Wednesday, 28 November 2007

OpenOCD Quick Reference Card

OpenOCD Quick Reference Card

OpenOCD Homepage:

Current OpenOCD revision: 128


Configuration Commands

telnet port Listen for telnet connections on port.

gdb port Listen for GDB connections on port, port+1, . . .(target 1, target 2, . . . )

User Commands

shutdown Shut server down.

exit Exit telnet. Leaves server running.

help Print available commands.


The interpreter commands may be used to define variables used within other subsystems like JTAG.

var [’del’|([size1] [sizeN])] Allocate, display or delete

variable. Allocation has to define the size for all num fields elements.

field [value| ’flip’ ] Display or modify variable field.

script Execute commands from file.


Configuration Commands

target Target type is arm7tdmi, arm9tdmi, arm720t, arm920t, arm926ejs,arm966e; endianness is either big or little; reset mode is one of reset halt, reset run,reset init, run and halt, run and init. Do not use reset halt orreset init on LPC2 or STR7.

target arm7tdmi [variant] variant is one ofarm7tdmi r4, arm7tdmi-s r4,

target arm9tdmi [variant] variant is one of arm920t, arm922t and

daemon startup <’reset’|’attach’> Describes what to do with target on
daemon startup.

target script event is either post halt or pre resume.

run and halt time Delay in msec between reset and debug request.

working area [backup|nobackup]

User Commands

targets [num] Display list of configured targets,or make target num the current target.reg [#|name] [value|’force’] Display or modify registers.

poll [’on’|’off’] Print information about the current target state. If the target is in debug mode, architecture specific information
about the current state are printed. Enable or disable continuous polling with optional parameter.
wait halt Wait for target halt halt Halt target


Resume the target at
the current position or at


Single-step at the
current position or at

reset [’run’|’halt’|’init’|’run and
halt’| ’run and init’]
the target in a few variations.
soft reset halt Halt
the target and do a soft reset.

md[whb] [count]
Display count words (32 bit),
half-words (16 bit) or bytes at address.
If count is omitted, one element is

mw[whb] Write
value at theword, half-word or byte
location address.

bp [hw] Set
a breakpoint of length bytes at address.

rbp Remove breakpoint at address.

Set a watchpoint of length bytes
at address.

rwp Remove a watchpoint at address.

load binary
Load binary file into target
memory (RAM) at address.

dump binary Dump target memory of size bytes at address

ARM v4/5

armv4 5 reg Display all banked ARM core

armv4 5 core mode [’arm’|’thumb’] Display thecurrent core state, or
switch between Arm and Thumb state.

armv4 5 disassemble [’thumb’] Disassemble instructions


The commands are cp15, virt2phys, mdw phys, mdh phys, mdb
, mww phys, mwh phys, mwb

See ARM7/9 for a short description.

ARM 7/9

arm7 9 write xpsr Write the program status register.
spsr selects between the current program status register (0) and the saved
program status register (1) of the current mode.

arm7 9 write xpsr im8 <8bit> Same as write xpsr, but use the
immediate operand opcode.

arm7 9 write core reg Write core register num of mode with value.

arm7 9 sw bkpts Enable or disable the use of
software breakpoints.

arm7 9 force hw bkpts Force the use of hardware breakpoints.

arm7 9 dbgrq Use EmbeddedICE dbgrq instead of
breakpoint for target halt requests (safe for all except ARM7TDMI

arm7 9 fast memory access Use fast but potentially unsafe memory accesses
instead of slow accesses. Assumes a sufficiently high clock speed.

arm7 9 dcc downloads use DCC downloads for larger memory writes.


arm920t cp15 [value] Display/modify CP15 register

arm920t cp15i
[value] [address]
cp15 (interpreted access)
arm920t cache info Display information about target caches.

arm920t virt2phys Translate
virtual to physical address.

arm920t md[whb]
phys [count]
memory word, half word, byte

arm920t mw[whb]
write memory word,
half word, byte

arm920t read cache display I/D
cache content

arm920t read mmu display I/D
mmu content


arm926ejs ... XXX To Do ARM966E

arm966e cp15 [value] Display/modify

CP15 register


Configuration Commands

interface name is one of parport,amt jtagaccel, ft2232, ep93xx


Describes the devices that form the JTAG daisy chain, with the first device
being the one closest to TDO.

jtag nsrst delay ms milliseconds delay between going nSRST inactive and
following JTAG operations.

jtag ntrst delay ms milliseconds delay between going nTRST inactive and
following JTAG operations.

reset config
[combination] [trst-type] [srst-type]
is one of none, trst
only, srst only or trst and srst.
Combination is one of srst pulls trst, trst pulls srst, combined,
trst-type is one oftrst open drain, trst push
srst-type is one of srst push pull, srst open
User &
Config Commands

jtag speed Select JTAG Speed ft2232: 6 MHz / (value+1) parport:
maximum speed /value
: 8 / 2**value

Note: Max. JTAG-Clock _ 1

6 × CPU-Clock!


parport port – Either I/O port address

(e.g. 0x378) or the number of the

/dev/parport device.

parport cable name is one of wiggler, old amt wiggler, chameleon, dlc5 (Xilinx
cable III), triton.

Amt jtagaccel

parport port see previous description.


ft2232 device desc USB device description. Use usbview or similar tool to get this string.

ft2232 layout Layout name is one of jtagkey, usbjtag, signalyzer, olimex-jtag, m5960, evb

ft2232 vid pid Vendor-ID vid and product-ID pid of
the FTDI device.

User Commands

scan chain
Print scan chain

endstate Finish JTAG operations in tap state.

jtag reset
Toggle reset lines.

runtest Move to Run-Test/Idle and execute num cycles. statemove Move to current endstate or tap state.

[devN] [instrN]
IR scan.

drscan [devN] [varN] Execute DR scan.


flash banks
Display list of
configured flash banks

flash info
Display information and
list of

blocks of
flash bank

flash probe
Probe flash bank num if it

matches the
configured bank.

flash erase check Check erase
state of flash sectors in bank

flash protect check Check protect
state of flash sectors in bank

flash erase Erase sectors at bank num, starting at sector first up to

and including last. Sector numbering starts at 0.

flash write Write binfile (in binary
format!) to bank num at offset bytes
from start of bank.

flash protect <’on’|’off’>

Enable (on) or disable (off)
protection of flash

sectors first to last of flash bank num.

flash bank [driver options...] Configure a flash bank at address base of size bytes with
a bus of
bus width bits formed by chips of chip width bits size using driver lpc2000, cfi, at91sam7, str7x,

flash bank lpc2000 0 0[’calc
The internal
flash of LPC2000 devices doesn’t require

chip- and buswidth to be defined.

lpc variant specifies the supported IAP commands

of the device (lpc2000 v1:2104—5—6, 2114—9,

2124—9, 2194, 2212—4, 2292—4; lpc2000 v2:

213x, 214x, 2101—2—3). The flash
bank is part

of target# which runs at cclk kHz.
Calc checksum

inserts a valid checksum into the
exception vector

when this area is flashed.

For LPC2138 and LPC2148 devices, the
size argument

has to reflect the user-accessible
size, i.e.

0x7d000 (500kB), not 0x80000

flash bank at91sam7 0 0 0 0

flash bank str7x 0 0

variant is one of STR71x,

STR73x or STR75x.

flash bank str9x 0 0 0

The str9 needs the flash controller
to be configured

prior to Flash programming:

str9x flash config b0size b1size


Example: str9x flash config 4 2 0 0x80000

This will setup the BBSR, NBBSR,

NBBADR registers respectively.

flash bank cfi

at91sam7 gpnvm set|clear set or

clear at91sam7 gpnvm bit

lpc2000 part id print part id of lpc2000

flash bank num


xsvf Program Xilinx Coolrunner




Commandline Options

$ openocd --help

Open On-Chip Debugger

(c) 2005 by Dominic Rath

--help | -h display this help

--file | -f use configuration file

--debug | -d set debug level

--log_output | -l redirect log
output to file

--interface | -i use jtag interface

Sample Configuration

[see $(SRCDIR)/doc/configs/*.cfg]

Some GDB commands

(gdb) target remote localhost:3333

(gdb) monitor arm7 9 force hw bkpts

force hardware breakpoints

More information

- Get current version with

svn co

- OpenOCD Forum at Spark Fun


- OpenFacts


- Mailing List “openocd-development”


- Yagarto ARM toolchain (Windows)

- Amontec JTAGkey[-Tiny], sdk4arm


QuickRef written by

Date: 2007-02-03

Download this QuickRef from

No comments:

Post a Comment