XDB Intel System Debugger 2015 Overview Training. Robert Mueller-Albrecht, TCE, SSG DPD ECDL

(1)

XDB – Intel® System Debugger 2015

Overview Training

(2)

Agenda

1) What is XDB?

2) Debugger startup and device/platform support

3) Debugger usage (Android* an Linux*)

4) System State Inspection

5) Instruction Trace

(3)

Optimization Notice

3 Key Features

• Linux* and Windows* host

• JTAG debug for Intel

®

_{Core™, Xeon}

®

_{& Quark SoC-based platforms}

• EFI/UEFI Firmware, bootloader debug, Linux

*

_{OS awareness}

• UEFI debugging, optionally with Agent module

• Dynamically loaded Linux kernel module debug

• JTAG system debug with event tracing (SVEN)

• Full CPU register description and bitfield editor

• Access to page translation and descriptor tables

• LBR, IPT On-Chip instruction trace support, SMP run control support

What is XDB? - Summary

(4)

4 Intel® System Debugger for the Internet of Things

Deep Insights into memory and system configuration

Fast issue resolution with low-level system debuggers

The only complete system debug solution for the Intel based Internet of Things

• JTAG based bootloader, OS and device driver debug

• Agent based UEFI debug

• In depth visualization of memory configuration, system state and register sets

• Common debugger front-end for all debug protocols

OpenOCD*

Dfx Abstraction Layer

Example: Galileo,

Intel® Quark SoC X1000

Example: Bayley Bay,

(5)

Optimization Notice

Intel® System Debugger and Intel® Quark SoC (1)

5 Supported Devices:

Intel® ITP-XDP3

Go to

https://designintools.intel.com/

, select the

Debug Tools

product

category and add

ITP-XDP BR3

to your cart.

TinCanTools* FLYSWATTER2

Go to

http://www.tincantools.com/wiki/Compiling_OpenOCD

Olimex* ARM-USB-OCD-H

(6)

Intel® System Debugger and Intel® Quark SoC (2)

Recommended setup for debugging with

OpenOCD*

• Host System

• USB 2.0 male-male A-B cable

• JTAG Probe

• ARM-JTAG-20-10 Adapter

• JTAG Port

• Intel® Galileo Board

• Serial Cable to view boot process

• Power Supply

(7)

Optimization Notice

7 Supported Formats & Software

Object File formats:

 ELF/DWARF from GCC/ICC Compilers

 PE/COFF+PDB from Microsoft Compilers

 Multiple simultaneous modules / mixed formats

Linux-specific Features:

 Auto-detect Kernel Module load/unload

 Kernel Data structure viewer

 Includes kernel threads, process list, process address space, and more.

EFI-specific Features:

 Load sources for PEI, DXE, and SMM modules (by address)

 Agent-based debugging without JTAG…

(8)

Supported Target Connection Methods

The debugger can connect via multiple methods:

Dfx Abstraction Layer API

for current Intel® Atom™ Processor, Intel® Quark SoC, Intel® Core™ Processors, Intel® Xeon™ Processors

Connect via conventional JTAG using ITP-XDP3 probe

Can be used concurrently with other Intel® ITPII clients

TCI API for older Intel® Atom™ Processors

Connect via conventional JTAG using ITP-XDP3 probe or Macraigor* usb2Demon*

OpenOCD* API for Intel® Quark SoC

Connect via conventional JTAG using low-cost JTAG probe (e.g. Olimex, Flyswatter)

Agent-based UEFI Debugger

Debug of UEFI firmware over USB/Serial using a target-side agent

Deployable on production hardware (no JTAG port)

Debug SEC/PEI/DXE with burned-in agent, or soft-load agent for post-shell work

(9)

Optimization Notice

Starting the Debugger

9 Step 1:

Open the folder where XDB was installed

Step 2:

Select a startup script and launch it,

“start_xdb_2015_products” or

“start_xdb_UEFI_agent” or

“start_xdb_legacy_products” or

“start_xdb_gdb_remote”

Step 3:

Connect to your target using the “Connect” button

(or Ctrl-R)

(10)

Intel® System Debugger Launcher

integrated into Eclipse* and Wind River* Workbench*

1. Define which debugger start-up to launch under “Launcher Options …”

2. Launch Debugger

(11)

Optimization Notice

Standard Debugger Features

11 Breakpoints

Program State

Multiple Source

Files

CPU Structures

Execution Trace

Syntax-highlights

And more!

Linux & EFI

Support

(12)

Initial Startup & overview

Assembly Window

Console Window

Displays status messages

(keep it open!)

Command-driven

operation also possible

Toolbars / Menus

Most functions available

from menus & buttons

Connect/Disconnect

(13)

Optimization Notice

Connecting To Targets

13 Step 2: Select your probe

Step 1: Click the

connect icon

Step 3: Select your target platform

Step 3a (optional): Enter advanced

connection parameters

(14)

Target Run Control

ASM step over

ASM step into

Run until caller

Step program until next source line

Restart target

Halt execution

Resume Execution

Step Over function call

Run Control

•Run/stop the CPU

•Step into, over, out

(15)

Optimization Notice

Multiple HW threads

15 The debugger can display how the multiple logical cores are used and

indicate which logical core is used by the current code displayed.

(16)

(17)

Optimization Notice

Loading the symbols

17 Browse to find the

identical binary file as

Loaded on the target.

Download = download into

Target RAM. Do not tick this if

You will debug SW already

on the target

(18)

How to find the sources

The debugger will try to find the source file

which matches the current instruction pointer.

If it cannot find the file it will ask you to do a

manual search.

(19)

Optimization Notice

Select source files to view

19 With the ‘Source Files’ icon you can open a

window which contains the source tree as found

in the binary file loaded in the debugger.

Just double click on any of the source

(20)

Evaluate symbols

Hover the cursor over a variable and the debugger will show you its value

(21)

Optimization Notice

Local variables

The example above shows part of the ‘rq’ structure

In expression field indicate that this is a compound element and that it has been

Expanded ( > for not expanded)

Local variable window will

display all variables which

are accessible from within

current scope

(22)

How did I reach the current location?

Source file:

line number

Current file

Function tree – bottom up

(23)

Optimization Notice

Create a breakpoint

23 Minimum - code location is required.

Hard option allows you to set a breakpoint

even if the memory location is not

accessible

For Watchpoints the location,

(24)

Debugging loadable modules

There is a Linux kernel module [xdbntf] provided with the debugger which you can

build and install – you then can load & debug Linux kernel modules and device drivers

(25)

Optimization Notice

Inspecting Android* & Linux* Kernel State

25 View all kernel thread with process id, current state, active flags, launch arguments

and call tree dependency.

(26)

What happened?

Inspecting System State

XDB presents state in a “Human Readable” format

Relationships: “show the nesting of structure members”

High-level decode: “show the names of bits in a register”

Context: “show the documentation for a register”

Program State:

Memory contents -> “Memory Window”

Program State -> “Locals Window / Eval Window”

CPU State:

General and Extended Registers

Page Tables

(27)

Optimization Notice

Overview of State Windows:

27 Execution Trace

Linux Kernel State

PCI Topology & Devices

Processor Structures

Page Tables

Callstack & HW Threads

Program Variables

(28)

Program State:

“Locals” Window

Program state for the

currently selected callstack

frame

Callstack Window

Show call stack for the currently

selected hardware thread

(29)

Optimization Notice

CPU State: Register Windows

29 GP Registers

CPU Registers

(30)

CPU State: Detailed Register View

Text Documentation

Bit-level Breakdown

(31)

Optimization Notice

What about paging?

31 Double click on a page table/directory

entry and You will have the ability to

modify the attribute bits with the

bit field editor

(32)

Virtual -> physical address mapping

Select an address and press Translate to find the address mapping.

(33)

Optimization Notice

Execution Trace

33 XDB Execution

Trace Viewer

XDB supports execution trace via:

Intel Processor Trace (Intel PT)

Last-Branch Record (LBR)

Trace data is presented as C source

code, view is integrated with other

source debug features

User is not concerned with underlying mechanism, it

“just works”

Trace

(34)

Execution Trace GUI Overview

Execution Trace GUI is fully integrated with source

debug, user can view trace data simultaneously with

source, ASM , callstack…

Execution Trace

history

ASM window

(35)

Optimization Notice

Execution Trace Features

35 Expand source lines

to reveal assembly

Jump to this line’s

source file or

instruction

Keep source and/or

assembler window

in-sync with trace

window

(36)

Execution Trace Features (continued)

Colors indicating how recently

the instruction/line was executed

“+” indicates

multiple hits

Coloring can be configured in Options -> GUI Preferences

Intuitive

following of

execution flow

(37)

Optimization Notice

PCI Scan Tool Technology Preview

Scan for devices, display device-specific registers:

(38)

SVEN SoC Trace –

low overhead technology for

static instrumentation of key SoC components

Intrumented Software Modules of

Devices & Systems

Event

Recorder

JTAG Device

Device

Kernel

User

• Event tracing with JTAG

• Smart breakpoints

• Interrupt execution on key events

• Visualize, Analyze and

Debug system event traces

• Command line interface

• Graphical interface

SVEN Event:

(39)

Optimization Notice

SVEN - A Stethoscope for your System System & SoC trace through JTAG

39 Trace Visualization

 Advanced navigation, search & filter

 Graphical and textual event display

 User controlled trace line grouping

Smart Event Triggers

 Live JTAG system debug with event tracing

 Smart breakpoints that interrupt execution on trace event calls

 Set smart breakpoints for in-depth analysis

For example:

 Break on any event from the USB driver

 Break on any Debug String that starts with “ERROR”

 Break if register X is accessed

 Break if register X bits [7-9] have value 0b101

• Timeline view

• Search & Filter

• Smart Event Trigger

definition

(40)

(41)

Optimization Notice

EFI BIOS Support

41 General EFI Features:

 Source-level debug in any phase of EFI,

from reset to OS boot

 Load symbols for all or selected modules

 Simultaneous debug of MSVC and

GCC-built modules

Passive mode (interrogation-based):

 Inspect target memory to locate

modules, load symbols

 Can be used on production BIOS

 Requires JTAG

Active Mode (agent-based):

 Receive notifications from agent as

modules are loaded/unloaded

 Break at init of a named module,

regardless of load position

 Requires debug agent

(42)

Stepping into BIOS code…

Before we can load symbols/source for EFI we need to be in protected mode

Using the Assembly-level Run Control features you can step from the reset

vector to the jump to protected mode:

(43)

Optimization Notice

43 Loading Symbols for EFI BIOS

Once in protected mode we can use an XDB function to load symbols for EFI:

“loadthis” command

 Key to EFI debug: searches memory for a relocatable EFI module, uses module

metadata to locate debug symbols & sources

 Works in all phases of EFI (SEC, PEI, DXE)

(44)

Debugging in SEC with sources:

Once XDB has symbols loaded it can locate source code for the current instruction point.

Both Source and ASM-level run control is now possible:

(45)

Optimization Notice

Setting a Breakpoint in Source Code

45 Using the context menu: set a breakpoint on a source line

(46)

(47)

Optimization Notice

Summary

47 XDB – Intel® System Debugger is

• Intel’s system software debug solution for

UEFI BIOS, firmware, bootloader, OS and device driver debug.

• It supports JTAG via ITP-XDP3

• It supports UEFI BIOS debug via EDKII debug agent and JTAG

• It is available as part of Intel System Studio in public and NDA versions

(48)

Legal Disclaimer & Optimization Notice

INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS”. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO

ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. INTEL ASSUMES NO LIABILITY WHATSOEVER AND

INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO THIS INFORMATION INCLUDING LIABILITY OR

WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT,

COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.

Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors.

Performance tests, such as SYSmark and MobileMark, are measured using specific computer systems, components, software,

operations and functions. Any change to any of those factors may cause the results to vary. You should consult other

information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of

that product when combined with other products.

trademarks of Intel Corporation in the U.S. and other countries.

Optimization Notice

Intel’s compilers may or may not optimize to the same degree for non-Intel microprocessors for optimizations that are not unique to Intel

microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the

availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent

optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture

are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the

specific instruction sets covered by this notice.

(49)

(50)