms if needed.
- Page-walk determinism: characterize worst-case latency of page table walks on TLB miss and how to bound it (e.g., via page-walk caches, walk-region placement in SPM, or dedicated QoS in memory system).
- TLB partitioning policy and granularity:
- Determine optimal partition sizing under dynamic workloads; explore runtime resizing without violating isolation.
- Assess support for multiple page sizes/huge pages and their impact on partition effectiveness.
- TLB locking usability limits: quantify how many entries can be locked, coverage of typical real-time working sets, and behavior when the locked set is insufficient (fallback timing bounds).
- Hybrid cache/SPM reconfiguration safety: define the protocol, atomicity, and latency of switching ways between cache and SPM; handle dirty-line eviction and data consistency; provide software hooks/ABI.
- Coherence and SPM semantics in multicore contexts: specify whether SPM ways participate in coherence, how DMA engines interact with SPM regions, and required barriers or data-movement protocols.
- OS/RTOS and toolchain integration:
- Provide APIs and kernel/runtime policies for SPM placement, TLB partition assignment, and CLIC configuration.
- Demonstrate compiler/linker support for placing ISRs/stacks/data into SPM and for coordinating register-spill targets.
- Virtualization claims need validation: quantify interrupt latency and variability with hypervisors (H-extension), including vCPU scheduling effects, nested virtualization, and virtual interrupt injection paths.
- Security and isolation analysis: evaluate whether TLB partitioning and SPM reduce or introduce new timing side channels/covert channels; analyze residual shared resources (branch predictors, fetch queues) and propose mitigations.
- Interaction with memory protection (PMP) and privilege: specify combined policies for partitioning, locking, and protection; ensure absence of configuration conflicts and define error-handling behavior.
- Software compatibility: detail how the enhanced CLIC (spec status, CSRs) interacts with existing RISC-V ecosystems (SBI, PLIC, Linux/RTOS ports); provide fallbacks and migration guidance.
- Performance impact on non-real-time tasks: quantify throughput losses due to SPM way removal and TLB partitioning for best-effort workloads; explore dynamic rebalancing to prevent starvation.
- Verification and certification: provide evidence (formal proofs, constrained-random testing) that partitioning and locking enforce non-interference; outline paths toward ISO 26262/DO-178C compliance and required diagnostic coverage (ECC/parity, lockstep).
- Scalability: assess whether the mechanisms and guarantees hold as core counts scale and as memory hierarchies deepen (clustered L2s, chiplets).
- Comparative positioning: benchmark against ARM Cortex-R/Cortex-M and other RT RISC-V cores on common suites (interrupts, memory determinism, end-to-end control tasks) to contextualize benefits and trade-offs.
- Reproducibility: release RTL branch, testbenches, configuration scripts, and measurement methodology to enable independent replication of latency numbers and further evaluation.
Practical Applications
Practical Applications Derived from the Paper
CVA6-RT introduces three hardware mechanisms—TLB partitioning/locking, dynamically reconfigurable L1 scratchpad mode, and enhanced low-jitter interrupt handling (CLIC + hardware context stacking)—that make a 64-bit RISC-V application-class core suitable for mixed-criticality workloads. Below are concrete applications that leverage these features across industry, academia, policy, and daily life.
Immediate Applications
- Mixed-criticality consolidation on a single RV64 core (replace separate μC + application CPU pairs)
- Description: Run OS-driven workloads (e.g., Linux services) alongside real-time control loops by placing ISRs, control code, and stacks in L1 scratchpad and using TLB partitions for isolation.
- Sectors: Automotive (zonal controllers), robotics, industrial automation.
- Tools/products/workflows: Board support packages with SPM-aware linker scripts (.text.spm/.data.spm), kernel drivers to configure CLIC and TLB partitions, mixed-criticality scheduling policies in Linux (PREEMPT_RT) or Zephyr/FreeRTOS.
- Assumptions/dependencies: OS/hypervisor support to configure SPM and TLB partitions; board-level SoC integration; bounded latencies beyond L1 (e.g., coherent interconnect, DRAM controller) may still require QoS.
- Low-latency interrupt pipelines for control loops (kHz–100 kHz)
- Description: Achieve ~12-cycle ISR entry by vectoring directly to priority ISRs, with hardware-assisted register stacking to minimize jitter; suitable for motor control, drive-by-wire, and servo loops.
- Sectors: Robotics (servo control), automotive (ABS, EPS auxiliaries), industrial PLCs.
- Tools/products/workflows: ISR libraries that auto-place handlers and state in SPM; control frameworks that assume bounded ISR latency; unit/integration tests measuring ISR jitter with performance counters.
- Assumptions/dependencies: Deterministic peripheral-to-core interrupt routing; careful board design to avoid interrupt storming; frequency to time mapping (e.g., 12 cycles at 1 GHz ≈ 12 ns).
- Real-time virtualization of critical workloads
- Description: Use the CLIC with virtualization support to host a safety- or time-critical RTOS VM alongside a Linux VM, with low, predictable interrupt latency in the RT VM.
- Sectors: Automotive domain controllers, industrial gateways, telecom edge nodes needing TSN timing.
- Tools/products/workflows: RISC-V hypervisors (e.g., Jailhouse-like partitioning, KVM-RISCV with CLIC support), VM configurations that pin SPM/TLB resources to critical VMs.
- Assumptions/dependencies: Hypervisor support for CLIC virtualization and TLB partition control; interrupt controller passthrough/virtualization; IOMMU or DMA isolation.
- Predictable memory access for WCET analysis and certification-like evidence
- Description: Pin critical code/data into L1 SPM and lock TLB entries to enable tighter WCET bounds and reduce execution-time variability.
- Sectors: Aerospace prototyping, medical device firmware, industrial safety controllers (pre-certification).
- Tools/products/workflows: WCET toolchains extended with SPM awareness; compiler/linker sections for deterministic placement; CI/CD gates verifying absence of cache hits/misses in critical paths.
- Assumptions/dependencies: SPM size suffices for critical hot paths; memory-mapped I/O and L2/DRAM behavior still modeled conservatively.
- Software-defined I/O and packet processing at the edge
- Description: Place fast-path packet processing (e.g., TSN control plane, soft NIC functions) in SPM and rely on low-jitter interrupts for line-rate determinism on modest links.
- Sectors: Industrial Ethernet/TSN, OT gateways, smart grid substations.
- Tools/products/workflows: DPDK-like lightweight frameworks adapted for RISC-V; NIC drivers that use CLIC preemption and SPM queues for RX/TX rings.
- Assumptions/dependencies: NIC latency and DMA determinism; IOMMU/IRQ routing; careful avoidance of shared cache contention for non-SPM paths.
- Open-source research and teaching platforms for real-time RISC-V
- Description: Use CVA6-RT in FPGA/ASIC prototypes for courses and research on mixed-criticality, WCET, and RT virtualization.
- Sectors: Academia, open hardware communities.
- Tools/products/workflows: Teaching labs with SPM/TLB partition exercises; RTL/FPGA reference platforms; benchmarks targeting ISR latency and memory predictability.
- Assumptions/dependencies: Public RTL availability, FPGA board support, stable toolchains (GCC/LLVM) with section placement.
- Developer workflows for deterministic microservices co-located with Linux
- Description: Co-locate hard/soft real-time services next to general-purpose services; use SPM for RT hot paths and TLB partitions to isolate service memory.
- Sectors: Edge computing, robotics software stacks (ROS 2).
- Tools/products/workflows: Container or cgroup profiles that tie SPM/TLB allocations to services; ROS 2 executors mapping callbacks into SPM; latency SLO monitoring.
- Assumptions/dependencies: Kernel interfaces for SPM and TLB management; careful NUMA/affinity management if multi-core.
- Education and hobbyist real-time projects (daily life)
- Description: Hobby drones, home robots, and maker projects benefit from deterministic control without a second microcontroller.
- Sectors: Consumer drones/robots, smart appliances (prototyping).
- Tools/products/workflows: Zephyr/FreeRTOS ports with CLIC/stacking enabled; reference projects demonstrating sensor ISR and control loops in SPM.
- Assumptions/dependencies: Accessible dev boards; community-maintained BSPs/drivers.
Long-Term Applications
- Safety-certified automotive and industrial controllers (ASIL/IEC 61508)
- Description: Transition CVA6-RT into certified products where mixed-criticality consolidation lowers BOM and wiring costs for zonal architectures.
- Sectors: Automotive, industrial automation, rail.
- Tools/products/workflows: Safety manuals, FMEDA, diagnostic coverage for CLIC/stacking; ISO 26262-qualified toolchains; certified RT hypervisor; deterministic DRAM/NoC QoS.
- Assumptions/dependencies: Safety process, fault-tolerance features (ECC, lockstep), verified DRAM controllers and interconnects, long-term vendor support.
- Avionics and medical devices requiring stringent timing and certification
- Description: Employ SPM + TLB locking to attain analyzable timing under DO-178C/DO-254 or IEC 62304 frameworks.
- Sectors: Aerospace, medical equipment.
- Tools/products/workflows: Qualified WCET tools; partitioned RTOS (ARINC 653-style) atop CVA6-RT; formal verification of interrupt/trap logic.
- Assumptions/dependencies: Tool qualification, rigorous verification of microarchitectural corner cases, long lifecycle component availability.
- Multi-core and SoC-level determinism with end-to-end QoS
- Description: Extend predictability beyond a single core with cache/NoC/DRAM partitioning to maintain tight bounds in many-core SoCs.
- Sectors: High-integration automotive SoCs, collaborative robots, 5G/TSN edge platforms.
- Tools/products/workflows: NoC bandwidth reservation, bank-partitioned LLC/SPM hierarchies, deterministic memory controllers, system-wide criticality-aware schedulers.
- Assumptions/dependencies: Architectural extensions across the memory system; integration with accelerators; updated OS/hypervisor to program QoS knobs.
- Standardized RISC-V real-time profiles and ecosystem tooling
- Description: Contribute CVA6-RT features to RISC-V profiles for real-time (ISA + platform), enabling portable RT OS stacks and drivers.
- Sectors: Cross-industry hardware/software vendors.
- Tools/products/workflows: RISC-V platform specifications for CLIC, SPM configuration CSRs, TLB partition/lock interfaces; upstream Linux/Zephyr support; compliance test suites.
- Assumptions/dependencies: RISC-V International standardization; vendor alignment; backward compatibility.
- Compiler and OS automation for SPM/TLB utilization
- Description: Toolchains that automatically place hot ISR paths/data into SPM and generate TLB lock/partition directives based on profiles or annotations.
- Sectors: Software tooling, embedded systems.
- Tools/products/workflows: Linker plugins, LTO passes for hot-path pinning; kernel APIs that expose SPM allocators; static analyzers ensuring no unintended cache use in RT code.
- Assumptions/dependencies: Stable SPM/TLB control abstractions; cross-module optimization reliability; developer adoption.
- Deterministic robotics and sensor-fusion pipelines at the edge
- Description: Guarantee bounded latency for sensor ingress (ISR) and early-stage pre-processing, co-located with higher-level planning on the same CPU.
- Sectors: Autonomous mobile robots, drones, AMRs, AR/VR devices.
- Tools/products/workflows: ROS 2 real-time executors with SPM-backed callback chains; sensor drivers mapped to prioritized CLIC vectors; end-to-end latency budgets enforced by schedulers.
- Assumptions/dependencies: Stable timing through peripheral buses and DMA; thermal/power constraints at higher frequencies.
- Real-time networking stacks with TSN and time-aware shapers
- Description: Implement precise time synchronization (PTP), scheduling, and policing with low-jitter ISRs and SPM data paths, complementing hardware TSN blocks.
- Sectors: Industrial Ethernet, power systems, audio-visual networks.
- Tools/products/workflows: PTP/TSN stacks tuned for CLIC/stacking; NIC drivers with SPM ring buffers; conformance and jitter-measurement harnesses.
- Assumptions/dependencies: Hardware timestamping on NICs; DMA and interrupt coalescing behaviors that preserve determinism.
- Policy and procurement for open, time-predictable compute in critical infrastructure
- Description: Advocate open-ISA, analyzable microarchitectures in public-sector tenders to reduce vendor lock-in and improve supply-chain transparency.
- Sectors: Government, critical infrastructure operators.
- Tools/products/workflows: Procurement guidelines referencing open ISA and predictability metrics (ISR latency bounds, WCET evidence); funding for open verification/test suites.
- Assumptions/dependencies: Maturity of open-source support, long-term maintenance commitments, alignment with security and safety certification requirements.
- Consumer products with consolidated compute (future-proofing)
- Description: Single-chip designs for smart appliances, AR glasses, and home robots that blend app-class features with deterministic control subsystems.
- Sectors: Consumer electronics, smart home.
- Tools/products/workflows: Vendor SDKs exposing SPM/TLB partition presets; app frameworks that isolate real-time features from third-party apps.
- Assumptions/dependencies: Cost and power competitiveness; robust sandboxing and security isolation coexisting with real-time guarantees.
Notes on feasibility across applications:
- CVA6-RT’s 12-cycle interrupt latency is achieved with L1-resident handler paths and hardware stacking; end-to-end latency depends on SoC integration (interconnect, memory, peripherals).
- The paper demonstrates suitability for soft real-time; hard real-time and safety certification will require additional system-level determinism (DRAM/NoC QoS), fault tolerance, and process evidence.
- Effective use of SPM and TLB features requires OS/hypervisor changes, compiler/linker support, and developer discipline in code/data placement.
Glossary
- Address decoding logic: Hardware that maps physical address ranges to specific on-chip resources or memory regions. "Address decoding logic in the cache controllers maps designated physical address regions to the SPM"
- Application-class processor: A CPU designed to run full operating systems and complex workloads (e.g., Linux), as opposed to microcontrollers. "the RISC-V ecosystem currently lacks an application-class processor with comparable real-time capabilities."
- Cache coloring: A software technique to partition cache sets via page coloring to reduce conflict and interference. "SW-only approaches such as cache and TLB coloring are often impractical due to high latency overhead"
- Cache replacement logic: The policy/mechanism that selects which cache line to evict on a miss. "Ways assigned to SPM are removed from the cache replacement logic, and their tags and valid bits are cleared"
- Cache way: One of the associativity ways in a set-associative cache that can be individually configured or allocated. "Each cache way can be dynamically configured either as a conventional cache way or as software-managed scratchpad memory."
- Commit stage: The pipeline stage where instructions retire and their effects become architecturally visible. "from the instruction decode stage to the commit stage"
- Context save: Storing CPU register state to memory during interrupts or traps to preserve execution context. "CVA6-RT adds hardware-assisted context save support."
- Context stacking: Automatic saving (stacking) of CPU context on interrupt/trap entry, often accelerated by hardware. "hardware-assisted context stacking"
- Core-Local Interrupt Controller (CLIC): A RISC-V per-core interrupt controller providing fine-grained priorities, vectoring, and preemption. "RISC-V Core-Local Interrupt Controller (CLIC)"
- Criticality domains: Hardware/software partitions with different safety or timing criticality levels to isolate resources. "Partitioning the SoC into criticality domains (e.g., 32-b/64-b control/application processors)"
- Deterministic memory access: Memory accesses with bounded, constant latency, independent of cache behavior. "for deterministic memory access"
- Eviction-based interference: Performance variability caused by one task evicting another task’s cache/TLB entries. "preventing eviction-based interference on a shared core."
- Hardware-assisted register stacking: Automatic hardware-driven saving of registers on interrupt/trap entry to reduce latency. "hardware-assisted register stacking for fast context switch."
- Interrupt injection: Delivering an interrupt directly into the processor pipeline or a specific privilege level. "direct interrupt injection to lower privilege modes"
- Interrupt latency: The time (often in cycles) from an interrupt request to the start of the handler. "CVA6-RT achieves an interrupt latency of 12 cycles"
- Interrupt nesting: Allowing higher-priority interrupts to preempt a currently executing interrupt handler. "interrupt vectoring, nesting, and tail-chaining."
- Interrupt vectoring: Hardware selection of the appropriate interrupt service routine address based on source/priority. "interrupt vectoring, nesting, and tail-chaining."
- Jitter: Variability in timing (e.g., response or latency), undesirable in real-time systems. "reduces interrupt latency and jitter"
- Mixed-criticality (MC) systems: Systems concurrently running tasks with different timing/safety criticality levels. "Mixed-criticality (MC) systems must execute workloads with different time-criticality levels"
- Pipeline flush: Discarding in-flight instructions to handle control-flow changes, traps, or precise exceptions. "pipeline flush latency"
- Preemption: Interrupting current execution so a higher-priority task/interrupt can run immediately. "fine-grained interrupt prioritization and preemption"
- Privilege modes: Processor execution levels with differing authority (e.g., machine, supervisor, user). "lower privilege modes"
- Pseudo-LRU: An approximate least-recently-used replacement policy used in caches/TLBs to reduce complexity. "pseudo-LRU-based TLB replacement logic"
- RV64GCH ISA: A RISC-V 64-bit ISA profile including the G (base + standard extensions), C (compressed), and H (hypervisor) extensions. "rv64gch ISA"
- Scratchpad memory (SPM): Software-managed on-chip memory providing fixed, predictable access latency. "software-managed scratchpad memory"
- Tail-chaining: A mechanism to transition directly from one interrupt service routine to the next without full save/restore. "tail-chaining."
- TLB coloring: Software technique to partition TLB sets to reduce contention across tasks. "cache and TLB coloring"
- TLB locking: Pinning TLB entries to prevent their eviction, ensuring predictable translation latency. "TLB partitioning and locking"
- TLB partitioning: Dividing TLB entries into disjoint sets assigned to tasks to avoid mutual interference. "TLB resource partitioning"
- Trap entry: The processor’s transition into a trap/interrupt handler, including initial microarchitectural steps. "To minimize software overhead during trap entry"
- Trap handling logic: Microarchitectural mechanisms responsible for detecting, prioritizing, and servicing traps/interrupts. "extending the core's trap handling logic to support hardware-managed context save."
- Virtualization: Hardware/software support that allows multiple isolated OS instances (VMs) to run concurrently. "has been extended to support virtualization"
- Virtualized systems: Systems that execute workloads inside virtual machines managed by a hypervisor. "virtualized systems"
- Zonal controllers: Automotive controllers that centralize processing per vehicle zone to simplify wiring and integration. "zonal controllers"
Collections
Sign up for free to add this paper to one or more collections.