| Age | Commit message (Collapse) | Author |
|---|
|
Allow opt-in DCDs to queue transfers behind a halted endpoint without changing hardware DCD behavior.
Retry dummy_hcd's transient EP_SET_HALT failure, queue MSC BOT status and recovery requests behind the halt, and clean up Raw Gadget endpoint workers across bus reset.
Signed-off-by: Zixun LI <[email protected]>
|
|
|
|
|
|
Cast BMaxPower in TUD_CONFIG_DESCRIPTOR to uint8_t
|
|
|
|
Enable APM32F0 dependency fetching and CI
|
|
Signed-off-by: Zixun LI <[email protected]>
|
|
|
|
|
|
Add etm-trace skill: unattended ETM instruction trace + per-board TRACE_ETM support
|
|
Coverage rows now resolve the de-collided module-qualified key introduced
for same-named statics. RA boards: document that --attach requires a
debugger-booted target - the C_DEBUGEN gate exists because an unguarded
TRCKCR write bricks standalone boots (hardware-proven), so the limitation
is documented rather than the guard weakened; a debugger-side TRCKCR hook
can lift it later once re-verified on hardware. The stm32n6 board-gating
suggestion is not taken: N6 trace pins are AF0-fixed chip-level, the same
family-wide pattern as stm32h7.
|
|
The board-specific PHY-reset nets move behind a board.h opt-in
(TRACE_ETM_QUIET_ENET_PHY on same70_xplained and mimxrt1170_evkb) so other
boards of those families cannot inherit a foreign GPIO write; the
chip-level trace pin muxes stay family-wide by design (same pattern as
stm32h7). same70 reference: width 1 is the validated default until the
J403.16 rework, and the hooks now wait (bounded) for PCKRDY3 before Ozone
arms trace. ra8m1 reference caches the boot ROM in AfterTargetConnect so
--attach sessions decode ROM execution too. etm_capture rejects an
unexpanded CMake JLINK_DEVICE with a clear error; PIO-USB + TRACE_ETM on
RP2350 is now a compile error (48 MHz trace clock is too slow for PIO-USB
and a runtime switch would desync the stream); etm_profile keeps
same-named statics from different modules as distinct rows.
Build-verified: same70_xplained, mimxrt1170_evkb, raspberry_pi_pico2.
|
|
Bot findings (Copilot/Codex): no-op board_trace_pinmux stubs for
lpcxpresso18s37/43s67 (TRACE_ETM otherwise broke their build), SAME70
ID_PIOD clock enable, capture-script duplicate BeforeTargetConnect on the
RA references, profile-script support for --no-timestamps itraces.
Deep review (whole branch): same70_xplained board row + caveat restored,
stale pico2 72 MHz claim corrected to the shipped 48, explicit
SetTracePortWidth(4) in the three references that relied on Ozone's
default, coverage-cell guard, median-based SysTick calibration, dead
session flag removed, stale RA8M1 divider comment fixed (0x02 = /4 is the
validated chip max) and the debugger guard indented.
EVKB bench findings: only R1884/D3 remains open (D1/D2 meter-verified);
RT1176 trace width is 1 or 4 only - J-Link arms the CSSYS TPIU and its
own sampler at 4-bit for any width>=2 request; a powered MCU-Link USB
breaks the external probe even with JP4 shorted.
|
|
Fresh bring-up pass on mimxrt1170_evkb: holding the 100M RTL8201 in reset
(ENET_RST_B = GPIO_LPSR_04) stops its RMII lines driving against the
shared trace pads and doubles the clean trace-pin rate to 50 MHz
(100 MHz CSTRACE root; 133 MHz root is marginal, stock 132 corrupts).
Validated 3x 8 s TinyUSB captures at 11.46M fetches. D1-D3 remain silent
in every configuration - the welded R1882-R1884 are electrically open;
reflow is the remaining step to width 4. Board notes gain JP4 (must be
shorted for an external probe on J58).
|
|
|
|
Initialize and clean up the Raw Gadget review findings.
Use a single variable-sized allocation for each asynchronous transfer job,
including the usb_raw_ep_io buffer, instead of allocating the job and ioctl
buffer separately.
This reduces allocation overhead and simplifies all cleanup paths while
retaining support for variable-sized transfers without introducing fixed
buffer limits or transfer pools.
|
|
Good catch. `configured` must be initialized explicitly because the context storage is not guaranteed to be zero-initialized at this point. I will set it to `false` in `raw_gadget_context_table_create()` and review the remaining context fields for the same issue.
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
|
|
|
|
Exclude native Linux targets from link-map, bloat, and memory-browser
post-processing.
These tools are intended for embedded firmware images and are not
applicable to executables built by the Linux Raw Gadget BSP.
|
|
Include tusb_option.h directly from raw_gadget_private.h instead of
relying on transitive includes.
This makes the header self-contained and removes the implicit dependency
on include order, ensuring that TinyUSB configuration macros are always
available where they are required.
|
|
Add a Linux board support package for the Raw Gadget device controller.
The BSP provides the board configuration, TinyUSB initialization hooks,
timing functions, and basic UART, LED, and button stubs required by the
device examples.
Raw Gadget is connected after the TinyUSB device stack has been
initialized by using the existing board_init_after_tusb() hook.
|
|
Add a TinyUSB device controller driver for the Linux Raw Gadget
interface.
The driver implements the TinyUSB DCD API on top of the Linux
Raw Gadget userspace interface and supports:
- Control transfers (EP0)
- Bulk endpoints
- Interrupt endpoints
- Dynamic endpoint configuration
- Remote wakeup handling
- Stall and clear-stall
- Asynchronous transfer processing
Isochronous transfers are not supported because the Linux
Raw Gadget API does not expose the required functionality.
The implementation is intended for development, testing and
virtual USB devices running entirely in userspace on Linux.
|
|
|
|
Fifth capture view alongside usbmon/kernel/target/wire: exact execution
history via J-Trace, existing only where the trace header is wired -
confirm with the user before reaching for it.
|
|
Instruction-level trace outranks PC-sampling when samples cannot resolve a
mechanism, but the J-Trace is exclusive per-board hardware: the agent uses
it only when its prompt says the board is trace-wired or the user asked,
and otherwise proposes it in notes - mirroring the lock-force consent rule.
|
|
target-debug replaced usb-target-debug in the debug-skill overhaul; update
the cross-skill table and PC-sampling pointer. Add the consent gate: the
J-Trace is a single probe moved between boards, so captures on a board the
user did not just ask about need explicit confirmation that it is wired.
|
|
J403 (bottom-side Cortex Debug+ETM footprint, header required):
TRACECLK=PD8 peripheral D, TRACED0-3=PD4-7 peripheral C. TRACE_ETM builds
hold the KSZ8081 PHY in reset (PD4-7 are its RMII receive outputs and it
drives against the trace stream), clock the TPIU from PCK3 (MCK/2) and
mux the pins; the ozone reference starts PCK3 in the post-reset/download
hooks - TPIU programming while PCK3 is stopped is silently lost. Width-1
validated at the stock 300 MHz core; width 4 blocked on a dead D1 line
(suspect probe channel, h743eval crosscheck pending).
|
|
The populated 20-pin Cortex Debug+ETM header carries 4-bit trace
(TRACECLK=PC27, D0-3=PC28/PC26/PC25/PC24, mux H). TRACE_ETM builds mux
the pins and enable GCLK channel 47 (GCLK_CM4_TRACE) from GCLK0 - without
that gate the port stays silent with pins and TPIU armed. Chip-max
120 MHz core / 60 MHz TRACECLK validated (3x 280M-fetch captures).
|
|
J-Link's built-in RP2350 script owns the whole chip-side path (component
map is not ROM-table-discoverable; a custom JLinkScript replaces the
built-in one and kills pin trace), re-arming at every resume - firmware
does no trace setup. TRACE_ETM builds pin clk_sys to 48 MHz from crt0
(fly-wire seating-proof; the port is DDR at clk_sys/2 and the J-Trace PRO
V2 cliff sits just above 40 MHz TRACECLK - SEGGER requires V3.0+ for this
chip), clear TIMER0/1 DBGPAUSE (default freezes the us-timer while any
core is debug-halted and sleep_ms spins forever), and run the UART console
TX-only (GPIO1 = default UART0 RX = TRACECLK).
|
|
Generic TRCKCR setup gated on DHCSR.C_DEBUGEN (a standalone-boot TRCKCR
write wedges the chip un-attachable until power-cycle), two-step write per
the hardware manual. ra6m5_ek: div-4 (25 MHz pin) - div-2 is dead on this
board at every width/timing; J9 must be closed. ra8m1_ek: chip-max
120 MHz TRCLK / 60 MHz pin via the committed JLinkScript whose empty
OnTraceStart defers the trace clock to firmware (J-Link's from-reset
enable steps the clock mid-stream at the FSP MOCO-to-PLL switch);
ReadIntoTraceCache covers runtime ROM execution. J9 closed on both EKs -
open = SWD contention up to apparent bricks.
|
|
M55 flashless RAM image: Development boot (JP2/BOOT1=1) REQUIRED - flash
boot parks the chip un-attachable. 300 MHz core (TRACE_ETM selects IC1/4;
600 MHz kills the stream in the startup burst), 18.75 MHz TRACECLK
(cpu/16) width 4; N6 trace components are ROM-table-discoverable, no
J-Link script.
|
|
300 MHz core, 50 MHz TRACECLK, width 2: SB11/SB12 stub TRACED2/3 onto Zio
CN8 and kill width 4 under IRQ-heavy USB traffic (removal = width-4 TODO
at 600 MHz). Session note: --attach while a host actively polls the
device wedges its USB session.
|
|
metro_m7_1011 (custom ETM-header rework): 500 MHz core, 66 MHz TRACECLK
width 4, +50 ps; trace_etm_init ungates the 132 MHz trace root that
BOARD_BootClockRUN leaves gated. mimxrt1170_evkb: 996 MHz CM7 at width 1,
CSTRACE pinned to 50 MHz (stock 132 corrupts - the Ethernet PHY loads the
CLK net) and the CM7 platform trace-funnel port enabled in firmware:
J-Link does not program that funnel and everything reads register-perfect
yet silent without it. FlexSPI boot needs the committed SP/PC hooks; D1-D3
stay dead pending the R1882-R1884 continuity check (width-4 TODO).
|
|
H5 hangs its debug AP if trace CoreSight is touched unclocked (recover =
power-cycle): the reference's AfterTargetConnect clocks the DBGMCU trace
domain but defers IOEN to firmware, or the mid-boot clock switch desyncs
the decoder. Stock solder bridges make the CN5 path marginal: validated
config is 100 MHz core, width 1, +5 ns (board.h selects the reduced clock
for TRACE_ETM builds); width 4 / 250 MHz retest waits on SB removal.
|
|
nrf52840dk: 16 MHz TRACECLK (hardware cap) width 4, P25 soldered, SW7=Alt;
no family code needed (J-Link arms TRACECONFIG). nrf5340dk: TRACE_ETM
builds force the TAD port to 16 MHz (SystemInit's 64 MHz is marginal),
+3 ns sample timing; the interface MCU's UART1 flow control drives the
trace pins - SB27/SB28 must be cut (P0.10/P0.11 = TRACEDATA1/0).
|
|
BSP mux + board.h are register-proven; the module routes TRACECLK to the
header only with SJ1's 0-ohm resistor moved to pads 2-3 (Lauterbach doc
confirms), so hardware validation waits on that rework.
|
|
60 MHz TRACECLK (CCLK/2) width 4 with J5 DBG_EN fitted; board.h drops the
trace-line pull-ups and the ozone reference points at the device example.
A badly-mated ribbon reads register-perfect yet silent - re-seat first.
|
|
120 MHz TRACECLK width 4 over the fully-wired J7 (rev B schematic,
TRACE_5V on pin 11). FS enumeration finishes in <100 ms - ISR analysis
needs a short no-eviction window (--duration-ms 150).
|
|
+100 ps sample timing at 400 MHz core / 50 MHz TRACECLK (PLL1R-fixed),
width 4. Startup-burst overflow at 400 MHz is expected; board.h documents
the PLLN reduction for overflow-free capture.
|
|
Headless instruction-trace capture on any TRACE_ETM-capable board via
Ozone's automation socket (port 19201, xvfb): etm_capture.py generates a
throwaway project from the board's committed ozone reference (device, TIF,
width, timing, hooks, JLinkScript inheritance), drives the session, and
exports profile/coverage; etm_profile.py renders hot functions, coverage,
per-line/instruction counters and ISR timing from the itrace stream.
SKILL.md carries rig discipline, capture recipes, a new-board bring-up
ladder and troubleshooting; boards.md is the per-board reference (config
table + caveats) for all validated boards.
|
|
docs(skills): debug-skill overhaul — role-neutral capture model, verified debugger arsenal, Espressif backend
|
|
misc.xml CMakePythonSetting + vcs.xml Pico-PIO-USB mapping churn were
IDE-local and unrelated; .idea now matches master exactly.
|
|
- target-debug: fault frame lives on PSP when EXC_RETURN bit2 set (FreeRTOS
tasks) — decode LR before choosing $msp/$psp (Codex; valid, our verify
happened to fault on MSP)
- esp-target-debug: show the Xtensa gdb for S3 in the attach recipe; clarify
adapter serial = USB-SJ iSerial (colon MAC, hardware-verified) vs the
CP2102N flasher uids in tinyusb.json (Codex; second half of the finding
had the identifiers inverted)
- esp plan: align serial form with the verified command; record the real
console-gate outcome (UART0, USB-SJ console untested) (Copilot)
- target-debug plan: Task 4 now consistently $JB/ARMv7-M matching the
executed JLinkExe path (Copilot)
- drop IDE-local .idea files swept in by the rename commit (Copilot)
|
|
by board family
- esp-target-debug: de-narrated (~1000 -> 847 words) — session-diary phrasing
('this unit', dates, 'we measured') replaced with durable reference facts;
restructured per-board (P4 vs S3 notes); new Scripted-session gotchas
section consolidates telnet-halt pattern, ESP_ONLYCPU, and ROM-frame
guidance; UART-reset recipe stated once
- target-debug: fix run-on seam from the -singlerun insertion
- target-debugger agent: charter now resolves the board family FIRST and
routes Espressif boards to esp-target-debug as primary playbook; skills
table re-aligned
- retrieval regression: 4/4 (agent routing, S3 keep-alive quirk, OpenOCD RTT
on ST-Link, ROM-frame guidance)
|
|
rig-verified
P4 (hand-wired USB-SJ breakout, GPIO24/25 from header J1):
- COEXISTENCE verified: 303a:1001 + cafe:4008 enumerated simultaneously;
gdb attach/halt/bt during live CDC traffic; symbolized app backtrace
(tud_task_ext <- usb_device_task <- vPortTaskWrapper)
- set ESP_RTOS FreeRTOS before board cfg -> full dual-core task list;
without it, bare 'Remote target'
- attach-may-reset nuance flagged (post-mortem autopsy caution)
- console = UART0 (CP2102 flasher tty) on stock builds; D+/D- swap symptom
documented (low-speed + error -71 vs full-speed)
S3 (same-port PHY swap):
- boundary captured live in dmesg: same hub port flips 303a:1001 ->
cafe:4008 as the app boots; openocd 'esp_usb_jtag: could not find or open
device!' verbatim
- attach/halt/symbol resolution verified via board_test (usb_new_phy absent
from ELF when CFG_TUD/TUH=0); app-context keep-alive quirk (~4 s
unattended drop, -71 half-dead, UART esptool reset recovers); cpu1
OCD_ID=0 -> ESP_ONLYCPU=1; telnet-halt + gdb-read scripted pattern;
RTC_CNTL PHY-mux reference (0x60008120) + esptool read_mem/write_mem
- target-debug pointer + target-debugger agent table row
|
|
Spec (brainstormed): own-skill backend decision, PHY-conflict map, six
verification gates, external-JTAG TODO. Plan executed same-day: all gates
run on the rig; apptrace resolved per its own gate rule as (untested).
|
|
to table; SWO enable chain
- DWT data trace: FUNCTION 0b0011 (ARMv7-M ARM Table C1-21) streams value +
accessor-PC packets per access, no halt, no code. Verified on
stm32f407disco (J-Link SWORead: 451 KB, value = uptime ms, PC =
tusb_time_millis_api) and stm32h743nucleo (OpenOCD/ST-Link tpiu capture:
607 KB, same decode). Caveat recorded: R/W-only trace floods on polled
variables.
- SWO enable chain documented: tools own TRCENA/ITM/TPIU; vendor part bites
— H7 needs DBGMCU trace clocks, PB3 manually muxed to AF0, native
stlink-dap (hla tpiu silently no-ops), the cfg's stm32h7x.swo object (the
.tpiu object is the parallel port), traceclk = c_ck 400 MHz (wrong guesses:
ratio-garbage or silence).
- Sections reordered to match the intrusiveness table (least->most
intrusive); cross-references fixed; table gains the data-trace row.
|
|
aligned columns
- target-debugger: skill list is now a table referencing skills by name only
(path pattern stated once).
- target-debug: probe-mapping run-on paragraph split into bullets; drop the
GDB Ninth-Edition caveat (calibre now holds the Tenth-Edition PDF, id 2264).
- Align markdown table columns across target-debug, usb-sniffer, usbmon, hil,
usbtest and the agent (7 tables); tables with paragraph-length cells left
unpadded (usbmon symptom map, usbtest case map).
|
|
table integration
- Vector catch + Cortex-M fault autopsy, verified with a deliberate bad-load
on stm32f407disco: CFSR=0x8200 (BFARVALID|PRECISERR), BFAR = exact bad
address, stacked pc addr2lined to the faulting line; gotchas recorded
(stale FPB comparators fire phantom SIGTRAPs — scrub first; arm DEMCR
after reset; loads precise / stores imprecise; ARMv6-M has no CFSR/BFAR)
- SWO exception trace + hw PC sampling gate PASSED on F407: 680 KB of
packets in 3 s (0x17 PC samples in flash range, 0x0E SysTick enter/exit);
JLinkSWOViewerCL decodes stimulus only — raw SWORead is the recipe;
SWOStart needs an explicit speed headless
- verifybin 'Verify successful.'; FreeRTOS -rtos plugin lists all 6
cdc_msc_freertos tasks after a run->stop cycle (plain attach = 0xDEAD
placeholder); semihosting anti-note; monitor-mode pointer (untested)
- Intrusiveness table gains the new rows; agent playbook bullet updated;
retrieval gate 5/5 with a fresh reader; executed plan committed
|
|
- Link J-Link UM08001, OpenOCD and GDB (Tenth Ed.) manuals
- bp/wp depth with halt-per-hit cost model. Verified on stm32f407disco
(J-Link) + raspberry_pi_pico (OpenOCD): FPB/DWT budget reads (M4 6 bp/4 wp,
M0+ 4/2 exact), 'Hardware watchpoint' confirmation rule (software fallback
single-steps = USB death), OpenOCD data-VALUE watchpoints, dprintf +
breakpoint command lists exercised on hardware; JLinkGDBServer -singlerun
lifecycle gotcha
- RTT is not J-Link-only: OpenOCD rtt setup/start/server verified on pico
(control block found at the nm address, LOG=2 boot banner captured over nc)
|
