# RISC-V External Debug **URL:** \ **Category:** SiFive RISC-V Core IP Evaluation\ **Created:** [August 15, 2017, 11:07am UTC](https://forums.sifive.com/t/risc-v-external-debug/690 "2017-08-15T11:07:27Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![huangwanneng](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@huangwanneng](https://forums.sifive.com/u/huangwanneng)\ **Post date:** [August 15, 2017, 11:07am UTC](https://forums.sifive.com/t/risc-v-external-debug/690/1 "2017-08-15T11:07:27Z")
Hi, all I want to accessing registers using abstract command, ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/6be724ba105a6f6ea709147593f9a5ae75f4a7c0.png) 1.According to the part Debugger Implementation of **_RISC-V External Debug Support Version 0.13_** ,but I don’t understand what do “ **S0** ” and “ **matatus** ” mean? They are just register’s name? 2.And I also want to know how can I write a specified value into a specified physical address such as 0x8000\_0000, But I look at the “S0” use the GPRs whose value is 0x1008,and the “mstatus” is 0x300? Why mstatus ‘s GPRs is 0x300, It already exceed the GPRs’ range. 3.And I also have a question that why the bit of **write** is 0 when read “ **S0** ” using abstract command, it means that **_Copy data from the register specied by regno into the arg0 region of data, if write is clearand transfer is set._** What dose “arg0 region of data” means? How can I read a specifed address such as 0x8000\_0004 by using Abstract command by JTAG simulation. What should I pass the address such as 0x8000\_0004 into DM? That’s all .Sincerely waiting for your reply. ---
**Author:** ![mwachs5](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.sifive.com/mwachs5/32/13_2.png) [@mwachs5](https://forums.sifive.com/u/mwachs5)\ **Post date:** [August 15, 2017, 3:56pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/2 "2017-08-15T15:56:21Z")
1. `s0` and `mstatus` are RISC-V Registers. `s0` is a GPR and `mstatus` is a CSR. You can find out more about them by reading the RISC-V ISA Specifications ([https://riscv.org/specifications/](https://riscv.org/specifications/)) 2. `mstatus` is not a GPR, it is a CSR. See Table 3.3 “Abstract Register Numbers”. 0x300 is in the range for CSRs. 3. To understand “arg0 region of data”, please see Table 3.2, “Use of Data Registers”. It is not possible to read/write arbitrary memory locations with Abstract Commands only. You must use the Program Buffer or the System Bus Access block. ---
**Author:** ![mwachs5](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.sifive.com/mwachs5/32/13_2.png) [@mwachs5](https://forums.sifive.com/u/mwachs5)\ **Post date:** [August 15, 2017, 4:00pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/3 "2017-08-15T16:00:08Z")
Also, since your question was specifically about the E31 Coreplex, a few things to note for that specific implementation of the spec: - Only GPR Abstract Commands are supported. To access a CSR, you need to use Program Buffer - There is no System Bus Access Block, so you must use the Progam Buffer to access memory. ---
**Author:** ![huangwanneng](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@huangwanneng](https://forums.sifive.com/u/huangwanneng)\ **Post date:** [August 16, 2017, 10:15am UTC](https://forums.sifive.com/t/risc-v-external-debug/690/4 "2017-08-16T10:15:29Z")
1.Thanks, but I don’t understand what does **_“lw s1, 0(s0)”_** mean ? Is it not a value? what is the value in JTAG Debug Module Interface Accessing? why is it a Assembler command? And I also want to know what does “ebreak” mean? ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/78f78f09a0a7a11505da74f62ceb9633f8c2ba05.png) ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/338aa9e6f098a26fd364f26759a305526d9f729e.png) 2.And I also have a question that why don’t leave **“write progbuf0" and "write progbuf1 ebreak "** behind? What operations does it actually represent? I think that they should place in the end. 3.why is **_“sw 0(s0) ,s1”_** in _ **"write a word to memory using program buffer"** _,but "**_“sw s1,0(s0)”_** in _ **"write block of memory using program buffer"** _, Are there some error? ---
**Author:** ![mwachs5](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.sifive.com/mwachs5/32/13_2.png) [@mwachs5](https://forums.sifive.com/u/mwachs5)\ **Post date:** [August 16, 2017, 4:27pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/5 "2017-08-16T16:27:12Z")
1. `lw s1 0(s0)` is a RISC-V assembly instruction. You can understand what it means and its exact value by reading about the `lw` instruction in the RISC-V ISA Manual. `ebreak` instruction is also a RISC-V instruction. You can determine the actual numerical value that is written by understanding RISC-V opcode encoding. It will be very difficult to understand the Debug Spec if you do not first read and understand the RISC-V ISA manuals. 2. I don’t really understand your second question. What is written to the program buffer is like a little mini program. `ebreak` marks the end of the program. You could write data0 before writing to progbuf, it does not matter, all those values can be written in any order as long as the are written before `command`. 3. To write a block of memory, the mini program is different. It is optimized to increment the address and work every time data0 register is written. So the registers are used differently. Probably it is fine to swap them around as well, as long as the appropriate `command` is written. ---
**Author:** ![huangwanneng](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@huangwanneng](https://forums.sifive.com/u/huangwanneng)\ **Post date:** [August 16, 2017, 4:51pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/6 "2017-08-16T16:51:59Z")
Thank you very much！But in the question three.I just want ask the sequence of “0(s0)” and “s1”. Is “s0” a sources？Is “s1” destination？why “s0” has a offset “0” . ---
**Author:** ![mwachs5](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.sifive.com/mwachs5/32/13_2.png) [@mwachs5](https://forums.sifive.com/u/mwachs5)\ **Post date:** [August 16, 2017, 4:58pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/7 "2017-08-16T16:58:50Z")
Oh, I see. Yes, the first example `sw 0(s0), s1` is written in a non-standard way for RISC-V. We will correct it, thanks for pointing it out. ---
**Author:** ![huangwanneng](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@huangwanneng](https://forums.sifive.com/u/huangwanneng)\ **Post date:** [August 16, 2017, 5:18pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/8 "2017-08-16T17:18:06Z")
And I want to know how many bits the “abits” of the address of Debug Module Interface Accessing.Are there 7 bits of address ？abits+data+op＝41bits？ ---
**Author:** ![huangwanneng](https://avatars.discourse-cdn.com/v4/letter/h/4af34b/32.png) [@huangwanneng](https://forums.sifive.com/u/huangwanneng)\ **Post date:** [August 17, 2017, 4:05pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/9 "2017-08-17T16:05:01Z")
I am simulating the Debug Module of E31 Coreplex by using JTAG.According to your suggestion,then I use the “program buffer” to try to write and read a value into arbitrarily address of the memory. First,I sent the JTAG instruction “0x11” for access DMI.Then I select the DR-scan,set “address+value+op(41bits?)” and shift it ,and then it execute the commands in the following order ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/a843ef3de4435b7c034e444d9efafc94f4266031.png) ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/ddf32269d16bf37ada148e5ce4bdefeb02d6fb4e.png) **But I can’t read the value what I have writen. I read the RISC-V ISA manuals find that “sw s0 0(s1)” 's value for 32 bits is as follow** ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/5e63be3a337da53df70c6471ae621ef8b022f791.png) On my opinion , **"imm[11:5] and imm[4:0]"** is 0 **"funct3**" is **“010”** , **"opcode"** is **“0100011”** , **"rs2"** is **“s0”** and the value of “s0” is **“01000”**. **Is it right?** **"rs1"** is **“s1”** and the value of **“s1”** is **“01001”**.is it right? if not ,and I really don’t know what the value is. But if I use gcc to disassembly “sw s0 0(s1)”, I can recieve a value **0xc080** which are **16bits**.why? I have known that RISC-V support the variable instruction. but JTAG needs 32 bits value as follow ![](https://us1.discourse-cdn.com/flex020/uploads/sifive/original/1X/ad168e1ae4ae7fab696e6ffd1778a9cbf585b135.png) That’s all .Sincerely waiting for your reply. ---
**Author:** ![DrewatSiFive](https://avatars.discourse-cdn.com/v4/letter/d/58f4c7/32.png) [@DrewatSiFive](https://forums.sifive.com/u/DrewatSiFive)\ **Post date:** [October 19, 2017, 2:45pm UTC](https://forums.sifive.com/t/risc-v-external-debug/690/10 "2017-10-19T14:45:06Z")
I placed the opcodes here: > [@Reading Memory](http://forums.sifive.com/t/reading-memory/701/2): > > Hello, If you are just looking for the 32bit opcode for the RV32I instruction sw s0,0(s1)? If so it is the following:0x0084\_A023. The opcode for the compressed version of the sw s0,0(s1) instruction (RV32IC) is as you observed: 0xC080. I’m not sure i know what you mean by higher or lower bit priority? When compiling it is always good practice to explicitly set the -march and -mabi fields explicitly. It looks like you were disassembling the Compressed instruction which doesn’t seem to be what you are after. This can be avoided by explicitly setting `-march=rv32i`.