| Age | Commit message (Collapse) | Author |
|---|
|
- sysview_ci.py: wait() after kill() on the OpenOCD/nc grace-period
timeout, so a still-exiting process can't hold the probe when the
recovery flash starts
- SKILL.md: point the OpenOCD and post-mortem recipes at
examples/device/cdc_msc_freertos, where build-sv actually lands
- stm32f401blackpill: override SYSVIEW_BUFFER_SIZE_DEFAULT to 4096;
the 64 KiB part overflows RAM by 12952 bytes at the family's 65536
default under SYSVIEW=4
- get_deps.py: align the SystemView entry's continuation lines
|
|
Third-party actions referenced by mutable tag are a supply-chain risk;
pin to the v11 commit SHA per the repo's existing action-pinning convention.
|
|
The HIL job captures the sysview-flagged boards after the functional tests;
a compare job turns base-vs-PR reports into sysview-comment, and
pr_comment.yml appends it to the HIL sticky comment. Every job is capped
above the pool guard.
|
|
sysview_ci.py builds, flashes and captures the sysview-flagged boards
(stm32f407disco and raspberry_pi_pico in tinyusb.json) on the rig, taking
each board's flock via hil_lock and restoring park firmware afterwards.
Hard-won correctness baked in from the dogfood runs: firmware paths carry
the flasher's extension via FLASHER_SUFFIX (JLinkExe and OpenOCD infer the
image format from it, and the RTT control block still comes from the ELF,
which is not always the flashed image); WCH boards are detected by their
wch-riscv target config (is_wch_board(), the plain "openocd" flasher name
since #3804 folded openocd_wch/openocd_adi away); build and flash failures
are excerpted from BOTH ends (cmake prints the diagnosis first and the call
stack last, ninja the reverse) and flash failures include the flasher's own
output so rc=124 can distinguish a wedged probe from a dead target; a bad
ELF no longer aborts the whole multi-board run; the enumeration wait sits
after the capture session's own reset; each capture picks a free RTT server
port. session_resets()/sysview.attach_only skips the in-session reset for
boards that never come back from it (metro_m4_express: both campaign
captures died with 'No control block found' while attach-without-reset
streamed immediately) - the flasher's post-flash reset already supplied the
fresh boot.
The suites join the pre-commit hil-test hook and master's test/hil/test/
carve-out pin.
|
|
The v2 post-mortem design and plan, the HIL performance-report design and
plan, and the promotion criteria for when a debugging technique earns its
own skill (added to the agents-workflows design).
|
|
RTOS/ISR scheduling, CPU load and latency-profile questions go to sysview
first; target-debug keeps the failure-hunting techniques. CLAUDE.md points
at the new skill.
|
|
SKILL.md leads with the capture routes ranked by evidence: OpenOCD RTT
streaming through the rtt skill's tools/rtt.py (--channel 1
--reset-before-attach, since the Init record that carries the timestamp
frequency and sync preamble is emitted once at boot; 238 KB captured without
it decodes to zero events), the live GUI recorder under Xvfb for depth, and
--from-raw post-mortem decode last. boards.md holds the per-board reference:
probe routes, RAM bases, measured buffer sizes, the full-pool campaign table
and the honest capture status of every board tried, including the gaps:
nrf5340dk HardFaults in vTaskStartScheduler before any task runs; PIO-USB
host ISRs are invisible to level-1 coverage (fruit_jam); metro_m4_express is
attach-only (the SAMD5x DSU CPU Reset Extension holds the core after an
in-session reset run); WCH is dump-only - the QingKe SDI has no autonomous
memory access, so a persistent debug session corrupts the running core ~1.9 s
into USB traffic, ruled out against lock, post-mortem mode and firmware; a
stray TU_ASSERT still halts for inspection rather than being silenced.
sysview_record.py drives the capture end to end and refuses to back up its
own ini stub as the user's SystemView config (a SIGKILLed run had consumed
the real backup that way). sysview_report.py turns the exported CSV into
the JSON report: ISR load, function pairing and durations, workload-window
CPU load from the scheduling events. Returns are classified on the bare
'Returns' detail - SystemView annotates a duration on only ~0.5% of them
(measured on stm32f407disco and raspberry_pi_pico), and when the annotation
is absent the duration comes from the recorded timestamps, verified the
same quantity at 167.998 vs a declared 168.000 ticks/us over 264 annotated
returns. Both loss markers count as overflow: explicit '*** Overflow ***'
rows and 'Returns to *** OVERFLOW ***' exit contexts - only counting the
first understated real loss by two orders of magnitude.
|
|
The dual-role dogfood measured the 4096 fallback losing 96.7% of ISR exit
contexts on mimxrt1064_evk and 99.1% on metro_m4_express; a local-board run
measured stm32u575nucleo losing ~19% of the whole stream under a 12 s
cdc_msc workload. The default was too small for any real capture on fast
parts and every user had to rediscover that per board.
Families now declare SYSVIEW_BUFFER_SIZE_DEFAULT in family.cmake (the
SYSVIEW_RAM_BASE_DEFAULT pattern): imxrt, nrf, rp2040, samd5x_e5x, stm32f4,
stm32f7, stm32h7 and stm32u5 set 65536, the measured-safe value.
-DSYSVIEW_BUFFER_SIZE still beats everything; small-RAM parts keep the 4096
fallback and their per-board overrides (stm32f072disco's 2048 verified
still honoured). lpc55 measured 34 lost events on the same route, an order
of magnitude lighter, so it keeps the fallback rather than inheriting a
default on thin evidence.
|
|
One sysview_rtt_conf_wch.h serves every WCH family instead of a per-family
copy; ch583 keeps its own RTT lock header because its interrupt controller
needs a different masking sequence than the ch32v parts.
|
|
Cortex-M0/M0+, the WCH RISC-V parts and MAX3266x have no usable DWT cycle
counter, so their family.c provides SEGGER_SYSVIEW_X_GetTimestamp() from a
free-running hardware timer: a 32-bit general-purpose timer on ST parts
(sysview_stm32_tim2.h), SysTick-extended sources on the M0 families, the
core's SysTick-equivalent on WCH with the documented ordered read of the
split count registers (sysview_wch_timestamp.h), and a TMR on MAX3266x
(sysview_max32_tmr.h).
max32666fthr's DWT implements only watchpoint comparators (DWT_CTRL.NOCYCCNT=1
read live; UG6971 documents no DWT/trace at all), so SystemView's ARMv7-M
default read 0xE0001004 as a frozen 0 and every duration decoded as zero. The
TMR runs at 48 MHz (f_PCLK = f_SYS_CLK/2; Continuous mode, CMP=0xFFFFFFFF,
prescaler 1 - UG6971 15.2 guarantees TMRn_CNT readable while counting); TMR0
by default - present on every MAX32 part, unused by the examples, FreeRTOS
ticks on SysTick - overridable with -DSYSVIEW_MAX32_TMR=n. The family builds
SystemView with SEGGER_SYSVIEW_CORE_OTHER and sets CFG_TUSB_SYSVIEW_TIMESTAMP_BSP,
a tusb_sysview.c opt-in for ARMv7-M parts without CYCCNT where the BSP also
reports the rate via SEGGER_SYSVIEW_X_GetTimestampFreq(); the fixed-1MHz
microsecond contract is unreachable on a powers-of-two-only prescaler.
SEGGER_SYSVIEW_X_GetInterruptId() gains the ICSR.VECTACTIVE read for
CORE_OTHER builds. MAX32650/32690 use different GCR clock-gate names and stay
unported. Measured on the rig: seven host-timed 1.000 s gaps at
1.00044-1.00091 (median +0.05%).
stm32f0 refuses to configure SYSVIEW for stm32f070xb at CMake time: that
variant has no TIM2 at all, and the alternative was an undefined-reference
link error with no hint.
The shared hw/bsp/sysview_*.h join ci_select rule 16's hw/bsp file list
(cross-family build files, compiled only under -DSYSVIEW which no CI leg
enables), mirrored in the spec's rule table, so master's classification
guard resolves them on both axes.
|
|
hw/bsp/sysview_freertos_hooks.h maps the FreeRTOS trace macros onto
SystemView task records (task names, switches, ready/blocked) and adds heap
tracking; the FreeRTOSConfig.h of the families used on the rig include it
when SYSVIEW is on.
The FreeRTOS examples grow their USB task stacks when CFG_TU*_SYSVIEW is
enabled, the same way they already do for CFG_TUSB_DEBUG -- the
instrumentation's stack cost is real (measured overflows on lpc55 before
the bump).
|
|
Level 2 marks the stack's task-side entry points (tud_task/tuh_task inner
loop, usbd_edpt_xfer, control transfers); level 3 adds the class drivers
(cdc, msc) and the rp2040 dcd/hcd as the reference portable layer. All
call sites compile away below their level.
|
|
tusb_int_handler() brackets the whole USB interrupt with SystemView ISR
enter/exit records, honouring its in_isr argument so a handler deferred to
task context is not recorded as an interrupt. usbd.h/usbh.h expose the
level-1 hooks the handler needs.
|
|
family_support.cmake/.mk translate -DSYSVIEW=<level> (CMake) / SYSVIEW=<level>
(Make) into CFG_TUD_SYSVIEW/CFG_TUH_SYSVIEW, pull in lib/SystemView sources
and the RTT/SystemView include paths, and refuse levels the family cannot
honour.
The lpc11/13/15/17/40/43 families declare SYSVIEW_RAM_BASE_DEFAULT
0x10000000: their SRAM does not start at the Cortex-M-canonical 0x20000000,
and the recorder needs the real base to find the RTT control block.
|
|
tusb_sysview.{c,h} carry the SystemView glue: the TU_SV_* event/function-name
table (offset TU_SV_EVENT_BASE 512), module registration, the leveled
CFG_TUD_SYSVIEW/CFG_TUH_SYSVIEW gates (1 = ISR only, 2 = +stack call sites,
3 = +class drivers), per-task stack high-water reporting with a cached
snapshot refreshed once per rotation, and the dual-role guard that collapses
double-recording when device and host share one vector.
ISR exit emits RecordExitISRToScheduler() when SCB->ICSR.PENDSVSET is set at
exit (Cortex-M0/M3+), so FreeRTOS captures don't show a causeless task switch
after every USB ISR; RISC-V keeps the plain exit record.
Unit-tested under ceedling against a fake SEGGER_SYSVIEW.h vendor header.
|
|
Fetched by get_deps.py like every other optional dependency, not vendored.
The target sources (SEGGER_SYSVIEW.c, RTT) are what the CFG_TU*_SYSVIEW
instrumentation links against; the desktop application is not part of this.
|
|
device/dfu: fix transfer buffer overwrite issue
|
|
device/cdc: avoid flushing tx buffer on connection
|
|
hcd/dwc2: fix FIFO allocation and periodic transfer
|
|
rp2040: do not require PICO_DEFAULT_PIO_USB_DP_PIN to be set for pio_usb
|
|
|
|
HFNUM retains only 16384 host-frame positions, while valid periodic endpoint intervals can be longer. Resubmission after the counter wraps can therefore alias the elapsed time and skip the next established service phase.
Cap the host-selected interval to one HFNUM cycle using the root-port frame unit. USB permits a shorter host-provided period, and the bounded interval keeps phase calculation unambiguous for native and split endpoints.
|
|
Periodic DMA channels use their natural service-boundary halt instead of a software CHDIS request. Keep the endpoint busy after an abort so a replacement transfer cannot reuse its state or buffer while the channel remains active.
When HCINT.HALTED arrives, release the channel without reporting completion for the aborted transfer. If endpoint closure is also pending, release the endpoint from the same halt path.
|
|
agent/fix-dwc2-host-fifo-allocation
|
|
A disconnect can close endpoint zero after an enumeration control stage completes but before USBH submits the next stage or request. HCD submission then legitimately returns false; treating that result as an invariant violation asserts during rapid replug and can leave enumeration unfinished.
Complete an in-progress control request as failed when its DATA or status stage cannot be submitted. Propagate submission failures from every asynchronous enumeration continuation and finish enumeration through the normal failure cleanup path. This keeps controller teardown races out of assertions without fabricating a successful transfer.
Validated by interrupting enumeration during rapid STM32U5A5 replug tests with DWC2 DMA and slave modes.
|
|
A root-port disconnect invalidates every active transfer. Retire channel and FIFO interrupt sources plus host-channel state in the disconnect ISR using the Linux DWC2 cleanup model instead of reinitializing the core and PHY, which can sleep on STM32 HS PHYs.
Flush posted slave requests, request halts for enabled channels, clear channel interrupt and software ownership, and keep endpoint records closing until USBH processes the remove event. Reject transfer submissions to closing endpoints, preserve fast-replug notification, and re-enable the global host-channel interrupt when a new channel is initialized.
|
|
agent/fix-dwc2-host-fifo-allocation
|
|
In slave mode, channel_xfer_start() enabled an OUT channel but left every FIFO write to a later PTXFEMP interrupt. DWC2 creates the request-queue entry only when the packet's final FIFO word is written, so unrelated interrupt work could consume the selected service frame before the transfer was actually queued.
Factor FIFO writes into a capacity-checked helper and write the initial packet while the channel-enable operation is still protected from DWC2 interrupts. Keep FIFO-empty interrupts only for data that does not fit immediately. The protected section never waits for FIFO or request-queue space.
When initial periodic OUT submission is too close to the frame boundary, release the unused channel and defer the still-pending endpoint to the next SOF. Internal retries bypass this initial boundary guard.
A hardware trace showed HCCHAR enabled for frame 0x0378 while the packet's final FIFO word was delayed until frame 0x03ae. The complete five-commit fix set passed 600 seconds in every O0/O2 and slave/DMA mode.
Signed-off-by: HiFiPHile <[email protected]>
|
|
Periodic IN and DMA-backed transfers selected ODDFRM before waiting for request-queue space. A DWC2 interrupt could also run between reading HFNUM and writing HCCHAR.CHENA, allowing the selected frame to pass while the transfer still appeared active.
Wait for request-queue capacity with controller interrupts enabled, then mask only GAHBCFG.GINT while sampling HFNUM and enabling a new periodic channel. Record the periodic phase from that same HFNUM sample so a boundary after channel enable cannot shift later interval calculations. The bounded critical section contains no queue wait, callback, disable, or allocation loop. Retries that already selected their frame bypass the new selection step.
Also clear a retained HCCHAR.CHDIS before every channel enable. A halted channel can otherwise be re-enabled as CHENA|CHDIS and wait for a terminal interrupt that never arrives.
Hardware traces captured periodic IN selections at frames 0x3303 and 0x3266 but activation only after 0x330c and 0x3273, respectively.
|
|
A frame-overrun interrupt means the selected periodic service interval has already been missed. Retrying an isochronous transfer after that point cannot deliver the original packet and can leave the class waiting indefinitely for a terminal result.
Enable frame-overrun interrupts for slave periodic channels. Complete isochronous IN and OUT overruns as XFER_RESULT_FAILED in both slave and DMA modes, accounting for bytes already written on OUT. Preserve the existing retry behavior for non-isochronous DMA transfers.
This reports the missed packet honestly through the normal HCD completion path: no fabricated success and no class-level abort workaround.
|
|
DWC2 buffer/external DMA mode automatically halts a periodic channel at its next service boundary. Programming HCCHAR.CHDIS|CHENA for a non-split periodic channel is explicitly disallowed by the controller programming guide, yet channel_disable() skipped that write only for split periodic transfers.
Return without programming channel disable for every periodic DMA channel. Non-periodic DMA and slave-mode channels retain the existing explicit-disable path.
The previous path reproduced after 420 seconds in O2/DMA with a closing capture transfer left INVALID while HCCHAR retained CHENA|CHDIS and HCINT was clear.
|
|
Slave-mode channel handlers process one interrupt cause per pass, but the dispatcher acknowledged every HCINT bit before invoking them. When ChHltd arrived together with another cause, the handler consumed the other cause and the halt was lost. A subsequent disable could then leave CHENA|CHDIS asserted with HCINT and HAINT clear, so the submitted periodic transfer never completed.
When a slave channel reports ChHltd with another cause, acknowledge only the non-halt causes and leave ChHltd pending for the next channel-IRQ pass. DMA handlers retain their existing combined-cause behavior.
The uninstrumented negative capture reproduced the lost terminal state with HCCHAR=0xe044881c, HCTSIZ=0x0008001c, HCINT=0, and XFER_RESULT_INVALID.
|
|
Protect periodic deferral cancellation from the SOF interrupt. Re-enable the host interrupt before disabling an active channel because slave-mode channel disable may wait for request-queue space.
|
|
agent/fix-dwc2-host-fifo-allocation
|
|
Popping an IN transfer-completion entry from GRXSTSP asserts HCINT.XferCompl. Drain the receive FIFO first, then read the live masked global status so the newly asserted channel completion is handled without waiting for another interrupt.
|
|
|
|
Anchor resubmitted periodic transfers to the endpoint service interval and defer early submissions through SOF. This prevents callback latency from shifting the cadence or causing intervals to be skipped, while keeping pending transfers abortable.
Signed-off-by: HiFiPHile <[email protected]>
|
|
Fix DWC2 DMA data toggle mismatch in IN-transfers
|
|
bound endpoint number in tu_bind_driver_to_ep_itf
|
|
tu_bind_driver_to_ep_itf() now returns false when ep_num >= CFG_TUH_ENDPOINT_MAX, but the host caller ignores that result and continues enumeration. Configurations such as host/bare_api set the limit to 8, while valid USB devices may use endpoints 8–15. A recognized class can therefore continue and later index ep_status[epnum] or ep2drv[epnum] out of bounds. Wrap this call in TU_ASSERT(...), as the device path already does, so parsing fails immediately.
Signed-off-by: HiFiPHile <[email protected]>
|
|
|
|
ucpd: Add "attached" state callback for CC state changes
|
|
|
|
disconnected->connected or connected->disconnected
|
|
|
|
rp2350: ETM trace board pico2_etm_trace
|
|
|
|
Closes the sys-clock question. rp2350: the dynamic 156 MHz switch is
removed - 150 MHz soak-tested clean (and a runtime switch truncates ETM
capture on the trace carrier). rp2040 keeps its existing 120 MHz: soak
sweeps show 120 = 8/8, stock 125 = 0/3 (bulk-OUT collapses, device NAKs
~600:1 with zero CRC errors on the wire), and 132 = 2/10 flaky despite an
exact 12n/375k divider - no divider criterion predicts rp2040 PIO-USB
health (the RX state machine samples at raw sysclk), so only
soak-validated clocks ship.
|
|
Board files for the trace carrier (console GP12/13, LED GP10, I2C GP8/9,
PIO-USB host on GP20, all retargeted in board.cmake so the SDK defaults
cannot mux a trace pin), compile-time trace pin-conflict checks, the
measured DBGPAUSE rationale, Ozone project, and skill/docs updates.
Trace validated at the stock 150 MHz (75 MHz TRACECLK, +1 ns sampling):
zero overflow through a 15 s throughput soak; V2 probe ceiling 120 MHz.
|
|
hil: drop the sysfs blindness subsystem and derive the recovery reserve
|
