XDB Intel System Debugger 2015 Overview Training Robert Mueller-Albrecht, TCE, SSG DPD ECDL
Agenda 1) What is XDB? 2) Debugger startup and device/platform support 3) Debugger usage (Android* an Linux*) 4) System State Inspection 5) Instruction Trace 6) UEFI debug 2
What is XDB? - Summary Source level Debugger for System Software Key Features Linux* and Windows* host JTAG debug for Intel Core, Xeon & Quark SoC-based platforms EFI/UEFI Firmware, bootloader debug, Linux * OS awareness UEFI debugging, optionally with Agent module Dynamically loaded Linux kernel module debug JTAG system debug with event tracing (SVEN) Full CPU register description and bitfield editor Access to page translation and descriptor tables LBR, IPT On-Chip instruction trace support, SMP run control support 3
Intel System Debugger for the Internet of Things The only complete system debug solution for the Intel based Internet of Things JTAG based bootloader, OS and device driver debug Agent based UEFI debug In depth visualization of memory configuration, system state and register sets Common debugger front-end for all debug protocols OpenOCD* Example: Galileo, Intel Quark SoC X1000 Dfx Abstraction Layer Example: Bayley Bay, Intel Atom Processor E3800 4 Deep Insights into memory and system configuration Fast issue resolution with low-level system debuggers
Intel System Debugger and Intel Quark SoC (1) Supported Devices: Intel ITP-XDP3 Go to https://designintools.intel.com/, select the Debug Tools product category and add ITP-XDP BR3 to your cart. TinCanTools* FLYSWATTER2 Go to http://www.tincantools.com/wiki/compiling_openocd Olimex* ARM-USB-OCD-H Go to https://www.olimex.com/products/arm/jtag/arm-usb-ocd-h/ 5
Intel System Debugger and Intel Quark SoC (2) Recommended setup for debugging with OpenOCD* Host System USB 2.0 male-male A-B cable JTAG Probe ARM-JTAG-20-10 Adapter JTAG Port Intel Galileo Board Serial Cable to view boot process Power Supply 6
Supported Formats & Software Object File formats: ELF/DWARF from GCC/ICC Compilers PE/COFF+PDB from Microsoft Compilers Multiple simultaneous modules / mixed formats Linux-specific Features: Auto-detect Kernel Module load/unload Kernel Data structure viewer Includes kernel threads, process list, process address space, and more. EFI-specific Features: Load sources for PEI, DXE, and SMM modules (by address) Agent-based debugging without JTAG 7
Supported Target Connection Methods The debugger can connect via multiple methods: Dfx Abstraction Layer API for current Intel Atom Processor, Intel Quark SoC, Intel Core Processors, Intel Xeon Processors Connect via conventional JTAG using ITP-XDP3 probe Can be used concurrently with other Intel ITPII clients TCI API for older Intel Atom Processors Connect via conventional JTAG using ITP-XDP3 probe or Macraigor* usb2demon* OpenOCD* API for Intel Quark SoC Connect via conventional JTAG using low-cost JTAG probe (e.g. Olimex*, Flyswatter*) Agent-based UEFI Debugger Debug of UEFI firmware over USB/Serial using a target-side agent Deployable on production hardware (no JTAG port) Debug SEC/PEI/DXE with burned-in agent, or soft-load agent for post-shell work User experience is identical regardless of target access method 8
Starting the Debugger Step 1: Open the folder where XDB was installed Step 2: Select a startup script and launch it, start_xdb_2015_products or start_xdb_uefi_agent or start_xdb_legacy_products or start_xdb_gdb_remote Step 3: Connect to your target using the Connect button (or Ctrl-R) 9
Intel System Debugger Launcher integrated into Eclipse* and Wind River* Workbench* 1. Define which debugger start-up to launch under Launcher Options 2. Launch Debugger 10
Standard Debugger Features Linux & EFI Support Multiple Source Files Syntax-highlights CPU Structures Execution Trace Breakpoints Program State And more! 11
Initial Startup & overview Connect/Disconnect Toolbars / Menus Most functions available from menus & buttons Assembly Window Console Window Displays status messages (keep it open!) Command-driven operation also possible 12
Connecting To Targets Step 1: Click the connect icon Step 2: Select your probe Step 3: Select your target platform Step 3a (optional): Enter advanced connection parameters Step 4: Connect! 13
Target Run Control Run Control Run/stop the CPU Step into, over, out ASM step over ASM step into Run until caller Step Over function call Step program until next source line Restart target Halt execution Resume Execution 14
Multiple HW threads The debugger can display how the multiple logical cores are used and indicate which logical core is used by the current code displayed. You can select a logical core and continue debugging the SW running there. 15
OS Debug Getting Started 16
Loading the symbols Browse to find the identical binary file as Loaded on the target. Download = download into Target RAM. Do not tick this if You will debug SW already on the target 17
How to find the sources The debugger will try to find the source file which matches the current instruction pointer. If it cannot find the file it will ask you to do a manual search. 18
Select source files to view With the Source Files icon you can open a window which contains the source tree as found in the binary file loaded in the debugger. Just double click on any of the source file names to open the file in the source window. 19
Evaluate symbols Hover the cursor over a variable and the debugger will show you its value Highlight a variable and use the right mouse click additional options are now available 20
Local variables Local variable window will display all variables which are accessible from within current scope The example above shows part of the rq structure In expression field indicate that this is a compound element and that it has been Expanded ( > for not expanded)
How did I reach the current location? Source file: line number Current file Function tree bottom up Only address presented when no debug information available
Create a breakpoint Minimum - code location is required. Hard option allows you to set a breakpoint even if the memory location is not accessible For Watchpoints the location, access type and length are important 23
Debugging loadable modules There is a Linux kernel module [xdbntf] provided with the debugger which you can build and install you then can load & debug Linux kernel modules and device drivers 24
Inspecting Android* & Linux* Kernel State View all kernel thread with process id, current state, active flags, launch arguments and call tree dependency. 25
What happened? Inspecting System State XDB presents state in a Human Readable format Relationships: show the nesting of structure members High-level decode: show the names of bits in a register Context: show the documentation for a register Program State: Memory contents -> Memory Window Program State -> Locals Window / Eval Window CPU State: General and Extended Registers Page Tables IA CPU data structures (GDT, IDT, LDT) 26
Overview of State Windows: Callstack & HW Threads Program Variables Linux Kernel State PCI Topology & Devices Memory & Registers Page Tables Processor Structures Execution Trace 27
Program State: Callstack Window Show call stack for the currently selected hardware thread Locals Window Program state for the currently selected callstack frame 28
CPU State: Register Windows GP Registers CPU Registers Model-Specific Registers 29
CPU State: Detailed Register View Bit-level Breakdown Text Documentation Set/Restore Values 30
What about paging? Double click on a page table/directory entry and You will have the ability to modify the attribute bits with the bit field editor 31
Virtual -> physical address mapping Select an address and press Translate to find the address mapping. When you press OK the page directory/table involved will be shown in the Paging window 32
Execution Trace XDB supports execution trace via: Intel Processor Trace (Intel PT) Last-Branch Record (LBR) Trace data is presented as C source code, view is integrated with other source debug features User is not concerned with underlying mechanism, it just works XDB Execution Trace Viewer Trace 33
Execution Trace GUI Overview Execution Trace GUI is fully integrated with source debug, user can view trace data simultaneously with source, ASM, callstack Source window ASM window Execution Trace history 34
Execution Trace Features Expand source lines to reveal assembly Keep source and/or assembler window in-sync with trace window Jump to this line s source file or instruction Clear trace buffers 35
Execution Trace Features (continued) Colors indicating how recently the instruction/line was executed Intuitive following of execution flow + indicates multiple hits Coloring can be configured in Options -> GUI Preferences 36
PCI Scan Tool Technology Preview Scan for devices, display device-specific registers: 37
SVEN SoC Trace low overhead technology for static instrumentation of key SoC components User Device Event Recorder V SVEN Event: Kernel Intrumented Software Modules of Devices & Systems JTAG Device Event tracing with JTAG Smart breakpoints Interrupt execution on key events Visualize, Analyze and Debug system event traces Command line interface Graphical interface 38
SVEN - A Stethoscope for your System System & SoC trace through JTAG Trace Visualization Advanced navigation, search & filter Graphical and textual event display User controlled trace line grouping Smart Event Triggers Live JTAG system debug with event tracing Smart breakpoints that interrupt execution on trace event calls Set smart breakpoints for in-depth analysis For example: Break on any event from the USB driver Break on any Debug String that starts with ERROR definition Break if register X is accessed Break if register X bits [7-9] have value 0b101 Timeline view Search & Filter Smart Event Trigger Enhance system stability through powerful JTAG & event tracing 39
UEFI Debug Getting Started 40
EFI BIOS Support General EFI Features: Source-level debug in any phase of EFI, from reset to OS boot Load symbols for all or selected modules Simultaneous debug of MSVC and GCCbuilt modules Passive mode (interrogation-based): Inspect target memory to locate modules, load symbols Can be used on production BIOS Requires JTAG Active Mode (agent-based): Receive notifications from agent as modules are loaded/unloaded Break at init of a named module, regardless of load position Requires debug agent SourceLevelDebugPkg in EDKII 41
Stepping into BIOS code Before we can load symbols/source for EFI we need to be in protected mode Using the Assembly-level Run Control features you can step from the reset vector to the jump to protected mode: You can also use the context menu in the ASM window: 42
Loading Symbols for EFI BIOS Once in protected mode we can use an XDB function to load symbols for EFI: loadthis command Key to EFI debug: searches memory for a relocatable EFI module, uses module metadata to locate debug symbols & sources Works in all phases of EFI (SEC, PEI, DXE) Searches from the current IP or from the a supplied address 43
Debugging in SEC with sources: Once XDB has symbols loaded it can locate source code for the current instruction point. Both Source and ASM-level run control is now possible: 44
Setting a Breakpoint in Source Code Using the Source Files window: find and open a specific file Using the context menu: set a breakpoint on a source line 45
Run to your Breakpoint! 46
Summary XDB Intel System Debugger is Intel s system software debug solution for UEFI BIOS, firmware, bootloader, OS and device driver debug. It supports JTAG via ITP-XDP3 It supports UEFI BIOS debug via EDKII debug agent and JTAG It is available as part of Intel System Studio in public and NDA versions Find out more at http://intel.ly/system-studio 47
Legal Disclaimer & INFORMATION IN THIS DOCUMENT IS PROVIDED AS IS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO THIS INFORMATION INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. Copyright 2014, Intel Corporation. All rights reserved. Intel, Pentium, Xeon, Xeon Phi, Core, VTune, Cilk, and the Intel logo are trademarks of Intel Corporation in the U.S. and other countries. Intel s compilers may or may not optimize to the same degree for non-intel microprocessors for optimizations that are not unique to Intel microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the specific instruction sets covered by this notice. Notice revision #20110804 48
Backup Intel Confidential - Internal Use Only 50 10/25/2014