[Reprint] - Arm Trusted Firmware overview

Arm Trusted Firmware overview

https://developer.arm.com/documentation/110431/0100/Debugging-Arm-Trusted-Firmware/Arm-Trusted-Firmware-overview?lang=en

 

The ATF cold boot flow comprises up to five individual boot stages running at different exception levels:

Boot stage	Exception level	Description
BL1	EL3	Trusted bootstrap; cold/warm boot detection
BL2	EL1S	Trusted bootloader
BL31	EL3	Resident runtime firmware
BL32	EL1S	[Optional] Trusted operating system
BL33	EL2	Normal world bootloader

With these stages run in the following order:

BL1  -->  BL2  -->  BL1  -->  BL31  -->  BL32  -->  BL31  -->  BL33

We recommend reading the Arm Trusted Firmware Design document for more information (can also be found in <workspace>/arm-tf/docs/).

This article outlines how to debug ATF:

• From the BL1 entrypoint through to the BL33 entrypoint i.e. “normal world handover”
• In a system without a trusted operating system i.e. no BL32 present
• Using the official reference implementation sources of BL1, BL2, and BL31 (*)

(*) The bl1/, bl2/, and bl31/ directories in <workspace>/arm-tf/.

When debugging ATF it is important to know which boot stage(s) contain the functionality that you are interested in; this way the correct symbols and debug information can be loaded, allowing us to set breakpoints on textual symbol names rather than raw addresses, see function call target names rather than PC relative offsets, and so on. It also means we can skip unnecessary parts of the boot flow.

To this end we have generated the following table of “interesting” functionality with corresponding boot stage and symbol name(s):

Functionality	Boot stage	Symbols
Cold/warm boot detection	BL1	plat_get_my_entrypoint
CPU-specific reset handlers	BL1	reset_handler
Bootstrap (BL1) entrypoint and early setup	BL1	bl1_entrypoint
Bootstrap (BL1) main	BL1	bl1_main
Load Bootloader (BL2) from FIP	BL1	bl1_load_bl2
Bootstrap (BL1) –> Bootloader (BL2) handover	BL1	bl1_prepare_next_image
Bootstrap (BL1) –> Bootloader (BL2) handover	BL1	el3_exit
Bootloader (BL2) entrypoint and early setup	BL2	bl2_entrypoint
Bootloader (BL2) main	BL2	bl2_main
Load images from FIP	BL2	bl2_load_images
Bootloader (BL2) –> Bootstrap (BL1) handover	BL2	smc
Bootstrap (BL1) –> Firmware (BL31) handover	BL1	bl1_plat_prepare_exit
Firmware (BL31) cold boot entrypoint and early setup	BL31	bl31_entrypoint
Firmware (BL31) warm boot entrypoint	BL31	bl31_warm_entrypoint
Firmware (BL31) main	BL31	bl31_main
Initialise CPU operations	BL31	init_cpu_ops
Power management setup	BL31	populate_power_domain_tree
Power management setup	BL31	psci_init_pwr_domain_node
Power management setup	BL31	psci_set_pwr_domains_to_run
CPU power down sequence	BL31	prepare_cpu_pwr_dwn
Firmware BL31 –> BL33 normal world handover	BL31	bl31_prepare_next_image
Firmware BL31 –> BL33 normal world handover	BL31	el3_exit

Make a note of any of these that interest you.