trace32仿真器使用教程+

Application Note for iAMP Debugging Release 09.2023TRACE32 Online HelpTRACE32 DirectoryTRACE32 IndexTRACE32 Documents ...................................................................................................................... Multicore Debugging ..................................................................................................................... Application Note for iAMP Debugging . (1)SMP, iAMP or AMP? (3)iAMP Setup (7)Example iAMP Setup10Version 09-Oct-2023 11-Nov-2021New manual.SMP, iAMP or AMP?TRACE32 offers various configuration possibilities for debugging multi-core target systems. This chapter explains the basic differences between:•SMP (Symmetrical MultiProcessig)•iAMP (integrated Asymmetrical MultiProcessing)•AMP (Asymmetrical MultiProcessig)This application note focuses on iAMP. It gives you a basic overview of the iAMP concept and helps you to choose the right configuration for your setup. For further details about iAMP and the commands used here, you can also see the “General Reference Guide” (general_ref_<x>.pdf) or contact**********************.If you want to create a new TRACE32 setup for any multicore system, one of the very first decisions you have to make is “AMP or SMP or iAMP?”. In some cases, only one of the possibilities is supported by TRACE32, for example: if you have several cores of different architectures (like one Arm core, one Xtensa core and one RISC-V core), then AMP is the only possible option. But in many cases, you have a choice.Let’s first take a look at the key properties of the three concepts:•All cores have the same instruction set.•All cores use the same instance of an OS (when not bare-metal and unless you are using a hypervisor (“Hypervisor Debugging User Guide” (hypervisor_user.pdf)).•All cores use the same memory model and same address translations (unless you are using a hypervisor).•All cores share the same physical and logical address space.•All cores share the same debug symbols (typically the same elf file).•All cores are debugged from a single TRACE32 PowerView instance. Y ou can have up to 1024cores.•TRACE32 starts and stops all cores simultaneously (even though you can temporarily single out one core for independent start/stop).iAMP (integrated asymmetrical multiprocessing):•All cores have the same instruction set.•There are typically multiple OS instances (if not bare metal).•There is just one global physical address space but each OS maintains its own set of virtual address spaces.•All cores are debugged from a single TRACE32 PowerView GUI. The number of cores is limited just by the core architecture used and can be very high.•TRACE32 allows to group cores logically into machines; this grouping depends on the logical structure of the system under debug - each machine consists of one or more cores. Up to30machines are possible.•Each machine has its own OS instance (if not bare metal).•Each machine has its own memory model, address translations and debug symbols.•TRACE32 starts and stops all cores simultaneously (even though you can temporarily single out one core for independent start/stop).•AMP can bundle single cores, as well as SMP and iAMP subsystems.•Mixing of different core architectures with different instruction sets is possible.•Each core/subsystem has its own TRACE32 PowerView GUI.•Each core/subsystem has its own (different) memory models, address translations, elf files and debug symbols.•Each core/subsystem can have its own physical address space.•Each core/subsystem has its own logical address spaces.•Each core/subsystem starts and stops independently but can also be synchronized.•AMP is limited to 16 TRACE32 PowerView GUIs.An example of an AMP system that bundles single cores, an SMP and an iAMP subsystem can be found on page10.The most important questions for the decision are:•Do all my cores use the same instruction set?If not, it is definitely AMP.•Do all my cores of the same instruction set run a single instance of OS?If yes, these cores form an SMP (sub)system.•Are there SMP subsystems and single cores of the same instruction set? Does it make sense to configure them as an iAMP system and debug them from a single TRACE32PowerView instance?Y es, if they are all using a global physical address space.Y es, if they logically belong together; that means they work together or in parallel on the same tasks.Y es, if you want or need to reduce the number of TRACE32 PowerView instances.The following table provides a systematic overview:SMP AMP iAMP Homogeneous cores (cores of the same instruction set)✓✓✓Heterogeneous cores✓Single TRACE32 instance/GUI✓✓Multiple TRACE32 instances/GUIs 16Hypervisor with statically assigned guests (core identity)✓✓✓Hypervisor with dynamic core assignment (core sharing)✓SMP OS (a single OS managing multiple cores)✓Multiple OSes without hypervisor✓Synchronous run✓✓✓Asynchronous run✓iAMP is available for selected core architectures like Arm, Hexagon and T riCore. If you need iAMP and your platform does not support it yet, please contact your local Lauterbach representative or**********************.Some of the decision criteria are easy to evaluate (like more than 16 CPUs) but some of them are quite fuzzy - talking to Lauterbach representative or Lauterbach support might help you with the decision.iAMP SetupThe basis for an iAMP system is that cores are grouped into machines.The SYStem.Option.MACHINESPACES ON command creates the basis for this.All cores that use the same instance of an OS (when not bare-metal) can be grouped and assigned to a machine by the TASK.Create.MACHINE command.Example :This will create two machines, each of them with two cores. Their setup can be then displayed using the commandTASK.List.MACHINES :The columns name and cores in the screenshot are self-explaining, ‘mid’ displays the machine ID, other columns are not relevant for our example.It may be necessary to use the CORE.ASSIGN command beforehand to assign the physical cores to the logical cores of the iAMP system.Use the command CORE.select <logical_core> to switch to the core of interest and the TRACE32PowerView GUI will display the system information from the perspective of the selected core. T o understand how this works, think that “the machine is never selected directly but always follows selected core”.By default, all cores are started and stopped simultaneously , but you can single out a single core for independent start/stop by using the CORE.SINGLE <logical_core> command.The CORE.select command without an argument can be used to reverse this selection after the core is stopped.It is imperative to ensure that the symbols loaded by any of the Data.LOAD.* commands will be added to the right machine space. When loading executables and symbol information, the safest way is to explicitly select the core to which the executable belongs – it then explicitly defines both the core and machine. One of the reasons is that registers like PC might be pre-initialized during Data.LOAD so by selecting the correct core it becomes clear where the register(s) are to be set:TASK.Create.MACHINE , 0. "main0" /CORE 0. 1.TASK.Create.MACHINE , 1. "main1" /CORE 2. 3.CORE.select 0.Data.LOAD.Elf application_subsystem0.elf CORE.select 2.Data.LOAD.Elf application_subsystem1.elf /NoClearOn the other hand, when you load only symbol information and no register content, it is sufficient to specify only the machine; knowledge of the specific core is not required. T o specify only the machine, use theloading offset parameter to Data.LOAD.* where this offset contains the machine number. In most cases you use zero as offset (unless you need to shift the data to another base address).Loading symbols using the machine ID makes them machine aware as can be seen in the image below.The machine name can be explicitly specified in a symbol name using triple-backslash (“\\\”) syntax.Example :This command will show the source of the symbol start from the module Global on the machine named main1.The general format for symbol names becomes:[\\\<machine_name>]\\[<program_name>]\[<module_name>]\<symbol_name>Both <program_name> and <module_name> may be omitted if there is no ambiguity with another symbol but the appropriate backslashes must remain to indicate where they were, for example:\\\<machine_name>\\\<symbol_name>So, our example of \\\main1\\Global\start now becomes \\\main1\\\\startWhen you activate the iAMP mode, the behavior of many commands changes. The commands now also consider the correct machine scope, for example:Data.LOAD.Elf application_subsystem0.elf 0x0:::0 /NoCODE /NoRegData.LOAD.Elf application_subsystem1.elf 0x1:::0 /NoClear /NoCODE /NoRegNOTE:This concept is extended to allow you to access a logical address on any machine and works like this:[<access_class>:][<machine_id>:::]<address_offset> Example:P:1:::0x1234000 means program address P:0x1234000 on machine 1.R:0:::0x81021864 means AArch32 Arm code at address R:0x81021864 on machine 0.List.Asm \\\main1\\\Global\startNormally, MMU.DUMP.TLB shows the only TLB in the system (where available). With iAMP, the contents displayed by MMU.DUMP.TLB will update after every change of machine and always show the TLB of the currently selected machine.The program counter is now shown everywhere with the machine number included - like in this CORE.List window:The machine number is also included in many other outputs and windows, almost everywhere where you see an address. The screenshot below shows the sYmbol.List.SECtion window. It can be seen that sections from all machines and all addresses include the machine number.Example iAMP SetupAssume the following system, based on a TDA4VM chip from T exas Instruments:•Four Cortex-R5 cores, grouped in two core pairs, called “main0” and “main1”. These four cores form our example iAMP system.Each core pair has its own symbols and ELF file (app_ddr.elf and app_sram.elf ).Both core pairs use logical memory but have their own translations.•In addition to that, there is also a Cortex-M3 core (“master”), Cortex-R5 (“mcu”) based SMP subsystem and a TI C71x (“dsp”) on the chip, which all need to be debugged as well.Four TRACE32 PowerView GUIs are needed to debug this AMP system:1.GUI to control the Cortex-R5 based iAMP subsystem 2.GUI to control a single Cortex-M33.GUI to control the Cortex-R5 based SMP subsystem4.GUI to control a single C71x DSPTRACE32 PowerDebugDebug Port®iAMP main0 + main1Cortex-M3masterSMP 2x Cortex-R5mcuC71x dspApplication Note for iAMP Debugging | 11©1989-2023 L auterbach So, let's focus on the iAMP subsystem - we want to preload all elf files, execute all startups immediately after loading, and then start the execution of all cores/machines from the symbol main simultaneously. For this setup, the following script can be used:The other subsystems of SoC are initialized as usual with their own scripts.The structure of the whole system can be then displayed via the command TargetSystem ALL .sYmbol.RESetSYStem.Option.MACHINESPACES ONTASK.CREATE.MACHINE , 0. "main0" /CORE 0. 1.TASK.CREATE.MACHINE , 1. "main1" /CORE 2. 3.CORE.select 0.Data.LOAD.Elf app_ddr.elfCORE.select 2.Data.LOAD.Elf app_ram.elf /NoClearCORE.SINGLE 0. ; enter single core execution mode Go mainWAIT !STATE.RUN()CORE.SINGLE 2. ; enter single core execution mode Go mainWAIT !STATE.RUN()CORE.select 0. ; leaving single core execution mode PRINT "Now we are ready to debug from main"。

Integration for X-T ools and X32 Release 09.2023TRACE32 Online HelpTRACE32 DirectoryTRACE32 IndexTRACE32 Documents ......................................................................................................................3rd-Party Tool Integrations ..........................................................................................................Integration for X-Tools and X32 (1)Overview (3)Brief Overview of Documents for New Users (3)Operation Theory (4)Installation (4)Startup Sequence (5)Menu Commands (6)Set Breakpoint Set breakpoint on current line6 Delete Breakpoint Delete breakpoint on current line6 List of all Breakpoints Lists the breakpoints6 Go Continue application6 Break Stop application6 Go until Cursor Continue application until this line7 Step Over Step over function call7 Step Into Step into function call7 Watch Variable Add variable to watch window7Working with the X-TOOLS extensions (8)Known Problems (9)Version 10-Oct-2023 OverviewThis interface integrates the X-TOOLS / X32 tool series (blue river software GmbH) and TRACE32. Current supported versions are:X-TOOLS Version 4.03X32 Version 2.0Hosts: Windows95, Windows NTIn the further description, both X-TOOLS Classic and X32 are referred to as X-TOOLS.Brief Overview of Documents for New UsersArchitecture-independent information:•“Training Basic Debugging” (training_debugger.pdf): Get familiar with the basic features of a TRACE32 debugger.•“T32Start” (app_t32start.pdf): T32Start assists you in starting TRACE32 PowerView instances for different configurations of the debugger. T32Start is only available for Windows.•“General Commands” (general_ref_<x>.pdf): Alphabetic list of debug commands.Architecture-specific information:•“Processor Architecture Manuals”: These manuals describe commands that are specific for the processor architecture supported by your debug cable. T o access the manual for your processorarchitecture, proceed as follows:-Choose Help menu > Processor Architecture Manual.•“OS Awareness Manuals” (rtos_<os>.pdf): TRACE32 PowerView can be extended for operating system-aware debugging. The appropriate OS Awareness manual informs you how to enable theOS-aware debugging.Operation TheoryX-TOOLS provides an additional menu, which allows to control TRACE32 main features via X-TOOLS. T o access these menu items, you have to install an helper application ("WxT32.exe") that manages thecommunication between X-TOOLS and TRACE32. X-TOOLS passes all requests via DDE messages to the helper application. This application converts the requests and sends them to the TRACE32 display driver via sockets (important: WINSOCK has to be installed!). The display driver transports the requests to theTRACE32. The answer goes exactly the same way backwards.X-TOOLS --> WxT32 --> t32 --> TRACE32NOTE:This integration uses internally the TRACE32 Remote API.The Remote API has restrictions if TRACE32 runs in demo mode.Please see there for further details.InstallationFollow these steps to install the X-TOOLS extension for TRACE32:1.Copy the file "~~/demo/env/xtools/wxt32.exe" to your X-TOOLS directory.2.Edit your "config.t32" file: Add between two empty lines the following statements, if not alreadythere:RCL=NETASSISTPACKLEN=1024No "PORT=" line should follow. The port defaults to 20000, and this is the only one currentlyusable.3.Start X-TOOLS, select menu Extras->Tools…Press the “Add” button and choose “WxT32.exe”.Press “OK”.4.If you like, you can add the startup call for your TRACE32 debugger to the “Tools” menu.Startup SequenceFor the first try on the X-TOOLS integration, follow the steps below. If you once got experienced, you can customize your own startup sequence, e.g. starting the WxT32 only, when it is needed.1.Switch on power on TRACE32 and your target.2.Start the TRACE32 debugger.3.Change the directory inside TRACE32 to your application.4.Setup TRACE32 and load your application.5.Start X-TOOLS. If you followed the installation steps above, the “Tools” menu should contain anitem called “WxT32”.6.Start WxT32 by choosing this menu item. WxT32 will automatically establish a DDE connectionto X-TOOLS and connect to the TRACE32 debugger. X-TOOLS then loads the current source fileand places the cursor to the line that represents the current program counter address.7.After the application came up, try "Step", “Go” etc.Menu CommandsX-TOOLS provides a menu (“Debugger”) to control TRACE32. The functionality of these menu items are described in the online help of X-TOOLS. Please see there for details. This chapter contains additional information for each menu item.Set Breakpoint Set breakpoint on current line Equivalent debugger command: Break.SetSets a program breakpoint on the line currently marked by the cursor.Delete Breakpoint Delete breakpoint on current line Equivalent debugger command: Break.DeleteDeletes the program breakpoint on the line currently marked by the cursor.List of all Breakpoints Lists the breakpoints No actions on TRACE32 performed.X-TOOLS lists all breakpoints known by itself.Go Continue application Equivalent debugger command: Go.directThis command starts the application. The helper application watches the state of TRACE32 and informs X-TOOLS of an eventual break (e.g. due to a breakpoint).Break Stop application Equivalent debugger command: Break.directThis command stops the application.Go until Cursor Continue application until this line Equivalent debugger command: Go.TillA temporary program breakpoint is set on the marked HLL line and the application is continued. As soon asa breakpoint is hit (either the temporary breakpoint or another set breakpoint), the application is stopped,and the temporary breakpoint is deleted.Step Over Step over function call Equivalent debugger command: Step.OverPerforms an HLL single step. If a function is called, the emulation will stop when the function returned to the caller.Step Into Step into function call Equivalent debugger command: Step.HllPerforms an HLL single step. If a function is called, the emulation will stop at the beginning of this function. Watch Variable Add variable to watch window Equivalent debugger command: Var.ViewAdds the variable marked or selected by the cursor to the watch window inside the TRACE32 display. A view window is created for each variable to watch.Working with the X-TOOLS extensionsY ou have to keep some things in mind, when working with the integration. It is not dangerous to use both - X-TOOLS Extension and TRACE32 debugger - to control the emulator. However in some cases the editor gets confused.X-TOOLS tracks the program counter when single stepping or breaking through its menu. It does notrecognize any action done in the TRACE32 debugger. That means, if you perform steps in TRACE32, X-TOOLS will show you the wrong program line. But that is harmless, because performing the next “Step Into”inside X-TOOLS will get you back to the right line.The WxT32 integration tool has its own breakpoint management. Breakpoints that should be displayed in X-TOOLS, MUST be set in X-TOOLS and MUST be deleted in X-TOOLS. X-TOOLS will not show breakpoints set in the TRACE32 debugger. We strongly recommend to use EITHER the X-TOOLS extensions forbreakpoints OR the breakpoint commands in the display driver BUT NOT both mixed together.Known Problems- Multiple HLL breakpoints on single ASM linesThe breakpoint management inside WxT32 works on HLL lines, while the breakpoint system insideTRACE32 works on hardware addresses. If you set two breakpoints on different HLL lines, which represent the same hardware address (e.g. comments), X-TOOLS will have two breakpoints, while TRACE32 will have one. Deleting one of the HLL breakpoints will delete the hardware breakpoint. That means, in X-TOOLS there is one breakpoint remaining, while TRACE32 has no breakpoint left.Workaround: Set breakpoints only on code lines. When detecting multiple breakpoints on a single address, delete all that breakpoints.。

如何用trace32调试native和kernel异常---------- for Android System Debug众所周知gdb功能强大，但相对于gdb的指令式调试，trace32的图形界面要更方便易上手，而且不用查记那些繁复的指令，虽然效率上不及gdb，但对于新手而言，使用trace32要比gdb 快捷。

下面就介绍如何使用trace32加载symbol文件。

1.启动trace32默认安装好trace32后，在开始菜单中选择“Trace32 Simulator for ARM”，如图1图12.启动模拟器在CPU菜单中选择“System Settings…”，如图2，图2在弹出窗口中的CPU框选择对应的CPU，如图3，对于MT6589平台选择CortexA9MPCore，图3然后点击UP即可启动模拟器，右下角会显示“system ready”，如图4。

图43.加载symbol文件加载的指令为“data.load.elf <symbol路径> <加载地址> /gnu /noclear /nocode”，symbol 文件可以是boot、lk等的elf文件，kernel的vmlinux，native so的symbol库；加载地址是可选项，可从PROCESS_MAP获取，也可从问题log获取。

加载完成后点击工具条上的蓝色感叹号就会显示出该symbol文件所对应的symbol，如图5，双击symbol符号可进入该symbol的具体内容。

图54.设置资源路径symbol文件加载完了，但对应的内容是十分难读的汇编语言，如图6，图6不过不用担心trace32支持symbol与code映射，可以将symbol与代码对应起来，在图6界面滑动鼠标滚轮，在命令框下方会提示该段symbol所对应的文件，如图7，图7将与symbol文件对应的同一版本的代码放到提示的路径下，在View菜单选择“Symbols”-> “Source Search Paths”，如图8，图8在弹出的对话框中点击“Add Dir…”按钮将路径设置到代码路径，然后点击“Reload”按钮，如图9，图9回到刚才symbol 界面，汇编语言就变成对应的代码了，如图10，图10点击 “Mode ” 按钮可切换到纯代码模式，如图11。

trace32的使⽤培训TRACE32 Online HelpTRACE32 DirectoryTRACE32 IndexTRACE32 Documents ......................................................................................................................! ICD In-Circuit Debugger ................................................................................................................! ICD Quick Installation and Tutorial ...........................................................................................! ICD Tutorial (1)Tutorial (3)About the Tutorial3 Start TRACE32-ICD4 Setup the Application Properties6 The Online Help7 Setup the Debug Environment10 Batch Jobs13 The User Interface15 How to Display and Modify CPU Registers18 How to Display and Modify the Special Function Registers20 How to Display and Modify Memory21 How to Debug the Program25 How to Set Breakpoints34 Software Breakpoints34 Breakpoints in ROM, Flash, EEPROM38 Breakpoints on Data Accesses39 Onchip Breakpoints (Overview)41 Display and Modify HLL Variables43 Format HLL-Variables45 Exit TRACE3248Version July, 26 2004TutorialAbout the TutorialWhat is it about?This is a tutorial for all In-Circuit Debuggers (TRACE32-ICD), that are implemented using their onchip debug interface. T ypical examples for onchip debug interfaces are BDM, JT AG, ONCE …Preconditions:The tutorial assumes that the development system is already installed. Y ou should have basic knowledge of the C-programming language in order to be able to follow the example code found in this tutorial. In addition working with WINDOWS is assumed as known. Also some knowledge of the used processor andassembler/compiler is necessary to get your debug system running.Purpose of this tutorial:The purpose of this tutorial is to get your debug system running, to write the batch job that does the necessary startup procedure and to make you familiar with the main features of the In-Circuit Debugger.How to use this tutorial:The tutorial contains a guided debug session. It uses a simple C-program example to show you the most important debug features. Y ou should perform a number of exercises as you read this tutorial. Werecommend to go completely through all chapters, since besides the tour (written in normal text format) there are very helpful remarks (written in italics) which will not be repeated in other chapters.Where can I get more information:The common TRACE32 user interface contains a detailed Online-Help, that offers the most currentdescription of all debug features. Refer to The Online Help on how to start the Online Help system.How long does it take?60 minutes.Start TRACE32-ICDIf your debug tools are installed in accordance to Quick Installation for TRACE32-ICD, power up your debug system first and then the target.T o start the debugger software on your host open the TRACE32 folder in the start menu and start theTRACE32 user interface. If you have generated an icon on your desktop, double click there. In the example below the software for two processor families (PowerPC and 68HC12) is installed.Setup the Application PropertiesThe property window of your application allows some basic settings for the debugger.1.Definition of a user specific configuration file.By default the configuration file config.t32 in the system directory is used. The option -c allowsyou to define your own location and name for the configuration file. For more information on theconfiguration file refer to Quick Installation forTRACE32-ICD2. Definition of a working directory.It is recommended not to work in the system directory.3. Definition of the start-up size of the application window.123The Online HelpThe most current version of the TRACE32 books is available in the online help. Y ou can get access to the TRACE32 online help using:the Help Topics button in the toolbarthe Help Contents entry in the menu barenter “HELP” in the command linetoolbar command linehelp menuThe online help provides also a powerful context sensitive help .Click first on the Help Context button and then move the quotation mark cursor on the object you are interested in. A popup window is opened to display information about this object.Use the Help Context button on the tool barto activate the context sensitive helpThe About TRACE32… command in the Help menu provides version information for all parts of TRACE32-ICD.Setup the Debug EnvironmentIn order to set-up your debugger, you need some knowledge about your CPU and about your target configuration. T o be able to download your program including all symbol and debug information you also need some knowledge about your compiler.A basic start-up procedure and the CPU specific setting for the ICD-Debuggers are described in the ICD Target Manual .Look at the Reference ICE/FIRE/ICD book for a detailed description of all generic commands.A typical start-up procedure consists of:ICD Target Manual gives quick accessto the settings and additional features for your CPU1.The CPU specific settings.The SYStem Window provides all CPU specific settings. Use System Settings… in the CPU menu to open this window.Inform the debugger about the CPU type on your target, if an automatic detection of the CPU is not possible. Select the correct CPU type from the pull down menu in the field CPU.(Command: SYStem.CPU )Set the system options in the option field corresponding to your target configuration and application program. (Command: SYStem.OptionOn some processor types the special function registers can be moved. The command(SYStem.Option BASE) is used to inform the debugger about the new base address (address of the first SFR). If the debugger does not have the correct base address no or wrong data will bedisplayed and FLASH programming might not be possible.Set the transfer clock from the debug interface to your target. By default TRACE32-ICD uses a fixed clock, generated by the Debug Module, to run the debug interface. A clock range from 100KHz up to5 MHz can be used.(Command: SYStem.BdmClock)We also provide a clock cable to allow you the use of the divided CPU clock as clock for the debug interface. The relation between the CPU clock and the debug interface clock is specific for your CPU.Refer to your ICD Target Manual for detailed information. The use of the divided CPU clock has the following advantages: The max. speed for the debug interface can be used. However we recommend 10MHz as the max.speed.The clock for the debug interface is automatically adapted if the CPU clock is changed by your appli-cation program.2. Enter the debug mode.Select the Up button in the Mode field to restart the CPU with debug mode enable.(Command: SYStem.Up)The user interface establishes the communication to the target′s microprocessor. After this command you should be able to access the registers.3. Do the target specific settings.The CPU is active now and you can initialize the CPU by writing to the special function registers using the Data.Set command. E. g. some CPUs need to set the chip selects in order to access memory. 4. Load your application.Load your application by using the commandData.LOAD.The option required for your compiler can be found in the ICD Target Manual in the sectionCompiler.If the file should be loaded to an EEPROM, the memory class EEPROM must be used to generate the required programming sequence. Example: d.load.b epromdata EEPROM:For flash programming refer to the FLASH command group in the Reference ICE/FIRE/ICD book.T o display the source code the compiled program must be equipped with debug information(frequently: compiler option “debug”). Then TRACE32 can load the compiler output formats directly.5. Initialize program counter and stackpointer: Register.SetMany compilers add these settings in the startup code to the user program automatically.It is recommended to write a batch job to set up the debugger to guarantee a proper start-up sequence.Batch JobsCreate a new batch file start.cmm in your working directory by using the command PEDIT start.cmm.TRACE32 has its own command language for batch jobs. It is called PRACTICE and it is very powerful (see the PRACTICE User’s Guide and PRACTICE Reference for more information). All commands of the TRACE32 development tools, commands for program flow, conditional commands and I/O commands are allowed. The default extension for batch files is “.cmm”.Also debugging of a PRACTICE program is supported. Look at the description in the PRACTICE User’s Guide and PRACTICE Reference (commands: PLIST, PEDIT, PBREAK).Enter the required commands, finish the batchjob by ENDDO and click the Save button. The picture above shows a startup procedure for the PowerPC505.Start the startup procedure by using Batchfile… in the File pulldown menu.T o continue our tour take one of the example files you can find in the TRACE32 system directory under \demo\\compiler\...e.g. \demo\powerpc\compiler\Diab\Diabc.cmm.or use your own batch file, if you have already prepared one.The User InterfaceRegister ButtonPulldown MenuCommand LineOpen a window to display the CPU registers. Y ou can alternatively select Registers from the View pulldown menu, push the Register button or enter Register.view at the prompt B:: in the command line.Most features can alternatively be selected from a pulldown menu, from a button in the main tool bar or from the command line. Please remember this even if we use just one way in the following chapters.The TRACE32 commands are not case sensitive. In the TRACE32 books we use upper case letters for the characters that are significant for the command entry. E.g. Register.view can be shortened by r . Another example which shows the typical TRACE32 command structure. is Data.List that can be shortened to d.l .A good hint is to look at the soft keys. They provide a guided command entry . All possible commands and parameters are displayed. Instead of writing to the command line you can assemble the correct command by clicking on the soft keys. Example: Assembly of the Data dump command by using the softkeys.More detailed information about the TRACE32 user interface can be found in the Operating System User’s Guide .In the window header the TRACE32 command that was executed to open the window is displayed.Soft KeysHow to Display and Modify CPU RegistersWe want to inspect the CPU registers now.T ry to change a register value by double-clicking on the value you want to change. The Register.Set command for the selected register is displayed in the command line. Y ou only have to enter the new value and confirm it with return (see right picture above).If the registers changed by the last steps should be marked in the Register window:1.Click to the window header with the right mouse button.The command, that was used to open the window is displayed in the command line for modification.The window header becomes red.2. Set the option /SpotLight and confirm the modification with return.3. Execute a few single steps.The registers changed by the last step are marked in dark red. The registers changed by the step before the last step are marked a little bit lighter etc. This works up to a level of 4 steps.function registers:If you select the register contents the address, bit position and complete name of the special function register is displayed in the state line.Y ou can modify the contents of a special function register:By pressing the right mouse button and selecting one of the predefined logical values from the pull-down menu.By a double-click to numeric values. A Data.Set command to change the register contents is dis-played in the command line. Enter the new value and confirm it with return.How to Display and Modify MemoryT o inspect an address range in the memory use the Data.dump window.。

1 前言Trace32 ICD ARM USB能实时DEBUG代码在手机中的运行情况，功能强大，但需要连接TRACE32硬件才能工作。

更重要的是，对于概率性死机的BUG，用Trace32 ICD ARM USB应该是很难找到问题，因为你不能确定手机什么时候crash。

其实TRACE32还有一个WIN32版本，用户只需要把手机crash时候的寄存器信息dump出来，就能在WIN32下定位到死在代码的那一行，非常类似于EMP 平台的CHKARM工具。

这就是本文将要描述的Trace32 Simulator for ARM工具。

2 安装WIN32版的TRACE32需要重新安装，安装文件和硬件版TRACE32是一样的，只是安装时候的选项不同，而且WIN32版的需要安装在不同的目录下（比如trace32-win32）。

z运行安装文件\trace32\bin\setup\setup.exe。

首先设置安装路径，注意不要和硬件版TRACE32安装在同一个目录下，请新建一个文件夹（比如trace32-win32）z选择【New Installation】，然后Nextz选择【Simulator】，这个是WIN32版TRACE32的选项（硬件版TRACE32是选择第2项，注意不要搞错了）z选择默认值，然后Nextz选择【SIM ARM7 ARM9 ARM10 ARM11】，和硬件版TRACE32一样z安装中，安装完毕后就可以使用了。

3 使用首先请确保你有保存当前手机软件的原始ARM文件。

手机死机时，按“#”键进入downloading模式。

z运行【QPST】→【Memory Debug】，制指定数据线端口z点击【Get Regions】显示将要dump的信息z点击【SaveTo】保存dump数据z创建保存dump数据的文件夹，建议放到Arm/ms/dump目录下z保存dump数据，这个过程花的时间比较长z保存完毕dump数据后，运行软件【Trace32 Simulator for ARM】首先把工作路径切换到\source\Arm\ms下z在命令行中输入do load_log，然后按回车z根据屏幕上的提示，选择【2. Call stack or memory compression log (.cmm file)】，然后按回车z根据屏幕上的提示，直接按回车z选中刚才dump出来的load.cmm文件并导入z导入load.cmm中……z完成load.cmm导入后，在命令行输入do load_rex_cor e 命令，并按回车z TRACE32定位到死机的代码行（高亮显示部分），和硬件版的TRACE32一样，可以查看当前变量值等有用的信息……分析，代码如下图所示。

Trace32-ICD使用说明作者：***日期：2008-8-11版本：V-1.0一、编写目的通过对该文档的阅读，能够掌握Trace32-ICD的软、硬件安装，使用Trace32-ICD进行flash擦除，程序下载，并熟悉在线调试。

二、T RACE32硬件的连接Trace32的硬件连接如下图所示：图2.1注意事项：电源打开/关闭时的正确顺序：打开：先调试器，再目标机。

关闭：先目标机，再调试器。

三、TRACE32软件的安装3.1 TRACE32-ICD软件包安装1、首先获取安装软件包，包括：Trace32安装包和USB Driver。

2、安装Trace软件包，运行..\ trace32\setup.bat批处理文件或..\trace32\bin\setup\setup.exe文件，系统自动安装，在安装过程中进行如下选择。

图 3.1 图3.2图3.3其他选项基本默认。

3.2 USB驱动安装正确连接Trace后，系统会自动提示发现硬件需要进行驱动。

此时选择驱动程序所在目录。

路径为..\ trace32\bin。

如图3.4所示。

图3.4四、Flash的擦除与下载程序由于手机在下载版本过程中死机或掉电造成手机无法正常启动，并且使用我们单位的ZXPST与QPST都无法进行版本下载，并且QXDM和ZXPST通过COM1接口也无法找到手机，于是无法下载。

在这种情况下我们可以使用Trace32-ICD进行Flash的擦除和程序下载。

4.1 设置环境CPU环境设置在SYStem窗口，SYStem窗口提供所有CPU特定的设置。

使用CPU菜单中的System Settings…打开SYStem窗口如图4.1所示。

需要配置主要包括CPU、时钟和UP加电，CPU选择ARM926EJ，时钟JtagClock选择Ttck，然后进行加电UP，如果连接一切都正常，设置这几项就可以了。

如图4.1所示：图4.1注意事项：如果UP不上出现如下错误emulation debug port fail，说明硬件连接不正确。

目录1．系统组成1．1硬件1．1.1主机1．1.2调试电缆1．1.3通过USB与PC连接1．1.4通过JTAG与目标连接1．1.5对PC硬件的要求1．1.6对目标板硬件的要求1．1.7加电1．2软件1．2.1驱动程序的安装2．PowerView调试界面的使用3．1 打开调试界面3．2 JTAG连接设置3．3 运行脚本文件3．4 观察/修改寄存器3．5 观察/修改存储器3．6 下载程序3．7 观察符号表3．8 打开程序列表窗口3．9 单步执行程序3．10 设置软件断点3．11 设置Onchip硬件断点3．12 设置数据观察断点3．13 全速运行程序3．14 停止运行程序3．15 观察变量3．16 观察堆栈3．17 在线Flash编程1．系统组成TRACE-ICP调试系统由硬件和软件两部分组成，硬件是自行研发的，软件是第三方的。

下面分成硬件和软件两部分来介绍。

1．1硬件TRACE-ICP的硬件设计采用模块化的结构，分为主机和调试电缆两部分。

1．1.1主机下面三张照片是TRACE-ICP主机的顶视图和前视图以及后视图。

图一、TRACE-ICP顶视图图二、TRACE-ICP前视图图三、TRACE-ICP后视图在图二中的连接器是标准DB25/M连接器，用于连接调试电缆。

在图三中，有两个连接器和一个LED指示灯。

左边的连接器是USB接口，用于通过USB电缆和PC连接。

右边的连接器是TRACE-ICP的外接5VDC电源接口。

TRACE-ICP可以通过USB供电，在USB供电不足的情况下，使用外接电源。

LED指示灯是TRACE-ICP的电源指示灯。

1．1.2调试电缆下图是TRACE-ICP的调试电缆的照片。

图四、TRACE-ICP的调试电缆TRACE-ICP的调试电缆有两个连接端，一个是标准的DB25/F连接器，用于和TRACE-ICP主机相连，另一个是针距为2.54毫米的标准IDC20连接器，用于和目标板连接。

T race T utorial Release 02.2023TRACE32 Online HelpTRACE32 DirectoryTRACE32 IndexTRACE32 Debugger Getting Started ..............................................................................................Trace Tutorial (1)History (3)About the Tutorial (3)What is Trace? (3)Trace Use Cases4Trace Methods (5)Simulator Demo (6)Trace Configuration (7)Trace Recording (8)Displaying the Trace Results (10)Trace List10 Displaying Function Run-Times13 Graphical Charts13 Numerical Statistics and Function Tree14 Duration Analysis15 Distance Analysis16 Variable Display17 Track Option18Searching Trace Results (19)Trace Save and Load (20)Version 10-Feb-2023 History18-Jun-21New manual.About the TutorialThis tutorial is an introduction to the trace functionality in TRACE32. It shows how to perform a tracerecording and how to display the recorded trace information.For simplicity, we use in this tutorial a TRACE32 Instruction Set Simulator, which offers a full tracesimulation. The steps and features described in this document are however valid for all TRACE32 products with trace support.The tutorial assumes that the TRACE32 software is already installed. Please refer to “TRACE32Installation Guide” (installation.pdf) for information about the installation process.Please refer to “ICD Tutorial” (icd_tutorial.pdf) for an introduction to debugging in TRACE32 PowerView. What is Trace?T race is the continuous recording of runtime information for later analysis. In this tutorial, we use the term trace synonymously with core trace. A core trace generates information about program execution on a core,i.e. program flow and data trace. The TRACE32 Instruction Set Simulator used in this tutorial supports a fulltrace simulation including the full program flow as well as all read and write data accesses to the memory. A real core may not support all types of trace information. Please refer to your Processor Architecture Manual for more information.Trace Use CasesT race is mainly used in the following cases:1.Understand the program execution in detail in order to find complex runtime errors more quickly.2.Analysis of the code performance of the target code3.Verification of real-time requirements4.Code-coverage measurementsTrace MethodsTRACE32 supports various trace methods. The trace method can be selected in the Trace configuration window, which can be opened from the menu Trace > Configuration…If a trace method is not supported by the current hardware/software setup, it is greyed out in the trace configuration window. NONE means that no trace method is selected.We use in this tutorial the trace method Analyzer. Please refer to the description of the commandTrace.METHOD for more information about the different trace methods.Simulator DemoWe use in this tutorial a TRACE32 Simulator for Arm. The described steps are however valid for the TRACE32 Simulator for other core architectures.T o load a demo on the simulator, follow these steps:1.Start the script search dialog from the menu File > Search for scripts…2.Enter in the search field “compiler demo”3.Select a demo from the list with a double click, a PSTEP window will appear. Press the“Continue” button.We will use here the demo “GNU C Example for SRAM”.Trace ConfigurationIn order to set up the trace, follow these steps:1.Open the menu Trace > Configuration… The trace method Analyzer [A] should be selected perdefault. If this is not the case, select this trace method2.Clear the contents of the trace buffer by pressing the Init button [B].3.Select the trace operation mode [C].In mode Fifo , new trace records will overwrite older records. The trace buffer includes thus always the last trace cycles before stopping the recording.In Mode Stack , the recording is stopped if the trace buffer is full. The trace buffer always includes in this case the first cycles after starting the recording.Mode Leash is similar to mode Stack , the program execution is however stopped when the trace buffer is nearly full.TRACE32 supports other trace modes. Some of these modes depend on the core architecture. Please refer to the documentation of the command Trace.Mode for more information. We will keep here the default trace mode selection, which is Fifo .4.The SIZE field [D] indicates the size of the trace buffer. As we are using a TRACE32 Simulator, the trace buffer is reserved by the TRACE32 PowerView application on the host. It is thuspossible to increase the size of this buffer. If a TRACE32 trace hardware is used with a real chip, the size of the trace buffer is limited by the size of the memory available on the trace tool.In order to have a longer trace recording, we will set the trace buffer size to 10000000.BACDThe same configuration steps can be performed using the following PRACTICE script:Trace RecordingPress the Go button to start the program execution.The trace recording is automatically started with the program execution. The state in the Trace window changes from OFF to Arm [A]. The used field displays the fill state of the trace buffer [B].In order to stop the trace recording, stop the program execution with the Break button. The state in the trace window changes to OFF .Trace.METHOD Analyzer Trace.InitTrace.Mode FifoTrace.SIZE 10000000.BACThe trace recording is automatically started and stopped when starting and stopping the program execution because of the AutoArm[C] setting in the Trace window, which is per default enabled. The trace recording can also be started/stopped manually while the program execution is running using the radio buttons Armand OFF of the Trace window [A].Displaying the Trace ResultsTRACE32 offers different view for displaying the trace results. This document shows some examples.Please note that the trace results can only be displayed if the trace state in the Trace window is OFF. It is not possible to display the trace results while recording.The caption of a TRACE32 window includes the TRACE32 command that can be executed in the TRACE32 command line or in a PRACTICE script to open this window, e.g. here Trace.ListTrace ListA list view of the trace results can be opened from the menu T race > List > Default. The same window canbe opened from the Trace configuration window by pressing the List button.The Trace.List window displays the recorded trace packets together with the corresponding assembler and source code.In our case, trace packets are program fetches (cycle fetch) or data accesses (e.g. wr-long and rd-long for 32bit write and read accesses). Each trace packet has a record number displayed in the record column. The record number is a negative index for Fifo mode.As we are using a Simulator, each assembly instruction has an own trace packet. This is not the case with a real hardware trace.The displayed information can be reduced using the Less button. By pressing Less three times, only the high-level source code is displayed. This can be reverted using the More button.A double click on a line with an assembly instruction or high-level source code opens a List window showing the corresponding line in the code.Using the TRACE32 menu Trace > List > Tracing with Source , you get a Trace.List and a List /Track window. When doing a simple click on a line in the Trace.List window, the List window will automaticallydisplay the corresponding code line.The timing information (see ti.back column) is generated in this case by the TRACE32 Instruction Set Simulator. With a real core trace, timestamps are either generated by the TRACE32 trace hardware or by the onchip trace module.Double clickSimpleclickDisplaying Function Run-TimesTRACE32 supports nested and flat function run-time analysis based on the trace results. Please refer to the video “Flat vs. Nesting Function Runtime Analysis” for an introduction to function run-time analysis inTRACE32:/tut_profiling.htmlGraphical ChartsBy selecting the menu Trace > Chart > Symbols, you can get a graphical chart that shows the distribution of program execution time at different symbols. The displayed results are based on a flat analysis:The corresponding nesting analysis can be displayed using the menu Perf > Function Runtime > Show as Timing.The In and Out buttons can be used to zoom in/out. Alternatively, you can select a position in the window and then use the mouse wheel to zoom in/out.Numerical Statistics and Function TreeThe menu entry Perf > Function Runtime >Show Numerical displays numerical statistics for each function with various information as total run-time, minimum, maximum and average run-times, ratio, and number of function calls.ABParents [A] displays for example a caller tree for the selected function. By doing a right mouse click on func1 and selecting Parents, we see the run-times of the functions func2 and func9, which have called func1 in thetrace recording.Children [B] displays the run-times of the functions called by the selected function, for example here the function subst called by the function encode.A function call tree view of all function recorded in the trace can be displayed using the menu entries Perf >Function Runtime > Show as Tree or Perf > Function Runtime > Show Detailed Tree.Duration AnalysisBy doing a right mouse click on a function in the numerical statistics window (Trace.STATistic.Func) then selecting Duration Analysis, you get an analysis of the function run-times between function entry and exit including the time spent in called subroutines, e.g. here for the function subst (P:0x114C corresponds to the start address of the subst function):The time interval can be changed using the Zoom buttons.Distance AnalysisBy doing a right mouse click on a function in the numerical statistics window (Trace.STATistic.Func) then selecting Distance Analysis, you can get run-times between two consecutive calls of the selected function,e.g. here for the function subst (P:0x114C corresponds to the start address of the subst function):Variable DisplayThe Trace.ListVar command allows to list recorded variables in the trace. If the command is used without parameters all recorded variables are displayed:Y ou can optionally add one or multiple variables as parameters.Example: display all accesses to the variables plot1 and plot2The Draw button can then be used to plot the displayed variables graphically against time. This corresponds to the following TRACE32 command:Please refer for more information about the Trace.DRAW command to “Application Note forTrace.DRAW” (app_trace_draw.pdf).Trace.ListVar Trace.ListVar %DEFault plot1 plot2Trace.DRAW.Var %DEFault plot1 plot2Track OptionThe /Track options allows to track windows that display the trace results. Y ou just need to add the /Track option after the command that opens a trace window, e.g.Trace.List /TrackThe cursor will then follow the movement in other trace windows, e.g. Trace.Chart.Func. Default is time tracking. If no time information is available, tracking to record number is performed.TRACE32 windows that displays the trace results graphically, e.g. Trace.Chart.Func, additionally accept the /ZoomTrack option. If the tracking is performed with another graphical window, the same zoom factor is used in this case.Trace.Chart.Func /ZoomTrackSearching Trace ResultsThe Find button allows to search for specific information in the trace results.Example 1: find the first call of function func21.Enter “func2” under address / expression2.Select Program under cycle3.Press the Find First button. The next entries to func2 in the trace can then be found using theNext buttonExample 2: Find all write accesses to the variable mstatic1 with the value 0x01.Enter “mstatic1” under address / expression2.Select Write under cycle3.Enter 0x0 under Data4.Press the Find All buttonPlease refer to “Application Note for Trace.Find” (app_trace_find.pdf) for more information about Trace.Find.Trace Save and LoadThe recorded trace can be stored in a file using the command Trace.SAVE , e.g.The saved file can then be loaded in TRACE32 PowerView using the command Trace.LOADThe TRACE32 trace display windows will show in this case a LOAD message in the low left cornerPlease note that TRACE32 additionally allows to export/import the trace results in different formats. Refer to the documentation of the command groups Trace.EXPORT and Trace.IMPORT for more information. Trace.SAVE file.adTrace.LOAD file.ad。