RISC-V /Debug /Match Control Type 6 (64-bit mcontrol6)

Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text

Interpret as Match Control Type 6 (64-bit mcontrol6)

63 6059 5655 5251 4847 4443 4039 3635 3231 2827 2423 2019 1615 1211 87 43 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 (load)load 0 (store)store 0 (execute)execute 0 (u)u0 (s)s0 (disabled)uncertainen 0 (m)m0 (equal)match0 (disabled)chain 0 (breakpoint)action0 (any)size0 (address)select 0 (false)hit0 0 (vu)vu 0 (vs)vs 0 (hit1)hit1 0 (certain)uncertain 0 (dmode)dmode 0type

hit0=false, select=address, size=any, chain=disabled, uncertainen=disabled, match=equal, uncertain=certain, action=breakpoint

Description

This register provides access to the trigger selected by {csr-tselect}. The reset values listed here apply to every underlying trigger.

This register is accessible as {csr-tdata1} when {tdata1-type} is 6.

Implementing this trigger as described here requires that {tinfo-version} is 1 or higher, which in turn means {csr-tinfo} must be implemented.

This replaces mcontrol in newer implementations and serves to provide additional functionality.

Address and data trigger implementation are heavily dependent on how the processor core is implemented. To accommodate various implementations, execute, load, and store address/data triggers may fire at whatever point in time is most convenient for the implementation.

tab:hwbp_timing suggests timings for the best user experience. The underlying principle is that firing just before the instruction gives a user more insight, so is preferable. However, depending on the instruction and conditions, it might not be possible to evaluate the trigger until the instruction has partially executed. In that case it is better to let the instruction retire before the trigger fires, to avoid extra memory accesses which might affect the state of the system.

Suggested Trigger Timings

Match Type Suggested Trigger Timing
Execute Address Before
Execute Instruction Before
Execute Address+Instruction Before
Load Address Before
Load Data After
Load Address+Data After
Store Address Before
Store Data Before
Store Address+Data Before

A chain of triggers must only fire if every trigger in the chain was matched by the same instruction.

The Privileged Spec says that breakpoint exceptions that occur on instruction fetches, loads, or stores update the tval CSR with either zero or the faulting virtual address. The faulting virtual address for an mcontrol6 trigger with {mcontrol6-action}=0 is the address being accessed and which caused that trigger to fire. If multiple mcontrol6 triggers are chained then the faulting virtual address is the address which caused any of the chained triggers to fire.

In implementations that support {mcontrol6-match} mode 1 (NAPOT), not all NAPOT ranges may be supported. All NAPOT ranges between $2^1$ and $2^{maskmax6}$ are supported where ${maskmax6} ≥ 1$. The value of maskmax6 can be determined by the debugger via the following sequence:

  1. Write {csr-tdata1}=0, in case the current {csr-tdata2} value is not supported with mcontrol6 triggers.
  2. Write {csr-tdata2}=0, which is always supported with mcontrol6 triggers.
  3. Write {csr-tdata1} with {tdata1-type}=mcontrol6 and {mcontrol6-match}=1.
  4. Read {mcontrol6-match}. If it is not 1 then NAPOT matching is not supported.
  5. Write all ones to {csr-tdata2}.
  6. Read {csr-tdata2}. The value of maskmax6 is the index of the most significant 0 bit plus 1.

If {csr-textra32} or {csr-textra64} are implemented for this trigger, it only matches when the conditions set there are satisfied.

📌 NOTE

{mcontrol6-uncertain} and {mcontrol6-uncertainen} exist to accommodate systems where not every memory access is fully observed by the Trigger Module. Possible examples include data values in far AMOs, and the address/data/size of accesses by instructions that perform multiple memory accesses, such as vector, push, and pop instructions.

While the uncertain mechanism exists to deal with these situations, it can lead to an unusable number of false positives. Users will get a much better debug experience if the TM does have perfect visibility into the details of every memory access.

Fields

load

When set, the trigger fires on the virtual address or data of any load.

store

When set, the trigger fires on the virtual address or data of any store.

execute

When set, the trigger fires on the virtual address or opcode of an instruction that is executed.

u

When set, enable this trigger in U-mode. This bit is hard-wired to 0 if the hart does not support U-mode.

s

When set, enable this trigger in S/HS-mode. This bit is hard-wired to 0 if the hart does not support S-mode.

uncertainen

0 (disabled): This trigger will only match if the hardware can perfectly evaluate it.

1 (enabled): This trigger will match if it’s possible that it would match if the Trigger Module had perfect information about the operations being performed.

m

When set, enable this trigger in M-mode.

match

0 (equal): Matches when any compare value equals {csr-tdata2}.

1 (napot): Matches when the top M bits of any compare value match the top M bits of {csr-tdata2}. M is XLEN-1 minus the index of the least-significant bit containing 0 in {csr-tdata2}. {csr-tdata2} is WARL and if bits maskmax6-1:0 are written with all ones then bit maskmax6-1 will be set to 0 while the values of bits maskmax6-2:0 are UNSPECIFIED. Legal values for {csr-tdata2} require M + maskmax6XLEN and M > 0. See above for how to determine maskmax6.

2 (ge): Matches when any compare value is greater than (unsigned) or equal to {csr-tdata2}.

3 (lt): Matches when any compare value is less than (unsigned) {csr-tdata2}.

4 (mask low): Matches when latexmath:[$\frac{XLEN}{2}-{1:0}] of any compare value equals latexmath:[$\frac{XLEN}{2}-{1:0}] of {csr-tdata2} after latexmath:[$\frac{XLEN}{2}-{1:0}] of the compare value is ANDed with XLEN-1:latexmath:[$\frac{XLEN}{2}$] of {csr-tdata2}.

5 (mask high): Matches when XLEN-1:latexmath:[$\frac{XLEN}{2}$] of any compare value equals latexmath:[$\frac{XLEN}{2}-{1:0}] of {csr-tdata2} after XLEN-1:latexmath:[$\frac{XLEN}{2}$] of the compare value is ANDed with XLEN-1:latexmath:[$\frac{XLEN}{2}$] of {csr-tdata2}.

8 (not equal): Matches when {mcontrol6-match} =0 would not match.

9 (not napot): Matches when {mcontrol6-match} =1 would not match.

12 (not mask low): Matches when {mcontrol6-match} =4 would not match.

13 (not mask high): Matches when {mcontrol6-match} =5 would not match.

chain

0 (disabled): When this trigger matches, the configured action is taken.

1 (enabled): While this trigger does not match, it prevents the trigger with the next index from matching.

action

The action to take when the trigger fires. The values are explained in tab:action.

0 (breakpoint):

1 (debug mode):

2 (trace on):

3 (trace off):

4 (trace notify):

8 (external0):

9 (external1):

size

0 (any): The trigger will attempt to match against an access of any size. The behavior is only well-defined if {mcontrol6-select}=0, or if the access size is XLEN.

1 (8bit): The trigger will only match against 8-bit memory accesses.

2 (16bit): The trigger will only match against 16-bit memory accesses or execution of 16-bit instructions.

3 (32bit): The trigger will only match against 32-bit memory accesses or execution of 32-bit instructions.

4 (48bit): The trigger will only match against execution of 48-bit instructions.

5 (64bit): The trigger will only match against 64-bit memory accesses or execution of 64-bit instructions.

6 (128bit): The trigger will only match against 128-bit memory accesses or execution of 128-bit instructions.

select

This bit determines the contents of the XLEN-bit compare values.

0 (address): There is at least one compare value and it contains the lowest virtual address of the access. In addition, it is recommended that there are additional compare values for the other accessed virtual addresses match. (E.g. on a 32-bit read from 0x4000, the lowest address is 0x4000 and the other addresses are 0x4001, 0x4002, and 0x4003.)

1 (data): There is exactly one compare value and it contains the data value loaded or stored, or the instruction executed. Any bits beyond the size of the data access will contain 0.

hit0

If they are implemented, {mcontrol6-hit1} (MSB) and {mcontrol6-hit0} (LSB) combine into a single 2-bit field. The TM updates this field when the trigger fires. After the debugger has seen the update, it will normally write 0 to this field to so it can see future changes.

If either of the bits is not implemented, the unimplemented bits will be read-only 0.

0 (false): The trigger did not fire.

1 (before): The trigger fired before the instruction that matched it was retired, but after all preceding instructions are retired. This explicitly allows for instructions to be partially executed, as described in multistate.

xepc or {csr-dpc} (depending on {mcontrol6-action}) must be set to the virtual address of the instruction that matched.

2 (after): The trigger fired after the instruction that triggered and at least one additional instruction were retired. xepc or {csr-dpc} (depending on {mcontrol6-action}) must be set to the virtual address of the next instruction that must be executed to preserve the program flow.

3 (immediately after): The trigger fired just after the instruction that triggered it was retired, but before any subsequent instructions were executed. xepc or {csr-dpc} (depending on {mcontrol6-action}) must be set to the virtual address of the next instruction that must be executed to preserve the program flow.

If the instruction performed multiple memory accesses, all of them have been completed.

vu

When set, enable this trigger in VU-mode. This bit is hard-wired to 0 if the hart does not support virtualization mode.

vs

When set, enable this trigger in VS-mode. This bit is hard-wired to 0 if the hart does not support virtualization mode.

hit1
uncertain

If implemented, the TM updates this field every time the trigger fires.

0 (certain): The trigger that fired satisfied the configured conditions, or this bit is not implemented.

1 (uncertain): The trigger that fired might not have perfectly satisfied the configured conditions. Due to the implementation the hardware cannot be certain.

dmode
type

Links

() ()