openocd.texi 60.9 KB
Newer Older
ntfreak's avatar
ntfreak committed
1
2
3
\input texinfo	@c -*-texinfo-*-
@c %**start of header
@setfilename openocd.info
4
@settitle Open On-Chip Debugger (OpenOCD)
ntfreak's avatar
ntfreak committed
5
6
7
8
9
10
11
12
@dircategory Development
@direntry
* OpenOCD: (openocd).      Open On-Chip Debugger.
@end direntry
@c %**end of header

@include version.texi

ntfreak's avatar
ntfreak committed
13
14
15
16
17
18
19
20
21
22
23
24
@copying
Copyright @copyright{} 2007-2008 Spen @email{spen@@spen-soft.co.uk}
@quotation
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2 or
any later version published by the Free Software Foundation; with no
Invariant Sections, with no Front-Cover Texts, and with no Back-Cover
Texts.  A copy of the license is included in the section entitled ``GNU
Free Documentation License''.
@end quotation
@end copying

ntfreak's avatar
ntfreak committed
25
@titlepage
26
27
@title Open On-Chip Debugger (OpenOCD)
@subtitle Edition @value{EDITION} for OpenOCD version @value{VERSION}
ntfreak's avatar
ntfreak committed
28
29
30
@subtitle @value{UPDATED}
@page
@vskip 0pt plus 1filll
ntfreak's avatar
ntfreak committed
31
@insertcopying
ntfreak's avatar
ntfreak committed
32
33
34
35
36
37
38
@end titlepage

@contents

@node Top, About, , (dir)
@top OpenOCD

ntfreak's avatar
ntfreak committed
39
This manual documents edition @value{EDITION} of the Open On-Chip Debugger
40
(OpenOCD) version @value{VERSION}, @value{UPDATED}.
ntfreak's avatar
ntfreak committed
41
42

@insertcopying
ntfreak's avatar
ntfreak committed
43
44

@menu
45
46
47
48
49
* About::             About OpenOCD.
* Developers::        OpenOCD developers
* Building::          Building OpenOCD
* Running::           Running OpenOCD
* Configuration::     OpenOCD Configuration.
50
* Target library::    Target library
51
* Commands::          OpenOCD Commands
ntfreak's avatar
ntfreak committed
52
* Sample Scripts::    Sample Target Scripts
53
* GDB and OpenOCD::   Using GDB and OpenOCD
54
* TCL and OpenOCD::   Using TCL and OpenOCD
oharboe's avatar
oharboe committed
55
* TCL scripting API:: Tcl scripting API
56
* Upgrading::         Deprecated/Removed Commands
ntfreak's avatar
ntfreak committed
57
58
59
60
61
62
63
64
65
* FAQ::               Frequently Asked Questions
* License::           GNU Free Documentation License
* Index::             Main index.
@end menu

@node About
@unnumbered About
@cindex about

66
The Open On-Chip Debugger (OpenOCD) aims to provide debugging, in-system programming
ntfreak's avatar
ntfreak committed
67
68
69
70
and boundary-scan testing for embedded target devices. The targets are interfaced
using JTAG (IEEE 1149.1) compliant hardware, but this may be extended to other
connection types in the future.

71
OpenOCD currently supports Wiggler (clones), FTDI FT2232 based JTAG interfaces, the
ntfreak's avatar
ntfreak committed
72
73
74
75
76
77
78
79
80
81
82
83
Amontec JTAG Accelerator, and the Gateworks GW1602. It allows ARM7 (ARM7TDMI and ARM720t),
ARM9 (ARM920t, ARM922t, ARM926ej--s, ARM966e--s), XScale (PXA25x, IXP42x) and
Cortex-M3 (Luminary Stellaris LM3 and ST STM32) based cores to be debugged.

Flash writing is supported for external CFI compatible flashes (Intel and AMD/Spansion
command set) and several internal flashes (LPC2000, AT91SAM7, STR7x, STR9x, LM3
and STM32x). Preliminary support for using the LPC3180's NAND flash controller is included.

@node Developers
@chapter Developers
@cindex developers

84
OpenOCD was created by Dominic Rath as part of a diploma thesis written at the
ntfreak's avatar
ntfreak committed
85
86
87
88
89
90
91
University of Applied Sciences Augsburg (@uref{http://www.fh-augsburg.de}).
Others interested in improving the state of free and open debug and testing technology
are welcome to participate.

Other developers have contributed support for additional targets and flashes as well
as numerous bugfixes and enhancements. See the AUTHORS file for regular contributors. 

92
93
The main OpenOCD web site is available at @uref{http://openocd.berlios.de/web/}

ntfreak's avatar
ntfreak committed
94
95
@node Building
@chapter Building
96
@cindex building OpenOCD
ntfreak's avatar
ntfreak committed
97
98
99
100
101
102
103
104
105
106

You can download the current SVN version with SVN client of your choice from the
following repositories:

 (@uref{svn://svn.berlios.de/openocd/trunk})

or

 (@uref{http://svn.berlios.de/svnroot/repos/openocd/trunk})

107
Using the SVN command line client, you can use the following command to fetch the
ntfreak's avatar
ntfreak committed
108
109
110
111
latest version (make sure there is no (non-svn) directory called "openocd" in the
current directory):

@smallexample
oharboe's avatar
oharboe committed
112
 svn checkout svn://svn.berlios.de/openocd/trunk openocd
ntfreak's avatar
ntfreak committed
113
114
@end smallexample

115
Building OpenOCD requires a recent version of the GNU autotools.
ntfreak's avatar
ntfreak committed
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
On my build system, I'm using autoconf 2.13 and automake 1.9. For building on Windows,
you have to use Cygwin. Make sure that your @env{PATH} environment variable contains no
other locations with Unix utils (like UnxUtils) - these can't handle the Cygwin
paths, resulting in obscure dependency errors (This is an observation I've gathered
from the logs of one user - correct me if I'm wrong).

You further need the appropriate driver files, if you want to build support for
a FTDI FT2232 based interface:
@itemize @bullet
@item @b{ftdi2232} libftdi (@uref{http://www.intra2net.com/opensource/ftdi/})
@item @b{ftd2xx} libftd2xx (@uref{http://www.ftdichip.com/Drivers/D2XX.htm})
@item When using the Amontec JTAGkey, you have to get the drivers from the Amontec
homepage (@uref{www.amontec.com}), as the JTAGkey uses a non-standard VID/PID. 
@end itemize

131
132
libftdi is supported under windows. Versions earlier than 0.13 will require patching.
see contrib/libftdi for more details.
ntfreak's avatar
ntfreak committed
133
134

In general, the D2XX driver provides superior performance (several times as fast),
135
but has the draw-back of being binary-only - though that isn't that bad, as it isn't
ntfreak's avatar
ntfreak committed
136
137
138
139
140
141
142
143
144
145
a kernel module, only a user space library.

To build OpenOCD (on both Linux and Cygwin), use the following commands:
@smallexample
 ./bootstrap 
@end smallexample
Bootstrap generates the configure script, and prepares building on your system.
@smallexample
 ./configure 
@end smallexample
oharboe's avatar
oharboe committed
146
Configure generates the Makefiles used to build OpenOCD.
ntfreak's avatar
ntfreak committed
147
148
149
@smallexample
 make 
@end smallexample
150
Make builds OpenOCD, and places the final executable in ./src/.
ntfreak's avatar
ntfreak committed
151
152
153
154
155
156

The configure script takes several options, specifying which JTAG interfaces
should be included:

@itemize @bullet
@item
oharboe's avatar
oharboe committed
157
@option{--enable-parport}
ntfreak's avatar
ntfreak committed
158
@item
oharboe's avatar
oharboe committed
159
@option{--enable-parport_ppdev}
ntfreak's avatar
ntfreak committed
160
@item
161
162
@option{--enable-parport_giveio}
@item
oharboe's avatar
oharboe committed
163
@option{--enable-amtjtagaccel}
ntfreak's avatar
ntfreak committed
164
@item
oharboe's avatar
oharboe committed
165
@option{--enable-ft2232_ftd2xx}
ntfreak's avatar
ntfreak committed
166
@footnote{Using the latest D2XX drivers from FTDI and following their installation
167
instructions, I had to use @option{--enable-ft2232_libftd2xx} for OpenOCD to
oharboe's avatar
oharboe committed
168
build properly.}
ntfreak's avatar
ntfreak committed
169
@item
oharboe's avatar
oharboe committed
170
@option{--enable-ft2232_libftdi}
ntfreak's avatar
ntfreak committed
171
@item
oharboe's avatar
oharboe committed
172
@option{--with-ftd2xx=/path/to/d2xx/}
173
174
175
176
177
178
179
180
@item
@option{--enable-gw16012}
@item
@option{--enable-usbprog}
@item
@option{--enable-presto_libftdi}
@item
@option{--enable-presto_ftd2xx}
181
182
@item
@option{--enable-jlink}
ntfreak's avatar
ntfreak committed
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
@end itemize

If you want to access the parallel port using the PPDEV interface you have to specify
both the @option{--enable-parport} AND the @option{--enable-parport_ppdev} option since
the @option{--enable-parport_ppdev} option actually is an option to the parport driver
(see @uref{http://forum.sparkfun.com/viewtopic.php?t=3795} for more info).

Cygwin users have to specify the location of the FTDI D2XX package. This should be an
absolute path containing no spaces.

Linux users should copy the various parts of the D2XX package to the appropriate
locations, i.e. /usr/include, /usr/lib. 

@node Running
@chapter Running
198
@cindex running OpenOCD
ntfreak's avatar
ntfreak committed
199
200
201
202
@cindex --configfile
@cindex --debug_level
@cindex --logfile
@cindex --search
203
OpenOCD runs as a daemon, waiting for connections from clients (Telnet, GDB, Other).
204
Run with @option{--help} or @option{-h} to view the available command line switches.
ntfreak's avatar
ntfreak committed
205
206
207

It reads its configuration by default from the file openocd.cfg located in the current
working directory. This may be overwritten with the @option{-f <configfile>} command line
208
switch.  The @option{-f} command line switch can be specified multiple times, in which case the config files
209
210
are executed in order. 

211
Also it is possible to interleave commands w/config scripts using the @option{-c} command line switch. 
ntfreak's avatar
ntfreak committed
212
213
214
215
216
217
218
219
220

To enable debug output (when reporting problems or working on OpenOCD itself), use
the @option{-d} command line switch. This sets the debug_level to "3", outputting
the most information, including debug messages. The default setting is "2", outputting
only informational messages, warnings and errors. You can also change this setting
from within a telnet or gdb session (@option{debug_level <n>}).

You can redirect all output from the daemon to a file using the @option{-l <logfile>} switch.

221
Search paths for config/script files can be added to OpenOCD by using
222
223
224
the @option{-s <search>} switch. The current directory and the OpenOCD target library 
is in the search path by default.

225
Note! OpenOCD will launch the GDB & telnet server even if it can not establish a connection
226
227
with the target. In general, it is possible for the JTAG controller to be unresponsive until 
the target is set up correctly via e.g. GDB monitor commands in a GDB init script.
ntfreak's avatar
ntfreak committed
228
229
230
231

@node Configuration
@chapter Configuration
@cindex configuration
232
OpenOCD runs as a daemon, and reads it current configuration
ntfreak's avatar
ntfreak committed
233
by default from the file openocd.cfg in the current directory. A different configuration
234
file can be specified with the  @option{-f <conf.file>} command line switch specified when starting OpenOCD.
ntfreak's avatar
ntfreak committed
235
236
237
238
239
240
241
242

The configuration file is used to specify on which ports the daemon listens for new
connections, the JTAG interface used to connect to the target, the layout of the JTAG
chain, the targets that should be debugged, and connected flashes.

@section Daemon configuration

@itemize @bullet
243
244
@item @b{init} This command terminates the configuration stage and enters the normal
command mode. This can be useful to add commands to the startup scripts and commands
245
246
such as resetting the target, programming flash, etc. To reset the CPU upon startup,
add "init" and "reset" at the end of the config script or at the end of the
247
OpenOCD command line using the @option{-c} command line switch.
248
@cindex init
ntfreak's avatar
ntfreak committed
249
250
251
252
253
254
255
256
257
@item @b{telnet_port} <@var{number}>
@cindex telnet_port
Port on which to listen for incoming telnet connections 
@item @b{gdb_port} <@var{number}>
@cindex gdb_port
First port on which to listen for incoming GDB connections. The GDB port for the
first target will be gdb_port, the second target will listen on gdb_port + 1, and so on. 
@item @b{gdb_detach} <@var{resume|reset|halt|nothing}>
@cindex gdb_detach
258
Configures what OpenOCD will do when gdb detaches from the daeman.
ntfreak's avatar
ntfreak committed
259
260
261
Default behaviour is <@var{resume}>
@item @b{gdb_memory_map} <@var{enable|disable}>
@cindex gdb_memory_map
262
Set to <@var{enable}> to cause OpenOCD to send the memory configuration to gdb when
ntfreak's avatar
ntfreak committed
263
264
265
requested. gdb will then know when to set hardware breakpoints, and program flash
using the gdb load command. @option{gdb_flash_program enable} will also need enabling
for flash programming to work.
266
Default behaviour is <@var{enable}>
ntfreak's avatar
ntfreak committed
267
268
@item @b{gdb_flash_program} <@var{enable|disable}>
@cindex gdb_flash_program
269
Set to <@var{enable}> to cause OpenOCD to program the flash memory when a
ntfreak's avatar
ntfreak committed
270
vFlash packet is received.
271
Default behaviour is <@var{enable}>
272
273
274
275
276
 at item @b{tcl_port} <@var{number}>
 at cindex tcl_port
Port on which to listen for incoming TCL syntax. This port is intended as
a simplified RPC connection that can be used by clients to issue commands
and get the output from the TCL engine.
277
@item @b{daemon_startup} <@var{mode}>
ntfreak's avatar
ntfreak committed
278
@cindex daemon_startup
279
@option{mode} can either @option{attach} or @option{reset}
280
281
This is equivalent to adding "init" and "reset" to the end of the config script.

282
It is available as a command mainly for backwards compatibility.
ntfreak's avatar
ntfreak committed
283
284
285
286
287
288
289
290
291
292
@end itemize

@section JTAG interface configuration

@itemize @bullet
@item @b{interface} <@var{name}>
@cindex interface
Use the interface driver <@var{name}> to connect to the target. Currently supported
interfaces are
@itemize @minus
293
@item @b{parport}
ntfreak's avatar
ntfreak committed
294
295
296
PC parallel port bit-banging (Wigglers, PLD download cable, ...)
@end itemize
@itemize @minus
297
@item @b{amt_jtagaccel}
ntfreak's avatar
ntfreak committed
298
299
300
301
Amontec Chameleon in its JTAG Accelerator configuration connected to a PC's EPP
mode parallel port
@end itemize
@itemize @minus
302
@item @b{ft2232}
ntfreak's avatar
ntfreak committed
303
304
305
306
307
308
FTDI FT2232 based devices using either the open-source libftdi or the binary only
FTD2XX driver. The FTD2XX is superior in performance, but not available on every
platform. The libftdi uses libusb, and should be portable to all systems that provide
libusb.
@end itemize
@itemize @minus
309
@item @b{ep93xx}
ntfreak's avatar
ntfreak committed
310
311
Cirrus Logic EP93xx based single-board computer bit-banging (in development)
@end itemize
312
313
314
315
316
317
318
319
320
321
322
323
@itemize @minus
@item @b{presto}
ASIX PRESTO USB JTAG programmer.
@end itemize
@itemize @minus
@item @b{usbprog}
usbprog is a freely programmable USB adapter.
@end itemize
@itemize @minus
@item @b{gw16012}
Gateworks GW16012 JTAG programmer.
@end itemize
324
325
326
327
@itemize @minus
@item @b{jlink}
Segger jlink usb adapter
@end itemize
ntfreak's avatar
ntfreak committed
328
329
330
@end itemize

@itemize @bullet
331
@item @b{jtag_speed} <@var{reset speed}> <@var{post reset speed}>
ntfreak's avatar
ntfreak committed
332
333
@cindex jtag_speed
Limit the maximum speed of the JTAG interface. Usually, a value of zero means maximum
334
335
336
speed. The actual effect of this option depends on the JTAG interface used. Reset
speed is used during reset and post reset speed after reset. post reset speed
is optional, in which case the reset speed is used.
ntfreak's avatar
ntfreak committed
337
@itemize @minus
338

ntfreak's avatar
ntfreak committed
339
340
341
@item wiggler: maximum speed / @var{number}
@item ft2232: 6MHz / (@var{number}+1)
@item amt jtagaccel: 8 / 2**@var{number}
342
@item jlink: maximum speed in kHz (0-12000), 0 will use RTCK
ntfreak's avatar
ntfreak committed
343
344
345
346
347
@end itemize

Note: Make sure the jtag clock is no more than @math{1/6th × CPU-Clock}. This is
especially true for synthesized cores (-S).

348
349
350
351
352
353
354
@item @b{jtag_khz} <@var{reset speed kHz}>  <@var{post reset speed kHz}>
@cindex jtag_khz
Same as jtag_speed, except that the speed is specified in maximum kHz. If
the device can not support the rate asked for, or can not translate from
kHz to jtag_speed, then an error is returned. 0 means RTCK. If RTCK
is not supported, then an error is reported.

ntfreak's avatar
ntfreak committed
355
356
357
358
@item @b{reset_config} <@var{signals}> [@var{combination}] [@var{trst_type}] [@var{srst_type}]
@cindex reset_config
The configuration of the reset signals available on the JTAG interface AND the target.
If the JTAG interface provides SRST, but the target doesn't connect that signal properly,
359
360
361
then OpenOCD can't use it. <@var{signals}> can be @option{none}, @option{trst_only},
@option{srst_only} or @option{trst_and_srst}.

ntfreak's avatar
ntfreak committed
362
[@var{combination}] is an optional value specifying broken reset signal implementations.
363
364
@option{srst_pulls_trst} states that the testlogic is reset together with the reset of
the system (e.g. Philips LPC2000, "broken" board layout), @option{trst_pulls_srst} says
ntfreak's avatar
ntfreak committed
365
366
that the system is reset together with the test logic (only hypothetical, I haven't
seen hardware with such a bug, and can be worked around).
367
368
@option{combined} imples both @option{srst_pulls_trst} and @option{trst_pulls_srst}.
The default behaviour if no option given is @option{separate}.
ntfreak's avatar
ntfreak committed
369
370

The [@var{trst_type}] and [@var{srst_type}] parameters allow the driver type of the
371
372
373
reset lines to be specified. Possible values are @option{trst_push_pull} (default)
and @option{trst_open_drain} for the test reset signal, and @option{srst_open_drain}
(default) and @option{srst_push_pull} for the system reset. These values only affect
ntfreak's avatar
ntfreak committed
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
JTAG interfaces with support for different drivers, like the Amontec JTAGkey and JTAGAccelerator. 

@item @b{jtag_device} <@var{IR length}> <@var{IR capture}> <@var{IR mask}> <@var{IDCODE instruction}>
@cindex jtag_device
Describes the devices that form the JTAG daisy chain, with the first device being
the one closest to TDO. The parameters are the length of the instruction register
(4 for all ARM7/9s), the value captured during Capture-IR (0x1 for ARM7/9), and a mask
of bits that should be validated when doing IR scans (all four bits (0xf) for ARM7/9).
The IDCODE instruction will in future be used to query devices for their JTAG
identification code. This line is the same for all ARM7 and ARM9 devices.
Other devices, like CPLDs, require different parameters. An example configuration
line for a Xilinx XC9500 CPLD would look like this:
@smallexample
jtag_device 8 0x01 0x0e3 0xfe
@end smallexample
The instruction register (IR) is 8 bits long, during Capture-IR 0x01 is loaded into
the IR, but only bits 0-1 and 5-7 should be checked, the others (2-4) might vary.
The IDCODE instruction is 0xfe.

@item @b{jtag_nsrst_delay} <@var{ms}>
@cindex jtag_nsrst_delay
395
How long (in milliseconds) OpenOCD should wait after deasserting nSRST before
ntfreak's avatar
ntfreak committed
396
397
398
starting new JTAG operations. 
@item @b{jtag_ntrst_delay} <@var{ms}>
@cindex jtag_ntrst_delay
399
How long (in milliseconds) OpenOCD should wait after deasserting nTRST before
ntfreak's avatar
ntfreak committed
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
starting new JTAG operations. 

The jtag_n[st]rst_delay options are useful if reset circuitry (like a reset supervisor,
or on-chip features) keep a reset line asserted for some time after the external reset
got deasserted.
@end itemize

@section parport options

@itemize @bullet
@item @b{parport_port} <@var{number}>
@cindex parport_port
Either the address of the I/O port (default: 0x378 for LPT1) or the number of
the @file{/dev/parport} device

When using PPDEV to access the parallel port, use the number of the parallel port:
@option{parport_port 0} (the default). If @option{parport_port 0x378} is specified
you may encounter a problem.
@item @b{parport_cable} <@var{name}>
@cindex parport_cable
The layout of the parallel port cable used to connect to the target.
Currently supported cables are 
@itemize @minus
423
@item @b{wiggler}
ntfreak's avatar
ntfreak committed
424
@cindex wiggler
425
The original Wiggler layout, also supported by several clones, such
ntfreak's avatar
ntfreak committed
426
as the Olimex ARM-JTAG
427
@item @b{old_amt_wiggler}
ntfreak's avatar
ntfreak committed
428
429
430
@cindex old_amt_wiggler
The Wiggler configuration that comes with Amontec's Chameleon Programmer. The new
version available from the website uses the original Wiggler layout ('@var{wiggler}')
431
@item @b{chameleon}
ntfreak's avatar
ntfreak committed
432
@cindex chameleon
433
The Amontec Chameleon's CPLD when operated in configuration mode. This is only used to program the Chameleon itself, not a connected target.
434
@item @b{dlc5}
ntfreak's avatar
ntfreak committed
435
@cindex dlc5
436
The Xilinx Parallel cable III.
437
@item @b{triton}
ntfreak's avatar
ntfreak committed
438
439
440
441
@cindex triton
The parallel port adapter found on the 'Karo Triton 1 Development Board'.
This is also the layout used by the HollyGates design
(see @uref{http://www.lartmaker.nl/projects/jtag/}).
442
@item @b{flashlink}
ntfreak's avatar
ntfreak committed
443
@cindex flashlink
444
The ST Parallel cable. 
ntfreak's avatar
ntfreak committed
445
446
447
448
@end itemize
@item @b{parport_write_on_exit} <@var{on|off}>
@cindex parport_write_on_exit
This will configure the parallel driver to write a known value to the parallel
449
interface on exiting OpenOCD
ntfreak's avatar
ntfreak committed
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
@end itemize

@section amt_jtagaccel options
@itemize @bullet
@item @b{parport_port} <@var{number}>
@cindex parport_port
Either the address of the I/O port (default: 0x378 for LPT1) or the number of the
@file{/dev/parport} device 
@end itemize
@section ft2232 options

@itemize @bullet
@item @b{ft2232_device_desc} <@var{description}>
@cindex ft2232_device_desc
The USB device description of the FTDI FT2232 device. If not specified, the FTDI
default value is used. This setting is only valid if compiled with FTD2XX support.
@item @b{ft2232_layout} <@var{name}>
@cindex ft2232_layout
The layout of the FT2232 GPIO signals used to control output-enables and reset
signals. Valid layouts are
@itemize @minus
471
@item @b{usbjtag}
472
"USBJTAG-1" layout described in the original OpenOCD diploma thesis
473
@item @b{jtagkey}
ntfreak's avatar
ntfreak committed
474
Amontec JTAGkey and JTAGkey-tiny
475
@item @b{signalyzer}
ntfreak's avatar
ntfreak committed
476
Signalyzer
477
@item @b{olimex-jtag}
ntfreak's avatar
ntfreak committed
478
Olimex ARM-USB-OCD
479
@item @b{m5960}
ntfreak's avatar
ntfreak committed
480
American Microsystems M5960
481
@item @b{evb_lm3s811}
ntfreak's avatar
ntfreak committed
482
483
Luminary Micro EVB_LM3S811 as a JTAG interface (not onboard processor), no TRST or
SRST signals on external connector
484
@item @b{comstick}
ntfreak's avatar
ntfreak committed
485
Hitex STR9 comstick 
486
@item @b{stm32stick}
ntfreak's avatar
ntfreak committed
487
Hitex STM32 Performance Stick
488
@item @b{flyswatter}
ntfreak's avatar
ntfreak committed
489
Tin Can Tools Flyswatter
490
@item @b{turtelizer2}
ntfreak's avatar
ntfreak committed
491
egnite Software turtelizer2
492
@item @b{oocdlink}
ntfreak's avatar
ntfreak committed
493
494
495
496
497
OOCDLink
@end itemize

@item @b{ft2232_vid_pid} <@var{vid}> <@var{pid}>
The vendor ID and product ID of the FTDI FT2232 device. If not specified, the FTDI
498
499
500
501
default values are used. Multiple <@var{vid}>, <@var{pid}> pairs may be given, eg.
@smallexample
ft2232_vid_pid 0x0403 0xcff8 0x15ba 0x0003
@end smallexample
ntfreak's avatar
ntfreak committed
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
@item @b{ft2232_latency} <@var{ms}>
On some systems using ft2232 based JTAG interfaces the FT_Read function call in
ft2232_read() fails to return the expected number of bytes. This can be caused by
USB communication delays and has proved hard to reproduce and debug. Setting the
FT2232 latency timer to a larger value increases delays for short USB packages but it
also reduces the risk of timeouts before receiving the expected number of bytes.
The OpenOCD default value is 2 and for some systems a value of 10 has proved useful. 
@end itemize

@section ep93xx options
@cindex ep93xx options
Currently, there are no options available for the ep93xx interface.

@page
@section Target configuration

@itemize @bullet
@item @b{target} <@var{type}> <@var{endianess}> <@var{reset_mode}> <@var{JTAG pos}>
<@var{variant}>
@cindex target
Defines a target that should be debugged. Currently supported types are:
@itemize @minus
524
525
526
527
528
529
530
531
532
533
@item @b{arm7tdmi}
@item @b{arm720t}
@item @b{arm9tdmi}
@item @b{arm920t}
@item @b{arm922t}
@item @b{arm926ejs}
@item @b{arm966e}
@item @b{cortex_m3}
@item @b{feroceon}
@item @b{xscale}
ntfreak's avatar
ntfreak committed
534
535
536
537
538
539
540
541
542
@end itemize

If you want to use a target board that is not on this list, see Adding a new
target board

Endianess may be @option{little} or @option{big}.

The reset_mode specifies what should happen to the target when a reset occurs:
@itemize @minus
543
@item @b{reset_halt}
ntfreak's avatar
ntfreak committed
544
545
546
547
@cindex reset_halt
Immediately request a target halt after reset. This allows targets to be debugged
from the very first instruction. This is only possible with targets and JTAG
interfaces that correctly implement the reset signals.
548
@item @b{reset_init}
ntfreak's avatar
ntfreak committed
549
550
551
552
@cindex reset_init
Similar to @option{reset_halt}, but executes the script file defined to handle the
'reset' event for the target. Like @option{reset_halt} this only works with
correct reset implementations.
553
@item @b{reset_run}
ntfreak's avatar
ntfreak committed
554
555
@cindex reset_run
Simply let the target run after a reset.
556
@item @b{run_and_halt}
ntfreak's avatar
ntfreak committed
557
558
@cindex run_and_halt
Let the target run for some time (default: 1s), and then request halt.
559
@item @b{run_and_init}
ntfreak's avatar
ntfreak committed
560
561
562
563
564
565
566
567
568
569
570
571
@cindex run_and_init
A combination of @option{reset_init} and @option{run_and_halt}. The target is allowed
to run for some time, then halted, and the @option{reset} event script is executed. 
@end itemize

On JTAG interfaces / targets where system reset and test-logic reset can't be driven
completely independent (like the LPC2000 series), or where the JTAG interface is
unavailable for some time during startup (like the STR7 series), you can't use
@option{reset_halt} or @option{reset_init}.

@item @b{target_script} <@var{target#}> <@var{event}> <@var{script_file}>
@cindex target_script
572
573
574
575
Event is one of the following:
@option{pre_reset}, @option{reset}, @option{post_reset}, @option{post_halt},
@option{pre_resume} or @option{gdb_program_config}.
@option{post_reset} and @option{reset} will produce the same results.
ntfreak's avatar
ntfreak committed
576
577
578
579
580
581
582
583
584
585
586
587

@item @b{run_and_halt_time} <@var{target#}> <@var{time_in_ms}>
@cindex run_and_halt_time
The amount of time the debugger should wait after releasing reset before it asserts
a debug request. This is used by the @option{run_and_halt} and @option{run_and_init}
reset modes. 
@item @b{working_area} <@var{target#}> <@var{address}> <@var{size}>
<@var{backup}|@var{nobackup}>
@cindex working_area
Specifies a working area for the debugger to use. This may be used to speed-up
downloads to target memory and flash operations, or to perform otherwise unavailable
operations (some coprocessor operations on ARM7/9 systems, for example). The last
588
589
parameter decides whether the memory should be preserved (<@var{backup}>) or can simply be overwritten (<@var{nobackup}>). If possible, use
a working_area that doesn't need to be backed up, as performing a backup slows down operation. 
ntfreak's avatar
ntfreak committed
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
@end itemize

@subsection arm7tdmi options
@cindex arm7tdmi options
target arm7tdmi <@var{endianess}> <@var{reset_mode}> <@var{jtag#}>
The arm7tdmi target definition requires at least one additional argument, specifying
the position of the target in the JTAG daisy-chain. The first JTAG device is number 0.
The optional [@var{variant}] parameter has been removed in recent versions.
The correct feature set is determined at runtime. 

@subsection arm720t options
@cindex arm720t options
ARM720t options are similar to ARM7TDMI options.

@subsection arm9tdmi options
@cindex arm9tdmi options
ARM9TDMI options are similar to ARM7TDMI options. Supported variants are
@option{arm920t}, @option{arm922t} and @option{arm940t}.
This enables the hardware single-stepping support found on these cores.

@subsection arm920t options
@cindex arm920t options
ARM920t options are similar to ARM9TDMI options.

@subsection arm966e options
@cindex arm966e options
ARM966e options are similar to ARM9TDMI options.

618
619
620
621
622
623
624
@subsection cortex_m3 options
@cindex cortex_m3 options
use variant <@var{variant}> @option{lm3s} when debugging luminary lm3s targets. This will cause
openocd to use a software reset rather than asserting SRST to avoid a issue with clearing
the debug registers. This is fixed in Fury Rev B, DustDevil Rev B, Tempest, these revisions will
be detected and the normal reset behaviour used.

ntfreak's avatar
ntfreak committed
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
@subsection xscale options
@cindex xscale options
Supported variants are @option{ixp42x}, @option{ixp45x}, @option{ixp46x},
@option{pxa250}, @option{pxa255}, @option{pxa26x}.

@section Flash configuration
@cindex Flash configuration

@itemize @bullet
@item @b{flash bank} <@var{driver}> <@var{base}> <@var{size}> <@var{chip_width}>
<@var{bus_width}> <@var{target#}> [@var{driver_options ...}]
@cindex flash bank
Configures a flash bank at <@var{base}> of <@var{size}> bytes and <@var{chip_width}>
and <@var{bus_width}> bytes using the selected flash <driver>.
@end itemize

@subsection lpc2000 options
@cindex lpc2000 options

@b{flash bank lpc2000} <@var{base}> <@var{size}> 0 0 <@var{target#}> <@var{variant}>
<@var{clock}> [@var{calc_checksum}]
LPC flashes don't require the chip and bus width to be specified. Additional
parameters are the <@var{variant}>, which may be @var{lpc2000_v1} (older LPC21xx and LPC22xx)
or @var{lpc2000_v2} (LPC213x, LPC214x, LPC210[123], LPC23xx and LPC24xx), the number
of the target this flash belongs to (first is 0), the frequency at which the core
is currently running (in kHz - must be an integral number), and the optional keyword
@var{calc_checksum}, telling the driver to calculate a valid checksum for the exception
vector table. 

@subsection cfi options
@cindex cfi options

@b{flash bank cfi} <@var{base}> <@var{size}> <@var{chip_width}> <@var{bus_width}>
<@var{target#}>
CFI flashes require the number of the target they're connected to as an additional
argument. The CFI driver makes use of a working area (specified for the target)
to significantly speed up operation. 

@var{chip_width} and @var{bus_width} are specified in bytes.

@subsection at91sam7 options
@cindex at91sam7 options

@b{flash bank at91sam7} 0 0 0 0 <@var{target#}>
AT91SAM7 flashes only require the @var{target#}, all other values are looked up after
reading the chip-id and type. 

@subsection str7 options
@cindex str7 options

@b{flash bank str7x} <@var{base}> <@var{size}> 0 0 <@var{target#}> <@var{variant}>
variant can be either STR71x, STR73x or STR75x. 

@subsection str9 options
@cindex str9 options

@b{flash bank str9x} <@var{base}> <@var{size}> 0 0 <@var{target#}>
The str9 needs the flash controller to be configured prior to Flash programming, eg.
@smallexample
str9x flash_config 0 4 2 0 0x80000
@end smallexample
This will setup the BBSR, NBBSR, BBADR and NBBADR registers respectively. 

@subsection str9 options (str9xpec driver)

@b{flash bank str9xpec} <@var{base}> <@var{size}> 0 0 <@var{target#}>
Before using the flash commands the turbo mode will need enabling using str9xpec
@option{enable_turbo} <@var{num>.}

Only use this driver for locking/unlocking the device or configuring the option bytes.
Use the standard str9 driver for programming.

@subsection stellaris (LM3Sxxx) options
@cindex stellaris (LM3Sxxx) options

@b{flash bank stellaris} <@var{base}> <@var{size}> 0 0 <@var{target#}>
stellaris flash plugin only require the @var{target#}. 

@subsection stm32x options
@cindex stm32x options

@b{flash bank stm32x} <@var{base}> <@var{size}> 0 0 <@var{target#}>
stm32x flash plugin only require the @var{target#}. 

709
710
711
712
713
714
715
716
717
718
719
720
@node Target library
@chapter Target library
@cindex Target library

OpenOCD comes with a target configuration script library. These scripts can be
used as-is or serve as a starting point.

The target library is published together with the openocd executable and 
the path to the target library is in the OpenOCD script search path.
Similarly there are example scripts for configuring the JTAG interface. 

The command line below uses the example parport configuration scripts
721
that ship with OpenOCD, then configures the str710.cfg target and
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
finally issues the init and reset command. The communication speed
is set to 10kHz for reset and 8MHz for post reset.


@smallexample
openocd -f interface/parport.cfg -c "jtag_khz 10 8000" -f target/str710.cfg -c "init" -c "reset"
@end smallexample


To list the target scripts available:

@smallexample
$ ls  /usr/local/lib/openocd/target

arm7_fast.cfg    lm3s6965.cfg  pxa255.cfg      stm32.cfg   xba_revA3.cfg
at91eb40a.cfg    lpc2148.cfg   pxa255_sst.cfg  str710.cfg  zy1000.cfg
at91r40008.cfg   lpc2294.cfg   sam7s256.cfg    str912.cfg
at91sam9260.cfg  nslu2.cfg     sam7x256.cfg    wi-9c.cfg
@end smallexample


ntfreak's avatar
ntfreak committed
743
744
745
746
@node Commands
@chapter Commands
@cindex commands

747
748
OpenOCD allows user interaction through a GDB server (default: port 3333),
a telnet interface (default: port 4444), and a TCL interface (default: port 5555). The command line interpreter
ntfreak's avatar
ntfreak committed
749
750
751
752
753
is available from both the telnet interface and a GDB session. To issue commands to the
interpreter from within a GDB session, use the @option{monitor} command, e.g. use
@option{monitor poll} to issue the @option{poll} command. All output is relayed through the
GDB session.

754
755
756
757
The TCL interface is used as a simplified RPC mechanism that feeds all the
input into the TCL interpreter and returns the output from the evaluation of
the commands.

ntfreak's avatar
ntfreak committed
758
759
760
761
762
763
764
765
766
767
@section Daemon

@itemize @bullet
@item @b{sleep} <@var{msec}>
@cindex sleep
Wait for n milliseconds before resuming. Useful in connection with script files
(@var{script} command and @var{target_script} configuration). 

@item @b{shutdown}
@cindex shutdown
768
Close the OpenOCD daemon, disconnecting all clients (GDB, Telnet, Other). 
ntfreak's avatar
ntfreak committed
769
770
771
772
773

@item @b{debug_level} [@var{n}]
@cindex debug_level
Display or adjust debug level to n<0-3> 

oharboe's avatar
oharboe committed
774
775
776
777
778
779
780
781
782
783
784
785
786
787
@item @b{fast} [@var{enable/disable}]
@cindex fast
Default disabled. Set default behaviour of OpenOCD to be "fast and dangerous". For instance ARM7/9 DCC memory
downloads and fast memory access will work if the JTAG interface isn't too fast and
the core doesn't run at a too low frequency. Note that this option only changes the default
and that the indvidual options, like DCC memory downloads, can be enabled and disabled
individually. 

The target specific "dangerous" optimisation tweaking options may come and go
as more robust and user friendly ways are found to ensure maximum throughput
and robustness with a minimum of configuration. 

Typically the "fast enable" is specified first on the command line:

788
@smallexample
oharboe's avatar
oharboe committed
789
openocd -c "fast enable" -c "interface dummy" -f target/str710.cfg
790
@end smallexample
oharboe's avatar
oharboe committed
791

ntfreak's avatar
ntfreak committed
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
@item @b{log_output} <@var{file}>
@cindex log_output
Redirect logging to <file> (default: stderr) 

@item @b{script} <@var{file}>
@cindex script
Execute commands from <file> 

@end itemize

@subsection Target state handling
@itemize @bullet
@item @b{poll} [@option{on}|@option{off}]
@cindex poll
Poll the target for its current state. If the target is in debug mode, architecture
807
specific information about the current state is printed. An optional parameter
ntfreak's avatar
ntfreak committed
808
809
810
811
allows continuous polling to be enabled and disabled.

@item @b{halt} [@option{ms}]
@cindex halt
812
Send a halt request to the target and wait for it to halt for up to [@option{ms}] milliseconds.
ntfreak's avatar
ntfreak committed
813
814
Default [@option{ms}] is 5 seconds if no arg given.
Optional arg @option{ms} is a timeout in milliseconds. Using 0 as the [@option{ms}]
815
will stop OpenOCD from waiting.
ntfreak's avatar
ntfreak committed
816
817
818
819
820
821
822
823
824
825

@item @b{wait_halt} [@option{ms}]
@cindex wait_halt
Wait for the target to enter debug mode. Optional [@option{ms}] is
a timeout in milliseconds. Default [@option{ms}] is 5 seconds if no
arg given.

@item @b{resume} [@var{address}]
@cindex resume
Resume the target at its current code position, or at an optional address.
826
OpenOCD will wait 5 seconds for the target to resume.
ntfreak's avatar
ntfreak committed
827
828
829
830
831
832
833
834

@item @b{step} [@var{address}]
@cindex step
Single-step the target at its current code position, or at an optional address. 

@item @b{reset} [@option{run}|@option{halt}|@option{init}|@option{run_and_halt}
|@option{run_and_init}]
@cindex reset
835
836
Perform a hard-reset. The optional parameter specifies what should happen after the reset.
This optional parameter overrides the setting specified in the configuration file,
ntfreak's avatar
ntfreak committed
837
838
making the new behaviour the default for the @option{reset} command.
@itemize @minus
839
@item @b{run}
ntfreak's avatar
ntfreak committed
840
841
@cindex reset run
Let the target run.
842
@item @b{halt}
ntfreak's avatar
ntfreak committed
843
844
@cindex reset halt
Immediately halt the target (works only with certain configurations).
845
@item @b{init}
ntfreak's avatar
ntfreak committed
846
847
848
@cindex reset init
Immediately halt the target, and execute the reset script (works only with certain
configurations)
849
@item @b{run_and_halt}
ntfreak's avatar
ntfreak committed
850
851
@cindex reset run_and_halt
Let the target run for a certain amount of time, then request a halt.
852
@item @b{run_and_init}
ntfreak's avatar
ntfreak committed
853
854
@cindex reset run_and_init
Let the target run for a certain amount of time, then request a halt. Execute the
855
reset script once the target enters debug mode.
ntfreak's avatar
ntfreak committed
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
@end itemize
@end itemize

@subsection Memory access commands
These commands allow accesses of a specific size to the memory system:
@itemize @bullet
@item @b{mdw} <@var{addr}> [@var{count}]
@cindex mdw
display memory words 
@item @b{mdh} <@var{addr}> [@var{count}]
@cindex mdh
display memory half-words 
@item @b{mdb} <@var{addr}> [@var{count}]
@cindex mdb
display memory bytes 
@item @b{mww} <@var{addr}> <@var{value}>
@cindex mww
write memory word 
@item @b{mwh} <@var{addr}> <@var{value}>
@cindex mwh
write memory half-word 
@item @b{mwb} <@var{addr}> <@var{value}>
@cindex mwb
write memory byte 

@item @b{load_image} <@var{file}> <@var{address}> [@option{bin}|@option{ihex}|@option{elf}]
@cindex load_image
Load image <@var{file}> to target memory at <@var{address}> 
@item @b{dump_image} <@var{file}> <@var{address}> <@var{size}>
@cindex dump_image
Dump <@var{size}> bytes of target memory starting at <@var{address}> to a
(binary) <@var{file}>.
@item @b{verify_image} <@var{file}> <@var{address}> [@option{bin}|@option{ihex}|@option{elf}]
@cindex verify_image
890
891
Verify <@var{file}> against target memory starting at <@var{address}>.
This will first attempt comparison using a crc checksum, if this fails it will try a binary compare.
ntfreak's avatar
ntfreak committed
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
@end itemize

@subsection Flash commands
@cindex Flash commands
@itemize @bullet
@item @b{flash banks}
@cindex flash banks
List configured flash banks 
@item @b{flash info} <@var{num}>
@cindex flash info
Print info about flash bank <@option{num}> 
@item @b{flash probe} <@var{num}>
@cindex flash probe
Identify the flash, or validate the parameters of the configured flash. Operation
depends on the flash type. 
@item @b{flash erase_check} <@var{num}>
@cindex flash erase_check
Check erase state of sectors in flash bank <@var{num}>. This is the only operation that
updates the erase state information displayed by @option{flash info}. That means you have
to issue an @option{erase_check} command after erasing or programming the device to get
updated information. 
@item @b{flash protect_check} <@var{num}>
@cindex flash protect_check
Check protection state of sectors in flash bank <num>. 
@option{flash erase_sector} using the same syntax. 
@item @b{flash erase_sector} <@var{num}> <@var{first}> <@var{last}>
@cindex flash erase_sector
Erase sectors at bank <@var{num}>, starting at sector <@var{first}> up to and including
920
<@var{last}>. Sector numbering starts at 0. Depending on the flash type, erasing may
ntfreak's avatar
ntfreak committed
921
922
923
924
require the protection to be disabled first (e.g. Intel Advanced Bootblock flash using
the CFI driver).
@item @b{flash erase_address} <@var{address}> <@var{length}>
@cindex flash erase_address
925
Erase sectors starting at <@var{address}> for <@var{length}> bytes
926
927
@item @b{flash write_bank} <@var{num}> <@var{file}> <@var{offset}>
@cindex flash write_bank
ntfreak's avatar
ntfreak committed
928
Write the binary <@var{file}> to flash bank <@var{num}>, starting at
929
<@option{offset}> bytes from the beginning of the bank.
930
@item @b{flash write_image} [@var{erase}] <@var{file}> [@var{offset}] [@var{type}]
ntfreak's avatar
ntfreak committed
931
932
933
934
@cindex flash write_image
Write the image <@var{file}> to the current target's flash bank(s). A relocation
[@var{offset}] can be specified and the file [@var{type}] can be specified
explicitly as @option{bin} (binary), @option{ihex} (Intel hex), @option{elf}
935
936
(ELF file) or @option{s19} (Motorola s19). Flash memory will be erased prior to programming
if the @option{erase} parameter is given.
ntfreak's avatar
ntfreak committed
937
938
939
@item @b{flash protect} <@var{num}> <@var{first}> <@var{last}> <@option{on}|@option{off}>
@cindex flash protect
Enable (@var{on}) or disable (@var{off}) protection of flash sectors <@var{first}> to
940
<@var{last}> of @option{flash bank} <@var{num}>.
ntfreak's avatar
ntfreak committed
941
942
943
944
945
946
947
948
949
950
951
952
@end itemize

@page
@section Target Specific Commands
@cindex Target Specific Commands

@subsection AT91SAM7 specific commands
@cindex AT91SAM7 specific commands
The flash configuration is deduced from the chip identification register. The flash
controller handles erases automatically on a page (128/265 byte) basis so erase is
not necessary for flash programming. AT91SAM7 processors with less than 512K flash
only have a single flash bank embedded on chip. AT91SAM7xx512 have two flash planes
953
that can be erased separatly. Only an EraseAll command is supported by the controller
ntfreak's avatar
ntfreak committed
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
for each flash plane and this is called with
@itemize @bullet
@item @b{flash erase} <@var{num}> @var{first_plane} @var{last_plane}
bulk erase flash planes first_plane to last_plane. 
@item @b{at91sam7 gpnvm} <@var{num}> <@var{bit}> <@option{set}|@option{clear}>
@cindex at91sam7 gpnvm
set or clear a gpnvm bit for the processor 
@end itemize

@subsection STR9 specific commands
@cindex STR9 specific commands
These are flash specific commands when using the str9xpec driver.
@itemize @bullet
@item @b{str9xpec enable_turbo} <@var{num}>
@cindex str9xpec enable_turbo
enable turbo mode, simply this will remove the str9 from the chain and talk
directly to the embedded flash controller. 
@item @b{str9xpec disable_turbo} <@var{num}>
@cindex str9xpec disable_turbo
restore the str9 into jtag chain. 
@item @b{str9xpec lock} <@var{num}>
@cindex str9xpec lock
lock str9 device. The str9 will only respond to an unlock command that will
erase the device. 
@item @b{str9xpec unlock} <@var{num}>
@cindex str9xpec unlock
unlock str9 device. 
@item @b{str9xpec options_read} <@var{num}>
@cindex str9xpec options_read
read str9 option bytes. 
@item @b{str9xpec options_write} <@var{num}>
@cindex str9xpec options_write
write str9 option bytes. 
@end itemize

@subsection STR9 configuration
@cindex STR9 configuration
@itemize @bullet
@item @b{str9x flash_config} <@var{bank}> <@var{BBSR}> <@var{NBBSR}>
<@var{BBADR}> <@var{NBBADR}>
@cindex str9x flash_config
Configure str9 flash controller.
@smallexample
eg. str9x flash_config 0 4 2 0 0x80000
This will setup
BBSR - Boot Bank Size register
NBBSR - Non Boot Bank Size register