CVA6-RT: Real-Time RISC-V Core Extension

• CVA6-RT is a real-time extension of the CVA6 RISC-V core featuring predictable address translation, deterministic memory access, and low interrupt latency.
• It employs hardware-accelerated mechanisms, including TLB partitioning and reconfigurable L1 scratchpad mode, to ensure fixed execution bounds for safety-critical operations.
• The design integrates efficient branch tracing and side-channel analysis support, enabling high observability and robust performance in mixed-criticality environments.

CVA6-RT is a real-time microarchitectural extension of the open-source CVA6 (formerly Ariane) RISC-V 64-bit application-class core. It introduces architectural and microarchitectural mechanisms to tightly bound worst-case execution and interrupt latency, as well as reduce timing variability—key requirements for mixed-criticality and real-time embedded systems. The extensions include predictable address translation via TLB partitioning and locking, dynamically reconfigurable scratchpad modes in L1 caches for deterministic access, and an enhanced interrupt subsystem featuring hardware-assisted context stacking. Additionally, CVA6-RT incorporates a RISC-V Efficient Trace–compliant instruction branch tracing (IBT) infrastructure, facilitating high-precision real-time trace capture with minimal area and bandwidth overhead. These capabilities position the core for safety-critical, time-predictable 64-bit SoC integration while maintaining full Linux compatibility and supporting complex real-time scheduling (Zelioli et al., 24 Jun 2026, Laghi et al., 24 Mar 2025).

1. CVA6-RT Architectural Enhancements

CVA6-RT extends the baseline 6-stage, in-order CVA6 core, which features Sv39 virtual memory, 32 KiB L1 caches, and pseudo-LRU replacement, by introducing three principal real-time blocks:

• TLB Partitioning and Locking: The 64-entry TLB is partitioned into P disjoint sets; partition selection and lockout are managed through dedicated CSRs (tbase_cfg, tlock_cfg). This ensures that time-critical tasks have persistent, non-evictable VA→PA translations, eliminating latency and unpredictability from TLB miss events. Locked entries deliver hit latency of $$T_{\mathrm{translate}}^{\max} = T_{\mathrm{TLB\_hit}} \approx 2$$–$3$ cycles, whereas general translation exhibits variabilities due to miss ($$T_{\mathrm{miss}} = N_{\mathrm{lvl}} \times (T_{\mathrm{mem}} + T_{\mathrm{walk\_overhead}})$$).
• Reconfigurable L1 Scratchpad Mode: The I- and D-cache ways can be selectively switched to scratchpad (SPM) through icache_cfg and dcache_cfg. In SPM mode, tags/valid bits are disabled, and address ranges are directly mapped, guaranteeing single-cycle ($T_{\mathrm{SPM}} = T_{\mathrm{L1\_hit}} \approx 1$ cycle) deterministic access latency for critical code/data. This eradicates cache-miss induced timing excursions ($T_{\mathrm{cache\_miss}}^{\max} \approx 61$ cycles).
• Enhanced Interrupt Controller with HW Context Stacking: An upgraded CLIC (Configurable Level Interrupt Controller) implements per-interrupt priority, virtualization (vCLIC), and tail-chaining. Context save is hardware-accelerated: a bitmap-driven mechanism auto-spills selected x1–x31 registers to SPM on trap entry, eliminating the need for software prologues and achieving a minimum interrupt latency of 12 cycles. The breakdown consists of IRQ propagation (3 cycles), injection (2), pipeline flush/redirect (7), and hardware save (0).

2. Deterministic Execution and Mixed-Criticality Operation

CVA6-RT's SPM and TLB partitioning provide a platform for execution with tight worst-case latency bounds, supporting strategies required in hard real-time and mixed-criticality environments.

• Memory Partitioning: Software configures SPM/I-cache or SPM/D-cache ways at boot, allocating them to safety-critical code (e.g., ISRs, control kernels). Non-critical tasks are restricted to non-SPM cache partitions. Analogously, TLB partition/locking prevents interference from lower criticality workloads.
• Jitter Elimination and Preemption: Interrupt handling leverages the hardware context stack and fine-grained CLIC prioritization. This enables preemption-latency guarantees and true tail-chaining (critical ISRs can always preempt with <1 cycle of variability).
• Latency and Variability Metrics: Empirical comparisons yield min/max interrupt latencies of 12/13 cycles (variability $\sigma_{\mathrm{CVA6\!-\!RT}} \approx 1$), compared to 120/170 (baseline CVA6) and 12/15 (Arm Cortex-M7), with a measured real-time workload speedup of 10× over the baseline (Zelioli et al., 24 Jun 2026).

3. Instruction Branch Tracing and Trace Encoder Integration

CVA6-RT further augments observability via a RISC-V Efficient Trace (E-Trace)–compliant Instruction Branch Tracing (IBT) system, implemented as a hardware Trace Encoder (TE):

• Trace Interface Port (TIP): Monitors the CVA6 retire stage, exposing PC, instruction types/sizes, privilege, and exception details via a synchronous handshake to the TE.
• TE Datapath and Core: Modular RTL architecture comprising:
  • APB-configurable control/config registers (te_reg)
  • Mask-based programmable trace filters (te_filter)
  • E-Trace packet construction (te_packet_emitter), supporting field multiplexing for multi-instruction retire
  • Priority management/packet arbitration (te_priority)
  • Compressed branch map tracking (te_branch_map; 31-bit register plus counter)
  • Periodic resynchronization support (te_resync_counter)
• AXI4/Ethernet Streaming: Trace packets are encapsulated and streamed off-chip for decoding and analysis.
• Empirical IBT Performance:
  • Area overhead: 9.2% on Xilinx VCU118 compared to CVA6-only; principal sources are TIP and AXI4 encapsulator (60% of overhead)
  • No impact on core clock frequency
  • Compression rate: Mean $R_{\mathrm{comp},\%} = 95.1\%$ across a diverse benchmark suite (integer, floating-point, vector, OS) (Laghi et al., 24 Mar 2025).

Benchmark	Compression $R_{\mathrm{comp},\%}$
axi_hyper_fibonacci	99.8
dhrystone	98.4
fp16_matmul	99.7
hello	90.4
timer	85.2
Average	95.1

• Trace Latency and Bandwidth: Peak trace bandwidth reaches 1.2 Gb/s (branch-dense workload), with end-to-end packetization latency of <3 cycles, no dropped packets at full retire rate.

4. Security and Side-Channel Analysis in CVA6-RT

Real-time usage in security-sensitive contexts necessitates active mitigation of power side-channel attacks (PSCAs), as demonstrated by cycle-accurate RTL-level evaluation:

• VeriSide Framework: Implements switching activity–based profiling, observing up to ∼98,523 nets at RTL. Generates time-aligned per-cycle power traces via Hamming distance.
• CPA Results: Correlation Power Analysis (targeting software AES S-Box) demonstrates recovery of the majority of subkey bytes with as few as 500–3,000 traces; peak Pearson correlations for different bytes range up to 0.85. The results confirm vulnerability at the unmitigated RTL (Farnaghinejad et al., 23 Dec 2025).
• Mitigation Recommendations:
  • RTL masking (share-based randomization at write-back stage): ~15% area, ~12% performance overhead
  • Clock/voltage randomization (insertion of skew cells, dynamic modulation): up to 10% power cost, minor real-time impact
  • Dual-rail datapaths for critical bytes: ~1% total area overhead
  • Pipeline shuffling (insertion of dummy operations): 2–3 cycle/round latency cost

A combination of lightweight masking and strategic hiding is suggested for real-time CVA6-RT deployments (Farnaghinejad et al., 23 Dec 2025).

5. ISA, CSR Extensions, and Programming Guidelines

CVA6-RT introduces new Control and Status Registers (CSRs) for fine-grained hardware control:

• TLB Management: tbase_cfg (partition enable bitmap), tlock_cfg (entry lock mask)
• Scratchpad Configuration: icache_cfg, dcache_cfg (way selection for SPM)
• HW Context Stacking: ctx_save_cfg (register auto-spill selection), stack_base (SPM spill area base)
• CLIC Extensions: Standard CLICCFG, CLICINFO, and CLICCTRLx for per-interrupt configurability

Programming guidelines for mixed-criticality operation specify reserving SPM/locked TLB regions for critical tasks/ISRs and assigning CLIC priorities such that only high-criticality events preempt. These enable bounded interrupt and memory access latency across OS and bare-metal workloads (Zelioli et al., 24 Jun 2026).

6. Evaluation Infrastructure and Empirical Analysis

Performance and determinism are validated through FPGA-in-the-loop emulation on a Xilinx VCU118 at 150 MHz, with real platform workloads and regression tests. The tracing subsystem is exercised under branch-intensive, vectorized, and OS-focused workloads, verifying:

• Sustained trace streaming without packet loss
• Cycle/resynchronization granularity through parameterized TE configuration
• Resource utilization, bandwidth, and latency profiles matching predicted levels
• End-to-end determinism maintained even in the presence of side-channel mitigation primitives when properly configured

These features ensure CVA6-RT is suitable for integration into mission- and safety-critical SoC designs demanding both high observability and strong time-predictability (Laghi et al., 24 Mar 2025, Zelioli et al., 24 Jun 2026).

7. Research Significance and Future Directions

CVA6-RT represents a convergence of open, Linux-capable RISC-V CPUs with hard real-time predictability and hardware-anchored trace/observability. Its selective SPM/locked TLB architecture, interrupt subsystem enhancements, and compliant IBT tracing address both the predictability and debug challenges of real-time, mixed-criticality, and safety-certified domains. The platform is intended for open-sourcing, further engagement with software trace decoders, and security-oriented enhancements (e.g., intrinsic side-channel countermeasures) (Laghi et al., 24 Mar 2025, Zelioli et al., 24 Jun 2026, Farnaghinejad et al., 23 Dec 2025). Future directions include richer trace packet formats, closer integration of power leakage countermeasures, and expanded hypervisor/guest virtualization support.