Chapter 3. The OpenRISC 1000 Architecture

3.1. The OpenRISC 1000 JTAG Interface
3.2. The OpenRISC 1000 Remote JTAG Protocol
3.3. Application Binary Interface (ABI)
3.4. Or1ksim: the OpenRISC 1000 Architectural Simulator

The OpenRISC 1000 architecture defines a family of free, open source RISC processor cores. It is a 32 or 64-bit load and store RISC architecture designed with emphasis on performance, simplicity, low power requirements, scalability and versatility.

The OpenRISC 1000 is fully documented in its Architecture Manual [8].

From a debugging perspective, there are three data areas that are manipulated by the instruction set.

Main memory. A uniform address space with 32 or 64-bit addressing. Provision for separate or unified instruction and data and instruction caches. Provision for separate or unified, 1 or 2-level data and instruction MMUs.
General Purpose Registers (GPRs). Up to 32 registers, 32 or 64-bit in length.
Special Purpose Registers (SPRs). Up to 32 groups each with up to 2048 registers, up to 32 or 64-bit in length. These registers provide all the administrative functionality of the processor: program counter, processor status, saved exception registers, debug interface, MMU and cache interfaces, etc.

The Special Purpose Registers (SPRs) represent a challenge for GDB, since they represent neither addressable memory, nor have the characteristics of a register set (generally modest in number).

A number of SPRs are of particular significance to the GDB implementation.

Configuration registers. The Unit Present register (SPR 1, UPR), CPU Configuration register (SPR 2, CPUCFGR) and Debug Configuration register (SPR 7, DCFGR) identify the features available in the particular OpenRISC 1000 implementation. This includes the instruction set in use, number of general purpose registers and configuration of the hardware debug interface.
Program counters. The Previous Program Counter (SPR 0x12, PPC) is the address of the instruction just executed. The Next Program Counter (SPR 0x10, NPC) is the address of the next instruction to be executed. The NPC is the value reported by GDBs $pc variable.
Supervision Register. The supervision register (SPR 0x11, SR) represents the current status of the processor. It is the value reported by GDBs status register variable, $ps.

Of particular importance are the SPRs in group 6 controlling the debug unit (if present). The debug unit can trigger a trap exception in response to any one of up to 10 watchpoints. Watchpoints are logical expressions built by combining matchpoints, which are simple point tests of particular behavior (has a specified address been accessed for example).

Debug Value and Control registers. There are up to 8 pairs of Debug Value (SPR 0x3000–0x3007, DVR0 through DVR7) and Debug Control (SPR 0x3008–0x300f, DCR0 through DCR7) registers. Each pair is associated with one hardware matchpoint. The Debug Value register in each pair gives a value to compare against. The Debug Control register indicates whether the matchpoint is enabled, the type of value to compare against (instruction fetch address, data load and/or store address data load and/or store value) and the comparison to make (equal, not equal, less than, less than or equal, greater than, greater than or equal), both signed and unsigned. If the matchpoint is enabled and the test met, the corresponding matchpoint is triggered.

Debug Watchpoint counters. There are two 16-bit Debug Watchpoint Counter registers (SPR 0x3012–0x3013, DWCR0 and DWCR1), associated with two further matchpoints. The upper 16 bits are a value to match, the lower 16 bits a counter. The counter is incremented when specified matchpoints are triggered (see Debug Mode register 1). When the count reaches the match value, the corresponding matchpoint is triggered.

	Caution
	There is potential ambiguity in that counters are incremented in response to matchpoints and also generate their own matchpoints. It is not good practice to set a counter to increment on its own matchpoint!

Debug Mode registers. There are two Debug Mode registers to control the behavior of the the debug unit (SPR 0x3010–0x3011, DMR1 and DMR2). DMR1 provides a pair of bits for each of the 10 matchpoints (8 associated with DVR/DCR pairs, 2 associated with counters). These specify whether the watchpoint is triggered by the associated matchpoint, by the matchpoint AND-ed with the previous watchpoint or by the matchpoint OR-ed with the previous watchpoint. By building chains of watchpoints, complex logical tests of hardware behavior can be built up.
Two further bits in DMR1 enable single step behavior (a trap exception occurs on completion of each instruction) and branch step behavior (a trap exception occurs on completion of each branch instruction).
DMR2 contains an enable bit for each counter, 10 bits indicating which watchpoints are assigned to which counter and 10 bits indicating which watchpoints generate a trap exception. It also contains 10 bits of output, indicating which watchpoints have generated a trap exception.
Debug Stop and Reason registers. In normal operation, all OpenRISC 1000 exceptions are handled through the exception vectors at locations 0x100 through 0xf00. The Debug Stop register (SPR 0x3014, DSR) is used to assign particular exceptions instead to the JTAG interface. These exceptions stall the processor, allowing the machine state to be analyzed through the JTAG interface. Typically a debugger will enable this for trap exceptions used for breakpointing.
Where an exception has been diverted to the development interface, the Debug Reason register (SPR 0x3021, DRR) indicates which exception caused the diversion. Note that although single stepping and branch stepping cause a trap, if they are assigned to the JTAG interface, they do not set the TE bit in the DRR. This allows an external debugger to distinguish between breakpoint traps and single/branch step traps.