on chip debug
**On-Chip Debug Infrastructure** is the **collection of hardware blocks embedded in the chip that enable software developers and validation engineers to observe, control, and trace program execution on the fabricated silicon** — providing breakpoints, single-stepping, register/memory access, and real-time trace capture through debug interfaces like JTAG and SWD, essential for firmware development, silicon bring-up, and field diagnostics.
**Debug Components**
| Component | Function | Access |
|-----------|---------|--------|
| Debug Access Port (DAP) | External interface to debug system | JTAG / SWD |
| Debug Module | Breakpoints, halt, single-step, register access | Through DAP |
| Embedded Trace | Record instruction/data flow in real time | Trace port or buffer |
| Cross-Trigger | Coordinate debug events across cores | Cross-trigger interface |
| Performance Monitors | Count events (cache miss, branch, etc.) | Register access |
| System Trace | OS-level event trace (context switch, IRQ) | STM (System Trace Macrocell) |
**ARM CoreSight Architecture (Industry Standard)**
- **ETM (Embedded Trace Macrocell)**: Compresses and outputs instruction trace per core.
- **ETB (Embedded Trace Buffer)**: On-chip SRAM buffer for trace data (when no trace port).
- **TPIU (Trace Port Interface Unit)**: Outputs trace data off-chip via trace pins.
- **CTI (Cross-Trigger Interface)**: Triggers between cores/components.
- **APB-AP**: Debug bus connecting DAP to all debug components.
- **ATB**: AMBA Trace Bus connecting trace sources to trace sinks.
**Debug Capabilities**
- **Halting debug**: Stop processor execution — examine/modify registers, memory, peripherals.
- **Hardware breakpoints**: Compare PC against breakpoint address — halt on match (typically 4-8 HW breakpoints).
- **Watchpoints**: Data address/value match — halt on specific memory access.
- **Single-step**: Execute one instruction at a time.
- **Real-time access**: Read/write memory while processor continues running (non-intrusive).
**Trace Types**
| Trace Type | Data Captured | Bandwidth | Use Case |
|-----------|-------------|-----------|----------|
| Instruction Trace (ETM) | PC, branch targets, timestamps | 1-4 Gbps | Code coverage, profiling |
| Data Trace (ETM) | Load/store addresses and values | 2-8 Gbps | Data flow analysis |
| System Trace (STM) | Software-instrumented events | 100 Mbps | OS event tracing |
| Bus Trace | AXI/AHB transactions | High | Interconnect debug |
**Debug for Multi-Core SoCs**
- Each core has its own debug module and ETM.
- **Cross-trigger matrix**: Event on Core 0 can halt Core 1 → coordinated multi-core debug.
- **Timestamp synchronization**: Global timestamp counter ensures trace from different cores can be time-correlated.
- **Power domain awareness**: Debug must work even when some domains are powered off → always-on debug domain.
**Security Considerations**
- Debug access = full control of chip → security risk.
- **Secure debug**: Authentication required before debug access granted.
- **Debug disable**: Fuse-blown in production to permanently disable debug port.
- **Authenticated debug**: Cryptographic challenge-response to enable debug on secure devices.
On-chip debug infrastructure is **essential for the entire lifecycle of a chip product** — from silicon bring-up where hardware bugs must be diagnosed, through firmware development where developers need visibility into code execution, to field diagnostics where deployed systems must be debugged without physical access to the board.