CrOS EC (Embedded Controller)

Fingerprint Debugging

This document describes how to attach a debugger with SWD in order to debug the FPMCU with gdb or to flash the FPMCU.

Overview

SWD

SWD (Single Wire Debug) was introduced by ARM with the Cortex-M family to reduce the pin count required by JTAG. JTAG requires 5 pins, but SWD can be done with only 3 pins. Furthermore, one of the freed up pins can be repurposed for tracing.

See CoreSight Connectors for details on the three standard types of connectors used for JTAG and SWD for ARM devices.

Hardware Required

Software Required

  • JLink Software (when using J-Trace or other Segger debug probes). This is the only software required for flashing.
  • In order to perform breakpoint debugging, you will need a tool that supports connecting gdbserver. This document will assume CLion (Googlers see CLion for ChromeOS) and was tested with JLink v6.94a. Alternatively, you can use Ozone, a standalone debugger from Segger.

JLink Software

Install the JLink software in the chroot with the following command:

(chroot) $ sudo emerge jlink
NOTE: The above command will print out a message directing you to manually download a tarball. You must follow these instructions for the installation to be complete.

Connecting SWD

Dragonclaw v0.3

The connector for SWD is J4 on Dragonclaw v0.3.

NOTE: Pay attention to the location of pin 1 (red wire) in the photos below so that you connect with the correct orientation.

SW2 on the edge of Dragonclaw must be set to CORESIGHT.

If you want to connect a 20-Pin ARM Standard JTAG Connector (0.10" / 2.54 mm), you can use the following adapter and cable.

Dragonclaw v0.3 with 20-pin SWD (0.05" / 1.27mm) on J4. Only half the pins are connected.
Dragonclaw with 20-pin SWD
Dragonclaw v0.3 with 10-pin SWD (0.05" / 1.27mm) on J4.
Dragonclaw with 10-pin SWD

Icetower v3

The connector for SWD is labeled with CORESIGHT20 DB CONN on Icetower v3.

JTAG on Icetower must be set to CORESIGHT (not SERVO).

Icetower v3 with 20-pin SWD (0.05" / 1.27mm) on CORESIGHT20 DB CONN.
Icetower with 20-pin SWD

Powering the Board

Servo Micro can provide both the 3.3V for the MCU and 1.8V for the sensor.

Run the following to start servod, which will enable power to these rails by default:

(chroot) $ sudo servod --board=<BOARD>

where <BOARD> is the board you are working with (dartmonkey or bloonchipper).

Theoretically, it's also possible to power through J-Trace, though the power pin on J-Trace only outputs 5V, whereas the MCU runs at 3.3V and the sensor runs at 1.8V. The pin is also not connected on the current designs.

Flashing the FPMCU with JLink

(chroot) $ cd ~/trunk/src/platform/ec

# JLinkRemoteServerCLExe will listen on port 19020 (among others) by default.
# This can be overridden with the -Port argument.
(chroot) $ sudo JLinkRemoteServerCLExe -select USB

You should see the following:

SEGGER J-Link Remote Server V6.94a
Compiled Jan 14 2021 11:52:48

'q' to quit '?' for help

Connected to J-Link with S/N 123456

Waiting for client connections...
  • Build the FPMCU image:
(chroot) $ cd ~/trunk/src/platform/ec

(chroot) $ make BOARD=<BOARD> -j

replacing <BOARD> with bloonchipper or dartmonkey.

(chroot) $ ~/trunk/src/platform/ec/util/flash_jlink.py --board <BOARD> --image ./build/<BOARD>/ec.bin

replacing <BOARD> with bloonchipper or dartmonkey.

Using JLink gdbserver

Start the JLink gdbserver for the appropriate MCU type:

(chroot) $ JLinkGDBServerCLExe -select USB -device STM32F412CG -endian little -if SWD -speed auto -noir -noLocalhostOnly

You should see the port that gdbserver is running on in the output:

Connecting to J-Link...
J-Link is connected.
Firmware: J-Trace PRO V2 Cortex-M compiled Feb  5 2021 14:50:19
Hardware: V2.00
S/N: XXXXX
Feature(s): RDI, FlashBP, FlashDL, JFlash, GDB
Checking target voltage...
Target voltage: 3.30 V
Listening on TCP/IP port 2331    <--- gdbserver port
Connecting to target...
Connected to target
Waiting for GDB connection...

Configure your editor to use this .gdbinit, taking care to set the correct environment variables for the BOARD and GDBSERVER being used. For CLion, if you want to use a .gdbinit outside of your HOME directory, you'll need to configure ~/.gdbinit.

In your editor, specify the IP address and port for gdbserver:

127.0.0.1:2331

You will also want to provide the symbol files:

  • RW image: build/<board>/RW/ec.RW.elf
  • RO image: build/<board>/RO/ec.RO.elf

Also, since we‘re compiling the firmware in the chroot, but your editor is running outside of the chroot, you’ll want to remap the source code path to account for this:

  • “Remote source” is the path inside the chroot: /home/<username>/trunk/src/platform/ec
  • “Local source” is the path outside the chroot: ${HOME}/chromiumos/src/platform/ec

To debug with CLion, you will create a new GDB Remote Debug Configuration called EC Debug, with:

  • 'target remote' args (gdbserver IP and port from above): 127.0.0.1:2331
  • Symbol file (RW or RO ELF): /path/to/build/<board>/RW/ec.RW.elf
  • Path mapping: Add remote to local source path mapping as described above.

After configuring this if you select the EC Debug target in CLion and click the debug icon, CLion and JLink will handle automatically flashing the ELF file and stepping through breakpoints in the code. Even if not debugging, this may help with your iterative development flow since the JLink tool can flash very quickly since it performs a differential flash. Note that you still need to recompile after making changes to the source code before launching the debugger.

Using Ozone

Ozone is a free standalone debugger provided by Segger that works with the J-Trace. You may want to use it if you need more powerful debug features than gdbserver can provide. For example, Ozone has a register mapping for the MCUs we use, so you can easily inspect CPU registers. It can also be automated with a scripting language and show code coverage when used with a J-Trace that is connected to the trace pins on a board. Note that the Dragonclaw v0.3 uses an STM32F412 package that does not have the synchronous trace pins, but the Nucleo STM32F412ZG does have the trace pins.