Back

ETM

Loading views...
← PreviousNext →

ETM

Category: Debug/Programming

Overview

ETM (Embedded Trace Macrocell) is an ARM CoreSight component providing full non-invasive instruction-level trace at full processor speed. It captures every executed instruction, branch target, and optionally data — enabling post-mortem fault analysis, code coverage, and performance profiling without any code modification.

1. Theory & Fundamentals

  • Part of ARM CoreSight debug architecture
  • Available on Cortex-M3/M4/M7/M33/A-series
  • Captures: All instructions, branches, exceptions, optionally data
  • Non-invasive: Zero runtime overhead, no code change needed
  • Output: Via TPIU to external trace hardware, or ETB (on-chip buffer)
  • ETMv4: Current version on M33/A53+
  • Bandwidth: Parallel trace port 4-bit @ 200 MHz = 100 MB/s

2. Frame / Packet Structure

ETM trace packets (compressed, self-describing):
  Branch packet: New PC after branch
  Range packet: Sequential instruction range
  Context packet: VMID/ASID for MMU systems
  Timestamp: Periodic reference points
  Exception: Entry/exit events

Packet format: Variable-length, header byte indicates type
Decoded using ELF binary + trace stream
by debug tool (Ozone, TRACE32, OpenCSD)

3. Protocol Mechanics

  • ETM configured via CoreSight memory-mapped registers
  • Trigger: Start/stop trace on address match or events
  • Filtering: Trace specific address ranges or privilege levels
  • FIFO: Feeds TPIU; overflow = trace corrupted (overflow marker emitted)
  • ETB: On-chip ~4KB trace buffer, read via JTAG post-execution
  • Security: ETM can be disabled in production silicon

4. Hardware Implementation

  • Trace hardware: SEGGER J-Trace Pro, Lauterbach TRACE32, ULINKpro
  • Parallel trace: TRACEDATA[0:3] + TRACECLK on 20-pin connector
  • SWO (1-bit trace): Lower bandwidth (~4 Mbps) via SWD connector
  • PCB: Length-matched TRACEDATA traces; 20-pin Cortex Debug+ETM
  • ETB: No external hardware; read after halt

5. Register-Level / Configuration

// Enable ETM (usually done by debug tool, shown for reference)
// ETM base: Cortex-M4 = 0xE0041000
#define ETM_LAR  0xE0041FB0  // Lock Access
#define ETM_CR   0xE0041000  // Control

*(uint32_t*)ETM_LAR = 0xC5ACCE55; // Unlock
CoreDEBUG->DEMCR |= CoreDebug_DEMCR_TRCENA_Msk;
// Enable via debugger tool; not normally in application code
// Debug tool configures ETM registers before target runs

6. Driver / Software Development

  • ETM configured by debug tool, not application firmware
  • Application compiled with -g (debug symbols, no -O2 for readable trace)
  • Trace decode: Debug tool reconstructs from trace stream + ELF
  • Streaming trace: J-Trace streams to PC in real-time
  • OpenCSD: Open-source CoreSight trace decoder library

7. Debugging & Testing

  • J-Trace + SEGGER Ozone: Instruction trace, code coverage, profiling
  • Lauterbach TRACE32: Cycle-accurate, data trace, most powerful
  • Common issues: Trace FIFO overflow; insufficient trace bandwidth; SWO rate limit
  • Verify TRACEDATA pins not shared with GPIO functions
  • ETB capture: Small buffer; use trigger to capture fault region

8. Real-World Applications

  1. Hard fault root-cause (trace execution leading to fault)
  2. Safety code coverage (IEC 62443, DO-178C)
  3. Performance profiling without instrumentation
  4. Security research / firmware reverse engineering
  5. RTOS context switch analysis

9. Advanced Topics & Edge Cases

  • Data trace: Record memory read/write values (very high bandwidth)
  • Cycle-accurate: Timestamps with cycle counter
  • CoreSight system: Multiple ETMs → funnel → TPIU
  • IJTAG: Internal access to ETM via JTAG (IEEE 1687)
  • ETM security: Disable in production, password-enable for authorized debug

10. Standards & Variants

Component Function
ETM Instruction trace
PTM Program trace (older M3/M4)
ETB On-chip trace buffer
TPIU Trace port to external
ITM Software printf trace
DWT Data watchpoint & trace

💡 Practical Examples

Ex 1: Hard fault trace — Enable ETM, run until fault, replay trace in Ozone to see exact instruction sequence.

Ex 2: Code coverage — Run test suite with J-Trace, Ozone shows heat map on source.

Ex 3: Performance profiling — ETM trace → analyze hot functions, no printf overhead.

🧪 Practice Questions

Beginner: 1) ETM vs printf debug? 2) Hardware needed? 3) SWO vs parallel trace? 4) What is an ETB? 5) Runtime overhead?

Intermediate: 1) ETM packet encoding. 2) Enable in J-Trace/Ozone. 3) Overflow prevention. 4) Find hard fault cause. 5) Bandwidth at 200 MHz M4?

Advanced: 1) Decode ETM stream with OpenCSD. 2) Trigger on address range. 3) Code coverage for safety cert. 4) ETM vs instrumentation. 5) ETM security in production.

Checklist

  • [ ] Understand ETM CoreSight architecture
  • [ ] Set up J-Trace or TRACE32
  • [ ] Connect parallel trace port or SWO
  • [ ] Configure trace in debug tool
  • [ ] Capture and decode instruction trace
  • [ ] Use ETM for hard fault analysis
  • [ ] Generate code coverage report
  • [ ] Profile performance without instrumentation
  • [ ] Handle FIFO overflow
  • [ ] Understand ETM security controls
← PreviousNext →