RISC-V Design · All levels

Privilege Levels, Execution Modes, and Delegation Boundaries

Privileged Architecture: RISC-V privileged architecture separates software responsibilities across machine mode (M), supervisor mode (S), and user mode (U), with optional hypervisor virtualization layering for host and guest control. M-mode owns platform bring-up and root control, while S-mode runs the operating system and U-mode executes applications under constrained permissions. Security and correctness hinge on explicit delegation and filtering: machine-level registers such as medeleg/mideleg can route selected traps to S-mode, while PMP and page-table permissions ensure each mode only touches approved address regions. Robust implementations also define deterministic rules for mode transitions during interrupts, exceptions, and system calls so return paths cannot leak privilege or corrupt architectural state.

What this topic teaches

Privilege Levels, Execution Modes, and Delegation Boundaries trains mechanism-first reasoning for RISC-V design closure. RISC-V privileged architecture separates software responsibilities across machine mode (M), supervisor mode (S), and user mode (U), with optional hypervisor virtualization layering for host and guest control. M-mode owns platform bring-up and root control, while S-mode runs the operating system and U-mode executes applications under constrained permissions. Security and correctness hinge on explicit delegation and filtering: machine-level registers such as medeleg/mideleg can route selected traps to S-mode, while PMP and page-table permissions ensure each mode only touches approved address regions. Robust implementations also define deterministic rules for mode transitions during interrupts, exceptions, and system calls so return paths cannot leak privilege or corrupt architectural state.

Senior-engineer framing question

When Privilege-transition latency and number of unauthorized accesses blocked by PMP/page-permission checks per billion instructions. moves, can you isolate first failing mechanism, request decisive evidence, assign owner, and decide release-safe action?

diagram

RISC-V PIPELINE DIAGRAM - Privilege Levels, Execution Modes, and Delegation Boundaries

PC -> IF -> ID -> EX -> MEM -> WB
      |     |      |      |      |
  i-cache decode  ALU/BR  LSU    regfile write
              \   |
               +-> branch resolve + redirect

Hot paths:
  - branch + load-use dependencies in ID/EX
  - memory latency stretching MEM stage
  - writeback arbitration for integer/vector units

Focus: map symptom to first failing stage

Architecture visuals

Draw before you tune. Use these visuals in design reviews, interview loops, and post-silicon triage.

Decode and control map

diagram

DECODE CONTROL MAP - Privilege Levels, Execution Modes, and Delegation Boundaries

opcode/funct3/funct7      controls asserted
-----------------------   ---------------------------------------
LUI / AUIPC               rd_write, imm_select(U), alu_add_pc
JAL / JALR                rd_write, pc_redirect, link_write
BRANCH                    cmp_enable, branch_type, pc_redirect
LOAD                      mem_read, rd_write, wb_sel(memory)
STORE                     mem_write, store_size, addr_calc
OP-IMM                    alu_enable, imm_select(I), rd_write
OP                        alu_enable, src2_reg, rd_write
SYSTEM / CSR              csr_readwrite, trap_check, privilege_gate
VECTOR (V extension)      vdecode, lane_mask, vtype_update

Privilege stack

diagram

PRIVILEGE MODE STACK - Privilege Levels, Execution Modes, and Delegation Boundaries

            +------------------------------+
            | Machine mode (M)             |
            | firmware, PMP, trap root     |
            +---------------+--------------+
                            |
                    delegated traps
                            v
            +------------------------------+
            | Supervisor mode (S)          |
            | kernel, page tables, drivers |
            +---------------+--------------+
                            |
                    ecall / syscall
                            v
            +------------------------------+
            | User mode (U)                |
            | applications, libraries      |
            +------------------------------+

Key rule: each upward transition records cause + PC in trap CSRs.

Translation path

diagram

MMU PAGE WALK DIAGRAM - Privilege Levels, Execution Modes, and Delegation Boundaries

virtual address
    |
    +--> TLB lookup hit? ---- yes ---> physical address -> cache/memory
    |             |
    |             no
    v
satp root PPN + VPN indices
    |
    +--> level-2 PTE fetch (valid?)
    |         |
    |         +-- no -> page fault trap
    v
level-1 PTE fetch -> level-0 PTE fetch
    |
    +--> permissions check (R/W/X, U/S, A/D)
             |
             +-- fail -> access fault trap
             +-- pass -> install TLB entry -> continue

Vector lane lens

diagram

VECTOR LANE VIEW - Privilege Levels, Execution Modes, and Delegation Boundaries

VLEN register file
   |
   +--> lane0: ALU/MUL/permute
   +--> lane1: ALU/MUL/permute
   +--> lane2: ALU/MUL/permute
   +--> lane3: ALU/MUL/permute
            ...
mask register -> per-lane predicate enable
load/store unit -> strided/segmented access queue

Throughput model:
effective ops/cycle = active_lanes * issue_rate * mask_density

Focus: balance lane utilization and memory feed

Ownership layers

diagram

RISC-V OWNERSHIP LAYERS - Privilege Levels, Execution Modes, and Delegation Boundaries

layer                  owner                         closure artifact
--------------------   ----------------------------  -----------------------------
ISA compliance         architecture/spec team        unpriv + priv test evidence
decode/control         front-end RTL owner           decode matrix + assertions
pipeline timing        microarchitecture owner       hazard/perf regression trends
memory + MMU           LSU/MMU owner                 TLB/pagewalk trace checks
privilege/CSR path     firmware + kernel interface   trap/interrupt conformance
vector subsystem       vector RTL + compiler owner   lane-utilization profiles

Evidence required

Primary metric: Privilege-transition latency and number of unauthorized accesses blocked by PMP/page-permission checks per billion instructions..
Primary artifact: Privilege-transition matrix covering entry source, target mode, delegated cause bits, and required state-save set..
Owners to include: CPU architecture lead, privileged ISA owner, firmware and boot owner, kernel porting owner, security validation owner.
One reproducible workload and one stable comparator run.
One run with locked environment metadata for causal confidence.

Root-cause tree

diagram

ROOT CAUSE TREE - Privilege Levels, Execution Modes, and Delegation Boundaries

Privilege-transition latency and number of unauthorized accesses blocked by PMP/page-permission checks per billion instructions. regressed
          |
   reproducible on fixed seed?
      /                 \
    no                   yes
    |                     |
env/tool drift       first failing domain?
                     /        |         \
                  decode    execute    memory/MMU
                    |         |            |
               control map  bypass/FU   TLB/walk/perm
                    |
         privilege/CSR side effects checked?

Stop at first confirmed mechanism, then assign explicit owner + fix proof.

Movement trend

diagram

BEFORE / AFTER TREND - Privilege Levels, Execution Modes, and Delegation Boundaries

Privilege-transition latency and number of unauthorized accesses blocked by PMP/page-permission checks per billion instructions.
  ^
  |                           o target band
  |                    o after fix + reruns
  |             o
  |      o baseline (failing)
  +--------------------------------------------------> iteration
       capture issue      isolate mechanism      close + monitor

Use this view to confirm the gain is causal and stable across seeds.

Key takeaways

Classify mechanism before proposing fixes.
Tie every claim to one proving artifact.
Close with owner accountability and rollback criteria.

Common pitfalls

Averaging away tail behavior and mode-specific failures.
Blending results from mismatched build/runtime metadata.
Declaring closure before cross-workload validation.

Practice this lesson