处理器调试技巧总结-优快云博客

本文链接：https://blog.youkuaiyun.com/tugouxp/article/details/104009816

本文详细介绍了在ARMv7架构下使用DS-5调试器进行内存空间调试的方法。包括如何设置特定内存空间的断点，读写内存，加载符号文件等。同时，文章还解释了不同内存空间前缀（如S、H、N、SP和NP）的含义及使用场景。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1. 不disable MMU,通过DS5查看物理内存：memory window 输入: SP:0x40000000，

标识查看安全物理内存的0x40000000地址。

The following address space prefixes might be available for ARMv7 based processors:

S: This corresponds to the secure address space.
H: This corresponds to the hypervisor address space.
N: This corresponds to the non-secure address space.
SP: This corresponds to secure world physical memory.
NP: This corresponds to non-secure world physical memory.

Note

The availability of an address space depends on what architecture features are implemented and the presence of secure debug privilege.

You can use these address space prefixes for various debugging activities such as to:

set breakpoint in a specific memory space, for example break EL1N:main.
read or write memory, for example x EL1N:0x80000000.
load symbols associated with a specific memory space, for example add-symbol-file foo.axf EL1N:0.

DS-5 Debugger also uses these prefixes when reporting the current memory space where the execution stopped, for example, Execution stopped at: EL3:0x0000000000000000.

Note

If the core is stopped in exception level EL3, the debugger cannot reliably determine whether the translation regime at EL1/EL0 is configured for secure or non-secure access. This is because the secure monitor can change this at run-time when switching between secure and non-secure worlds. Memory accesses from EL3, such as setting software breakpoints at EL1S: or EL1N: addresses, might cause corruption or the target to lockup.
The memory spaces for the EL1 and EL0 exception levels have the same prefix because the same translation tables are used for both EL0 and EL1. These translation tables are used for either Secure EL1/EL0 or Non-secure EL1/EL0. The consequence of this is that if the core, in AArch64 state, is stopped in EL0 in secure state, then the debugger misleadingly reports: Execution stopped at: EL1S:0x0000000000000000. The reported EL1S: here refers to the memory space that is common to EL0 and EL1. It does not refer to the exception level. To see the exception level that the core stopped in, check the $AArch64::$System::$PSTATE register.