CONFIDENTIAL 1

Insight Coresight Design with DS-5

Zenon Xiu

CONFIDENTIAL 2

Why debug and trace is more complicated

In the past, debug and trace world used to be simple

CONFIDENTIAL 3

Why debug and trace is more complicated

Nowadays, system is getting bigger and bigger, more complicated.

Why?

CONFIDENTIAL 4

Why debug and trace is more complicated Coresight architecture is introduced for complicated system

A Coresight system example.

Due to the complicity, HW design might get a problem, it is hard to spot the problem.

A powerful debug tool is required.

Dual

Cortex-A CTI

PTM

Dual

Cortex-A Cortex-R Mali CTI CTI

ETM PTM

Video DSP Image DSP CTI CTI

Trace bus TMC

TPIU

DAP

STM

Debug bus

Syst

em

bu

s

SWD/

JTAG

CTM

CONFIDENTIAL 5

Debug and trace with DS-5+DSTREAM

CONFIDENTIAL 6

Build DS-5 debug and trace support, easy if no hardware issue With DS-5 Platform Configuration Editor, it is easy to build debug and trace support for

most platforms. Replaces legacy command-line tools, provide flexibility and ease of use

Enhanced topology discovery, display, and editing

Removes the need to hand-edit DTSL scripts for most platforms

Enhanced manual device addition and configuration

Guide: http://ds.arm.com/developer-resources/tutorials/soc-bring-up-in-ds-5-using-the-platform-configuration-

editor-pce/

CONFIDENTIAL 7

Spot Coresight problem with DS-5 However, there might be a Coresight hardware issue, you might *not* be able to,

Discover your system.

Halt/stop the processors

◦ Cannot debug the ROM code.

◦ Cannot download any image.

Get any trace data

◦ Potentially, without trace support, if there is a complicated issue

(e.g Linux kernel randomly crash, or system hang),

it would be hard to find the root cause.

You really cannot blame DS-5

CONFIDENTIAL 8

Spot Coresight problem with DS-5 How to spot this kind of problem?

Besides standard functions, DS-5 provides some useful tools, working with DSTREAM,

to help engineers insights their platform Coresight design, and spot the problem.

◦ CSAT.

◦ dbghw_log_client.

Several real cases are discussed later.

CONFIDENTIAL 9

Case study I – Fail to detect the system (1) Problem description

Fail to detect the system

Debugger reported,

◦ Info: ROM table base address = 0x80000000

◦ Info: Reading device registers at address 0x80018000

◦ Info: unknown failure during memory read at address 0x80018ff0

◦ Info: Reading device registers at address 0x8001a000

◦ Info: unknown failure during memory read at address 0x8001aff0

◦ Info: Reading device registers at address 0x8001c000 Info: unknown failure during memory read at address

0x8001cff0

◦ Info: Reading device registers at address 0x8001e000

◦ Info: unknown failure during memory read at address 0x8001eff0

◦ Info: End of ROM table Info: No platforms found that match

Explore the reason with dbghw_log_client

dbghw_log_client is a DS-5 utility to log detailed DSTREAM behavior and low level DAP accesses.

You could see every DAP/Coresight Compenents/Debug register access made by debugger.

Very useful problem spotting tool.

CONFIDENTIAL 10

Case study I – Fail to detect the system (1) How to use dbghw_log_client

1. Power cycle the target and the DSTREAM/RVI unit

2. Issue one of the following commands:

◦ for USB

dbghw_log_client -daplog full USB:nnnnnnnn

◦ for Ethernet

dbghw_log_client -daplog full TCP:aaa.bbb.ccc.ddd

◦ (where 'aaa.bbb.ccc.ddd' represents your DSTREAM/RVI unit's TCP/IP address)

3. Start the log capture and send the output to a file:

◦ for USB

dbghw_log_client USB:nnnnnnnn>C:\temp\dstream.log

◦ for Ethernet

dbghw_log_client TCP:aaa.bbb.ccc.ddd>C:\temp\dstream.log

CONFIDENTIAL 11

Case study 1 – fail to detect the system (1) Capture the log.

1447 serverd trace DAPLOG [002248] <AP.0x0C > R 0x00018003/0xFFFFFFFF (AP.DRW @ 0x80018FF0)

1448 serverd trace DAPLOG [002249] <AP.0x0C > R 0x0001A003/0xFFFFFFFF (AP.DRW @ 0x80018FF4)

1449 serverd trace DAPLOG [002250] <AP.0x0C > R 0x0001C003/0xFFFFFFFF (AP.DRW @ 0x80018FF8)

1450 serverd trace DAPLOG [002251] <DP.RDBUFF> R 0x0001E003/0xFFFFFFFF (AP.DRW @ 0x80018FFC)

Analyzing the log file.

Above sequence reads Component ID registers (from 0xFF0-0xFFC offsets), but what we have in

fact read is the ROM table values again (0x1A003, 0x1C003, etc). That can't be a coincidence.

It seems like the DAP is simply not responding correctly to what should be an ordinary register

access to the TFADDR. It seems DAP and JTAG clocks have glitches.

Issue found

Partner double checked that there was indeed a problem with the clocks when running on the

emulator.

CONFIDENTIAL 12

Case study I – Fail to detect the system (2) Problem description

When auto detecting, debugger reported,

"Auto configure failed. Check the Debug Hardware connection with the target.”

Capture the log serverd info DP_PowerUp - Powering up the DAP

serverd error LastErr[0] +++ Failed DAP Power up request [DEBUG SYSTEM]. DP_CSW=0x00000000

Issue found

CDBGPWRUPACK of partner’s DAP design is tied low , which is wrong.

CONFIDENTIAL 13

Case study II – Fail to stop the processor Sometimes, DS-5 cannot stop an running processor. In most situation, it is not a

debugger issue, but a software or hardware issue.

How to spot,

dbghw_log_client and CoreSight Access Tool

CoreSight Access Tool (CSAT) is a utility with command line interface provided in DS-5,

which provides fine control of access DAP/Coresight Compenents/Debug registers.

User guide here,

CONFIDENTIAL 14

Case study II – Fail to stop the processor Problem description

A53+A57 big.LITTLE system also reports the error

randomly running for a long time,

and DS-5 debugger cannot stop the CPU.

Spot the problem with dbghw_log_client and CSAT

Use dbghw_log_client to check whether the CPU is powered down. ◦ serverd trace DAPLOG [102941] <DP.ADDR > W 0x00000000/0xFFFFFFFF

◦ serverd trace DAPLOG [102942] <AP.0x04 > W 0x80810310/0xFFFFFFFF (AP.TFADDR)

◦ serverd trace DAPLOG [102943] <AP.0x00 > W 0x80000002/0xFFFFFFFF (AP.CSW)

◦ serverd trace DAPLOG [102944] <DP.ADDR > W 0x00000010/0xFFFFFFFF

◦ serverd trace DAPLOG [102945] <AP.0x04 > R 0x00000000/0x00000000

◦ serverd trace DAPLOG [102946] <DP.RDBUFF> R 0x00000001/0xFFFFFFFF (@ 0x80810314)

The processor is powered up

Try CSAT to halt the CPU.

Use CSAT to check whether the CPU is alive.

CONFIDENTIAL 15

Case study II– Fail to stop the processor Explore the problem with dbghw_log_client and CSAT

Use dbghw_log_client to check whether the CPU is powered down.

Try CSAT to halt the CPU. ◦ con TCP:10.164.3.62

◦ chain dev=auto

◦ dvo 0

◦ dpe

◦ dmw 1 0x82020FB0 0xc5acce55

◦ dmw 1 0x82020000 0x1

◦ dmw 1 0x820200A0 0x1

◦ dmw 1 0x8202001c 0x1

◦ dmr 1 0x82010314 1

Cannot halt the processor, the processor possibly

deadlock.

Use CSAT to check whether the CPU is alive.

CONFIDENTIAL 16

Case study II– Fail to stop the processor Explore the problem with dbghw_log_client and CSAT

Use dbghw_log_client to check whether the CPU is powered down.

Try CSAT to halt the CPU.

Use CSAT to check whether the CPU is alive.

◦ Check CPU debug PC sampling register

to see if it was changing.

◦ PC sampling did not change, CPU is dead.

◦ And we got the which piece of code when CPU

was deadlock.

Next step,

Why CPU deadlock? You might need a trace..

CONFIDENTIAL 17

Case study II – Fail to stop the processor Trace and offline decode.

CSAT could be used to dump raw trace data for later offline decoding.

◦ CSAT command

etb

etb baseaddr 0x801a4000

etb

etb dumpbin d:\etb_A17_ETF.trb

Offline decoding of the raw trace data supported by DTSL

S:0xC06A8190 __arch_swab32

S:0xC06A8190 E595C030 LDR r12,[r5,#0x30]

S:0xC06A8194 E6BFEF3C REV lr,r12

S:0xC06A8198 tcp_transmit_skb+460

S:0xC06A8198 E588E004 STR lr,[r8,#4]

S:0xC06A819C __arch_swab32

S:0xC06A819C E5940360 LDR r0,[r4,#0x360]

S:0xC06A81A0 E6BF1F30 REV r1,r0

S:0xC06A81A4 tcp_transmit_skb+472

S:0xC06A81A4 E5881008 STR r1,[r8,#8]

S:0xC06A81A8 E5D5303CLDRB r3,[r5,#0x3c]

S:0xC06A81AC E183C602 ORR r12,r3,r2,LSL #12

S:0xC06A81B0 __fswab16

S:0xC06A81B0 E6FFE07C UXTH lr,r12

S:0xC06A81B4 __arch_swahb32

S:0xC06A81B4 E6BF0FBE REV16 r0,lr

S:0xC06A81B8 __fswab16+8

S:0xC06A81B8 E1C800BCSTRH r0,[r8,#0xc]

S:0xC06A81BC tcp_transmit_skb+496

S:0xC06A81BC E5D5103CLDRB r1,[r5,#0x3c]

S:0xC06A81C0 E3110002 TST r1,#2

S:0xC06A81C4 1A00011E BNE {pc}+0x480 ; 0xc06a8644

S:0xC06A81C8 tcp_receive_window

S:0xC06A81C8 E5940444 LDR r0,[r4,#0x444]

S:0xC06A81CC E5941368 LDR r1,[r4,#0x368]

S:0xC06A81D0 E594C360 LDR r12,[r4,#0x360]

S:0xC06A81D4 E080A001 ADD r10,r0,r1

S:0xC06A81D8 tcp_select_window+16

S:0xC06A81D8 E1A00004 MOV r0,r4

S:0xC06A81DC tcp_receive_window+20

S:0xC06A81DC E05AA00C SUBS r10,r10,r12

S:0xC06A81E0 4A000096 BMI {pc}+0x260 ; 0xc06a8440

CONFIDENTIAL 18

Case study II – Fail to stop the processor Other hardware issues that we found is causing failure to stop the processor.

CPU pipeline halt

◦ Instruction fetch in invalid memory at reset.

◦ CPU deadlock

◦ Memory access cannot complete.

Slow Emulation

◦ JTAG timeout

OS Lock

SPIDEN/ DBGEN is tied wrongly.

CONFIDENTIAL 19

Case study III – Fail to get trace data Partner failed to get trace data from TPIU, but suceed getting trace from ETB.

Should be a problem of TPIU, how to identify?

Using CSAT to perform TPIU ‘Walking 1s Pattern’ test to check whether TPIU itself

works.

dmr 1 0x80009000 1 dmw 1 0x80009004 0x00008000 ==> Change port size here if port size is not 16 dmw 1 0x80009204 0x00020001 ==> Set TPIU Walking 1s Pattern dmr 1 0x80009204 1 trace open TCP:10.164.3.57 ==> Please change the IP address trace setmode classic trace setconfigitem PORT_WIDTH 16 ==> Change port size here if port size is not 16 trace setconfigitem CLOCK_MODE Clock_DDR trace setconfigitem ETM_PROTOCOL ETMv3 trace start trace stop trace read 0 1 raw

CONFIDENTIAL 20

Case study III– Fail to get trace data If TPIU works, we should get,

------------------------------------

00020001 00080004 00200010 00800040

02000100 08000400 20001000 80004000

------------------------------------

However, we got, ------------------------------------

00000000 00000000 00000000 00000000

00000000 00000000 00000000 00000000

00000000 00000000 00000000 00000000

00000000 00000000 00000000 00000000

00000000 00000000 00000000 00000000

------------------------------------

Spot the problem,

TPIU doesn’t work.

Finally, find TPIU PinMux issue.

We also help partner finding TPIU timing issue with help of CSAT.

CONFIDENTIAL 21

Conclusion DS-5 + DSTREAM is more than

DS-5 IDE

• Powerful, customized editor based on industry standard Eclipse IDE 4.3

• Hundreds of compatible plugins

Streamline Analyzer

• CPU, GPU, interconnect performance and power analysis

• Time- and event-based profiling

DS-5 Debugger

• Comprehensive device bring-up tools and s/w debugger for single- and multi-core platforms

• OS aware debug, on silicon, virtual platform and emulator

Compilation Tools

• ARM Compiler 5 and 6 C/C++ toolchains for bare-metal and RTOS

• Integrated Linaro GCC for ARM Linux

CONFIDENTIAL 22

Conclusion It could also be used for

Spotting Coresight hardware design issue.

◦ Verify ROM table design.

◦ Verify CPU debug register access.

◦ Verify trace functionality.

◦ Verify debug APB bus timing.

System hang analyzing.

◦ Trace dump and offline decoding.

Processor deadlock analyzing.

CONFIDENTIAL 23

Q&A

Thanks