1
Debug vs trace
Intrusive debug
CPU
Breakpoint
CPU stopped
Stops the execution
Misses what happened before
Hard to reproduce
ChipTrace® (non-intrusive)
Non-intrusive*
Full execution history
Post-mortem analysis
* The ETM never stops the core. If it cannot keep up, it drops trace and marks the gap (an overflow packet), flagged at decode. With an ETR sink, trace writes also share system-memory bandwidth with the application.
From "Where did it stop?" To "What happened before?"
2
CoreSight™ architecture
ChipTrace drives the Arm CoreSight™ trace infrastructure directly, register by register.
Cortex-A · Cortex-R · Cortex-M
Interconnect trace: Arteris FlexNoC observers and Ncore probes
- 1 · SourcesETM one per core, Cortex-A, R or M · STM / ITM software messages · FlexNoC observers · Ncore probes
- 2 · FunnelCSTF merges every stream, each keeps its trace ID
- 3 · On-chip buffersETF circular buffer → Replicator → ETR in system memory · TPIU not used
- 4 · Read backThe dump is kept in non-volatile memory across a reset, read back over Ethernet or JTAG, decoded in TRACE32 or ChipTraceAnalyzer.
- AcrossTSG one time base for every source · CTI / CTM an ETM event or a FlexNoC / Ncore alarm starts or stops the capture
What each block does
ETMEmbedded Trace Macrocell, one per core
Observes the instructions the core retires and emits a compressed program-flow stream on the ATB, tagged with a trace ID.
STM / ITMSoftware stimulus
Memory-mapped stimulus ports: a store from software becomes a timestamped message in the same trace stream.
FlexNoCArteris NoC observers
Watch the traffic of the network-on-chip (cores, DRAM, DMA) and put their packets on the ATB through their own endpoint; an address match raises an alarm into the CTI.
NcoreArteris coherent-interconnect probes
Match the requests and responses of the cache-coherent interconnect by address, count them against a threshold, log its errors; their packets go on the ATB, their alarms into the CTI.
CSTFTrace funnel
Merges several ATB streams into one, with a programmable priority per port. Streams keep their trace ID.
ETFTrace Memory Controller, Embedded Trace FIFO
On-chip SRAM inside the TMC. Used as a circular buffer (ETB mode) that keeps the last of the trace, or as an elastic FIFO in front of another sink.
ReplicatorATB splitter
Sends one stream to two sinks, and can pass or drop ranges of trace IDs on each output.
ETRTrace Memory Controller, Embedded Trace Router
An AXI master that writes the stream into system memory, in one linear buffer or through a scatter-gather table: a longer history than the ETF holds.
TPIUTrace port interface unit
Drives the stream off-chip on dedicated pins, to an external trace probe. Not used: ChipTrace needs no probe.
CTI / CTMCross-trigger interface and matrix
Routes events between blocks and cores: an ETM event or a FlexNoC / Ncore alarm can start or stop the capture, a trigger can halt another core.
TSGTimestamp generator
A free-running counter distributed to every trace unit, so packets from different cores share one time base.
Read backWhat ChipTrace adds
The trace buffer is dumped and kept in non-volatile memory across a crash or a reset, then read back over Ethernet or JTAG and decoded in TRACE32 or ChipTraceAnalyzer.
Block set and topology vary from one SoC to another: the number of funnels, the ETF/ETR arrangement and the CTI mapping are part of the per-SoC configuration. Hover a block or a card to find the other.
3
What the ETM actually emits
One bit per branch, the address only when it is new. The decoder rebuilds the rest from the ELF.
ChipTrace turns on:ContextIDVMIDtimestampscycle countingbranch broadcasting
| Packet | What it tells the decoder |
|---|---|
| Sync | Where to start decoding, even in the middle of a buffer. every 4 KB |
| Atom E / N | Branch taken or not: one bit per branch, most of the compression. |
| Address | Where a taken branch went. Almost always one byte, “an address already sent” (exact match), without the address; the address itself only when it is new, at a sync or a first jump. |
| Data | The address and value of each load and store, in a range you choose. Cortex-R52, Cortex-M7 |
| Exception / Context | An interrupt taken, a process (ContextID) or a guest (VMID) switched in. |
| Timestamp / Cycles | One clock across cores (TSG), and cycle-level timing between branches. |
Why the decoder needs the ELF
The instructions between two branches are never traced: TRACE32 or ChipTraceAnalyzer reads them in the ELF. So decode with the exact binary that ran: a rebuild diverges silently.
4
Where the trace goes
On the chip, in a circular buffer: no trace port, no probe.
ETFdefault sink
SRAM inside the chip: 32 KB on NG-Ultra, 16 KB per ETF on S32G3.
Works before the DDR is up. The firmware reads it back after the stop.
ETRsupported
A buffer in system memory: 4 KB, or 8 KB in scatter-gather, in the examples.
A longer history, once that memory is up.
TPIUnot used
Streams the trace off-chip, to a probe on a trace connector.
ChipTrace needs neither.
What is left in the buffer when the system stops
t1 capture startexecution history →stop event
overwritten as the write pointer wraps
last N KB before stop
The buffer never fills up: the oldest trace is overwritten. When the firmware stops the capture (fault, end of test, trigger), what remains is the last moments before the stop: what a post-mortem needs.
How long that is depends on how often the code branches: measure it on your own workload. A gap in the trace (an ETM overflow) is flagged at decode.
5
Multi-core: correlation and context
Every core on one clock: who did what, and in which order.
identify the corerebuild the orderfollow the interactionsspot the races
| # | Time | Core | Instruction | Function |
|---|---|---|---|---|
| 1 | ≈ 0.040 µs | C0 | LDR r0, [r4] | update_count+0x08 |
| 2 | ≈ 0.080 µs | C2 | CMP r2, #0 | poll_can+0x1C |
| 3 | ≈ 0.120 µs | C1 | STR r3, [r4] | reset_count+0x0C |
| 4 | ≈ 0.200 µs | C0 | STR r0, [r4] | update_count+0x10 |
| 5 | 0.260 µs | C3 | BL log_event | idle_task+0x24 |
④ C0 writes back the value it read at ①: C1's reset at ③ is lost. One clock for all the cores puts ③ between ① and ④.With data trace on (Cortex-R52, Cortex-M7), each LDR and STR comes with its address and value: C0 is seen writing back the old count. Without it, the decoder rebuilds them from the ELF between two traced branches, at the time of the nearest branch (≈).
6
Non-intrusive execution
Observe execution without stopping the processor.
Intrusive debug
CPU
STOP
Debugger
Stops the application
May miss the real cause
ChipTrace® (non-intrusive)
CPU
ETM ×N
Trace buffer
CPU continues running
Captures real execution history
The ETM never stops the core. If it cannot keep up, it drops trace and marks the gap (an overflow packet), flagged at decode.
7
How ChipTrace works, end to end
ChipTrace's code runs only before and after the capture: in between, the hardware records alone.
- 1BootfirmwareChipTrace programs the CoreSight blocks once, at boot.
- 2Runhardware onlyYour application runs at full speed: no ChipTrace code, no interrupt, no polling. The ETMs record into a circular buffer.
- 3Stop & savefirmwareOn a fault or a trigger, the buffer is frozen and saved to non-volatile memory: it survives a reset.
- 4Read backanytime laterOver Ethernet or JTAG. No probe on the board.
- 5DecodehostTRACE32 or ChipTraceAnalyzer rebuilds each core's path with the ELF, and the data values where data trace is on: how it reached the fault, without reproducing it.
MOVE.B training
Learn the trace ChipTrace relies on
The CoreSight units ChipTrace programs, the cores it traces and the SoCs it runs on, each one a MOVE.B course.