OpenOCD is a software for On-Chip debugging. It integrates server for JTAG interface and GDB for remote debug.

Debugging with JTAG interface can be very useful in more complex hardware project. It was used in Sarge SBC project and thanks to it i was able to move forward when the project stuck in place.

To get OpenOCD go to project web site, it can be also bitbaked with recipe.

There is a special config file that should be created before running openocd program.

I’ve used two debugging interfaces and here comes my config files:

openmoko debug board – /etc/openocd_moko.confg
telnet_port 4444
gdb_port 3333
interface ft2232
jtag_speed 0
ft2232_vid_pid 0x1457 0x5118
ft2232_layout "jtagkey"
reset_config trst_and_srst
jtag_device 4 0x1 0xf 0xe
daemon_startup attach
target arm920t little reset_run 0 arm920t
#working_area 0 0x200000 0x4000 backup
run_and_halt_time 0 5000

parallel port wiggler – /etc/openocd.confg

telnet_port 4444
gdb_port 3333
interface parport
jtag_speed 0
parport_port 0
parport_cable wiggler
reset_config trst_and_srst
target arm920t little reset_run 0 arm920t
jtag_device 4 0x1 0xf 0xe
daemon_startup attach
working_area 0 0x20000000 0x01000000 nobackup
flash bank cfi 0x10000000 0x800000 2 2 0
run_and_halt_time 0 5000

running openocd:

openocd -f /etc/openocd.cfg

tank:/usr/local/arm/bin # openocd -f /etc/openocd.conf
Info: openocd.c:86 main(): Open On-Chip Debugger (2007-04-26 16:40 CEST)

now we can connect directly to server:

mcgregor@tank:~> telnet localhost 4444
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> help
help display this help
sleep sleep for <n> milliseconds
version show OpenOCD version
shutdown shut the server down
exit exit telnet session
log_output redirect logging to <file> (default: stderr)
debug_level adjust debug level <0-3>
jtag_speed set jtag speed (if supported) <speed>
scan_chain print current scan chain configuration
endstate finish JTAG operations in <tap_state>
jtag_reset toggle reset lines <trst> <srst>
runtest move to Run-Test/Idle, and execute <num_cycles>
statemove move to current endstate or [tap_state]
irscan execute IR scan <device> <instr> [dev2] [instr2] ...
drscan execute DR scan <device> <var> [dev2] [var2] ...
verify_ircapture verify value captured during Capture-IR <enable|disable>
var allocate, display or delete variable <name> [num_fields|'del'] [size1] ...
field display/modify variable field <var> <field> [value|'flip']
script execute commands from <file>
xsvf run xsvf <file>
targets no help available
flash no help available
banks - list configured flash banks
info - print info about flash bank <num>
probe - identify flash bank <num>
erase_check - check erase state of sectors in flash bank <num>
protect_check - check protection state of sectors in flash bank <num>
erase - erase sectors at <bank> <first> <last>
write - write binary <bank> <file> <offset>
protect - set protection of sectors at <bank> <first> <last> <on|off>
nand no help available
pld programmable logic device commands
arm7_9 arm7/9 specific commands
write_xpsr - write program status register <value> <not cpsr|spsr>
write_xpsr_im8 - write program status register <8bit immediate> <rotate> <not cpsr|spsr>
write_core_reg - write core register <num> <mode> <value>
sw_bkpts - support for software breakpoints <enable|disable>
force_hw_bkpts - use hardware breakpoints for all breakpoints (disables sw breakpoint support) <enable|disable>
dbgrq - use EmbeddedICE dbgrq instead of breakpoint for target halt requests <enable|disable>
fast_writes - (deprecated, see: arm7_9 fast_memory_access)
fast_memory_access - use fast memory accesses instead of slower but potentially unsafe slow accesses <enable|disable>
dcc_downloads - use DCC downloads for larger memory writes <enable|disable>
etb_dump - dump current ETB content
armv4_5 armv4/5 specific commands
reg - display ARM core registers
core_state - display/change ARM core state <arm|thumb>
disassemble - disassemble instructions <address> <count> ['thumb']
arm9tdmi arm9tdmi specific commands
vector_catch - catch arm920t vectors ['all'|'none'|'<vec1 vec2 ...>']
arm920t arm920t specific commands
cp15 - display/modify cp15 register <num> [value]
cp15i - display/modify cp15 (interpreted access) <opcode> [value] [address]
cache_info - display information about target caches
virt2phys - translate va to pa <va>
mdw_phys - display memory words <physical addr> [count]
mdh_phys - display memory half-words <physical addr> [count]
mdb_phys - display memory bytes <physical addr> [count]
mww_phys - write memory word <physical addr> <value>
mwh_phys - write memory half-word <physical addr> <value>
mwb_phys - write memory byte <physical addr> <value>
read_cache - display I/D cache content
read_mmu - display I/D mmu content
cfi no help available
reg no help available
poll poll target state
wait_halt wait for target halt [time (s)]
halt halt target
resume resume target [addr]
step step one instruction
reset reset target [run|halt|init|run_and_halt|run_and_init]
soft_reset_halt halt the target and do a soft reset
mdw display memory words <addr> [count]
mdh display memory half-words <addr> [count]
mdb display memory bytes <addr> [count]
mww write memory word <addr> <value>
mwh write memory half-word <addr> <value>
mwb write memory byte <addr> <value>
bp set breakpoint <address> <length> [hw]
rbp remove breakpoint <adress>
wp set watchpoint <address> <length> <r/w/a> [value] [mask]
rwp remove watchpoint <adress>
load_image load_image <file> <address> ['bin'|'ihex']
dump_image dump_image <file> <address> <size>
load_binary [DEPRECATED] load_binary <file> <address>
dump_binary [DEPRECATED] dump_binary <file> <address> <size>

debugging is more convenient using a debugger with GUI interface. For that I’m using DDD.

DDD uses external gdb for debugging, so using debugger option you can set arm-linux-gdb for your target hardware:

ddd --debugger ./arm-sarge-linux-gnueabi-gdb --command /usr/local/arm/gdb/init.gdb

the command option allows to pass a file containing initial sequence of commands for gdb, in my case:

target remote localhost:3333
monitor arm7_9 sw_bkpts enable

the last line is very important and allows to set software breakpoints.


DDD screenshot:


Thanks to DDD with arm-linux-gdb and wiggler JTAG interface I discovered some missaligment issues in my

bintools (gcc 4.1.1) for my target. I’ve switched to gcc 3.4.5 and now everything works fine.

Leave a Reply

You must be logged in to post a comment.