Address	Name	Page
0x04	Abstract Data 0 (data0)
0x0f	Abstract Data 11 (data11)
0x10	Debug Module Control (dmcontrol)
0x11	Debug Module Status (dmstatus)
0x12	Hart Info (hartinfo)
0x13	Halt Summary 1 (haltsum1)
0x14	Hart Array Window Select (hawindowsel)
0x15	Hart Array Window (hawindow)
0x16	Abstract Control and Status (abstractcs)
0x17	Abstract Command (command)
0x18	Abstract Command Autoexec (abstractauto)
0x19	Configuration String Pointer 0 (confstrptr0)
0x1a	Configuration String Pointer 1 (confstrptr1)
0x1b	Configuration String Pointer 2 (confstrptr2)
0x1c	Configuration String Pointer 3 (confstrptr3)
0x1d	Next Debug Module (nextdm)
0x20	Program Buffer 0 (progbuf0)
0x2f	Program Buffer 15 (progbuf15)
0x30	Authentication Data (authdata)
0x34	Halt Summary 2 (haltsum2)
0x35	Halt Summary 3 (haltsum3)
0x37	System Bus Address 127:96 (sbaddress3)
0x38	System Bus Access Control and Status (sbcs)
0x39	System Bus Address 31:0 (sbaddress0)
0x3a	System Bus Address 63:32 (sbaddress1)
0x3b	System Bus Address 95:64 (sbaddress2)
0x3c	System Bus Data 31:0 (sbdata0)
0x3d	System Bus Data 63:32 (sbdata1)
0x3e	System Bus Data 95:64 (sbdata2)
0x3f	System Bus Data 127:96 (sbdata3)
0x40	Halt Summary 0 (haltsum0)

Debug Module Status (dmstatus, at 0x11)

[dmstatus] This register reports status for the overall Debug Module as well as the currently selected harts, as defined in hasel. Its address will not change in the future, because it contains version.

This entire register is read-only.

Field	Description	Access	Reset
[impebreak] |impebreak|	If 1, then there is an implicit ebreak instruction at the non-existent word immediately after the Program Buffer. This saves the debugger from having to write the ebreak itself, and allows the Program Buffer to be one word smaller. This must be 1 when progbufsizeis 1.	R	Preset
[allhavereset] |allhavereset|	This field is 1 when all currently selected harts have been reset and reset has not been acknowledged for any of them.	R	-
[anyhavereset] |anyhavereset|	This field is 1 when at least one currently selected hart has been reset and reset has not been acknowledged for that hart.	R	-
[allresumeack] |allresumeack|	This field is 1 when all currently selected harts have acknowledged their last resume request.	R	-
[anyresumeack] |anyresumeack|	This field is 1 when any currently selected hart has acknowledged its last resume request.	R	-
[allnonexistent] |allnonexistent|	This field is 1 when all currently selected harts do not exist in this platform.	R	-
[anynonexistent] |anynonexistent|	This field is 1 when any currently selected hart does not exist in this platform.	R	-
[allunavail] |allunavail|	This field is 1 when all currently selected harts are unavailable.	R	-
[anyunavail] |anyunavail|	This field is 1 when any currently selected hart is unavailable.	R	-
[allrunning] |allrunning|	This field is 1 when all currently selected harts are running.	R	-
[anyrunning] |anyrunning|	This field is 1 when any currently selected hart is running.	R	-
[allhalted] |allhalted|	This field is 1 when all currently selected harts are halted.	R	-
[anyhalted] |anyhalted|	This field is 1 when any currently selected hart is halted.	R	-
[authenticated] |authenticated|	0: Authentication is required before using the DM. 1: The authentication check has passed. On components that don’t implement authentication, this bit must be preset as 1.	R	Preset
[authbusy] |authbusy|	0: The authentication module is ready to process the next read/write to authdata. 1: The authentication module is busy. Accessing authdataresults in unspecified behavior. authbusyonly becomes set in immediate response to an access to authdata.	R	0
[hasresethaltreq] |hasresethaltreq|	1 if this Debug Module supports halt-on-reset functionality controllable by the setresethaltreqand clrresethaltreqbits. 0 otherwise.	R	Preset
[confstrptrvalid] |confstrptrvalid|	0: confstrptr0–confstrptr3hold information which is not relevant to the configuration string. 1: confstrptr0–confstrptr3hold the address of the configuration string.	R	Preset
[version] |version|	0: There is no Debug Module present. 1: There is a Debug Module and it conforms to version 0.11 of this specification. 2: There is a Debug Module and it conforms to version 0.13 of this specification. 15: There is a Debug Module but it does not conform to any available version of this spec.	R	2

Debug Module Control (dmcontrol, at 0x10)

[dmcontrol] This register controls the overall Debug Module as well as the currently selected harts, as defined in hasel.

[hartsel] Throughout this document we refer to hartsel, which is hartselhi combined with hartsello. While the spec allows for 20 hartselbits, an implementation may choose to implement fewer than that. The actual width of hartselis called HARTSELLEN. It must be at least 0 and at most 20. A debugger should discover HARTSELLEN by writing all ones to hartsel(assuming the maximum size) and reading back the value to see which bits were actually set. Debuggers must not change hartselwhile an abstract command is executing.

There are separate setresethaltreqand clrresethaltreqbits so that it is possible to write dmcontrolwithout changing the halt-on-reset request bit for each selected hart, when not all selected harts have the same configuration.

On any given write, a debugger may only write 1 to at most one of the following bits: resumereq, hartreset, ackhavereset, setresethaltreq, and clrresethaltreq. The others must be written 0.

[resethaltreq] resethaltreqis an optional internal bit of per-hart state that cannot be read, but can be written with setresethaltreqand clrresethaltreq.

Field	Description	Access	Reset
[haltreq] |haltreq|	Writing 0 clears the halt request bit for all currently selected harts. This may cancel outstanding halt requests for those harts. Writing 1 sets the halt request bit for all currently selected harts. Running harts will halt whenever their halt request bit is set. Writes apply to the new value of hartseland hasel.	W	-
[resumereq] |resumereq|	Writing 1 causes the currently selected harts to resume once, if they are halted when the write occurs. It also clears the resume ack bit for those harts. resumereqis ignored if haltreqis set. Writes apply to the new value of hartseland hasel.	W1	-
[hartreset] |hartreset|	This optional field writes the reset bit for all the currently selected harts. To perform a reset the debugger writes 1, and then writes 0 to deassert the reset signal. While this bit is 1, the debugger must not change which harts are selected. If this feature is not implemented, the bit always stays 0, so after writing 1 the debugger can read the register back to see if the feature is supported. Writes apply to the new value of hartseland hasel.	R/W	0
[ackhavereset] |ackhavereset|	0: No effect. 1: Clears havereset for any selected harts. Writes apply to the new value of hartseland hasel.	W1	-
[hasel] |hasel|	Selects the definition of currently selected harts. 0: There is a single currently selected hart, that is selected by hartsel. 1: There may be multiple currently selected harts – the hart selected by hartsel, plus those selected by the hart array mask register. An implementation which does not implement the hart array mask register must tie this field to 0. A debugger which wishes to use the hart array mask register feature should set this bit and read back to see if the functionality is supported.	R/W	0
[hartsello] |hartsello|	The low 10 bits of hartsel: the DM-specific index of the hart to select. This hart is always part of the currently selected harts.	R/W	0
[hartselhi] |hartselhi|	The high 10 bits of hartsel: the DM-specific index of the hart to select. This hart is always part of the currently selected harts.	R/W	0
[setresethaltreq] |setresethaltreq|	This optional field writes the halt-on-reset request bit for all currently selected harts, unless clrresethaltreqis simultaneously set to 1. When set to 1, each selected hart will halt upon the next deassertion of its reset. The halt-on-reset request bit is not automatically cleared. The debugger must write to clrresethaltreqto clear it. Writes apply to the new value of hartseland hasel. If hasresethaltreqis 0, this field is not implemented.	W1	-
[clrresethaltreq] |clrresethaltreq|	This optional field clears the halt-on-reset request bit for all currently selected harts. Writes apply to the new value of hartseland hasel.	W1	-
[ndmreset] |ndmreset|	This bit controls the reset signal from the DM to the rest of the system. The signal should reset every part of the system, including every hart, except for the DM and any logic required to access the DM. To perform a system reset the debugger writes 1, and then writes 0 to deassert the reset.	R/W	0
[dmactive] |dmactive|	This bit serves as a reset signal for the Debug Module itself. 0: The module’s state, including authentication mechanism, takes its reset values (the dmactivebit is the only bit which can be written to something other than its reset value). 1: The module functions normally. No other mechanism should exist that may result in resetting the Debug Module after power up, with the possible (but not recommended) exception of a global reset signal that resets the entire platform. A debugger may pulse this bit low to get the Debug Module into a known state. Implementations may pay attention to this bit to further aid debugging, for example by preventing the Debug Module from being power gated while debugging is active.	R/W	0

Hart Info (hartinfo, at 0x12)

[hartinfo] This register gives information about the hart currently selected by hartsel.

This register is optional. If it is not present it should read all-zero.

If this register is included, the debugger can do more with the Program Buffer by writing programs which explicitly access the data and/or dscratch registers.

This entire register is read-only.

Field	Description	Access	Reset
[nscratch] |nscratch|	Number of dscratch registers available for the debugger to use during program buffer execution, starting from dscratch0. The debugger can make no assumptions about the contents of these registers between commands.	R	Preset
[dataaccess] |dataaccess|	0: The data registers are shadowed in the hart by CSRs. Each CSR is DXLEN bits in size, and corresponds to a single argument, per Table [tab:datareg]. 1: The data registers are shadowed in the hart’s memory map. Each register takes up 4 bytes in the memory map.	R	Preset
[datasize] |datasize|	If dataaccessis 0: Number of CSRs dedicated to shadowing the data registers. If dataaccessis 1: Number of 32-bit words in the memory map dedicated to shadowing the data registers. Since there are at most 12 data registers, the value in this register must be 12 or smaller.	R	Preset
[dataaddr] |dataaddr|	If dataaccessis 0: The number of the first CSR dedicated to shadowing the data registers. If dataaccessis 1: Signed address of RAM where the data registers are shadowed, to be used to access relative to zero.	R	Preset

Hart Array Window Select (hawindowsel, at 0x14)

[hawindowsel] This register selects which of the 32-bit portion of the hart array mask register (see Section [hartarraymask]) is accessible in hawindow.

Field	Description	Access	Reset
[hawindowsel] |hawindowsel|	The high bits of this field may be tied to 0, depending on how large the array mask register is. E.g. on a system with 48 harts only bit 0 of this field may actually be writable.	R/W	0

Hart Array Window (hawindow, at 0x15)

[hawindow] This register provides R/W access to a 32-bit portion of the hart array mask register (see Section [hartarraymask]). The position of the window is determined by hawindowsel. I.e. bit 0 refers to hart ${\tt {hawindowsel}}* 32$, while bit 31 refers to hart ${\tt {hawindowsel}}* 32 + 31$.

Since some bits in the hart array mask register may be constant 0, some bits in this register may be constant 0, depending on the current value of hawindowsel.

Abstract Control and Status (abstractcs, at 0x16)

[abstractcs] Writing this register while an abstract command is executing causes cmderrto be set to 1 (busy) if it is 0.

datacountmust be at least 1 to support RV32 harts, 2 to support RV64 harts, or 4 to support RV128 harts.

Field	Description	Access	Reset
[progbufsize] |progbufsize|	Size of the Program Buffer, in 32-bit words. Valid sizes are 0 - 16.	R	Preset
[busy] |busy|	1: An abstract command is currently being executed. This bit is set as soon as commandis written, and is not cleared until that command has completed.	R	0
[cmderr] |cmderr|	Gets set if an abstract command fails. The bits in this field remain set until they are cleared by writing 1 to them. No abstract command is started until the value is reset to 0. This field only contains a valid value if busyis 0. 0 (none): No error. 1 (busy): An abstract command was executing while command, abstractcs, or abstractautowas written, or when one of the data or progbuf registers was read or written. This status is only written if cmderrcontains 0. 2 (not supported): The requested command is not supported, regardless of whether the hart is running or not. 3 (exception): An exception occurred while executing the command (e.g. while executing the Program Buffer). 4 (halt/resume): The abstract command couldn’t execute because the hart wasn’t in the required state (running/halted), or unavailable. 5 (bus): The abstract command failed due to a bus error (e.g. alignment, access size, or timeout). 7 (other): The command failed for another reason.	R/W1C	0
[datacount] |datacount|	Number of data registers that are implemented as part of the abstract command interface. Valid sizes are 1 – 12.	R	Preset

Abstract Command (command, at 0x17)

[command] Writes to this register cause the corresponding abstract command to be executed.

Writing this register while an abstract command is executing causes cmderrto be set to 1 (busy) if it is 0.

If cmderris non-zero, writes to this register are ignored.

cmderrinhibits starting a new command to accommodate debuggers that, for performance reasons, send several commands to be executed in a row without checking cmderrin between. They can safely do so and check cmderrat the end without worrying that one command failed but then a later command (which might have depended on the previous one succeeding) passed.

Field	Description	Access	Reset
[cmdtype] |cmdtype|	The type determines the overall functionality of this abstract command.	W	0
[control] |control|	This field is interpreted in a command-specific manner, described for each abstract command.	W	0

Abstract Command Autoexec (abstractauto, at 0x18)

[abstractauto] This register is optional. Including it allows more efficient burst accesses. A debugger can detect whether it is support by setting bits and reading them back.

Writing this register while an abstract command is executing causes cmderrto be set to 1 (busy) if it is 0.

Field	Description	Access	Reset
[autoexecprogbuf] |autoexecprogbuf|	When a bit in this field is 1, read or write accesses to the corresponding progbuf word cause the command in commandto be executed again.	R/W	0
[autoexecdata] |autoexecdata|	When a bit in this field is 1, read or write accesses to the corresponding data word cause the command in commandto be executed again.	R/W	0

Configuration String Pointer 0 (confstrptr0, at 0x19)

[confstrptr0] When confstrptrvalidis set, reading this register returns bits 31:0 of the configuration string pointer. Reading the other confstrptr registers returns the upper bits of the address.

When system bus mastering is implemented, this must be an address that can be used with the System Bus Access module. Otherwise, this must be an address that can be used to access the configuration string from the hart with ID 0.

If confstrptrvalidis 0, then the confstrptr registers hold identifier information which is not further specified in this document.

The configuration string itself is described in the Privileged Spec.

This entire register is read-only.

Next Debug Module (nextdm, at 0x1d)

[nextdm] If there is more than one DM accessible on this DMI, this register contains the base address of the next one in the chain, or 0 if this is the last one in the chain.

This entire register is read-only.

Abstract Data 0 (data0, at 0x04)

[data0] data0through data11are basic read/write registers that may be read or changed by abstract commands. datacountindicates how many of them are implemented, starting at data0, counting up. Table [tab:datareg] shows how abstract commands use these registers.

Accessing these registers while an abstract command is executing causes cmderrto be set to 1 (busy) if it is 0.

Attempts to write them while busyis set does not change their value.

The values in these registers may not be preserved after an abstract command is executed. The only guarantees on their contents are the ones offered by the command in question. If the command fails, no assumptions can be made about the contents of these registers.

Program Buffer 0 (progbuf0, at 0x20)

[progbuf0] progbuf0through progbuf15provide read/write access to the optional program buffer. progbufsizeindicates how many of them are implemented starting at progbuf0, counting up.

Accessing these registers while an abstract command is executing causes cmderrto be set to 1 (busy) if it is 0.

Attempts to write them while busyis set does not change their value.

Authentication Data (authdata, at 0x30)

[authdata] This register serves as a 32-bit serial port to/from the authentication module.

When authbusyis clear, the debugger can communicate with the authentication module by reading or writing this register. There is no separate mechanism to signal overflow/underflow.

Halt Summary 0 (haltsum0, at 0x40)

[haltsum0] Each bit in this read-only register indicates whether one specific hart is halted or not. Unavailable/nonexistent harts are not considered to be halted.

The LSB reflects the halt status of hart {hartsel[19:5],5’h0}, and the MSB reflects halt status of hart {hartsel[19:5],5’h1f}.

This entire register is read-only.

Halt Summary 1 (haltsum1, at 0x13)

[haltsum1] Each bit in this read-only register indicates whether any of a group of harts is halted or not. Unavailable/nonexistent harts are not considered to be halted.

This register may not be present in systems with fewer than 33 harts.

The LSB reflects the halt status of harts {hartsel[19:10],10’h0} through {hartsel[19:10],10’h1f}. The MSB reflects the halt status of harts {hartsel[19:10],10’h3e0} through {hartsel[19:10],10’h3ff}.

This entire register is read-only.

Halt Summary 2 (haltsum2, at 0x34)

[haltsum2] Each bit in this read-only register indicates whether any of a group of harts is halted or not. Unavailable/nonexistent harts are not considered to be halted.

This register may not be present in systems with fewer than 1025 harts.

The LSB reflects the halt status of harts {hartsel[19:15],15’h0} through {hartsel[19:15],15’h3ff}. The MSB reflects the halt status of harts {hartsel[19:15],15’h7c00} through {hartsel[19:15],15’h7fff}.

This entire register is read-only.

Halt Summary 3 (haltsum3, at 0x35)

[haltsum3] Each bit in this read-only register indicates whether any of a group of harts is halted or not. Unavailable/nonexistent harts are not considered to be halted.

This register may not be present in systems with fewer than 32769 harts.

The LSB reflects the halt status of harts 20’h0 through 20’h7fff. The MSB reflects the halt status of harts 20’hf8000 through 20’hfffff.

This entire register is read-only.

System Bus Access Control and Status (sbcs, at 0x38)

[sbcs]

Field	Description	Access	Reset
[sbversion] |sbversion|	0: The System Bus interface conforms to mainline drafts of this spec older than 1 January, 2018. 1: The System Bus interface conforms to this version of the spec. Other values are reserved for future versions.	R	1
[sbbusyerror] |sbbusyerror|	Set when the debugger attempts to read data while a read is in progress, or when the debugger initiates a new access while one is already in progress (while sbbusyis set). It remains set until it’s explicitly cleared by the debugger. While this field is set, no more system bus accesses can be initiated by the Debug Module.	R/W1C	0
[sbbusy] |sbbusy|	When 1, indicates the system bus master is busy. (Whether the system bus itself is busy is related, but not the same thing.) This bit goes high immediately when a read or write is requested for any reason, and does not go low until the access is fully completed. Writes to sbcswhile sbbusyis high result in undefined behavior. A debugger must not write to sbcsuntil it reads sbbusyas 0.	R	0
[sbreadonaddr] |sbreadonaddr|	When 1, every write to sbaddress0automatically triggers a system bus read at the new address.	R/W	0
[sbaccess] |sbaccess|	Select the access size to use for system bus accesses. 0: 8-bit 1: 16-bit 2: 32-bit 3: 64-bit 4: 128-bit If sbaccesshas an unsupported value when the DM starts a bus access, the access is not performed and sberroris set to 4.	R/W	2
[sbautoincrement] |sbautoincrement|	When 1, sbaddress is incremented by the access size (in bytes) selected in sbaccessafter every system bus access.	R/W	0
[sbreadondata] |sbreadondata|	When 1, every read from sbdata0automatically triggers a system bus read at the (possibly auto-incremented) address.	R/W	0
[sberror] |sberror|	When the Debug Module’s system bus master encounters an error, this field gets set. The bits in this field remain set until they are cleared by writing 1 to them. While this field is non-zero, no more system bus accesses can be initiated by the Debug Module. An implementation may report “Other” (7) for any error condition. 0: There was no bus error. 1: There was a timeout. 2: A bad address was accessed. 3: There was an alignment error. 4: An access of unsupported size was requested. 7: Other.	R/W1C	0
[sbasize] |sbasize|	Width of system bus addresses in bits. (0 indicates there is no bus access support.)	R	Preset
[sbaccess128] |sbaccess128|	1 when 128-bit system bus accesses are supported.	R	Preset
[sbaccess64] |sbaccess64|	1 when 64-bit system bus accesses are supported.	R	Preset
[sbaccess32] |sbaccess32|	1 when 32-bit system bus accesses are supported.	R	Preset
[sbaccess16] |sbaccess16|	1 when 16-bit system bus accesses are supported.	R	Preset
[sbaccess8] |sbaccess8|	1 when 8-bit system bus accesses are supported.	R	Preset

System Bus Address 31:0 (sbaddress0, at 0x39)

[sbaddress0] If sbasizeis 0, then this register is not present.

When the system bus master is busy, writes to this register will set sbbusyerrorand don’t do anything else.

If sberroris 0, sbbusyerroris 0, and sbreadonaddr is set then writes to this register start the following:

Set sbbusy.

Perform a bus read from the new value of sbaddress.

If the read succeeded and sbautoincrementis set, increment sbaddress.

Clear sbbusy.

Field	Description	Access	Reset
[address] |address|	Accesses bits 31:0 of the physical address in sbaddress.	R/W	0

System Bus Address 63:32 (sbaddress1, at 0x3a)

[sbaddress1] If sbasizeis less than 33, then this register is not present.

When the system bus master is busy, writes to this register will set sbbusyerrorand don’t do anything else.

Field	Description	Access	Reset
[address] |address|	Accesses bits 63:32 of the physical address in sbaddress (if the system address bus is that wide).	R/W	0

System Bus Address 95:64 (sbaddress2, at 0x3b)

[sbaddress2] If sbasizeis less than 65, then this register is not present.

When the system bus master is busy, writes to this register will set sbbusyerrorand don’t do anything else.

Field	Description	Access	Reset
[address] |address|	Accesses bits 95:64 of the physical address in sbaddress (if the system address bus is that wide).	R/W	0

System Bus Address 127:96 (sbaddress3, at 0x37)

[sbaddress3] If sbasizeis less than 97, then this register is not present.

When the system bus master is busy, writes to this register will set sbbusyerrorand don’t do anything else.

Field	Description	Access	Reset
[address] |address|	Accesses bits 127:96 of the physical address in sbaddress (if the system address bus is that wide).	R/W	0

System Bus Data 31:0 (sbdata0, at 0x3c)

[sbdata0] If all of the sbaccess bits in sbcsare 0, then this register is not present.

Any successful system bus read updates sbdata. If the width of the read access is less than the width of sbdata, the contents of the remaining high bits may take on any value.

If sberroror sbbusyerrorboth aren’t 0 then accesses do nothing.

If the bus master is busy then accesses set sbbusyerror, and don’t do anything else.

Writes to this register start the following:

Set sbbusy.

Perform a bus write of the new value of sbdata to sbaddress.

If the write succeeded and sbautoincrementis set, increment sbaddress.

Clear sbbusy.

Reads from this register start the following:

“Return” the data.

Set sbbusy.

If sbreadondatais set, perform a system bus read from the address contained in sbaddress, placing the result in sbdata.

If sbautoincrementis set, increment sbaddress.

Clear sbbusy.

Only sbdata0has this behavior. The other sbdata registers have no side effects. On systems that have buses wider than 32 bits, a debugger should access sbdata0after accessing the other sbdata registers.

Field	Description	Access	Reset
[data] |data|	Accesses bits 31:0 of sbdata.	R/W	0

System Bus Data 63:32 (sbdata1, at 0x3d)

[sbdata1] If sbaccess64and sbaccess128are 0, then this register is not present.

If the bus master is busy then accesses set sbbusyerror, and don’t do anything else.

Field	Description	Access	Reset
[data] |data|	Accesses bits 63:32 of sbdata (if the system bus is that wide).	R/W	0

System Bus Data 95:64 (sbdata2, at 0x3e)

[sbdata2] This register only exists if sbaccess128is 1.

If the bus master is busy then accesses set sbbusyerror, and don’t do anything else.

Field	Description	Access	Reset
[data] |data|	Accesses bits 95:64 of sbdata (if the system bus is that wide).	R/W	0

System Bus Data 127:96 (sbdata3, at 0x3f)

[sbdata3] This register only exists if sbaccess128is 1.

If the bus master is busy then accesses set sbbusyerror, and don’t do anything else.

Field	Description	Access	Reset
[data] |data|	Accesses bits 127:96 of sbdata (if the system bus is that wide).	R/W	0