Bare Metal Debug


is it possible/ whats the best way to debug Bare Metal (E.g. Bare Metal App as BL3-3 (replacing UEFI) in the ARM Trusted Firmware Build) on the HiKey Board? I found a Description for this on the Juno Board :

Does it work the same way on HiKey Board?
I assume one has to solder a 10 pin Header at J10 and then use ARM Tools with DSTREAM and DS-5…,
OR are there other Tools available…?


Once you solder on the JTAG connector, you should be able to use any commercial jtag debugger or one of the tools listed here:

See page 17 of this document:
for more info on the JTAG connector to use.

Hi Mark,

I know your post is very old, but in case your still interested in this, what I have done is to use u-boot in BL3-3. This can then be used to load other bare metal apps.

Some rather old instructions on how to do that are here: -

For a JTAG setup for HiKey I bought: -

and was planning on using a TinCanTools flyswatter2. I found some initial armv8 OpenOCD support here

But haven’t got round to trying it all out yet to see if I can talk to the SoC.

Hi Peter,

thanks for the info. Unfortunately I did not have access to a early HiKey Board, I am just in the process of ordering.
Since I have access to a DS-5/DSTREAM I will focus on trying to figure out how it is possible with this environment.
Here is my plan:

  1. Solder the FTSH-105-01-L-DV connector to the HiKey Board
  2. Connect a 10-PIN 2X5 SOCKET-SOCKET 1.27MM CABLE from the soldered HiKey Connector to the DSTREAM Coresight 10 Socket.
  3. Now since there is no DS-5 Target available for the HiKey Board follow the Steps how to add bare metal support for a new target:

I will try this out when I get the boards.
In case someone has experience with DS-5/DSTREAM (e.g. a DS-5 Debug config) on the Hikey Board would be good to know.


Hi Markus,

So I managed to get my OpenOCD JTAG setup working. I can set halt the processor, set breakpoints, and write memory. Reading memory isn’t working yet.

The important bits of the OpenOCD hi6220.cfg file I created I’ve pasted in below. Hopefully this should be enough to get you going with the DS-5. I’ve never used the DS-5 myself, but I suspect all it will need to know is the DAP and cti base addresses for the different A53 cores.

jtag newtap $_CHIPNAME dap -irlen 4 -ircapture 0x1 -irmask 0x3 -expected-id 0x5ba00477 -enable

#JTAG tap: auto0.tap tap/device found: 0x5ba00477 (mfg: 0x23b, part: 0xba00, ver: 0x5)
target create $_TARGETNAME aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x80190000 -ctibase 0x80198000 -coreid 0
#target create $_TARGETNAME_1 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x80192000 -ctibase 0x80199000 -coreid 1
#target create $_TARGETNAME_2 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x80194000 -ctibase 0x8019A000 -coreid 2
#target create $_TARGETNAME_3 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x80196000 -ctibase 0x8019B000 -coreid 3
#target create $_TARGETNAME_4 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x801D0000 -ctibase 0x801D8000 -coreid 4
#target create $_TARGETNAME_5 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x801D2000 -ctibase 0x801D9000 -coreid 5
#target create $_TARGETNAME_6 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x801D4000 -ctibase 0x801DA000 -coreid 6
#target create $_TARGETNAME_7 aarch64 -chain-position $_CHIPNAME.dap -dbgbase 0x801D6000 -ctibase 0x801DB000 -coreid 7

FYI the full file is here

kind regards,


Hi Mark,

In case you are interested, I wrote a wiki page on what I got working with HiKey and OpenOCD JTAG. The link is here

The base addresses for the different cores in hi6220.cfg maybe useful for configuring the DS-5/DSTREAM software.



Hi Peter and Mark,

I’m in the process of choosing a debug board and I am currently trying to figure out which features I can have.
What I would like to do is:

be able to load a program
read registers and other states
set states and possibly registers
read and set memory

If I could also do all of these programmatically I would be very happy.

Do you have any recommendations, were you able to read memory yet?


Check out the following blog -

It has all the details you are looking for. There is a sample bare metal program which you can modify to read the registers/memory etc.

I would like to try the OpenOCD with the process you provided, however, I can not clone the OpenOCD source codes.
Following error is present. It seems that I do not have permission to clone it.

Cloning into ‘openocd-code’…
The authenticity of host ‘ (’ can’t be established.
ECDSA key fingerprint is c2:3c:61:ff:85:d7:91:8e:25:1b:db:ac:0c:8a:57:72.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘,’ (ECDSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.


I am trying with the DS-5 debugger, and four A53 can be debugged now.
I will let you know if everything is OK.


Besides, do you have the coresight topology of Hikey960?
If yes, it would be very quick for me to make it work on ARM ds-5.