[rtl] Read csr_addr direct from instruction

Previously the ibex_cs_registers module received the CSR address via the
operand muxes. This has been observed to cause timing issues in some
cases. The CSR address is always read from the same bits of the
instruction so there's no need to go via the operand muxes. With this
change the relevant instruction bits are fed straight out of the decoder
and into the ibex_cs_registers module.

rtl/ibex_core.sv

@@ -618,6 +618,7 @@ module ibex_core import ibex_pkg::*; #(
     // CSR ID/EX
     .csr_access_o         (csr_access),
     .csr_op_o             (csr_op),
+    .csr_addr_o           (csr_addr),
     .csr_op_en_o          (csr_op_en),
     .csr_save_if_o        (csr_save_if),  // control signal to save PC
     .csr_save_id_o        (csr_save_id),  // control signal to save PC
@@ -1046,7 +1047,6 @@ module ibex_core import ibex_pkg::*; #(
   /////////////////////////////////////////
 
   assign csr_wdata  = alu_operand_a_ex;
-  assign csr_addr   = csr_num_e'(csr_access ? alu_operand_b_ex[11:0] : 12'b0);
 
   ibex_cs_registers #(
     .DbgTriggerEn     (DbgTriggerEn),

rtl/ibex_decoder.sv

@@ -83,6 +83,7 @@ module ibex_decoder #(
   // CSRs
   output logic                 csr_access_o,          // access to CSR
   output ibex_pkg::csr_op_e    csr_op_o,              // operation to perform on CSR
+  output ibex_pkg::csr_num_e   csr_addr_o,            // CSR address
 
   // LSU
   output logic                 data_req_o,            // start transaction to data memory
@@ -138,6 +139,8 @@ module ibex_decoder #(
   assign imm_u_type_o = { instr[31:12], 12'b0 };
   assign imm_j_type_o = { {12{instr[31]}}, instr[19:12], instr[20], instr[30:21], 1'b0 };
 
+  assign csr_addr_o = csr_num_e'(instr[31:20]);
+
   // immediate for CSR manipulation (zero extended)
   assign zimm_rs1_type_o = { 27'b0, instr_rs1 }; // rs1
 
@@ -1168,9 +1171,10 @@ module ibex_decoder #(
           alu_op_b_mux_sel_o = OP_B_IMM;
         end else begin
           // instruction to read/modify CSR
-          alu_op_b_mux_sel_o = OP_B_IMM;
           imm_a_mux_sel_o    = IMM_A_Z;
-          imm_b_mux_sel_o    = IMM_B_I;  // CSR address is encoded in I imm
+
+          // No need for operand/immediate B mux selection. The CSR address is fed out as csr_addr_o
+          // as the CSR address always comes from the same field in the instruction.
 
           if (instr_alu[14]) begin
             // rs1 field is used as immediate

rtl/ibex_id_stage.sv

@@ -95,6 +95,7 @@ module ibex_id_stage #(
   // CSR
   output logic                      csr_access_o,
   output ibex_pkg::csr_op_e         csr_op_o,
+  output ibex_pkg::csr_num_e        csr_addr_o,
   output logic                      csr_op_en_o,
   output logic                      csr_save_if_o,
   output logic                      csr_save_id_o,
@@ -497,6 +498,7 @@ module ibex_id_stage #(
     // CSRs
     .csr_access_o(csr_access_o),
     .csr_op_o    (csr_op_o),
+    .csr_addr_o  (csr_addr_o),
 
     // LSU
     .data_req_o           (lsu_req_dec),