Debugging Methods and Techniques for ATF Architecture 3.4 (GDB, JTAG, Logging System)

Table of Contents

• 3.4.1 Overview of Debugging
• 3.4.2 GDB Debugging Methods
• Basic Configuration
• Multi-Stage Debugging Techniques
• Common Issues Handling
• 3.4.3 Practical JTAG Debugging
• Hardware Connection Configuration
• Key Debugging Scenarios
• 3.4.4 Using the Logging System
• TF-A Logging Framework
• Log Output Configuration
• Advanced Debugging Techniques
• 3.4.5 Typical Debugging Cases
• Case 1: BL2 Image Load Failure
• Case 2: PSCI Call Timeout
• 3.4.6 Recommended Debugging Tools

3.4.1 Overview of Debugging

As the underlying firmware, TF-A debugging has the following characteristics:

• Debugging must occur in the early boot stage
• Relies on hardware debugging interfaces
• Restricted by security mechanisms (e.g., when MMU is not enabled)
• Significant differences in multi-stage debugging environments

3.4.2 GDB Debugging Methods

Basic Configuration

# Using cross-debugging toolchain
aarch64-none-elf-gdb -x gdbinit.bl1 build/fvp/debug/bl1/bl1.elf

# Common gdbinit configuration
set architecture aarch64
target remote localhost:1234  # QEMU/FVP debugging port
set print pretty on
break bl1_main

Multi-Stage Debugging Techniques

1. BL1 Stage Debugging:

• Need to connect to the ROM starting address (0x0)
• Note that there is no memory mapping at this time, physical addresses must be used

add-symbol-file build/fvp/debug/bl31/bl31.elf 0x04023000
monitor semihosting-cmdline "--board=fvp --data=bl31.bin@0x04023000"

• Use <span>info threads</span> to view all EL states
• <span>thread <n></span> to switch between different exception levels

Common Issues Handling

• Symbol Loading Failure: Confirm that the ELF file matches the memory mapping
• Single Asynchronous Exception: Check if the current exception level allows instruction execution
• Cache Consistency Issues: Use <span>dc ivac</span> command to clear the cache

3.4.3 Practical JTAG Debugging

Hardware Connection Configuration

# OpenOCD configuration example
interface ftdi
ftdi_vid_pid 0x0403 0x6010
adapter_khz 1000
transport select jtag
set _CHIPNAME cpu0
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf

Key Debugging Scenarios

1. Pre-MMU Stage:

• Set breakpoints using physical addresses
• Hardware breakpoints may need to be disabled (some platforms have restrictions)

# Switch to secure state
arm64 dpm security on
# Access secure memory
mem2array buf 32 0x80000000 1024

# List all cores
targets
# Switch core
target smp.cpu1

3.4.4 Using the Logging System

TF-A Logging Framework

// Log level definitions
#define LOG_LEVEL_ERROR 40
#define LOG_LEVEL_NOTICE 20
#define LOG_LEVEL_INFO 10

// Usage example
NOTICE("BL1: %s boot loader\n", version_string);
INFO("CPU: %s\n", cpu_model);

Log Output Configuration

1. Serial Output:

   # Makefile configuration
   PLAT=imx8mm DEBUG=1 LOG_LEVEL=40
   

2. Memory Log Buffer:

   // Define log buffer
   DECLARE_LOGBUF(buf, 4096);
   // Dump log at runtime
   logbuf_dump(buf);
   

3. Runtime Control:

   # Dynamically adjust log level via SMC
   echo 20 > /sys/kernel/debug/tfa_log_level
   

Advanced Debugging Techniques

1. Crash Analysis:

   # View exception context
   info registers all
   # Disassemble current instruction
   x/i $pc
   # Backtrace call stack
   bt full
   

2. Stack Order Sensitive Issues:

• Use ETM trace unit to capture instruction flow
• Analyze PMU counter data

# Check SCR_EL3 register
p/x $scr_el3
# Verify memory attributes
maintenance flush cache

3.4.5 Typical Debugging Cases

Case 1: BL2 Image Load Failure

1. Phenomenon: System hangs after BL1 execution
2. Debugging Steps:

   break bl1_load_bl2
   watch *(uint64_t*)0x40010000  # Monitor load address
   x/8i $pc-16  # Check instructions around the exception point
   

Case 2: PSCI Call Timeout

1. Phenomenon: Linux CPU hotplug fails
2. Solution:

   # Enable PSCI debugging log
   echo 1 > /sys/kernel/debug/tfa/trace_psci
   # Check CPU state register
   mmio 0x1c820000  # CPU power state
   

3.4.6 Recommended Debugging Tools

Best Practice Recommendations:

1. Prioritize using QEMU for algorithm verification
2. Issues in production environments must be reproduced on real hardware
3. Add WATCHPOINTS in critical paths
4. Regularly save JTAG logs