### Introduction ###
Embedded Trace Buffer (ETB) provides on-chip storage of trace data,
usually has buffer size from 2KB to 8KB. These data has been used for
profiling and this has been well implemented in coresight driver.
This patch set is to explore ETB RAM data for postmortem debugging.
We could consider ETB RAM data is quite useful for postmortem debugging,
especially if the hardware design with local ETB buffer (ARM DDI 0461B)
chapter 1.2.7. 'Local ETF', with this kind design every CPU has one
dedicated ETB RAM. So it's quite handy that we can use alive CPU to help
dump the hang CPU ETB RAM. Then we can quickly get to know what's the
exact execution flow before its hang.
Due ETB RAM buffer has small size, if all CPUs shared one ETB buffer
then the trace data for causing error is easily to be overwritten by
other PEs; but even so sometimes we still have chance to go through the
trace data to assist debugging panic issues.
### Implementation ###
Firstly we need provide a unified APIs for panic dump functionality, so
it can be easily extended to enable panic dump for multiple drivers. This
is finished by patch 0001, it registers panic notifier, and provide the
general APIs {coresight_add_panic_cb|coresight_del_panic_cb} as helper
functions so any coresight device can add into dump list or delete itself
as needed.
Generally all the panic dump specific stuff are related to the sinks
devices, so this initial version code it only supports sink devices; and
Patch 0002 is to add and remove panic callback for sink devices.
Patch 0003 and 0004 are to add panic callback functions for tmc and etb10
drivers; so these two drivers can save specific trace data when panic
happens.
NOTE: patch 0003 for tmc driver panic callback which has been verified on
Hikey board. patch 0004 for etb10 has not been tested due lack hardware
in hand.
### Usage ###
Below are the example for how to use panic dump functionality on 96boards
Hikey, the brief flow is: when the panic happens the ETB panic callback
function saves trace data into memory, then relies on kdump to use
recovery kernel to save DDR content as kernel core dump file; after we
transfer kernel core dump file from board to host PC, use 'crash' tool to
extract the coresight ETB trace data; finally we can use python script
to generate perf format compatible file and use 'perf' to output the
readable execution flow.
- Save trace data into memory with kdump on Hikey:
ARM64's kdump supports to use the same kernel image both for main
kernel and dump-capture kernel; so we can simply to load dump-capture
kernel with below command:
./kexec -p vmlinux --dtb=hi6220-hikey.dtb --append="root=/dev/mmcblk0p9
rw maxcpus=1 reset_devices earlycon=pl011,0xf7113000 nohlt
initcall_debug console=tty0 console=ttyAMA3,115200 clk_ignore_unused"
Enable the coresight path for ETB device:
echo 1 > /sys/bus/coresight/devices/f6402000.etf/enable_sink
echo 1 > /sys/bus/coresight/devices/f659c000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659d000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659e000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659f000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65dc000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65dd000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65de000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65df000.etm/enable_source
- After kernel panic happens, the kdump launches dump-capture kernel;
so we need save kernel's dump file on target:
cp /proc/vmcore ./vmcore
After we download vmcore file from Hikey board to host PC, we can
use 'crash' tool to check coresight dump info and extract trace data:
crash vmlinux vmcore
crash> log
[ 37.559337] coresight f6402000.etf: invoke panic dump...
[ 37.565460] coresight-tmc f6402000.etf: Dump ETB buffer 0x2000 at 0xffff80003b8da180
crash> rd 0xffff80003b8da180 0x2000 -r cs_etb_trace.bin
- Use python script perf_cs_dump_wrapper.py to wrap trace data for
perf format compatible file and finally use perf to output CPU
execution flow:
On host PC run python script, please note now this script is not flexbile
to support all kinds of coresight topologies, this script still has hard coded
info related with coresight specific topology in Hikey:
python perf_cs_dump_wrapper.py -i cs_etb_trace.bin -o perf.data
On Hikey board:
./perf script -v -F cpu,event,ip,sym,symoff --kallsyms ksymbol -i perf.data -k vmlinux
[002] instructions: ffff0000087d1d60 psci_cpu_suspend_enter+0x48
[002] instructions: ffff000008093400 cpu_suspend+0x0
[002] instructions: ffff000008093210 __cpu_suspend_enter+0x0
[002] instructions: ffff000008099970 cpu_do_suspend+0x0
[002] instructions: ffff000008093294 __cpu_suspend_enter+0x84
[002] instructions: ffff000008093428 cpu_suspend+0x28
[002] instructions: ffff00000809342c cpu_suspend+0x2c
[002] instructions: ffff0000087d1968 psci_suspend_finisher+0x0
[002] instructions: ffff0000087d1768 psci_cpu_suspend+0x0
[002] instructions: ffff0000087d19f0 __invoke_psci_fn_smc+0x0
Have uploaded related tools into folder:
http://people.linaro.org/~leo.yan/debug/coresight_dump/
Changes from RFC:
* Follow Mathieu's suggestion, use general framework to support dump
functionality.
* Changed to use perf to analyse trace data.
Leo Yan (4):
coresight: support panic dump functionality
coresight: add and remove panic callback for sink
coresight: tmc: hook panic callback for ETB/ETF
coresight: etb10: hook panic callback
drivers/hwtracing/coresight/Kconfig | 10 ++
drivers/hwtracing/coresight/Makefile | 1 +
drivers/hwtracing/coresight/coresight-etb10.c | 16 +++
drivers/hwtracing/coresight/coresight-panic-dump.c | 130 +++++++++++++++++++++
drivers/hwtracing/coresight/coresight-priv.h | 10 ++
drivers/hwtracing/coresight/coresight-tmc-etf.c | 26 +++++
drivers/hwtracing/coresight/coresight.c | 11 ++
include/linux/coresight.h | 2 +
8 files changed, 206 insertions(+)
create mode 100644 drivers/hwtracing/coresight/coresight-panic-dump.c
--
2.7.4
After kernel panic happens, coresight has many useful info can be used
for analysis. For example, the trace info from ETB RAM can be used to
check the CPU execution flows before crash. So we can save the tracing
data from sink devices, and rely on kdump to extract them from vmcore
file.
This patch is to add a simple framework to support panic dump
functionality; it registers panic notifier, and provide the general APIs
{coresight_add_panic_cb|coresight_del_panic_cb} as helper functions so
any coresight device can add itself into dump list or delete as needed;
usually these two functions can be used when a session is started or
when it ends. When kernel panic happened, the panic notifier iterates
dump list and calls every node for the device callback function to dump
device specific info. Generally all the panic dump specific stuff are
related to the sinks devices, so this initial version code it only
supports sink devices.
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/Kconfig | 10 ++
drivers/hwtracing/coresight/Makefile | 1 +
drivers/hwtracing/coresight/coresight-panic-dump.c | 130 +++++++++++++++++++++
drivers/hwtracing/coresight/coresight-priv.h | 10 ++
include/linux/coresight.h | 2 +
5 files changed, 153 insertions(+)
create mode 100644 drivers/hwtracing/coresight/coresight-panic-dump.c
@@ -0,0 +1,130 @@+/*+*Copyright(C)2017LinaroLimited.Allrightsreserved.+*Author:LeoYan<leo.yan@linaro.org>+*+*Thisprogramisfreesoftware;youcanredistributeitand/ormodifyit+*underthetermsoftheGNUGeneralPublicLicenseversion2aspublishedby+*theFreeSoftwareFoundation.+*+*Thisprogramisdistributedinthehopethatitwillbeuseful,butWITHOUT+*ANYWARRANTY;withouteventheimpliedwarrantyofMERCHANTABILITYor+*FITNESSFORAPARTICULARPURPOSE.SeetheGNUGeneralPublicLicensefor+*moredetails.+*+*YoushouldhavereceivedacopyoftheGNUGeneralPublicLicensealongwith+*thisprogram.Ifnot,see<http://www.gnu.org/licenses/>.+*/++#include<linux/coresight.h>+#include<linux/coresight-pmu.h>+#include<linux/cpumask.h>+#include<linux/device.h>+#include<linux/list.h>+#include<linux/mm.h>+#include<linux/init.h>+#include<linux/perf_event.h>+#include<linux/slab.h>+#include<linux/types.h>+#include<linux/workqueue.h>++staticDEFINE_MUTEX(coresight_panic_lock);+staticstructlist_headcoresight_panic_list;+staticstructnotifier_blockcoresight_panic_nb;++structcoresight_panic_node{+char*name;+structcoresight_device*csdev;+structlist_headlist;+};++staticintcoresight_panic_notify(structnotifier_block*nb,+unsignedlongmode,void*_unused)+{+intret=0,err;+structcoresight_panic_node*node;+structcoresight_device*csdev;+u32type;++mutex_lock(&coresight_panic_lock);++list_for_each_entry(node,&coresight_panic_list,list){+csdev=node->csdev;+type=csdev->type;++dev_info(&csdev->dev,"invoke panic dump...\n");++switch(type){+caseCORESIGHT_DEV_TYPE_SINK:+caseCORESIGHT_DEV_TYPE_LINKSINK:+err=sink_ops(csdev)->panic_cb(csdev);+if(err)+ret=err;+break;+default:+dev_err(&csdev->dev,+"Unsupported type for panic dump\n");+break;+}+}++mutex_unlock(&coresight_panic_lock);+returnret;+}++intcoresight_add_panic_cb(structcoresight_device*csdev)+{+structcoresight_panic_node*node;++node=kzalloc(sizeof(structcoresight_panic_node),GFP_KERNEL);+if(!node)+return-ENOMEM;++node->name=kstrndup(dev_name(&csdev->dev),16,GFP_KERNEL);+if(!node->name){+kfree(node);+return-ENOMEM;+}+node->csdev=csdev;++mutex_lock(&coresight_panic_lock);+list_add_tail(&node->list,&coresight_panic_list);+mutex_unlock(&coresight_panic_lock);++return0;+}++voidcoresight_del_panic_cb(structcoresight_device*csdev)+{+structcoresight_panic_node*node;++mutex_lock(&coresight_panic_lock);++list_for_each_entry(node,&coresight_panic_list,list){+if(node->csdev==csdev){+list_del(&node->list);+kfree(node->name);+kfree(node);+mutex_unlock(&coresight_panic_lock);+return;+}+}++dev_err(&csdev->dev,"Failed to find panic node.\n");+mutex_unlock(&coresight_panic_lock);+}++staticint__initcoresight_panic_init(void)+{+intret;++INIT_LIST_HEAD(&coresight_panic_list);++coresight_panic_nb.notifier_call=coresight_panic_notify;+ret=atomic_notifier_chain_register(&panic_notifier_list,+&coresight_panic_nb);+if(ret)+returnret;++return0;+}+subsys_initcall(coresight_panic_init);
If the sink device has panic callback function, add the panic callback
node for coresight panic dump list when the sink device is enabled;
also cleanup the node when the sink device is disabled.
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/coresight.c | 11 +++++++++++
1 file changed, 11 insertions(+)
The panic dump functionality has been ready, this patch is to hook
panic callback function for ETB/ETF. Because the driver data structure
has allocated buffer when the session started, so simply save ETB/ETF
trace data into the buffer when panic happens.
Below is simple usage when we connect kdump to extract trace data:
- During kernel panic, tmc driver prints out below log.
Dump ETB buffer 0x2000 at 0xffff80003bd5a180
- After get kernel dump file 'vmcore', use below command to extract
ETB/ETF trace data.
crash vmlinux vmcore
rd 0xffff80003bd5a180 0x2000 -r cs_etb_trace.bin
- Generate perf formatted file, so can be analyzed by perf tool:
python perf_cs_dump_wrapper.py -i cs_etb_trace.bin -o perf.data
./perf script -v -F cpu,event,ip,sym,symoff --kallsyms ksymbol -i perf.data -k vmlinux
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/coresight-tmc-etf.c | 26 +++++++++++++++++++++++++
1 file changed, 26 insertions(+)
This patch is to hook panic callback for etb10 driver; so after panic
can dump trace data from it.
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/coresight-etb10.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
From: Suzuki K Poulose <Suzuki.Poulose@arm.com> Date: 2017-06-05 08:57:44
On 03/06/17 15:42, Leo Yan wrote:
### Introduction ###
Embedded Trace Buffer (ETB) provides on-chip storage of trace data,
usually has buffer size from 2KB to 8KB. These data has been used for
profiling and this has been well implemented in coresight driver.
This patch set is to explore ETB RAM data for postmortem debugging.
We could consider ETB RAM data is quite useful for postmortem debugging,
especially if the hardware design with local ETB buffer (ARM DDI 0461B)
chapter 1.2.7. 'Local ETF', with this kind design every CPU has one
dedicated ETB RAM. So it's quite handy that we can use alive CPU to help
dump the hang CPU ETB RAM. Then we can quickly get to know what's the
exact execution flow before its hang.
Due ETB RAM buffer has small size, if all CPUs shared one ETB buffer
then the trace data for causing error is easily to be overwritten by
other PEs; but even so sometimes we still have chance to go through the
trace data to assist debugging panic issues.
### Implementation ###
Firstly we need provide a unified APIs for panic dump functionality, so
it can be easily extended to enable panic dump for multiple drivers. This
is finished by patch 0001, it registers panic notifier, and provide the
general APIs {coresight_add_panic_cb|coresight_del_panic_cb} as helper
functions so any coresight device can add into dump list or delete itself
as needed.
Generally all the panic dump specific stuff are related to the sinks
devices, so this initial version code it only supports sink devices; and
Patch 0002 is to add and remove panic callback for sink devices.
Patch 0003 and 0004 are to add panic callback functions for tmc and etb10
drivers; so these two drivers can save specific trace data when panic
happens.
NOTE: patch 0003 for tmc driver panic callback which has been verified on
Hikey board. patch 0004 for etb10 has not been tested due lack hardware
in hand.
- After kernel panic happens, the kdump launches dump-capture kernel;
so we need save kernel's dump file on target:
cp /proc/vmcore ./vmcore
After we download vmcore file from Hikey board to host PC, we can
use 'crash' tool to check coresight dump info and extract trace data:
crash vmlinux vmcore
crash> log
[ 37.559337] coresight f6402000.etf: invoke panic dump...
[ 37.565460] coresight-tmc f6402000.etf: Dump ETB buffer 0x2000 at 0xffff80003b8da180
crash> rd 0xffff80003b8da180 0x2000 -r cs_etb_trace.bin
Have you explored appending the above information as a vmcoreinfo parameter via
vmcoreinfo_append_str() ? That would make it easier to list all the information
above and if needed, we may be able to extend the makedumpfile to dump the ETB
dumps from a given vmcore.
Suzuki
From: Suzuki K Poulose <Suzuki.Poulose@arm.com> Date: 2017-06-05 09:24:46
On 03/06/17 15:42, Leo Yan wrote:
quoted hunk
If the sink device has panic callback function, add the panic callback
node for coresight panic dump list when the sink device is enabled;
also cleanup the node when the sink device is disabled.
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/coresight.c | 11 +++++++++++
1 file changed, 11 insertions(+)
Just a thought, instead of adding/deleting every time the sink is enabled,
could we add/del the device once for-ever and let the panic_cb decide to dump
it based on whether the device was active or not ?
Suzuki
On Mon, Jun 05, 2017 at 09:57:39AM +0100, Suzuki K Poulose wrote:
On 03/06/17 15:42, Leo Yan wrote:
quoted
### Introduction ###
Embedded Trace Buffer (ETB) provides on-chip storage of trace data,
usually has buffer size from 2KB to 8KB. These data has been used for
profiling and this has been well implemented in coresight driver.
This patch set is to explore ETB RAM data for postmortem debugging.
We could consider ETB RAM data is quite useful for postmortem debugging,
especially if the hardware design with local ETB buffer (ARM DDI 0461B)
chapter 1.2.7. 'Local ETF', with this kind design every CPU has one
dedicated ETB RAM. So it's quite handy that we can use alive CPU to help
dump the hang CPU ETB RAM. Then we can quickly get to know what's the
exact execution flow before its hang.
Due ETB RAM buffer has small size, if all CPUs shared one ETB buffer
then the trace data for causing error is easily to be overwritten by
other PEs; but even so sometimes we still have chance to go through the
trace data to assist debugging panic issues.
### Implementation ###
Firstly we need provide a unified APIs for panic dump functionality, so
it can be easily extended to enable panic dump for multiple drivers. This
is finished by patch 0001, it registers panic notifier, and provide the
general APIs {coresight_add_panic_cb|coresight_del_panic_cb} as helper
functions so any coresight device can add into dump list or delete itself
as needed.
Generally all the panic dump specific stuff are related to the sinks
devices, so this initial version code it only supports sink devices; and
Patch 0002 is to add and remove panic callback for sink devices.
Patch 0003 and 0004 are to add panic callback functions for tmc and etb10
drivers; so these two drivers can save specific trace data when panic
happens.
NOTE: patch 0003 for tmc driver panic callback which has been verified on
Hikey board. patch 0004 for etb10 has not been tested due lack hardware
in hand.
quoted
- After kernel panic happens, the kdump launches dump-capture kernel;
so we need save kernel's dump file on target:
cp /proc/vmcore ./vmcore
quoted
After we download vmcore file from Hikey board to host PC, we can
use 'crash' tool to check coresight dump info and extract trace data:
crash vmlinux vmcore
crash> log
[ 37.559337] coresight f6402000.etf: invoke panic dump...
[ 37.565460] coresight-tmc f6402000.etf: Dump ETB buffer 0x2000 at 0xffff80003b8da180
crash> rd 0xffff80003b8da180 0x2000 -r cs_etb_trace.bin
Have you explored appending the above information as a vmcoreinfo parameter via
vmcoreinfo_append_str() ? That would make it easier to list all the information
above and if needed, we may be able to extend the makedumpfile to dump the ETB
dumps from a given vmcore.
Thanks for good suggestion, Suzuki. After you pointed out
vmcoreinfo_append_str() I look at it a bit just now, will add it in
next version and verify on Hikey.
Thanks,
Leo Yan
On Mon, Jun 05, 2017 at 10:24:41AM +0100, Suzuki K Poulose wrote:
On 03/06/17 15:42, Leo Yan wrote:
quoted
If the sink device has panic callback function, add the panic callback
node for coresight panic dump list when the sink device is enabled;
also cleanup the node when the sink device is disabled.
Signed-off-by: Leo Yan <redacted>
---
drivers/hwtracing/coresight/coresight.c | 11 +++++++++++
1 file changed, 11 insertions(+)
Just a thought, instead of adding/deleting every time the sink is enabled,
could we add/del the device once for-ever and let the panic_cb decide to dump
it based on whether the device was active or not ?
Yeah, we can check 'if (drvdata->mode == CS_MODE_DISABLED)' and
directly bail out if the module is disabled for panic dumping. Will
fix with this way.
Thanks,
Leo Yan
On 3 June 2017 at 08:42, Leo Yan [off-list ref] wrote:
After kernel panic happens, coresight has many useful info can be used
for analysis. For example, the trace info from ETB RAM can be used to
check the CPU execution flows before crash. So we can save the tracing
data from sink devices, and rely on kdump to extract them from vmcore
file.
This patch is to add a simple framework to support panic dump
functionality; it registers panic notifier, and provide the general APIs
{coresight_add_panic_cb|coresight_del_panic_cb} as helper functions so
any coresight device can add itself into dump list or delete as needed;
usually these two functions can be used when a session is started or
when it ends. When kernel panic happened, the panic notifier iterates
dump list and calls every node for the device callback function to dump
device specific info. Generally all the panic dump specific stuff are
related to the sinks devices, so this initial version code it only
supports sink devices.
Signed-off-by: Leo Yan <redacted>
This driver provides panic dump functionality for CoreSight
devices. When a kernel panic happen a device supplied callback function
is used to save trace data to memory. From there we rely on kdump to extract
the trace data from kernel dump file.
There is no need for another copy of the device name as it is already
available in csdev->dev.
+ struct coresight_device *csdev;
+ struct list_head list;
+};
+
+static int coresight_panic_notify(struct notifier_block *nb,
+ unsigned long mode, void *_unused)
+{
+ int ret = 0, err;
+ struct coresight_panic_node *node;
+ struct coresight_device *csdev;
+ u32 type;
+
+ mutex_lock(&coresight_panic_lock);
+
+ list_for_each_entry(node, &coresight_panic_list, list) {
+ csdev = node->csdev;
+ type = csdev->type;
+
+ dev_info(&csdev->dev, "invoke panic dump...\n");
+
+ switch (type) {
+ case CORESIGHT_DEV_TYPE_SINK:
+ case CORESIGHT_DEV_TYPE_LINKSINK:
+ err = sink_ops(csdev)->panic_cb(csdev);
+ if (err)
+ ret = err;
+ break;
+ default:
+ dev_err(&csdev->dev,
+ "Unsupported type for panic dump\n");
+ break;
+ }
+ }
+
+ mutex_unlock(&coresight_panic_lock);
+ return ret;
+}
This should be called in coresight_register() if a csdev has a panic
callback. I'm backing Suzuki's suggestion of executing the callbacks
only if a device has been enabled. That way the only thing CS devices
have to do is provide a panic_cb function.
On 5 June 2017 at 02:57, Suzuki K Poulose [off-list ref] wrote:
On 03/06/17 15:42, Leo Yan wrote:
quoted
### Introduction ###
Embedded Trace Buffer (ETB) provides on-chip storage of trace data,
usually has buffer size from 2KB to 8KB. These data has been used for
profiling and this has been well implemented in coresight driver.
This patch set is to explore ETB RAM data for postmortem debugging.
We could consider ETB RAM data is quite useful for postmortem debugging,
especially if the hardware design with local ETB buffer (ARM DDI 0461B)
chapter 1.2.7. 'Local ETF', with this kind design every CPU has one
dedicated ETB RAM. So it's quite handy that we can use alive CPU to help
dump the hang CPU ETB RAM. Then we can quickly get to know what's the
exact execution flow before its hang.
Due ETB RAM buffer has small size, if all CPUs shared one ETB buffer
then the trace data for causing error is easily to be overwritten by
other PEs; but even so sometimes we still have chance to go through the
trace data to assist debugging panic issues.
### Implementation ###
Firstly we need provide a unified APIs for panic dump functionality, so
it can be easily extended to enable panic dump for multiple drivers. This
is finished by patch 0001, it registers panic notifier, and provide the
general APIs {coresight_add_panic_cb|coresight_del_panic_cb} as helper
functions so any coresight device can add into dump list or delete itself
as needed.
Generally all the panic dump specific stuff are related to the sinks
devices, so this initial version code it only supports sink devices; and
Patch 0002 is to add and remove panic callback for sink devices.
Patch 0003 and 0004 are to add panic callback functions for tmc and etb10
drivers; so these two drivers can save specific trace data when panic
happens.
NOTE: patch 0003 for tmc driver panic callback which has been verified on
Hikey board. patch 0004 for etb10 has not been tested due lack hardware
in hand.
quoted
- After kernel panic happens, the kdump launches dump-capture kernel;
so we need save kernel's dump file on target:
cp /proc/vmcore ./vmcore
quoted
After we download vmcore file from Hikey board to host PC, we can
use 'crash' tool to check coresight dump info and extract trace data:
crash vmlinux vmcore
crash> log
[ 37.559337] coresight f6402000.etf: invoke panic dump...
[ 37.565460] coresight-tmc f6402000.etf: Dump ETB buffer
0x2000 at 0xffff80003b8da180
crash> rd 0xffff80003b8da180 0x2000 -r cs_etb_trace.bin
Have you explored appending the above information as a vmcoreinfo parameter
via
vmcoreinfo_append_str() ? That would make it easier to list all the
information
above and if needed, we may be able to extend the makedumpfile to dump the
ETB
dumps from a given vmcore.
Suzuki
One thing this patchset doesn't address is the tracer configuration
(metadata). I'm thinking we can use the same mechanism to store the
relevant information in memory in the same format done for perf.
On 3 June 2017 at 08:42, Leo Yan [off-list ref] wrote:
### Introduction ###
Good day Leo,
Embedded Trace Buffer (ETB) provides on-chip storage of trace data,
usually has buffer size from 2KB to 8KB. These data has been used for
profiling and this has been well implemented in coresight driver.
This patch set is to explore ETB RAM data for postmortem debugging.
We could consider ETB RAM data is quite useful for postmortem debugging,
especially if the hardware design with local ETB buffer (ARM DDI 0461B)
chapter 1.2.7. 'Local ETF', with this kind design every CPU has one
dedicated ETB RAM. So it's quite handy that we can use alive CPU to help
dump the hang CPU ETB RAM. Then we can quickly get to know what's the
exact execution flow before its hang.
Due ETB RAM buffer has small size, if all CPUs shared one ETB buffer
then the trace data for causing error is easily to be overwritten by
other PEs; but even so sometimes we still have chance to go through the
trace data to assist debugging panic issues.
### Implementation ###
Firstly we need provide a unified APIs for panic dump functionality, so
it can be easily extended to enable panic dump for multiple drivers. This
is finished by patch 0001, it registers panic notifier, and provide the
general APIs {coresight_add_panic_cb|coresight_del_panic_cb} as helper
functions so any coresight device can add into dump list or delete itself
as needed.
Generally all the panic dump specific stuff are related to the sinks
devices, so this initial version code it only supports sink devices; and
Patch 0002 is to add and remove panic callback for sink devices.
Patch 0003 and 0004 are to add panic callback functions for tmc and etb10
drivers; so these two drivers can save specific trace data when panic
happens.
NOTE: patch 0003 for tmc driver panic callback which has been verified on
Hikey board. patch 0004 for etb10 has not been tested due lack hardware
in hand.
### Usage ###
On top of my comments in the patches I think this section is
interesting and worth its own text file under Documentation. We
already have coresight.txt and coresight-cpu-debug.txt... As such I
suggest you add a new "coresight" directory under Documentation/trace
and move coresight.txt and coresight-cpu-debug.txt there. Once that
is done you can add coresight-panic-dump.txt there.
Below are the example for how to use panic dump functionality on 96boards
Hikey, the brief flow is: when the panic happens the ETB panic callback
function saves trace data into memory, then relies on kdump to use
recovery kernel to save DDR content as kernel core dump file; after we
transfer kernel core dump file from board to host PC, use 'crash' tool to
extract the coresight ETB trace data; finally we can use python script
to generate perf format compatible file and use 'perf' to output the
readable execution flow.
- Save trace data into memory with kdump on Hikey:
ARM64's kdump supports to use the same kernel image both for main
kernel and dump-capture kernel; so we can simply to load dump-capture
kernel with below command:
./kexec -p vmlinux --dtb=hi6220-hikey.dtb --append="root=/dev/mmcblk0p9
rw maxcpus=1 reset_devices earlycon=pl011,0xf7113000 nohlt
initcall_debug console=tty0 console=ttyAMA3,115200 clk_ignore_unused"
Enable the coresight path for ETB device:
echo 1 > /sys/bus/coresight/devices/f6402000.etf/enable_sink
echo 1 > /sys/bus/coresight/devices/f659c000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659d000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659e000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f659f000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65dc000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65dd000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65de000.etm/enable_source
echo 1 > /sys/bus/coresight/devices/f65df000.etm/enable_source
- After kernel panic happens, the kdump launches dump-capture kernel;
so we need save kernel's dump file on target:
cp /proc/vmcore ./vmcore
After we download vmcore file from Hikey board to host PC, we can
use 'crash' tool to check coresight dump info and extract trace data:
crash vmlinux vmcore
crash> log
[ 37.559337] coresight f6402000.etf: invoke panic dump...
[ 37.565460] coresight-tmc f6402000.etf: Dump ETB buffer 0x2000 at 0xffff80003b8da180
crash> rd 0xffff80003b8da180 0x2000 -r cs_etb_trace.bin
- Use python script perf_cs_dump_wrapper.py to wrap trace data for
perf format compatible file and finally use perf to output CPU
execution flow:
On host PC run python script, please note now this script is not flexbile
to support all kinds of coresight topologies, this script still has hard coded
info related with coresight specific topology in Hikey:
python perf_cs_dump_wrapper.py -i cs_etb_trace.bin -o perf.data
I'm not sure what we'll do with "perf_cs_dump_wrapper.py" yet... I
suspect openCSD on github will be a good place for it but let's see
about that later.
Regards,
Mathieu
On Hikey board:
./perf script -v -F cpu,event,ip,sym,symoff --kallsyms ksymbol -i perf.data -k vmlinux
[002] instructions: ffff0000087d1d60 psci_cpu_suspend_enter+0x48
[002] instructions: ffff000008093400 cpu_suspend+0x0
[002] instructions: ffff000008093210 __cpu_suspend_enter+0x0
[002] instructions: ffff000008099970 cpu_do_suspend+0x0
[002] instructions: ffff000008093294 __cpu_suspend_enter+0x84
[002] instructions: ffff000008093428 cpu_suspend+0x28
[002] instructions: ffff00000809342c cpu_suspend+0x2c
[002] instructions: ffff0000087d1968 psci_suspend_finisher+0x0
[002] instructions: ffff0000087d1768 psci_cpu_suspend+0x0
[002] instructions: ffff0000087d19f0 __invoke_psci_fn_smc+0x0
Have uploaded related tools into folder:
http://people.linaro.org/~leo.yan/debug/coresight_dump/
Changes from RFC:
* Follow Mathieu's suggestion, use general framework to support dump
functionality.
* Changed to use perf to analyse trace data.
Leo Yan (4):
coresight: support panic dump functionality
coresight: add and remove panic callback for sink
coresight: tmc: hook panic callback for ETB/ETF
coresight: etb10: hook panic callback
drivers/hwtracing/coresight/Kconfig | 10 ++
drivers/hwtracing/coresight/Makefile | 1 +
drivers/hwtracing/coresight/coresight-etb10.c | 16 +++
drivers/hwtracing/coresight/coresight-panic-dump.c | 130 +++++++++++++++++++++
drivers/hwtracing/coresight/coresight-priv.h | 10 ++
drivers/hwtracing/coresight/coresight-tmc-etf.c | 26 +++++
drivers/hwtracing/coresight/coresight.c | 11 ++
include/linux/coresight.h | 2 +
8 files changed, 206 insertions(+)
create mode 100644 drivers/hwtracing/coresight/coresight-panic-dump.c
--
2.7.4