\chapter{Introduction}
\label{sec:intro}

When a design progresses from simulation to hardware implementation, a user's
control and understanding of the system's current state drops dramatically.
To help bring up and debug low level software and hardware,
it is critical to have good debugging support built into the hardware.
When a robust OS is running on a core, software can handle many
debugging tasks. However, in many scenarios, hardware support is essential.

This document outlines a standard architecture for external debug support 
on RISC-V platforms. This architecture allows a variety of implementations and
tradeoffs, which is complementary to the wide range of RISC-V implementations.
At the same time, this specification defines common interfaces to
allow debugging tools and components to target a variety of platforms based on the RISC-V ISA.

System designers may choose to add additional hardware debug support,
but this specification defines a standard interface for common
functionality.

\section{Terminology}

A \emph{platform} is a single integrated circuit consisting of one or more
\emph{components}. Some components may be RISC-V cores, while others may have a different
function. Typically they will all be connected to a single system bus.
A single RISC-V core contains one or more hardware threads, called
\emph{harts}.

\subsection{Context}

\begin{steps}{This document is written to work with:}
\item The RISC-V Instruction Set Manual, Volume I: User-Level ISA, Document
    Version 2.2
\item The RISC-V Instruction Set Manual, Volume II: Privileged Architecture, Version
    1.10
\end{steps}

\section{About This Document}

\subsection{Structure}

This document contains two parts. The main part of the document is the
specification, which is given in the numbered sections. The second part
of the document is a set of  appendices. The information
in the appendix is intended to clarify and provide examples, but is
not part of the actual specification.


\subsection{Register Definition Format}

All register definitions in this document follow the format shown below.
A simple graphic shows which fields are in the register. The
upper and lower bit indices are shown to the top left and top right of each
field. The total number of bits in the field are shown below it.

After the graphic follows a table which for each field lists its name,
description, allowed accesses, and reset value. The allowed accesses are listed
in Table~\ref{tab:access}.

\begin{table}[htp]
    \centering
    \caption{Register Access Abbreviations}
    \label{tab:access}
    \begin{tabulary}{\textwidth}{|l|L|}
        \hline
        R & Read-only. \\
        \hline
        R/W & Read/Write. \\
        \hline
        R/W0 & Read/Write. Only writing 0 has an effect.  \\
        \hline
        R/W1 & Read/Write. Only writing 1 has an effect.  \\
        \hline
        R/W1C & Read/Write. For each bit in the field, writing 1 clears that bit. Writing 0 has no effect. \\
        \hline
        W & Write-only. When read this field returns 0. \\
        \hline
        W1 & Write-only. Only writing 1 has an effect. \\
        \hline
    \end{tabulary}
\end{table}

Names of registers and their bits are hyperlinks to their definition. If you're
reading this on paper, there's an index with all their names on page
\pageref{index}.

\input{sample_registers.tex}

%\input{reading_order.tex}

\section{Background}

There are several use cases for dedicated debugging hardware, both
internal to a CPU core and with an external connection.
This specification addresses the use cases listed below. Implementations
can choose not to implement every feature, which means some use cases might
not be supported.

\begin{itemize}

\item Debugging low-level software in the absence of an OS or other software.

\item Debugging issues in the OS itself.

\item Bootstrapping a system to test, configure, and program components before
  there is any executable code path in the system.

\item Accessing hardware on a system without a working CPU.

\end{itemize}

In addition, even without a hardware debugging interface,
architectural support in a RISC-V CPU can aid software debugging and
performance analysis by allowing hardware triggers and breakpoints.
This specification aims to define common resources which can be used
for different cases.

When debugging software, this specification distinguishes between two
forms of external debugging. The first is \emph{halt mode} debugging,
where an external debugger halts some or all components of a
platform and inspects their state while they are in stasis.
The debugger can read and/or modify state, then direct the hardware
to execute a single instruction, or continue to run freely.

The second is \emph{run mode} debugging. In this mode a software
debug agent runs on a component (eg.  triggered by a timer interrupt or breakpoint
on a RISC-V core) which transfers data to or from the debugger
without halting the component, only briefly interrupting its program flow.
This functionality is essential if the component is controlling some real-time system (like a
hard drive) where long timing delays could lead to physical damage.
This requires additional software support (both on the system as well as on the debugger),
and efficient communication channels between the component and the debugger.

%MAW -- where does Quick Access fit in the above description? Is it fair to call
% it run-mode debugging?

\section{Supported Features}

The debug interface described in this specification supports the following features:

\begin{enumerate}
   \item RV32, RV64, and future RV128 are all supported.
   \item Any hart in the platform can be independently debugged.
   \item A debugger can discover almost\footnote{Notable exceptions include
       information about the memory map and peripherals.} everything it needs
       to know itself, without user configuration.
   \item Each hart can be debugged from the very first instruction executed.
   \item A RISC-V hart can be halted when a software breakpoint instruction is
       executed.
   \item Hardware single-step can execute one instruction at a time.
   \item Debug functionality is independent of the debug transport used.
   \item The debugger does not need to know anything about the microarchitecture
       of the cores it is debugging.

   \item Arbitrary subsets of harts can be halted and resumed simultaneously.
       (Optional)
   \item Arbitrary instructions can be executed on
       a halted hart. That means no new debug functionality is needed when a
       core has additional or custom instructions or state, as
       long as there exist programs
       that can move that state into GPRs. (Optional)
   \item Registers can be accessed without halting. (Optional)
   \item A running hart can be directed to execute a short sequence
       of instructions, with little overhead. (Optional)
   \item A system bus master allows memory access without
       involving any hart. (Optional)
   \item A RISC-V hart can be halted when a trigger matches the PC,
       read/write address/data, or an instruction opcode. (Optional)
\end{enumerate}

While both the mechanism to execute arbitrary instructions and the system bus
master are optional, at least one of them must be implemented. Otherwise there
is no mechanism to access memory.

This document does not suggest a strategy or implementation for hardware test,
debugging or error detection techniqes. Scan, BIST, etc. are out of scope of
this specification, but this specification does not intend to limit their use
in RISC-V systems.

The debug interface deals with physical addresses only. Address translation is
outside the scope of this specification, as are software threads.
