[Question] Enabling CoreSight TRBE in firmware on CIX Orion O6

[Yunseong Kim <yunseong.kim@est.tech>]

Hi CIX team,

I'm working on vock (https://github.com/yskzalloc/vock), a tool that maps
userspace programs to the exact kernel code they exercise using hardware
trace. On arm64, this relies on CoreSight ETM (--mode hw, for non-kcov
enabled kernel) to collect kernel coverage without requiring CONFIG_KCOV.
Without firmware enabling TRBE or exposing TMC/ETR, I cannot verify or test
the arm64 CoreSight code path on the Orion O6 at all.

I've been testing on a CIX Orion O6 board running Debian sid latest generic kernel
and found that CoreSight trace is not functional due to firmware-level restrictions.

Test environment running Debian sid arm64 kernel:

  Board:    CIX Orion O6
  Kernel:   Debian arm64 generic (7.1+unreleased-arm64, CONFIG_CORESIGHT=m)
  CPU:      Cortex-A520 (0xd81) + Cortex-A720 (0xd80), 12 cores
  Firmware: UEFI/ACPI (no device tree)

What works:

  - coresight_etm4x module loads successfully
  - cs_etm PMU appears at /sys/bus/event_source/devices/cs_etm (type=12)
  - nr_addr_filters = 8

  $ lsmod | grep coresight
  coresight_etm4x       118784  0
  coresight             110592  1 coresight_etm4x

  $ ls /sys/bus/event_source/devices/cs_etm/type
  12

What fails:

  1. No CoreSight bus devices are registered:

     $ ls /sys/bus/coresight/devices/
     (empty)

  2. perf AUX mmap fails (no trace sink available):

     $ perf record -e cs_etm// -- ls
     intel_pt: aux mmap: Cannot allocate memory

  3. TRBE module loads but registers no devices (firmware blocks access):

     $ sudo modprobe coresight-trbe
     $ ls /sys/bus/coresight/devices/
     (empty)

  4. dmesg shows only configuration manager, no ETM/TRBE device probes:

     [ 4479.881313] cs_system_cfg: CoreSight Configuration manager initialised

  5. DSDT has no CoreSight ACPI devices (no ARMHC500/ARMHC501/ARMHC97C HIDs)

Root cause:

  The Cortex-A520 and Cortex-A720 cores support both ETM and TRBE in
  hardware, but the firmware (TF-A/EL3) does not enable OS-level access:

  - TRBE: MDCR_EL3.NSTBE is likely not set, preventing non-secure
    trace buffer access
  - TMC/ETR: No MMIO-mapped trace sinks are described in the ACPI DSDT
  - Self-hosted trace: MDCR_EL3.NSTB / CPTR_EL3.TTA may not be configured


Can you check enabling CoreSight trace support in the Orion O6 firmware by either:

  (1) (Preferred) Enable TRBE access from non-secure EL1/EL2:
     - Set MDCR_EL3.NSTBE = 1 in TF-A
     - This allows the per-CPU Trace Buffer Extension to work as a sink
       without any additional MMIO hardware

  (2) Or expose the full CoreSight topology in ACPI:
     - Add ARMHC97C (TMC-ETR) device with MMIO base address
     - Add ARMHC502 (funnel) devices if applicable
     - Reference: ARM DEN0067 (CoreSight Architecture ACPI bindings)

(1) is simpler and doesn't require ACPI table changes, it's a single register
bit in the secure firmware.


Thank you!

Best regards