Kill Bugs efficiently with Code Trace - IAR Systems...•When someone says “trace”, they generally mean ETM • SWO Trace is a low-speed trace option for ARM Cortex cores: •Not

Kill Bugs efficiently with

Code Trace

ARMTechCon

Rafael Taubinger – Sr. Field Application Engineer

• What is Trace?

• Different kinds of Trace

• Why do you want Trace?

• I-jet Trace

• Demo

• Summary

• Q&A

AGENDA

• Follow your steps vs. (single-)

stepping

• Go back in time and evaluate

execution backwards

• No gaps

WHAT IS TRACE

Different kinds of Trace

• When someone says “trace”, they generally mean ETM

• SWO Trace is a low-speed trace option for ARM Cortex cores:

• Not guaranteed to get every instruction - ~1 in 8000 instructions

• Every ARM Cortex chip can do SWO trace

• ETB trace (CM0+)

• A small tracebuffer is located on the device

• Every instruction traced

• Memory in the kB range, instruction clock in the MHz range, two bytes per instruction -> very

limited depth

• ETM Trace is a high-speed trace:

• Can select between stalling on trace FIFO full or full chip execution

• Buffers are generally on the hardware debug probe (up to 1GB of trace memory on I-jet

Trace)

• Not all chips have the optional ETM module

SWO TRACE vs. ETM TRACE

TRACE PINS CORTEX M3/M4 CORES

2 SWDIO / TMS

4 SWCLK / TCK

6 SWO/EXTa/TRACECTL / TDO

8 NC/EXTb / TDI

10 nRESET

12 TRACECLK

14 TRACEDATA[0]

16 TRACEDATA[1]

18 TRACEDATA[2]

20 TRACEDATA[3]

VTref 1

GND 3

GND 5

KEY 7

GNDDetect 9

GND/TgtPwr+Cap 11

GND/TgtPwr+Cap 13

GND 15

GND 17

GND 19

Serial Wire and Trace

CORTEX M3/M4 CORESIGHT

DWT

CPU statistics

FPB

6 breakpoints

DAP

JTAG

live

core access

I-jet

ITM

ITM

Instrumentation Trace

ETM trigger

ETBinstruction

trace

ETB

Embedded Trace Buffer

ETM

Embedded Trace MacrocellETM

instruction trace

trace port

4 watchpoints

PC sampler

Interrupt trace

software trace

32 channels

time stamping

SWD/SWO

CORTEX A CORESIGHT

Why do you want Trace?

ADVANTAGES OF USING TRACE?

• Unlike conventional debugging technologies, trace is non-

intrusive.

• Can be used to debug your application in real-time

• You can see cycle counts of your application to measure

performance

WHAT CAN TRACE DO FOR YOU?

• These are the types of problems that can be found with a quality trace:

• Pointer problems.

• Illegal instructions and data aborts (such as misaligned writes).

• Code overwrites – writes to Flash, unexpected writes to peripheral

registers (SFRs), corrupted stack. How did I get here?

• Out of bounds data. Uninitialized variables and arrays.

• Some of these can be found during routine testing, others are “million

dollar” bugs that may not be found until later

AND…

• Other things that can be found with trace:

• Stack overflows - what causes the stack to grow bigger than it

should?

• Runaway programs - your program has gone off into the weeds

and you need to know why.

• Communication protocol and timing issues, general system

timing problems.

• Profile Analyzer - where is the CPU spending its time?

• Code Coverage, a certification requirement. Was this code

executed?

• All are easily done with trace!

The IAR Systems solution

I-jet TRACE

• I-jet Trace delivers large trace memory capacities and high-speed

communication via SuperSpeed USB 3.0

• Support foworks with all Cortex M cores that contain ETM

• SWO using Manchester and UART, at up to 200 Mbps

• Up to 150MHz ETM trace clock, supports cores up to 300MHz System

clock

• Memory capacity of 32 Msamples

• 64-bit time stamp CPU cycle

accuracy for timing analysis

I-jet Trace TOOL INTEGRATION

ADDITIONAL FEATURES

Instruction

Profiling

Function

Trace

ETM Trace

Function

Profiler

Code

Coverage

Practical Use Case

FINDING HARD FAULT ERRORS

• Fastest way is to bisect your code with a breakpoint

• When you are inputting a test case, you should know roughly

what functions will be called and in what order

• Pick a halfway spot in that execution and set a breakpoint

• If you make it to the breakpoint, the hard fault is the second “half”

of your code

• Once you locate in which half of code your hard fault is triggered, bisect

that code half into two halves and set another breakpoint

• Repeat until you find the statement that triggers the hard fault

STEPS TO FIND HARD FAULT ERRORS

• First, set a breakpoint at the top of your hard fault handler

• Turn on the ETM Trace with your toolsuite

• Reset your code and run until you hit the breakpoint

• The previous instruction in your trace log will be the one that

tripped the hard fault

• Set a breakpoint in the top of the function that caused the hard

fault and reset

• Reset code and try to understand what caused the hard fault

Demo

Summary

SUMMARY

• A modern JTAG debug probe can yield a surprisingly advanced

visualization of your application’s behavior using the Instrumentation

Trace Macrocell (ITM) available in Cortex-M based microcontrollers.

• Utilizing the full Embedded Trace Macrocell (ETM) available in many

ARM devices adds even more possibilities to kill bugs in the most

efficient way.

• In this session, we had an overview at the technology behind various

ARM trace sources and use trace-based debugger technology to

demonstrate the benefits of ARM Cortex debug features.

Want to learn more?

• Book an IAR Academy course

• Get a demo of our latest news

THANK YOU FOR

YOUR ATTENTION!