Using CoreSight Trace Techniques on Cortex - IAR Systems

y Ryan Sheng, IAR Systems
<strong>Using</strong> <strong>CoreSight</strong> <strong>Trace</strong> <strong>Techniques</strong> on Cortex-M3/M4
The debug system of ARM Cortex-M3/M4 is based on the new <strong>CoreSight</strong> architecture. In addition to
traditional invasive operations, <strong>CoreSight</strong>-based designs enable the memory and peripheral registers to
be examined even when the CPU is running. Furthermore, <strong>CoreSight</strong> architecture also introduces
powerful trace capabilities that include:
• Data <strong>Trace</strong>, generating events to record data reads/writes, exceptions/interrupts, and PC
(program counter) sampling information.
• Software <strong>Trace</strong>, supporting output of debug messages (e.g. printf) to the host.
• Instruction <strong>Trace</strong>, collecting a sequence of every executed instruction continuously for a
selected portion of your application.
Once generated, trace data can be transferred to the host through a debug probe such as IAR J-Link or
IAR J-<strong>Trace</strong>. IAR C-SPY Debugger can then collect and display this information in various windows for
analysis.
<strong>Trace</strong> data can be useful for locating errors that have irregular symptoms and occur sporadically. It is
also helpful for analyzing dynamic system behavior, optimizing performance bottlenecks, and counting
code coverage statistics.
Debug Interface and <strong>Trace</strong> System
Unlike ARM7/ARM9, the Cortex-M3/M4 core itself does not have a JTAG interface. Instead, the Debug
Port (DP) module is decoupled from the core. Current DPs can support the well-known JTAG interface
and the Serial-Wire Debug (SWD) interface.
There are up to three components in Cortex-M3/M4 that can be a trace source: DWT (Data Watchpoint
and <strong>Trace</strong>, for Data <strong>Trace</strong>), ITM (Instrumentation <strong>Trace</strong> Macrocell, for Software <strong>Trace</strong>), and ETM
(Embedded <strong>Trace</strong> Macrocell, for full Instruction <strong>Trace</strong>). DWT, ITM and ETM generate trace data in the
form of packets and transfer them through an Advanced <strong>Trace</strong> Bus (ATB) to the <strong>Trace</strong> Port Interface
Unit (TPIU). TPIU has two operation modes: Clocked mode, using up to 4-bit (1, 2 or 4-bit) parallel data
outputs, and SWV (Serial-Wire Viewer) mode, using a single-bit SWO (Serial Wire Output) output
format. Instruction <strong>Trace</strong> (from ETM) must use the parallel trace port, while packets of Data <strong>Trace</strong> and
Software <strong>Trace</strong> normally use SWO (called SWO <strong>Trace</strong>) but can also be multiplexed with the ETM trace
stream through the parallel trace port.
The figure below shows the diagram of a Cortex-M3/M4 trace system. JTAG/SWD, SWO and the 4-bit
parallel trace port can be deployed into a 19-pin (0.05”) Cortex Debug + ETM connector on the target.
IAR J-<strong>Trace</strong> for Cortex-M3 can use this connector directly and support all these trace capabilities
(including ETM).
Note that the ETM component is optional. Not all Cortex-M3/M4 devices have ETM, but nearly all of
them support JTAG/SWD debugging and SWO <strong>Trace</strong>. SWO and JTAG/SWD signals can be deployed
into a 20-pin (0.1”) standard JTAG connector. Both IAR J-Link and IAR J-<strong>Trace</strong> can use this connector
directly and support the SWO channel. IAR J-Link is a more affordable probe for ARM targets without
ETM, supporting all ARM7/ARM9/ARM11/Cortex-M0/M1/M3/M4/R4 cores.

Note that the TDO signal of JTAG is multiplexed with SWO in both connectors (see the figure below), so
that SWO <strong>Trace</strong> is not accessible when the DP is in a JTAG configuration. Only the SWD interface can
be used together with SWO.
<strong>Trace</strong>-related Debugger Features of C-SPY
When debugging with IAR J-Link/IAR J-<strong>Trace</strong> in C-SPY, you can use trace-related windows such as
SWO or ETM <strong>Trace</strong>, Function <strong>Trace</strong>, Timeline, Interrupt Log, Interrupt Log Summary, Data Log, Data
Log Summary and Find in <strong>Trace</strong>. Various types of trace breakpoints and triggers are available to control
the collection of trace data. In addition, several other features of C-SPY also use trace data, such as the
Profiler and Code coverage. Please note that the SWO channel does not have unlimited throughput,
thus it is usually not possible to use all the above features at the same time.
Page 2

When debugging, two indicators labeled ETM and SWO respectively, are visible on the IDE main
window toolbar (as the figure below). If any of these indicators is green, it means that the corresponding
trace hardware is generating trace data. Just point at the indicator with your mouse to get detailed tips
about which C-SPY features that have requested trace data generation. This is useful, for example, if
the SWO communication channel often overflows because too many C-SPY features are enabled for
trace data usage.
Data <strong>Trace</strong>
The DWT (Data Watchpoint and <strong>Trace</strong>) component generates Data <strong>Trace</strong> information in Cortex-M3/M4.
It has four independent watchpoints (comparators) which can be programmed to compare data
addresses or program counters. If there is a matched comparison, the watchpoint can therefore halt the
processor, generate Data <strong>Trace</strong> packets or trigger ETM. DWT also contains a PC sampler, an interrupt
trace module and a set of counters for CPU cycle statistics. It is capable of recording data reads and
writes with timing statistics, logging the execution of exceptions and interrupts, sampling the PC
(program counter) at regular intervals, etc.
<strong>Trace</strong> packets generated by DWT are transferred to ITM through ATB at first. ITM acts as a merging unit
to combine its own trace data with DWT packets, and it is responsible for sending the merged packets
stream to TPIU.
Example 1: Monitor the value of static variables
Example 2: Measure the time consumption of a piece of code
Example 3: View the graph of interrupts
Example 4: Statistical code profiling on function level
Software <strong>Trace</strong>
The ITM (Instrumentation <strong>Trace</strong> Macrocell) component of a Cortex-M3/M4 device can have three
operation modes (trace sources):
• Application software can write console messages directly to ITM stimulus ports and output
them to the host as trace packets. This is normally called Software <strong>Trace</strong>.
• ITM can merge and forward trace packets generated from DWT to TPIU.
• ITM can generate timestamp packets that are inserted into the trace stream, to help the host
debugger to find out the timing of events.
Software <strong>Trace</strong> is a printf-style debugging method that is driven directly by the application. It is used for
sending data from the target application to the host debugger without stopping the program execution.
ITM contains 32 stimulus ports, allowing different software routines to access different ports, and the
messages can be collected by the host debugger. Each ITM stimulus port can be enabled or disabled
individually. Unlike traditional terminal I/O semihosting mechanisms based on breakpoints, using
Software <strong>Trace</strong> to output debug messages does not cause much delay for the application. The speed
will be comparable to using a high speed UART.
• Example 5: Printf via SWO
• Example 6: Direct output via ITM stimulus ports
Page 3

Instruction trace
Instruction <strong>Trace</strong> (also known as ETM trace) is a continuously collected sequence of every executed
instruction for a selected portion of the application. Note that the ETM (Embedded <strong>Trace</strong> Macrocell)
component is optional so that some Cortex-M3/M4 devices might not support Instruction <strong>Trace</strong>. When
ETM is included and enabled, it generates trace packets and sends them to TPIU. A special hardware
probe (e.g. IAR J-<strong>Trace</strong> for Cortex-M3) is required to receive these packets and transfer them to the
host debugger. The J-<strong>Trace</strong> probe contains a 4MB buffer that collects instructions in real time, but the
trace data will not be displayed in the ETM <strong>Trace</strong> window of C-SPY until the execution has been
stopped.
Since the (up to) 4-bit trace port is not sufficient to transfer all executed instructions, ETM does not
actually output every address/instruction that the processor has reached or executed. It usually
generates compressed information about the program flow and outputs full addresses only if needed
(e.g. if a branch has taken place). Since the debugger knows the application code image, it can then
reconstruct the full instruction sequence from the trace data.
Supported by a probe such as IAR J-<strong>Trace</strong> for Cortex-M3, Instruction <strong>Trace</strong> can be used with SWO
trace (Data <strong>Trace</strong> and Software <strong>Trace</strong>) concurrently. In this case, trace data from DWT and ITM will also
be collected to the ETM trace buffer, instead of being streamed via the SWO channel immediately. This
means that DWT and ITM trace data will not be displayed until the execution has been stopped, instead
of being continuously updated in the C-SPY windows.
• Example 7: Instruction trace and function trace
• Example 8: View the call stack graph
• Example 9: Statistics of code coverage
Page 4