On-Chip Instrumentation

Neal Stollon

On-Chip Instrumentation

Design and Debug for Systems on Chip

Neal StollonHDL Dynamics, DallasTX, USAneals@hdldynamics.com

ARM9, Coresight, ETM, ETM9, MMD are trademarks or registered trademarks of ARM Holdings plc. All rights reserved.EJTAG, HyperDebug, MIPS64, MIPS32, OCI, PDtrace, RRT are trademarks or registered trademarks of MIPS Technologies, Inc. All rights reserved.OSCAN, CDX, BDX are trademarks or registered trademarks of IEEE 1149.7 Working Group. All rights reserved.TCODE, NPC are trademarks or registered trademarks of IEEE 5001 and Nexus 5001 Forum. All rights reserved.ONCE, mxC are trademarks or registered trademarks of Freescale Inc. All rights reserved.OCDS, MCDS, Cerebus, PCP2 are trademarks or registered trademarks of Infineon Technologies AG. All rights reserved.Any other third party trademarks remain the property of their respective ownersAll copyrights on images, graphics, descriptions, products, and brands remain property of their respective owners. No infringement of rights is intended or implied.

ISBN 978-1-4419-7562-1 e-ISBN 978-1-4419-7563-8DOI 10.1007/978-1-4419-7563-8Springer New York Dordrecht Heidelberg London

© Springer Science+Business Media, LLC 2011All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed is forbidden.The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.

Printed on acid-free paper

Springer is part of Springer Science+Business Media (www.springer.com)

v

When I started this book, I thought I understood the world of on-chip debug–after all, I had been part of one of the leading startups in the area for 5 years and had been a participant in a number of standard and industry organizations that were leading the world of on-chip debug and instrumentation into the next wave. As I gathered my materials, I grew more impressed by the day and by the month at the body of work that this topic has accumulated, in industry and in academia, in every nook and cranny of the embedded systems business, from embedded processor, to bus architecture, to FPGA, to IP development; engineers have developed and cus-tomized a truly impressive range of on-chip debug and instrumentation solutions to address and support their products and to enable an increasingly capable infrastruc-ture that does much more than the prosaic word debug implies and starts to address the full potential of what on-chip instrumentation can truly provide for the electron-ics industry.

This book came about, in part, because of the lack of a comprehensive discus-sion of on-chip debug instrumentation. This seems to have been an area where the experts come about from on-the-job experience and in ad hoc methods. On-chip debug is an integral part of most modern processor and system on-chip (SoC) design, but in my experience it is not a topic given in-depth discussion in engineer-ing school (universities take note). Most engineers’ experience of on-chip debug is limited to plugging into the JTAG port and running the software, with little under-standing of what goes on within. This text tries to provide a general overview of the different types of on-chip debug that goes into a design.

This book is structured into three main sections; the first, Chaps. 1–7, is an intro-duction to the variety of concepts that make up on-chip debug, in particular looking at some of the history and well-established infrastructure, including an overview of JTAG from a debug, rather than test, point of view. It also looks at aspects of processor- and bus-level instrumentation and discusses multicore on-chip debug issues The second section, Chaps. 8–11, addresses a number of the standards and industry efforts that are ongoing in areas ranging from instrument interfaces to JTAG advances, some of which, like Nexus and OCP-IP, I have been involved in, and others that have been a learning experience for me over the last year, all of which I believe will form the core basis for the next generation of on-chip debug. The third section, Chaps. 12–15, is a survey of some of the wide variety of commercially

Preface

vi Preface

supported solutions for on-chip debug, addressing a limited cross section of the types of on-chip instruments that are available for different processors and SoCs.

Some areas related to on-chip debug have been intentionally kept generic and out of the discussion to maintain the focus on the on-chip instrumentation. Notably, I have kept any detailed discussion of probes and host-based debugger software to a minimum, other than what is required to make the concepts of JTAG and trace understandable. This may seem unusual, but the reasons for this are two-fold. First, the topic of debug probe and software design is at least a book in itself. Second, the commercial business involved in probes and debug software is a significant busi-ness unit for most processor companies as well as the dozens of companies that provide probe and software solutions (many run by people I know) that address the range of debug options. To mention any one example in any detail would ignore the rest that are equally deserving of mention.

Few are of variety of instrumentation- and debug-related areas I cover are dis-cussed exhaustively. This is due to both limitations on space and a large amount of supplemental detailed information available elsewhere for those who want to explore in more depth. Similarly, I have intentionally avoided discussion of some of the more advanced implementations, in order to keep the text accessible to a more general reader. For virtually all topics, I highly recommend the reader to directly contact the IP or chip vender or standards group for more detailed and updated information on the topics. Those interested in instrumentation products can find an amount of online resources that address specific instrumentation solutions in minute detail. The amount of documentation avaliable on MIPS EJTAG or ARM ETM, for example, can put page length of War and Peace to shame.

The standards-related activities are somewhat less well documented, in some cases because they are work in progress. However, there is a lot of follow-on infor-mation out there for those who search. So I have tried to focus on what I think are the interesting or unique parts of different instrumentation solutions, with the assumption that readers interested in more detail can find it.

I want to acknowledge a number of people in the industry who have helped me along the way, especially Rick Leatherman and the on-chip instrumentation team of the First Silicon Solutions group at MIPS, who got me started in thinking about on-chip instrumentation and who taught me far more they realize about on-chip debug technologies and the businesses involved. I also thank the current and past members of the Nexus IEEE 5000 Forum and members of the OCP-IP Debug Working Group, with special recognition to Bob Uvacek, my longtime compatriot in the working group.

Last, but by far not least, I want to acknowledge my family, without whom I am nothing. My wife Marcy, my daughters Courtney and Naomi, my son Eric, and my mom Rita Bickel Stollon (of blessed memory) were patient and understanding of the time I spent working on this book. Finally, I dedicate this book to my family but especially to my father Arthur Stollon (of blessed memory), who proofread every-thing I wrote while I was in school and taught me “be prepared to trudge thru the wilderness to get a change at the limelight”.

Dallas, TX Neal Stollon

vii

Contents

1 Introduction ............................................................................................... 11.1 The Need for On-Chip Debug ............................................................ 11.2 Instrument- (**in-silicon) and EDA- (Presilicon) Based Verification 31.3 SoC Debug Requirements .................................................................. 71.4 Instrumentation-Based Debug Infrastructure ..................................... 11

2 On-Chip Instrumentation Components .................................................. 172.1 Trace and Event Triggering ................................................................ 172.2 External Interfaces for On-Chip Instrumentation .............................. 182.3 Performance Analysis Using On-Chip Instrumentation .................... 192.4 On-Chip Logic and Bus Analysis ...................................................... 202.5 On-Chip Instrumentation Examples .................................................. 22

2.5.1 Trace Monitoring and Interfaces ........................................... 222.5.2 Bus Logic Monitoring ........................................................... 232.5.3 Real-Time Data Exchange ..................................................... 25

2.6 Multiprocessor Debug ....................................................................... 26

3 JTAG Use in Debug ................................................................................... 313.1 JTAG Pins .......................................................................................... 323.2 Test Access Port ................................................................................. 353.3 JTAG Registers .................................................................................. 383.4 JTAG Instructions .............................................................................. 393.5 Boundary-Scan Description Language .............................................. 403.6 The Road to JTAG: Historical Debug Approaches ............................ 44

3.6.1 Background Debug Mode ...................................................... 47

4 Processor System Debug ........................................................................... 494.1 A Processor Debug Instrument Implementation ................................ 524.2 Processor Trace Compression ............................................................ 554.3 Hunting Code Errors with Self-Trace ................................................ 59

viii Contents

5 An On-Chip Debug System ...................................................................... 615.1 OCDS Features .................................................................................. 62

5.1.1 Debug Events ......................................................................... 645.1.2 Debug Event Actions ............................................................. 645.1.3 Debug Registers ..................................................................... 65

5.2 Operation Modes ................................................................................ 655.2.1 Entering Communication Mode ............................................ 665.2.2 Communication Mode Instructions ....................................... 665.2.3 Monitor-to-Debugger Host Data Transfer (Receive) ............. 675.2.4 Debugger Host-to-Monitor Data Transfer (Send) ................. 675.2.5 High-Level Synchronization .................................................. 67

5.3 OCDS Registers ................................................................................. 685.3.1 Debug Task ID Register......................................................... 685.3.2 Instruction Pointer Register ................................................... 685.3.3 Hardware Trigger Comparison Registers .............................. 695.3.4 Considerations on Accessing OCDS Registers ..................... 69

5.4 OCDS JTAG Access .......................................................................... 705.4.1 Steps to Initialize the JTAG Module ..................................... 72

5.5 OCDS Module Access ....................................................................... 725.5.1 Error Protection ..................................................................... 72

5.6 OCDS JTAG I/O Instructions ............................................................ 745.7 OCDS JTAG Registers ....................................................................... 765.8 Hardware Triggers ............................................................................. 77

5.8.1 Structure of a Noninterruptible Monitor Routine .................. 795.8.2 Structure of an Interruptible Monitor Routine....................... 795.8.3 Debug Event Control Registers ............................................. 80

5.9 Additional Features ............................................................................ 815.9.1 System Security ..................................................................... 825.9.2 Reset from the JTAG Side ..................................................... 835.9.3 Reset from the Chip/Processor Side ...................................... 83

6 Bus System Debug ..................................................................................... 856.1 On-Chip Buses ................................................................................... 856.2 Socket-Based SoC Design ................................................................. 87

6.2.1 SoC Interconnect Complexities ............................................. 876.3 Bus-Level Integration ......................................................................... 90

6.3.1 Bus Master Monitoring.......................................................... 916.3.2 Peripheral Bus Monitoring .................................................... 916.3.3 Slave Monitoring ................................................................... 91

6.4 Internal and External Alternatives for Bus Trace............................... 926.5 Programmable Bus Performance Monitoring .................................... 936.6 Bus Performance Monitoring ............................................................. 946.7 On-Chip and Off-Chip Analysis ........................................................ 986.8 Request Response Trace Bus Analysis .............................................. 101

6.8.1 RRT Operations ..................................................................... 1036.8.2 RRT Implementation ............................................................. 104

ixContents

7 Multiprocessor Debugging ....................................................................... 1097.1 Cross-Triggering and Global Breakpoint Control ............................. 1107.2 HyperDebug Distributed Cross-Triggering ....................................... 110

7.2.1 HyperDebug Controller ......................................................... 1127.2.2 Typical HyperDebug Implementation ................................... 113

7.3 Multicore Synchronization Triggering and Global Actions .............. 115

8 IEEE 1149.7: cJTAG/aJTAG .................................................................... 1178.1 Test and Debug Views of 1149.7 ....................................................... 1188.2 Key T0–T5 Class Functions .............................................................. 1208.3 MIPI Use of 1149.7 ........................................................................... 129

8.3.1 MIPI System Trace Module .................................................. 1308.4 Nexus Use of 1149.7 ......................................................................... 132

8.4.1 IEEE 1149.7/Nexus Integration ............................................. 134

9 IEEE P1687 – IJTAG ................................................................................ 1379.1 Overlap Zones and Gateway Elements .............................................. 1399.2 Classes of P1687 Instruments ............................................................ 1419.3 IEEE 1500 Instruments ...................................................................... 143

10 OCP IP Debug Interfaces ......................................................................... 14510.1 OCP Multicore Debug ..................................................................... 14610.2 OCP Debug Features ........................................................................ 14810.3 Three Views of Debugging .............................................................. 150

10.3.1 Pure Software Debugging................................................... 15010.3.2 Pure Hardware Debugging ................................................. 15110.3.3 System-on-Chip Debugging ............................................... 151

10.4 Debug Components and IP Interfaces .............................................. 15110.5 Debug Socket Definitions ................................................................ 152

10.5.1 Core Debug Socket Interfaces ............................................ 15410.5.2 Cross-Triggering Socket Interfaces .................................... 15710.5.3 OCP Synchronized Run Control ........................................ 16310.5.4 OCP Traffic-Monitoring and Trace Interfaces ................... 16310.5.5 Performance Monitoring .................................................... 16510.5.6 System Timestamping ........................................................ 16610.5.7 Power Management Monitoring ......................................... 16610.5.8 Security Debug Interface .................................................... 167

11 Nexus IEEE 5001....................................................................................... 16911.1 Nexus Implementation Classes ........................................................ 17111.2 Nexus Message Architecture ........................................................... 172

11.2.1 Nexus TCODEs .................................................................. 17411.2.2 Nexus Registers .................................................................. 178

11.3 NEXUS Interfaces ............................................................................ 18011.3.1 Nexus JTAG Access ........................................................... 18011.3.2 NEXUS AUX Interfaces .................................................... 181

x Contents

11.4 Multicore Nexus Debug Approaches ............................................... 18511.4.1 Input Tool-to-Target Messages ........................................... 18711.4.2 Output Target-to-Tool Messages ........................................ 188

11.5 Nexus Product Implementations ...................................................... 18911.6 Summary .......................................................................................... 193

12 MIPS EJTAG ............................................................................................. 19512.1 EJTAG Instructions and Registers ................................................... 19712.2 PC Sampling .................................................................................... 19912.3 MIPS PDtrace™ .............................................................................. 199

12.3.1 Trace Output Formats ......................................................... 20012.3.2 Trace Control Block Registers ............................................ 204

12.4 TCB Trigger Logic Overview .......................................................... 20612.5 PDtrace External Interface ............................................................... 20712.6 TCtrace IF ........................................................................................ 20912.7 PDTRACE Operations ..................................................................... 210

13 ARM ETM ................................................................................................. 21313.1 ETM Signals .................................................................................... 213

13.1.1 External Signals .................................................................. 21413.2 ETM9 Registers ............................................................................... 21613.3 Trace Interface ................................................................................. 218

14 Infineon Multicore Debug Solution ............................................................ 21914.1 MCDS Trace Protocol Definition .................................................... 221

14.1.1 Data Trace ........................................................................... 22314.2 Debug Transactor: RUN Control Bus Master .................................. 22414.3 MCDS Run Control: On-Chip Debug Support ................................ 225

14.3.1 BCU Level 1 (Bus-Observer Unit on the System Bus) ...... 22714.3.2 Concurrent Debugging in Level 3 MCDS

(Two-Channel Tracing) .......................................................... 22814.3.3 Debug Interface (Cerberus)

(Debug Bus-Transactor Module) ........................................... 22814.4 RW Mode and Communication Mode ............................................. 22814.5 Multicore Break Switch ................................................................... 229

15 EJTAG and Trace in Toshiba TX Cores ................................................. 23115.1 Processor Access Overview ............................................................. 23215.2 Toshiba EJTAG Instructions and Registers ...................................... 23315.3 Debug Exceptions ............................................................................ 23515.4 Processor Debug Instructions and CP0 Registers ............................ 23515.5 Break Functions ............................................................................... 23715.6 Output by PC Trace .......................................................................... 238

Index ................................................................................................................. 241