Acid your ARM

We have developed jtagfs, a protocol stack and filesystem which enables live debugging of an ARM machine using acid. It accesses the hardware through a JTAG interface, providing new ways of debugging which dissolve the boundaries between the kernel, user space and the loader and gives direct access to the hardware. At the same time acid provides high level abstractions to interpret the results and automate the debugging process. Introduction JTAG is a standard for boundary scanning, a method for testing digital circuits by means of a shift register (boundary scan shift register or BSR). The BSR is used to drive the inputs and outputs of different parts of the circuit. On each subcircuit the BSR is con­ trolled by a TAP (Test Access Port), used to transverse the states of the BSR on each tick of the clock, load it and set its connections to the pins, input and output values of the circuit. On complex digital circuits, like a microprocessor, the BSR can be used to con­ trol separately and test different subcircuits by feeding it different chains (a sequence of bits). While debugging some drivers in the Sheevaplug, it came to our attention that the ARM cores have a well documented JTAG interface [10]. Furthermore, the chains to control all of the models are very similar, with only small differences between them. The micropro­ cessor includes a TAP controller and some extra debugging hardware as part of the macrocell called Embedded ICE [6] or Embedded ICE-RT [7] depending on the particular model. The JTAG interface provides access from an external external machine to differ­ ent parts of the microprocessor. Through JTAG the debugger can make the processor enter debug mode, write directly to the processor registers, inject instructions with full access to the hardware and restart the processor no matter its state. Furthermore, some machines like the Sheevaplug contain a chip which in addition to providing access to the serial port on the machine has a subcircuit able to interact with the TAP con­ trollers on the board and the microprocessor, making them accessible through USB. This chip, called AN2232C-01 [4] , is a command processor which can drive any kind of serial interface (act as an MPSSE or Multi-Protocol Synchronous Serial Engine). It can also work as an MCU host bus emulator. We will be using it as an MPSSE, so we will just call it MPSSE from now on. All this capabilities mean that with the appropriate software it is possible to debug the kernel having facilities akin to that available on special development boards while at the same time running regular production kernels. It is even possible to debug simultane­ ously the kernel, user space and the loader, vanishing the frontiers and providing full access to the hardware. The problem is that the appropriate software did not exist. The software we have had access to has some limited debugging capabilities through gdb or direct access to the hardware. Porting existing software to Plan 9, while being more complicated than writing it from scratch would have been not enough because of the dependencies with gdb and its lack of generality in the interfaces it offered. Leveraging on [14] and with an approach similar to rdbfs(4) [11] but with a twist, we have devel­ oped a general purpose a complete programmable debugging interface for the ARM machines, providing full access to the hardware. JTAG basics Each JTAG capable device has a number of TAPs connected in series or in parallel. Each TAP normally has four inputs, TCLK, TMS, TDI and TDO, connected as is shown in Figure 1.