White paper. Recording and analyzing execution history using ETM/ETB instruction tracing

Transcription

1 Recrding and analyzing executin histry using ETM/ETB instructin tracing

2 Cpyright Ntice COPYRIGHT NOTICE Cpyright 2016 Atllic AB. All rights reserved. N part f this dcument may be reprduced r distributed withut the prir written cnsent f Atllic AB. TRADEMARK Atllic, Atllic TrueSTUDIO and the Atllic lgtype are trademarks r registered trademarks wned by Atllic. ECLIPSE is a registered trademark f the Eclipse fundatin. ARM and Crtex are trademarks r registered trademarks f ARM Ltd. All ther prduct names are trademarks r registered trademarks f their respective wners. DISCLAIMER The infrmatin in this dcument is subject t change withut ntice and des nt represent a cmmitment f Atllic AB. The infrmatin cntained in this dcument is assumed t be accurate, but Atllic assumes n respnsibility fr any errrs r missins. In n event shall Atllic AB, its emplyees, its cntractrs, r the authrs f this dcument be liable fr any type f damage, lsses, csts, charges, claims, demands, claim fr lst prfits, fees, r expenses f any nature r kind. DOCUMENT IDENTIFICATION ASW-WPETM April 2015 REVISION First versin April 2015 Secnd versin August 2016 Atllic AB Science Park Gjuterigatan 7 SE Jönköping Sweden +46 (0) Web: Atllic Inc 241 Bstn Pst Rad West (1st Flr), Marlbrugh, Massachusetts USA +1 (973) (Vice) +1 (877) (Tll Free) +1 (973) (Fax) sales.usa@atllic.cm Web: ii P a g e

3 List f Cntents Cntents Abstract... 1 Intrductin... 2 Instructin tracing verview... 3 ETM tracing... 3 ETB tracing... 3 Trace triggers... 3 Recrding and analyzing executin histry with Atllic TrueSTUDIO Pr. 5 Enable Trace... 5 Cnfiguring the Tracing Sessin... 6 Trace Triggers... 8 Add Trace Trigger in the Editr... 9 Managing Trace Triggers Start Trace Recrding Analyzing the Trace Display Optins Search the Trace Lg Exprting a Trace Lg Summary iii P a g e

4 Tables N table f figures entries fund. v P a g e

5 ABSTRACT ARM Crtex micrcntrllers cntinue t push the price/perfrmance rati t unprecedented levels. This allws mre cmplex embedded systems t be designed, cmprising mre sftware. And hence, the prblem f debugging cmplex errr situatins is increased t. This white paper utlines hw the ETM and ETB instructin tracing technlgy can be used fr advanced debugging f Crtex-M applicatins. Instructin tracing enables develpers t recrd executin histry fr later analysis, which can be a great help in certain situatins. 1 P a g e

6 INTRODUCTION Finding bugs in sftware is a difficult and time cnsuming prcess. Debugging is usually mre difficult in many embedded applicatins fr several reasns. Executin timing is ften critical, and results can be skewed by the inclusin f instrumentatin cde. In cases f mtr, actuatr r ther cntrl applicatins, it may nt be pssible, r particularly revealing t stp the device under test fr debugging peratins. The ETM and ETB debugger technlgies frm ARM, fund in Crtex-M micrcntrller prduct families, prvides instructin tracing that enables develpers t recrd the executin histry fr later analysis. This is made pssible by the internal architecture f the devices, and in the case f ETM, als adding the requirement f an ETM trace-enabled debugger prbe, such as SEGGER J-Trace. This white paper gives a brief backgrund t the Embedded Trace Macrcell (ETM) and Embedded Trace Buffer (ETB) technlgies. It als utlines hw advanced debuggers can explit the ETM and ETB trace technlgy t deliver pwerful debug capabilities t develpers. Many embedded develpers cntinue t use tried and true methds f debugging such as blinking LED and printf() utputs. When the ease f use, infrmatin cntent and the cst efficiency f mdern debugging technlgy is cnsidered, it is well wrth a develper s while t devte the relatively small amunt f effrt t becming familiar with these methdlgies as the payback in time savings in debugging and testing will be cnsiderable. 2 P a g e

7 INSTRUCTION TRACING OVERVIEW Instructin tracing is valuable in very tricky debug scenaris, and is cnsidered the heavy guns f embedded debugging. The purpse is t recrd executin histry, and later analyze what really happened when the system malfunctined. Sme types f applicatins need instructin tracing, as physical hardware can be damaged if yu stp n a breakpint during debugging. Mtr cntrl applicatins are a typical example here. T use instructin tracing in cmpatible ARM prcessrs, a cuple f different technlgies are available. Their respective rles will be explained belw. ETM TRACING Embedded Trace Macrcell (ETM) tracing requires an ETM trace-enabled debugger prbe, such as SEGGER J-Trace. Such debugger prbes typically have a large n-prbe trace buffer t stre the recrded executin histry, r even uses real-time streaming t the hst PC, and are thus mre expensive cmpared t standard debugger prbes withut ETM trace supprt. Trace buffers used with ETM tracing are typically many MB r GB in size. T use ETM tracing, a 20-pin JTAG cnnectr is used where 5 pins are dedicated fr ETM tracing (1 clck pin and 4 data pins). ETB TRACING Embedded Trace Buffer (ETB) tracing d nt need any particular trace-enabled debugger prbe, but instead uses a (very much) smaller trace buffer in RAM f the Crtex-M device. ETB can thus be used withut the mre expensive trace-enabled debugger prbes with cmpatible Crtex-M devices, but the executin time that can be recrded is a lt shrter. Trace buffers used with ETB are typically very small, nly a cuple f KB, as they use the RAM f the micrcntrller device as a trace buffer. T use ETB tracing, n particular extra JTAG pins are needed, as the trace buffer is just upladed frm the target RAM just like any ther array f bytes. TRACE TRIGGERS Because recrding the executin histry f a prcessr running at full speed generates massive amunts f data (easily many gigabytes f trace data n a Crtex-M cre during nly a cuple f secnds f executin time), great care is taken t reduce the amunt f trace data that is recrded. 3 P a g e

8 Trace-enabled debuggers therefre supprt cnfiguratin f where in the cde, r at what events, trace recrding shall start and stp. This is t reduce the massive vlumes f trace data recrded. 4 P a g e

9 RECORDING AND ANALYZING EXECUTION HISTORY WITH ATOLLIC TRUESTUDIO PRO Atllic TrueSTUDIO Pr supprts ETM and ETB instructin tracing, prvided that traceenabled hardware is being used. Instructin tracing recrds the executin flw f the prcessr in real-time. The recrded trace buffer can then be upladed t the debugger and analyzed t lcate the cause f sftware errrs. Instructin tracing is particularly useful when debugging prblems that nly ccur spradically, r when stpping n a breakpint will damage physical hardware. Bth ETM and ETB tracing recrds all executed machine cde instructins, until the hardware buffer limits are reached. A trace buffer is filled very quickly even thugh it is highly cmpressed. The cmpressed trace buffer in a JTAG prbe with a 16MB f trace buffer typically expands int 200MB f uncmpressed machine readable data, and t 2-3GB f human readable data. Instructin tracing thus quickly generates a huge amunt f data. This can happen in a fractin f a secnd n a speedy prcessr. ENABLE TRACE Instructin tracing (using ETM r ETB) must be enabled in the debug cnfiguratin f the debugger. T enable instructin tracing, first pen the debug cnfiguratin dialg bx: 5 P a g e

10 Figure 1 Enable Tracing in the Debug Cnfiguratin Then, select ETM (requires a trace enabled debugger prbe like SEGGER J-Trace) r ETB (can be used with any debugger prbe, prvided the device supprts ETB) trace system as apprpriate. CONFIGURING THE TRACING SESSION Once the debugger prbe and trace system have been cnfigured, and a debug sessin has been started, the tracing can be cnfigured. T cnfigure trace, suspend the debug sessin and pen the Trace Lg view (Select View in the tp menu and then ETM/ETB, Trace Lg). In the Trace Lg view tlbar, click n the Cnfiguratin tlbar buttn. Figure 2 Cnfiguratin Tlbar Buttn The Trace Cnfiguratin dialg bx will be displayed: 6 P a g e

11 Figure 3 - Trace Cnfiguratin Cnfigure the Trace Prt Width drpdwn list t match the number f pins used fr ETM tracing n the hardware bard. Using the Stall prcessr n FIFO full checkbx, select ne f these tw ptins: Stall the prcessr when the ETM trace FIFO buffer becmes full. With this setting, n trace data is lst but the timing behavir f the applicatin can be changed. D nt stall the prcessr when the ETM trace FIFO buffer becmes full. With this setting, the prcessr will always cntinue t run at full speed but trace data may be lst. Sme devices supprt timestamps. Enabling the timestamps can be useful if timing infrmatin is needed. It will hwever reduce the amunt f ther infrmatin available. 7 P a g e

12 TRACE TRIGGERS The trick with Instructin tracing is t trace nly where tracing is needed. Otherwise the imprtant infrmatin can be impssible t lcate in the huge amunt f data that will be cllected r lst since it ccurred t lng time befre debugging was suspended and the trace infrmatin upladed. There are fur hardware triggers that can be set t starting and stpping the tracing n different cnditins. T access them, pen the Trace Cnfiguratin as abve and select Add Trace Triggers The triggers can als be added frm the Breakpints view. Figure 4 - Trace Cnfiguratin Fr each f the triggers 0-3, it is pssible t define that the trigger shall start r stp tracing, if its cnfigured cnditins are met. Each trigger has the fllwing ptins: The Actin t perfrm when the cnditin is triggered: Trace Start: Starts cllecting trace data Trace Stp: Stps cllecting trace data The Type f memry access that triggers the actin: PC: Triggered when executin reaches an address Data Read: Triggered when data is read frm an address Data Write: Triggered when data is written t an address Data Read/Write: Triggered when data is read r written t an address Enter the address t trigger n in the Expressin/Address field. This field accepts: Numeric address cnstants such as 0xffff0010 Numeric address ranges such as 0xffff0010 t 0xffff001f 8 P a g e

13 Functin symbls such as main Variable symbls such as MyGlbalCunter It is als pssible t define mathematical expressins like main + 7 Typically, at least ne trigger is cnfigured t start tracing, and anther trigger is cnfigured t stp tracing. ADD TRACE TRIGGER IN THE EDITOR Start and Stp Trace Triggers can als be added directly in the C/C++ Editr ruler and the Disassembly view. These triggers wrk in line with the Breakpints, except that they will nt suspend the executin. Instead they will start r stp cllecting f trace data when executin reaches that line. In shrt, they are trace start/stp pints in the cde. Right click n the ruler t the left in the editr windw and select Add Trace Trigger. Figure 5 Add Trace Trigger in the Editr A new trigger will be created and tracing starts t be cllected when executin reaches that line f cde. Figure 6 Trace Trigger in the Editr 9 P a g e

14 MANAGING TRACE TRIGGERS All the Trace Triggers are visible frm the Breakpints view. Figure 7 Trace Trigger in the Editr Frm this view the triggers can easily be inactivated, activated, remved and even added. Bear in mind that the hardware supprts up t a maximum f fur simultaneus Trace Triggers. START TRACE RECORDING Once tracing has been enabled, click the Recrd tlbar buttn in the Trace Lg view t enable recrding f trace data. Figure 8 Recrd Tlbar Buttn With trace recrding enabled, start target executin. When executin is suspended, the Trace Lg view is filled with the recrded instructin trace (prvided the trace start trigger cnditin was fulfilled). ANALYZING THE TRACE When later n suspending executin, the trace buffer is upladed t the Trace Lg view. It is filled with the recrded instructin stream, alng with ther data that is prvided by analyzing the trace recrding. 10 P a g e

15 Figure 9 - The Trace Lg View The Trace Lg view shws detailed infrmatin n what the prcessr was ding up t the pint f suspending executin. Please nte the clumn with graphical icns that anntate the Trace Lg view with infrmatin abut executin flw branches: Call a new functin Return frm a functin Jump up in the cde Jump dwn in the cde Iterate n the same instructin A cnditinal branch was nt taken At the end f the view is the End f Trace marker displayed. This is added t the Trace Lg each time the buffer is verflwed and it indicates that sme trace data mst likely is lst. Figure 10 - Trace Restarted 11 P a g e

16 The ther imprtant marker is the Trace restarted marker. It indicates that the target wasn t able t generate all the trace infrmatin withut affecting the perfrmance f the running applicatin. Sme data is lst. T vercme this issue, enable Stall prcessr n FIFO full in the Trace Cnfiguratin. DISPLAY OPTIONS The Lg Trace view supprts several different display ptins ( zm levels): Functin call tracing C tracing C/Assembler mixed mde tracing Assembler tracing Raw trace packet lg Use the different Display Optins Tlbar Buttns t switch between the different viewmdes. The Functin call tracing displays what functin the executin is in and frm where it is called r returned frm. Figure 11 Display Optins Tlbar Buttn 12 P a g e

17 Figure 12 - Different zm levels in the instructin trace lg SEARCH THE TRACE LOG The recrded trace buffer can becme very large. Atllic TrueSTUDIO Pr supprts appended trace buffers f a ttal f 100 millin lines. Fr this reasn, a search functin is available, t enable users t find imprtant infrmatin in the ptentially huge dataset. Figure 13 Search Tlbar Buttn Using the search feature it is pssible t search fr certain data f particular interest. Fr example, assume a system crash smetimes happens because a variable has an illegal value. By searching the instructin trace fr the address f the variable, it is pssible t understand what cde mdifies the value and gives it the illegal value causing a system crash. 13 P a g e

18 EXPORTING A TRACE LOG It is pssible t save the trace lg by clicking n the Exprt Trace tlbar buttn in the Trace Lg view. Figure 14 Exprt Tlbar Buttn The trace lg can be saved t either cmma separated value files (*.csv) that can be imprted int Micrsft Excel, r t human readable ASCII text files (*.txt). Cnfigure the trace recrd range t exprt using the Frm Index and T Index fields. As the saved trace lg becmes apprximately 200 times larger than its cmpressed size in the JTAG prbe trace buffer, the saved trace lg can ptinally be split t many files in rder t avid exprted trace lgs which are several gigabytes in size (fr example, the 16MB cmpressed trace buffer in Segger J-Trace expands t 2-3GB when saved t a human readable trace lg file in *.CSV r *.TXT frmats). Figure 15 - Exprting the Trace Lg After a trace lg has been exprted int readable frmat, very cmplex prblems can be analyzed ffline, fr example by writing a script prgram that prgrammatically analyzes the executin histry, thus autmatically scanning millins f executed machine cde instructins, trying t find that dd reasn fr the millin dllar bug. 14 P a g e

19 SUMMARY Many f the hardware cmpnents f electrnics prducts are becming less expensive as time ges n. This trend is actually driving up sftware develpment and testing csts, as the adptin f cheaper hardware enables mre prduct features that must be supprted by sftware. This means mre bugs t find, and less time t find them. The infrmatin prvided by ETM r ETB instructin tracing can be valuable tls in a develper s repertire when used prperly. Mre infrmatin abut Atllic and the Atllic TrueSTUDIO prduct is available here: P a g e