$npx -y skills add easyzoom/aix-skills --skill embedded-fault-debugUse when embedded firmware crashes, traps, faults, resets unexpectedly, jumps to default handlers, corrupts stack, or executes invalid instructions
| 1 | # Embedded Fault Debug |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Use this skill to preserve crash evidence and find the first failing instruction. The agent should read architecture-specific fault state before reset, map addresses to symbols, and separate root cause from secondary symptoms. |
| 6 | |
| 7 | ## When To Use |
| 8 | |
| 9 | Use this skill when: |
| 10 | |
| 11 | - Firmware hits HardFault, BusFault, UsageFault, trap, illegal instruction, default handler, watchdog reset, assert, or panic. |
| 12 | - The board resets unexpectedly or hangs after a repeatable action. |
| 13 | - The user has a register dump, fault log, crash PC, stack dump, watchdog event, or GDB backtrace. |
| 14 | |
| 15 | Do not use this skill when the target cannot yet connect or flash; use `mcu-flashing-debug` first. |
| 16 | |
| 17 | ## First Questions |
| 18 | |
| 19 | Ask for: |
| 20 | |
| 21 | - Architecture/chip family and toolchain. |
| 22 | - Exact symptom and whether it is reproducible. |
| 23 | - Register dump, backtrace, fault/trap registers, assert log, or reset reason. |
| 24 | - ELF/MAP file that matches the running image. |
| 25 | - Whether the target has been reset since the fault. |
| 26 | |
| 27 | ## Workflow |
| 28 | |
| 29 | 1. Preserve state. |
| 30 | Do not reset or reflash until fault registers, PC, LR/RA, SP, and stack frame are captured. |
| 31 | |
| 32 | 1. Confirm image-symbol match. |
| 33 | Ensure the ELF/MAP file matches the firmware currently running on target. |
| 34 | |
| 35 | 1. Identify the faulting address. |
| 36 | Map PC, exception return address, `mepc`, stacked PC, or return address to a symbol and source line. |
| 37 | |
| 38 | 1. Classify the cause. |
| 39 | Separate invalid memory access, illegal instruction, stack overflow, alignment, bus/peripheral access, watchdog, assert, and default handler cases. |
| 40 | |
| 41 | 1. Walk backward to the first bad state. |
| 42 | Inspect caller, input pointers, stack bounds, interrupt context, DMA/cache interactions, and recent initialization. |
| 43 | |
| 44 | 1. Add a focused verification. |
| 45 | Use a watchpoint, assertion, guard pattern, stack watermark, or minimal repro to prove the suspected cause. |
| 46 | |
| 47 | ## Architecture Notes |
| 48 | |
| 49 | ### Cortex-M |
| 50 | |
| 51 | Read SCB fault registers before reset: |
| 52 | |
| 53 | ```text |
| 54 | CFSR = 0xE000ED28 |
| 55 | HFSR = 0xE000ED2C |
| 56 | MMFAR = 0xE000ED34 |
| 57 | BFAR = 0xE000ED38 |
| 58 | ``` |
| 59 | |
| 60 | Decode stacked `r0-r3`, `r12`, `lr`, `pc`, and `xpsr` from MSP or PSP. |
| 61 | |
| 62 | ### RISC-V |
| 63 | |
| 64 | Read: |
| 65 | |
| 66 | ```text |
| 67 | mcause, mepc, mtval, mtvec, mstatus, sp |
| 68 | ``` |
| 69 | |
| 70 | Check whether `mcause` is interrupt or exception, and map `mepc` to source/disassembly. |
| 71 | |
| 72 | ### 8051 |
| 73 | |
| 74 | Use available evidence: |
| 75 | |
| 76 | - Reset reason register if the derivative provides one. |
| 77 | - Stack pointer and internal RAM pressure. |
| 78 | - ISR vector selection and default handler loops. |
| 79 | - Watchdog configuration. |
| 80 | - GPIO heartbeat or serial breadcrumbs around suspected code. |
| 81 | |
| 82 | ## Common Root Causes |
| 83 | |
| 84 | - Stack overflow or ISR stack pressure. |
| 85 | - Null/corrupt function pointer. |
| 86 | - Wrong vector table, trap vector, or interrupt number. |
| 87 | - Accessing peripheral before clock/reset release. |
| 88 | - DMA writing outside buffers. |
| 89 | - Cache coherency issue on cache-enabled MCUs. |
| 90 | - Compiler target flags not matching core features. |
| 91 | - Watchdog not serviced during long init. |
| 92 | - Bootloader/app offset mismatch. |
| 93 | |
| 94 | ## Verification |
| 95 | |
| 96 | Before claiming a fault is understood: |
| 97 | |
| 98 | - State the matched ELF/MAP and running firmware identity if known. |
| 99 | - Report faulting PC/address and mapped symbol/source. |
| 100 | - Report architecture-specific fault registers or explain why unavailable. |
| 101 | - State the suspected root cause and the evidence linking it to the fault. |
| 102 | - State the next minimal verification step, such as watchpoint, stack watermark, or assertion. |
| 103 | |
| 104 | ## Common Failures |
| 105 | |
| 106 | - Resetting immediately and losing the only useful fault state. |
| 107 | - Trusting a backtrace when the ELF does not match flashed firmware. |
| 108 | - Fixing the line where the fault occurred instead of the earlier corruption. |
| 109 | - Ignoring interrupt context, stack selection, or DMA/cache side effects. |
| 110 | - Treating watchdog reset as a generic crash without reading reset reason. |
| 111 | |
| 112 | ## Example |
| 113 | |
| 114 | User: |
| 115 | |
| 116 | ```text |
| 117 | 程序跑一会儿就进 HardFault。 |
| 118 | ``` |
| 119 | |
| 120 | Agent: |
| 121 | |
| 122 | 1. Asks for chip, ELF, register dump, CFSR/HFSR, stacked PC, and whether reset happened. |
| 123 | 1. Maps stacked PC to source. |
| 124 | 1. Checks stack bounds, caller, interrupt context, and invalid memory access evidence. |
| 125 | 1. Suggests a focused watchpoint or stack watermark before changing code. |