1This is openocd.info, produced by makeinfo version 6.5 from 2openocd.texi. 3 4This User's Guide documents release 0.11.0, dated 7 March 2021, of the 5Open On-Chip Debugger (OpenOCD). 6 7 * Copyright (C) 2008 The OpenOCD Project 8 * Copyright (C) 2007-2008 Spencer Oliver <spen@spen-soft.co.uk> 9 * Copyright (C) 2008-2010 Oyvind Harboe <oyvind.harboe@zylin.com> 10 * Copyright (C) 2008 Duane Ellis <openocd@duaneellis.com> 11 * Copyright (C) 2009-2010 David Brownell 12 13 Permission is granted to copy, distribute and/or modify this 14 document under the terms of the GNU Free Documentation License, 15 Version 1.2 or any later version published by the Free Software 16 Foundation; with no Invariant Sections, no Front-Cover Texts, and 17 no Back-Cover Texts. A copy of the license is included in the 18 section entitled "GNU Free Documentation License". 19INFO-DIR-SECTION Development 20START-INFO-DIR-ENTRY 21* OpenOCD: (openocd). OpenOCD User's Guide 22END-INFO-DIR-ENTRY 23 24 25File: openocd.info, Node: Flash Programming, Next: PLD/FPGA Commands, Prev: Flash Commands, Up: Top 26 2713 Flash Programming 28******************** 29 30OpenOCD implements numerous ways to program the target flash, whether 31internal or external. Programming can be achieved by either using *note 32Programming using GDB: programmingusinggdb, or using the commands given 33in *note Flash Programming Commands: flashprogrammingcommands. 34 35 36To simplify using the flash commands directly a jimtcl script is 37available that handles the programming and verify stage. OpenOCD will 38program/verify/reset the target and optionally shutdown. 39 40The script is executed as follows and by default the following actions 41will be performed. 42 1. 'init' is executed. 43 2. 'reset init' is called to reset and halt the target, any 'reset 44 init' scripts are executed. 45 3. 'flash write_image' is called to erase and write any flash using 46 the filename given. 47 4. If the 'preverify' parameter is given, the target is "verified" 48 first and only flashed if this fails. 49 5. 'verify_image' is called if 'verify' parameter is given. 50 6. 'reset run' is called if 'reset' parameter is given. 51 7. OpenOCD is shutdown if 'exit' parameter is given. 52 53An example of usage is given below. *Note program::. 54 55 # program and verify using elf/hex/s19. verify and reset 56 # are optional parameters 57 openocd -f board/stm32f3discovery.cfg \ 58 -c "program filename.elf verify reset exit" 59 60 # binary files need the flash address passing 61 openocd -f board/stm32f3discovery.cfg \ 62 -c "program filename.bin exit 0x08000000" 63 64 65File: openocd.info, Node: PLD/FPGA Commands, Next: General Commands, Prev: Flash Programming, Up: Top 66 6714 PLD/FPGA Commands 68******************** 69 70Programmable Logic Devices (PLDs) and the more flexible Field 71Programmable Gate Arrays (FPGAs) are both types of programmable 72hardware. OpenOCD can support programming them. Although PLDs are 73generally restrictive (cells are less functional, and there are no 74special purpose cells for memory or computational tasks), they share the 75same OpenOCD infrastructure. Accordingly, both are called PLDs here. 76 7714.1 PLD/FPGA Configuration and Commands 78======================================== 79 80As it does for JTAG TAPs, debug targets, and flash chips (both NOR and 81NAND), OpenOCD maintains a list of PLDs available for use in various 82commands. Also, each such PLD requires a driver. 83 84They are referenced by the number shown by the 'pld devices' command, 85and new PLDs are defined by 'pld device driver_name'. 86 87 -- Config Command: pld device driver_name tap_name [driver_options] 88 Defines a new PLD device, supported by driver DRIVER_NAME, using 89 the TAP named TAP_NAME. The driver may make use of any 90 DRIVER_OPTIONS to configure its behavior. 91 92 -- Command: pld devices 93 Lists the PLDs and their numbers. 94 95 -- Command: pld load num filename 96 Loads the file 'filename' into the PLD identified by NUM. The file 97 format must be inferred by the driver. 98 9914.2 PLD/FPGA Drivers, Options, and Commands 100============================================ 101 102Drivers may support PLD-specific options to the 'pld device' definition 103command, and may also define commands usable only with that particular 104type of PLD. 105 106 -- FPGA Driver: virtex2 [no_jstart] 107 Virtex-II is a family of FPGAs sold by Xilinx. It supports the 108 IEEE 1532 standard for In-System Configuration (ISC). 109 110 If NO_JSTART is non-zero, the JSTART instruction is not used after 111 loading the bitstream. While required for Series2, Series3, and 112 Series6, it breaks bitstream loading on Series7. 113 114 -- Command: virtex2 read_stat num 115 Reads and displays the Virtex-II status register (STAT) for 116 FPGA NUM. 117 118 119File: openocd.info, Node: General Commands, Next: Architecture and Core Commands, Prev: PLD/FPGA Commands, Up: Top 120 12115 General Commands 122******************* 123 124The commands documented in this chapter here are common commands that 125you, as a human, may want to type and see the output of. Configuration 126type commands are documented elsewhere. 127 128Intent: 129 * Source Of Commands 130 OpenOCD commands can occur in a configuration script (discussed 131 elsewhere) or typed manually by a human or supplied 132 programmatically, or via one of several TCP/IP Ports. 133 134 * From the human 135 A human should interact with the telnet interface (default port: 136 4444) or via GDB (default port 3333). 137 138 To issue commands from within a GDB session, use the 'monitor' 139 command, e.g. use 'monitor poll' to issue the 'poll' command. All 140 output is relayed through the GDB session. 141 142 * Machine Interface The Tcl interface's intent is to be a machine 143 interface. The default Tcl port is 5555. 144 14515.1 Server Commands 146==================== 147 148 -- Command: exit 149 Exits the current telnet session. 150 151 -- Command: help [string] 152 With no parameters, prints help text for all commands. Otherwise, 153 prints each helptext containing STRING. Not every command provides 154 helptext. 155 156 Configuration commands, and commands valid at any time, are 157 explicitly noted in parenthesis. In most cases, no such 158 restriction is listed; this indicates commands which are only 159 available after the configuration stage has completed. 160 161 -- Command: sleep msec ['busy'] 162 Wait for at least MSEC milliseconds before resuming. If 'busy' is 163 passed, busy-wait instead of sleeping. (This option is strongly 164 discouraged.) Useful in connection with script files ('script' 165 command and 'target_name' configuration). 166 167 -- Command: shutdown ['error'] 168 Close the OpenOCD server, disconnecting all clients (GDB, telnet, 169 other). If option 'error' is used, OpenOCD will return a non-zero 170 exit code to the parent process. 171 172 Like any TCL commands, also 'shutdown' can be redefined, e.g.: 173 # redefine shutdown 174 rename shutdown original_shutdown 175 proc shutdown {} { 176 puts "This is my implementation of shutdown" 177 # my own stuff before exit OpenOCD 178 original_shutdown 179 } 180 If user types CTRL-C or kills OpenOCD, either the command 181 'shutdown' or its replacement will be automatically executed before 182 OpenOCD exits. 183 184 -- Command: debug_level [n] 185 Display debug level. If N (from 0..4) is provided, then set it to 186 that level. This affects the kind of messages sent to the server 187 log. Level 0 is error messages only; level 1 adds warnings; level 188 2 adds informational messages; level 3 adds debugging messages; and 189 level 4 adds verbose low-level debug messages. The default is 190 level 2, but that can be overridden on the command line along with 191 the location of that log file (which is normally the server's 192 standard output). *Note Running::. 193 194 -- Command: echo [-n] message 195 Logs a message at "user" priority. Output MESSAGE to stdout. 196 Option "-n" suppresses trailing newline. 197 echo "Downloading kernel -- please wait" 198 199 -- Command: log_output [filename | "default"] 200 Redirect logging to FILENAME or set it back to default output; the 201 default log output channel is stderr. 202 203 -- Command: add_script_search_dir [directory] 204 Add DIRECTORY to the file/script search path. 205 206 -- Command: bindto [NAME] 207 Specify hostname or IPv4 address on which to listen for incoming 208 TCP/IP connections. By default, OpenOCD will listen on the 209 loopback interface only. If your network environment is safe, 210 'bindto 0.0.0.0' can be used to cover all available interfaces. 211 21215.2 Target State handling 213========================== 214 215In this section "target" refers to a CPU configured as shown earlier 216(*note CPU Configuration::). These commands, like many, implicitly 217refer to a current target which is used to perform the various 218operations. The current target may be changed by using 'targets' 219command with the name of the target which should become current. 220 221 -- Command: reg [(number|name) [(value|'force')]] 222 Access a single register by NUMBER or by its NAME. The target must 223 generally be halted before access to CPU core registers is allowed. 224 Depending on the hardware, some other registers may be accessible 225 while the target is running. 226 227 _With no arguments_: list all available registers for the current 228 target, showing number, name, size, value, and cache status. For 229 valid entries, a value is shown; valid entries which are also dirty 230 (and will be written back later) are flagged as such. 231 232 _With number/name_: display that register's value. Use FORCE 233 argument to read directly from the target, bypassing any internal 234 cache. 235 236 _With both number/name and value_: set register's value. Writes 237 may be held in a writeback cache internal to OpenOCD, so that 238 setting the value marks the register as dirty instead of 239 immediately flushing that value. Resuming CPU execution (including 240 by single stepping) or otherwise activating the relevant module 241 will flush such values. 242 243 Cores may have surprisingly many registers in their Debug and trace 244 infrastructure: 245 246 > reg 247 ===== ARM registers 248 (0) r0 (/32): 0x0000D3C2 (dirty) 249 (1) r1 (/32): 0xFD61F31C 250 (2) r2 (/32) 251 ... 252 (164) ETM_contextid_comparator_mask (/32) 253 > 254 255 -- Command: halt [ms] 256 -- Command: wait_halt [ms] 257 The 'halt' command first sends a halt request to the target, which 258 'wait_halt' doesn't. Otherwise these behave the same: wait up to 259 MS milliseconds, or 5 seconds if there is no parameter, for the 260 target to halt (and enter debug mode). Using 0 as the MS parameter 261 prevents OpenOCD from waiting. 262 263 Warning: On ARM cores, software using the _wait for interrupt_ 264 operation often blocks the JTAG access needed by a 'halt' 265 command. This is because that operation also puts the core 266 into a low power mode by gating the core clock; but the core 267 clock is needed to detect JTAG clock transitions. 268 269 One partial workaround uses adaptive clocking: when the core 270 is interrupted the operation completes, then JTAG clocks are 271 accepted at least until the interrupt handler completes. 272 However, this workaround is often unusable since the 273 processor, board, and JTAG adapter must all support adaptive 274 JTAG clocking. Also, it can't work until an interrupt is 275 issued. 276 277 A more complete workaround is to not use that operation while 278 you work with a JTAG debugger. Tasking environments generally 279 have idle loops where the body is the _wait for interrupt_ 280 operation. (On older cores, it is a coprocessor action; newer 281 cores have a 'wfi' instruction.) Such loops can just remove 282 that operation, at the cost of higher power consumption 283 (because the CPU is needlessly clocked). 284 285 -- Command: resume [address] 286 Resume the target at its current code position, or the optional 287 ADDRESS if it is provided. OpenOCD will wait 5 seconds for the 288 target to resume. 289 290 -- Command: step [address] 291 Single-step the target at its current code position, or the 292 optional ADDRESS if it is provided. 293 294 -- Command: reset 295 -- Command: reset run 296 -- Command: reset halt 297 -- Command: reset init 298 Perform as hard a reset as possible, using SRST if possible. _All 299 defined targets will be reset, and target events will fire during 300 the reset sequence._ 301 302 The optional parameter specifies what should happen after the 303 reset. If there is no parameter, a 'reset run' is executed. The 304 other options will not work on all systems. *Note Reset 305 Configuration::. 306 307 - run Let the target run 308 - halt Immediately halt the target 309 - init Immediately halt the target, and execute the reset-init 310 script 311 312 -- Command: soft_reset_halt 313 Requesting target halt and executing a soft reset. This is often 314 used when a target cannot be reset and halted. The target, after 315 reset is released begins to execute code. OpenOCD attempts to stop 316 the CPU and then sets the program counter back to the reset vector. 317 Unfortunately the code that was executed may have left the hardware 318 in an unknown state. 319 320 -- Command: adapter assert [signal [assert|deassert signal]] 321 -- Command: adapter deassert [signal [assert|deassert signal]] 322 Set values of reset signals. Without parameters returns current 323 status of the signals. The SIGNAL parameter values may be 'srst', 324 indicating that srst signal is to be asserted or deasserted, 325 'trst', indicating that trst signal is to be asserted or 326 deasserted. 327 328 The 'reset_config' command should already have been used to 329 configure how the board and the adapter treat these two signals, 330 and to say if either signal is even present. *Note Reset 331 Configuration::. Trying to assert a signal that is not present 332 triggers an error. If a signal is present on the adapter and not 333 specified in the command, the signal will not be modified. 334 335 Note: TRST is specially handled. It actually signifies JTAG's 336 RESET state. So if the board doesn't support the optional 337 TRST signal, or it doesn't support it along with the specified 338 SRST value, JTAG reset is triggered with TMS and TCK signals 339 instead of the TRST signal. And no matter how that JTAG reset 340 is triggered, once the scan chain enters RESET with TRST 341 inactive, TAP 'post-reset' events are delivered to all TAPs 342 with handlers for that event. 343 34415.3 I/O Utilities 345================== 346 347These commands are available when OpenOCD is built with 348'--enable-ioutil'. They are mainly useful on embedded targets, notably 349the ZY1000. Hosts with operating systems have complementary tools. 350 351_Note:_ there are several more such commands. 352 353 -- Command: append_file filename [string]* 354 Appends the STRING parameters to the text file 'filename'. Each 355 string except the last one is followed by one space. The last 356 string is followed by a newline. 357 358 -- Command: cat filename 359 Reads and displays the text file 'filename'. 360 361 -- Command: cp src_filename dest_filename 362 Copies contents from the file 'src_filename' into 'dest_filename'. 363 364 -- Command: ip 365 _No description provided._ 366 367 -- Command: ls 368 _No description provided._ 369 370 -- Command: mac 371 _No description provided._ 372 373 -- Command: meminfo 374 Display available RAM memory on OpenOCD host. Used in OpenOCD 375 regression testing scripts. 376 377 -- Command: peek 378 _No description provided._ 379 380 -- Command: poke 381 _No description provided._ 382 383 -- Command: rm filename 384 Unlinks the file 'filename'. 385 386 -- Command: trunc filename 387 Removes all data in the file 'filename'. 388 38915.4 Memory access commands 390=========================== 391 392These commands allow accesses of a specific size to the memory system. 393Often these are used to configure the current target in some special 394way. For example - one may need to write certain values to the SDRAM 395controller to enable SDRAM. 396 397 1. Use the 'targets' (plural) command to change the current target. 398 2. In system level scripts these commands are deprecated. Please use 399 their TARGET object siblings to avoid making assumptions about what 400 TAP is the current target, or about MMU configuration. 401 402 -- Command: mdd [phys] addr [count] 403 -- Command: mdw [phys] addr [count] 404 -- Command: mdh [phys] addr [count] 405 -- Command: mdb [phys] addr [count] 406 Display contents of address ADDR, as 64-bit doublewords ('mdd'), 407 32-bit words ('mdw'), 16-bit halfwords ('mdh'), or 8-bit bytes 408 ('mdb'). When the current target has an MMU which is present and 409 active, ADDR is interpreted as a virtual address. Otherwise, or if 410 the optional PHYS flag is specified, ADDR is interpreted as a 411 physical address. If COUNT is specified, displays that many units. 412 (If you want to manipulate the data instead of displaying it, see 413 the 'mem2array' primitives.) 414 415 -- Command: mwd [phys] addr doubleword [count] 416 -- Command: mww [phys] addr word [count] 417 -- Command: mwh [phys] addr halfword [count] 418 -- Command: mwb [phys] addr byte [count] 419 Writes the specified DOUBLEWORD (64 bits), WORD (32 bits), HALFWORD 420 (16 bits), or BYTE (8-bit) value, at the specified address ADDR. 421 When the current target has an MMU which is present and active, 422 ADDR is interpreted as a virtual address. Otherwise, or if the 423 optional PHYS flag is specified, ADDR is interpreted as a physical 424 address. If COUNT is specified, fills that many units of 425 consecutive address. 426 42715.5 Image loading commands 428=========================== 429 430 -- Command: dump_image filename address size 431 Dump SIZE bytes of target memory starting at ADDRESS to the binary 432 file named FILENAME. 433 434 -- Command: fast_load 435 Loads an image stored in memory by 'fast_load_image' to the current 436 target. Must be preceded by fast_load_image. 437 438 -- Command: fast_load_image filename address ['bin'|'ihex'|'elf'|'s19'] 439 Normally you should be using 'load_image' or GDB load. However, 440 for testing purposes or when I/O overhead is significant(OpenOCD 441 running on an embedded host), storing the image in memory and 442 uploading the image to the target can be a way to upload e.g. 443 multiple debug sessions when the binary does not change. Arguments 444 are the same as 'load_image', but the image is stored in OpenOCD 445 host memory, i.e. does not affect target. This approach is also 446 useful when profiling target programming performance as I/O and 447 target programming can easily be profiled separately. 448 449 -- Command: load_image filename address [['bin'|'ihex'|'elf'|'s19'] 450 'min_addr' 'max_length'] 451 Load image from file FILENAME to target memory offset by ADDRESS 452 from its load address. The file format may optionally be specified 453 ('bin', 'ihex', 'elf', or 's19'). In addition the following 454 arguments may be specified: MIN_ADDR - ignore data below MIN_ADDR 455 (this is w.r.t. to the target's load address + ADDRESS) MAX_LENGTH 456 - maximum number of bytes to load. 457 proc load_image_bin {fname foffset address length } { 458 # Load data from fname filename at foffset offset to 459 # target at address. Load at most length bytes. 460 load_image $fname [expr $address - $foffset] bin \ 461 $address $length 462 } 463 464 -- Command: test_image filename [address ['bin'|'ihex'|'elf']] 465 Displays image section sizes and addresses as if FILENAME were 466 loaded into target memory starting at ADDRESS (defaults to zero). 467 The file format may optionally be specified ('bin', 'ihex', or 468 'elf') 469 470 -- Command: verify_image filename address ['bin'|'ihex'|'elf'] 471 Verify FILENAME against target memory starting at ADDRESS. The 472 file format may optionally be specified ('bin', 'ihex', or 'elf') 473 This will first attempt a comparison using a CRC checksum, if this 474 fails it will try a binary compare. 475 476 -- Command: verify_image_checksum filename address ['bin'|'ihex'|'elf'] 477 Verify FILENAME against target memory starting at ADDRESS. The 478 file format may optionally be specified ('bin', 'ihex', or 'elf') 479 This perform a comparison using a CRC checksum only 480 48115.6 Breakpoint and Watchpoint commands 482======================================= 483 484CPUs often make debug modules accessible through JTAG, with hardware 485support for a handful of code breakpoints and data watchpoints. In 486addition, CPUs almost always support software breakpoints. 487 488 -- Command: bp [address len ['hw']] 489 With no parameters, lists all active breakpoints. Else sets a 490 breakpoint on code execution starting at ADDRESS for LENGTH bytes. 491 This is a software breakpoint, unless 'hw' is specified in which 492 case it will be a hardware breakpoint. 493 494 (*Note arm9 vector_catch: arm9vectorcatch, or *note xscale 495 vector_catch: xscalevectorcatch, for similar mechanisms that do not 496 consume hardware breakpoints.) 497 498 -- Command: rbp 'all' | address 499 Remove the breakpoint at ADDRESS or all breakpoints. 500 501 -- Command: rwp address 502 Remove data watchpoint on ADDRESS 503 504 -- Command: wp [address len [('r'|'w'|'a') [value [mask]]]] 505 With no parameters, lists all active watchpoints. Else sets a data 506 watchpoint on data from ADDRESS for LENGTH bytes. The watch point 507 is an "access" watchpoint unless the 'r' or 'w' parameter is 508 provided, defining it as respectively a read or write watchpoint. 509 If a VALUE is provided, that value is used when determining if the 510 watchpoint should trigger. The value may be first be masked using 511 MASK to mark "don't care" fields. 512 51315.7 Real Time Transfer (RTT) 514============================= 515 516Real Time Transfer (RTT) is an interface specified by SEGGER based on 517basic memory reads and writes to transfer data bidirectionally between 518target and host. The specification is independent of the target 519architecture. Every target that supports so called "background memory 520access", which means that the target memory can be accessed by the 521debugger while the target is running, can be used. This interface is 522especially of interest for targets without Serial Wire Output (SWO), 523such as ARM Cortex-M0, or where semihosting is not applicable because of 524real-time constraints. 525 526 Note: The current implementation supports only single target 527 devices. 528 529The data transfer between host and target device is organized through 530unidirectional up/down-channels for target-to-host and host-to-target 531communication, respectively. 532 533 Note: The current implementation does not respect channel buffer 534 flags. They are used to determine what happens when writing to a 535 full buffer, for example. 536 537Channels are exposed via raw TCP/IP connections. One or more RTT 538servers can be assigned to each channel to make them accessible to an 539unlimited number of TCP/IP connections. 540 541 -- Command: rtt setup address size ID 542 Configure RTT for the currently selected target. Once RTT is 543 started, OpenOCD searches for a control block with the identifier 544 ID starting at the memory address ADDRESS within the next SIZE 545 bytes. 546 547 -- Command: rtt start 548 Start RTT. If the control block location is not known, OpenOCD 549 starts searching for it. 550 551 -- Command: rtt stop 552 Stop RTT. 553 554 -- Command: rtt polling_interval [interval] 555 Display the polling interval. If INTERVAL is provided, set the 556 polling interval. The polling interval determines (in 557 milliseconds) how often the up-channels are checked for new data. 558 559 -- Command: rtt channels 560 Display a list of all channels and their properties. 561 562 -- Command: rtt channellist 563 Return a list of all channels and their properties as Tcl list. 564 The list can be manipulated easily from within scripts. 565 566 -- Command: rtt server start port channel 567 Start a TCP server on PORT for the channel CHANNEL. 568 569 -- Command: rtt server stop port 570 Stop the TCP sever with port PORT. 571 572The following example shows how to setup RTT using the SEGGER RTT 573implementation on the target device. 574 575 resume 576 577 rtt setup 0x20000000 2048 "SEGGER RTT" 578 rtt start 579 580 rtt server start 9090 0 581 582In this example, OpenOCD searches the control block with the ID "SEGGER 583RTT" starting at 0x20000000 for 2048 bytes. The RTT channel 0 is 584exposed through the TCP/IP port 9090. 585 58615.8 Misc Commands 587================== 588 589 -- Command: profile seconds filename [start end] 590 Profiling samples the CPU's program counter as quickly as possible, 591 which is useful for non-intrusive stochastic profiling. Saves up 592 to 10000 samples in 'filename' using "gmon.out" format. Optional 593 'start' and 'end' parameters allow to limit the address range. 594 595 -- Command: version 596 Displays a string identifying the version of this OpenOCD server. 597 598 -- Command: virt2phys virtual_address 599 Requests the current target to map the specified VIRTUAL_ADDRESS to 600 its corresponding physical address, and displays the result. 601 602 603File: openocd.info, Node: Architecture and Core Commands, Next: JTAG Commands, Prev: General Commands, Up: Top 604 60516 Architecture and Core Commands 606********************************* 607 608Most CPUs have specialized JTAG operations to support debugging. 609OpenOCD packages most such operations in its standard command framework. 610Some of those operations don't fit well in that framework, so they are 611exposed here as architecture or implementation (core) specific commands. 612 61316.1 ARM Hardware Tracing 614========================= 615 616CPUs based on ARM cores may include standard tracing interfaces, based 617on an "Embedded Trace Module" (ETM) which sends voluminous address and 618data bus trace records to a "Trace Port". 619 620 * Development-oriented boards will sometimes provide a high speed 621 trace connector for collecting that data, when the particular CPU 622 supports such an interface. (The standard connector is a 38-pin 623 Mictor, with both JTAG and trace port support.) Those trace 624 connectors are supported by higher end JTAG adapters and some logic 625 analyzer modules; frequently those modules can buffer several 626 megabytes of trace data. Configuring an ETM coupled to such an 627 external trace port belongs in the board-specific configuration 628 file. 629 * If the CPU doesn't provide an external interface, it probably has 630 an "Embedded Trace Buffer" (ETB) on the chip, which is a dedicated 631 SRAM. 4KBytes is one common ETB size. Configuring an ETM coupled 632 only to an ETB belongs in the CPU-specific (target) configuration 633 file, since it works the same on all boards. 634 635ETM support in OpenOCD doesn't seem to be widely used yet. 636 637 Issues: ETM support may be buggy, and at least some 'etm config' 638 parameters should be detected by asking the ETM for them. 639 640 ETM trigger events could also implement a kind of complex hardware 641 breakpoint, much more powerful than the simple watchpoint hardware 642 exported by EmbeddedICE modules. _Such breakpoints can be 643 triggered even when using the dummy trace port driver_. 644 645 It seems like a GDB hookup should be possible, as well as tracing 646 only during specific states (perhaps _handling IRQ 23_ or _calls 647 foo()_). 648 649 There should be GUI tools to manipulate saved trace data and help 650 analyse it in conjunction with the source code. It's unclear how 651 much of a common interface is shared with the current XScale trace 652 support, or should be shared with eventual Nexus-style trace module 653 support. 654 655 At this writing (November 2009) only ARM7, ARM9, and ARM11 support 656 for ETM modules is available. The code should be able to work with 657 some newer cores; but not all of them support this original style 658 of JTAG access. 659 66016.1.1 ETM Configuration 661------------------------ 662 663ETM setup is coupled with the trace port driver configuration. 664 665 -- Config Command: etm config target width mode clocking driver 666 Declares the ETM associated with TARGET, and associates it with a 667 given trace port DRIVER. *Note Trace Port Drivers: 668 traceportdrivers. 669 670 Several of the parameters must reflect the trace port capabilities, 671 which are a function of silicon capabilities (exposed later using 672 'etm info') and of what hardware is connected to that port (such as 673 an external pod, or ETB). The WIDTH must be either 4, 8, or 16, 674 except with ETMv3.0 and newer modules which may also support 1, 2, 675 24, 32, 48, and 64 bit widths. (With those versions, 'etm info' 676 also shows whether the selected port width and mode are supported.) 677 678 The MODE must be 'normal', 'multiplexed', or 'demultiplexed'. The 679 CLOCKING must be 'half' or 'full'. 680 681 Warning: With ETMv3.0 and newer, the bits set with the MODE 682 and CLOCKING parameters both control the mode. This modified 683 mode does not map to the values supported by previous ETM 684 modules, so this syntax is subject to change. 685 686 Note: You can see the ETM registers using the 'reg' command. 687 Not all possible registers are present in every ETM. Most of 688 the registers are write-only, and are used to configure what 689 CPU activities are traced. 690 691 -- Command: etm info 692 Displays information about the current target's ETM. This includes 693 resource counts from the 'ETM_CONFIG' register, as well as silicon 694 capabilities (except on rather old modules). from the 695 'ETM_SYS_CONFIG' register. 696 697 -- Command: etm status 698 Displays status of the current target's ETM and trace port driver: 699 is the ETM idle, or is it collecting data? Did trace data 700 overflow? Was it triggered? 701 702 -- Command: etm tracemode [type context_id_bits cycle_accurate 703 branch_output] 704 Displays what data that ETM will collect. If arguments are 705 provided, first configures that data. When the configuration 706 changes, tracing is stopped and any buffered trace data is 707 invalidated. 708 709 * TYPE ... describing how data accesses are traced, when they 710 pass any ViewData filtering that was set up. The value is one 711 of 'none' (save nothing), 'data' (save data), 'address' (save 712 addresses), 'all' (save data and addresses) 713 * CONTEXT_ID_BITS ... 0, 8, 16, or 32 714 * CYCLE_ACCURATE ... 'enable' or 'disable' cycle-accurate 715 instruction tracing. Before ETMv3, enabling this causes much 716 extra data to be recorded. 717 * BRANCH_OUTPUT ... 'enable' or 'disable'. Disable this unless 718 you need to try reconstructing the instruction trace stream 719 without an image of the code. 720 721 -- Command: etm trigger_debug ('enable'|'disable') 722 Displays whether ETM triggering debug entry (like a breakpoint) is 723 enabled or disabled, after optionally modifying that configuration. 724 The default behaviour is 'disable'. Any change takes effect after 725 the next 'etm start'. 726 727 By using script commands to configure ETM registers, you can make 728 the processor enter debug state automatically when certain 729 conditions, more complex than supported by the breakpoint hardware, 730 happen. 731 73216.1.2 ETM Trace Operation 733-------------------------- 734 735After setting up the ETM, you can use it to collect data. That data can 736be exported to files for later analysis. It can also be parsed with 737OpenOCD, for basic sanity checking. 738 739To configure what is being traced, you will need to write various trace 740registers using 'reg ETM_*' commands. For the definitions of these 741registers, read ARM publication _IHI 0014, "Embedded Trace Macrocell, 742Architecture Specification"_. Be aware that most of the relevant 743registers are write-only, and that ETM resources are limited. There are 744only a handful of address comparators, data comparators, counters, and 745so on. 746 747Examples of scenarios you might arrange to trace include: 748 749 * Code flow within a function, _excluding_ subroutines it calls. Use 750 address range comparators to enable tracing for instruction access 751 within that function's body. 752 * Code flow within a function, _including_ subroutines it calls. Use 753 the sequencer and address comparators to activate tracing on an 754 "entered function" state, then deactivate it by exiting that state 755 when the function's exit code is invoked. 756 * Code flow starting at the fifth invocation of a function, combining 757 one of the above models with a counter. 758 * CPU data accesses to the registers for a particular device, using 759 address range comparators and the ViewData logic. 760 * Such data accesses only during IRQ handling, combining the above 761 model with sequencer triggers which on entry and exit to the IRQ 762 handler. 763 * _... more_ 764 765At this writing, September 2009, there are no Tcl utility procedures to 766help set up any common tracing scenarios. 767 768 -- Command: etm analyze 769 Reads trace data into memory, if it wasn't already present. 770 Decodes and prints the data that was collected. 771 772 -- Command: etm dump filename 773 Stores the captured trace data in 'filename'. 774 775 -- Command: etm image filename [base_address] [type] 776 Opens an image file. 777 778 -- Command: etm load filename 779 Loads captured trace data from 'filename'. 780 781 -- Command: etm start 782 Starts trace data collection. 783 784 -- Command: etm stop 785 Stops trace data collection. 786 78716.1.3 Trace Port Drivers 788------------------------- 789 790To use an ETM trace port it must be associated with a driver. 791 792 -- Trace Port Driver: dummy 793 Use the 'dummy' driver if you are configuring an ETM that's not 794 connected to anything (on-chip ETB or off-chip trace connector). 795 _This driver lets OpenOCD talk to the ETM, but it does not expose 796 any trace data collection._ 797 -- Config Command: etm_dummy config target 798 Associates the ETM for TARGET with a dummy driver. 799 800 -- Trace Port Driver: etb 801 Use the 'etb' driver if you are configuring an ETM to use on-chip 802 ETB memory. 803 -- Config Command: etb config target etb_tap 804 Associates the ETM for TARGET with the ETB at ETB_TAP. You 805 can see the ETB registers using the 'reg' command. 806 -- Command: etb trigger_percent [percent] 807 This displays, or optionally changes, ETB behavior after the 808 ETM's configured _trigger_ event fires. It controls how much 809 more trace data is saved after the (single) trace trigger 810 becomes active. 811 812 * The default corresponds to _trace around_ usage, 813 recording 50 percent data before the event and the rest 814 afterwards. 815 * The minimum value of PERCENT is 2 percent, recording 816 almost exclusively data before the trigger. Such extreme 817 _trace before_ usage can help figure out what caused that 818 event to happen. 819 * The maximum value of PERCENT is 100 percent, recording 820 data almost exclusively after the event. This extreme 821 _trace after_ usage might help sort out how the event 822 caused trouble. 823 824 -- Trace Port Driver: oocd_trace 825 This driver isn't available unless OpenOCD was explicitly 826 configured with the '--enable-oocd_trace' option. You probably 827 don't want to configure it unless you've built the appropriate 828 prototype hardware; it's _proof-of-concept_ software. 829 830 Use the 'oocd_trace' driver if you are configuring an ETM that's 831 connected to an off-chip trace connector. 832 833 -- Config Command: oocd_trace config target tty 834 Associates the ETM for TARGET with a trace driver which 835 collects data through the serial port TTY. 836 837 -- Command: oocd_trace resync 838 Re-synchronizes with the capture clock. 839 840 -- Command: oocd_trace status 841 Reports whether the capture clock is locked or not. 842 84316.2 ARM Cross-Trigger Interface 844================================ 845 846The ARM Cross-Trigger Interface (CTI) is a generic CoreSight component 847that connects event sources like tracing components or CPU cores with 848each other through a common trigger matrix (CTM). For ARMv8 849architecture, a CTI is mandatory for core run control and each core has 850an individual CTI instance attached to it. OpenOCD has limited support 851for CTI using the _cti_ group of commands. 852 853 -- Command: cti create cti_name '-dap' dap_name '-ap-num' apn 854 '-baseaddr' base_address 855 Creates a CTI instance CTI_NAME on the DAP instance DAP_NAME on 856 MEM-AP APN. The BASE_ADDRESS must match the base address of the 857 CTI on the respective MEM-AP. All arguments are mandatory. This 858 creates a new command '$cti_name' which is used for various 859 purposes including additional configuration. 860 861 -- Command: $cti_name enable 'on|off' 862 Enable ('on') or disable ('off') the CTI. 863 864 -- Command: $cti_name dump 865 Displays a register dump of the CTI. 866 867 -- Command: $cti_name write REG_NAME VALUE 868 Write VALUE to the CTI register with the symbolic name REG_NAME. 869 870 -- Command: $cti_name read REG_NAME 871 Print the value read from the CTI register with the symbolic name 872 REG_NAME. 873 874 -- Command: $cti_name ack EVENT 875 Acknowledge a CTI EVENT. 876 877 -- Command: $cti_name channel CHANNEL_NUMBER OPERATION 878 Perform a specific channel operation, the possible operations are: 879 gate, ungate, set, clear and pulse 880 881 -- Command: $cti_name testmode 'on|off' 882 Enable ('on') or disable ('off') the integration test mode of the 883 CTI. 884 885 -- Command: cti names 886 Prints a list of names of all CTI objects created. This command is 887 mainly useful in TCL scripting. 888 88916.3 Generic ARM 890================ 891 892These commands should be available on all ARM processors. They are 893available in addition to other core-specific commands that may be 894available. 895 896 -- Command: arm core_state ['arm'|'thumb'] 897 Displays the core_state, optionally changing it to process either 898 'arm' or 'thumb' instructions. The target may later be resumed in 899 the currently set core_state. (Processors may also support the 900 Jazelle state, but that is not currently supported in OpenOCD.) 901 902 -- Command: arm disassemble address [count ['thumb']] 903 Disassembles COUNT instructions starting at ADDRESS. If COUNT is 904 not specified, a single instruction is disassembled. If 'thumb' is 905 specified, or the low bit of the address is set, Thumb2 (mixed 906 16/32-bit) instructions are used; else ARM (32-bit) instructions 907 are used. (Processors may also support the Jazelle state, but 908 those instructions are not currently understood by OpenOCD.) 909 910 Note that all Thumb instructions are Thumb2 instructions, so older 911 processors (without Thumb2 support) will still see correct 912 disassembly of Thumb code. Also, ThumbEE opcodes are the same as 913 Thumb2, with a handful of exceptions. ThumbEE disassembly 914 currently has no explicit support. 915 916 -- Command: arm mcr pX op1 CRn CRm op2 value 917 Write VALUE to a coprocessor PX register passing parameters CRN, 918 CRM, opcodes OPC1 and OPC2, and using the MCR instruction. 919 (Parameter sequence matches the ARM instruction, but omits an ARM 920 register.) 921 922 -- Command: arm mrc pX coproc op1 CRn CRm op2 923 Read a coprocessor PX register passing parameters CRN, CRM, opcodes 924 OPC1 and OPC2, and the MRC instruction. Returns the result so it 925 can be manipulated by Jim scripts. (Parameter sequence matches the 926 ARM instruction, but omits an ARM register.) 927 928 -- Command: arm reg 929 Display a table of all banked core registers, fetching the current 930 value from every core mode if necessary. 931 932 -- Command: arm semihosting ['enable'|'disable'] 933 Display status of semihosting, after optionally changing that 934 status. 935 936 Semihosting allows for code executing on an ARM target to use the 937 I/O facilities on the host computer i.e. the system where OpenOCD 938 is running. The target application must be linked against a 939 library implementing the ARM semihosting convention that forwards 940 operation requests by using a special SVC instruction that is 941 trapped at the Supervisor Call vector by OpenOCD. 942 943 -- Command: arm semihosting_cmdline ['enable'|'disable'] 944 Set the command line to be passed to the debugger. 945 946 arm semihosting_cmdline argv0 argv1 argv2 ... 947 948 This option lets one set the command line arguments to be passed to 949 the program. The first argument (argv0) is the program name in a 950 standard C environment (argv[0]). Depending on the program (not 951 much programs look at argv[0]), argv0 is ignored and can be any 952 string. 953 954 -- Command: arm semihosting_fileio ['enable'|'disable'] 955 Display status of semihosting fileio, after optionally changing 956 that status. 957 958 Enabling this option forwards semihosting I/O to GDB process using 959 the File-I/O remote protocol extension. This is especially useful 960 for interacting with remote files or displaying console messages in 961 the debugger. 962 963 -- Command: arm semihosting_resexit ['enable'|'disable'] 964 Enable resumable SEMIHOSTING_SYS_EXIT. 965 966 When SEMIHOSTING_SYS_EXIT is called outside a debug session, things 967 are simple, the openocd process calls exit() and passes the value 968 returned by the target. 969 970 When SEMIHOSTING_SYS_EXIT is called during a debug session, by 971 default execution returns to the debugger, leaving the debugger in 972 a HALT state, similar to the state entered when encountering a 973 break. 974 975 In some use cases, it is useful to have SEMIHOSTING_SYS_EXIT return 976 normally, as any semihosting call, and do not break to the 977 debugger. The standard allows this to happen, but the condition to 978 trigger it is a bit obscure ("by performing an RDI_Execute request 979 or equivalent"). 980 981 To make the SEMIHOSTING_SYS_EXIT call return normally, enable this 982 option (default: disabled). 983 98416.4 ARMv4 and ARMv5 Architecture 985================================= 986 987The ARMv4 and ARMv5 architectures are widely used in embedded systems, 988and introduced core parts of the instruction set in use today. That 989includes the Thumb instruction set, introduced in the ARMv4T variant. 990 99116.4.1 ARM7 and ARM9 specific commands 992-------------------------------------- 993 994These commands are specific to ARM7 and ARM9 cores, like ARM7TDMI, 995ARM720T, ARM9TDMI, ARM920T or ARM926EJ-S. They are available in addition 996to the ARM commands, and any other core-specific commands that may be 997available. 998 999 -- Command: arm7_9 dbgrq ['enable'|'disable'] 1000 Displays the value of the flag controlling use of the EmbeddedIce 1001 DBGRQ signal to force entry into debug mode, instead of 1002 breakpoints. If a boolean parameter is provided, first assigns 1003 that flag. 1004 1005 This should be safe for all but ARM7TDMI-S cores (like NXP LPC). 1006 This feature is enabled by default on most ARM9 cores, including 1007 ARM9TDMI, ARM920T, and ARM926EJ-S. 1008 1009 -- Command: arm7_9 dcc_downloads ['enable'|'disable'] 1010 Displays the value of the flag controlling use of the debug 1011 communications channel (DCC) to write larger (>128 byte) amounts of 1012 memory. If a boolean parameter is provided, first assigns that 1013 flag. 1014 1015 DCC downloads offer a huge speed increase, but might be unsafe, 1016 especially with targets running at very low speeds. This command 1017 was introduced with OpenOCD rev. 60, and requires a few bytes of 1018 working area. 1019 1020 -- Command: arm7_9 fast_memory_access ['enable'|'disable'] 1021 Displays the value of the flag controlling use of memory writes and 1022 reads that don't check completion of the operation. If a boolean 1023 parameter is provided, first assigns that flag. 1024 1025 This provides a huge speed increase, especially with USB JTAG 1026 cables (FT2232), but might be unsafe if used with targets running 1027 at very low speeds, like the 32kHz startup clock of an AT91RM9200. 1028 102916.4.2 ARM720T specific commands 1030-------------------------------- 1031 1032These commands are available to ARM720T based CPUs, which are 1033implementations of the ARMv4T architecture based on the ARM7TDMI-S 1034integer core. They are available in addition to the ARM and ARM7/ARM9 1035commands. 1036 1037 -- Command: arm720t cp15 opcode [value] 1038 _DEPRECATED - avoid using this. Use the 'arm mrc' or 'arm mcr' 1039 commands instead._ 1040 1041 Display cp15 register returned by the ARM instruction OPCODE; else 1042 if a VALUE is provided, that value is written to that register. 1043 The OPCODE should be the value of either an MRC or MCR instruction. 1044 104516.4.3 ARM9 specific commands 1046----------------------------- 1047 1048ARM9-family cores are built around ARM9TDMI or ARM9E (including ARM9EJS) 1049integer processors. Such cores include the ARM920T, ARM926EJ-S, and 1050ARM966. 1051 1052 -- Command: arm9 vector_catch ['all'|'none'|list] 1053 Vector Catch hardware provides a sort of dedicated breakpoint for 1054 hardware events such as reset, interrupt, and abort. You can use 1055 this to conserve normal breakpoint resources, so long as you're not 1056 concerned with code that branches directly to those hardware 1057 vectors. 1058 1059 This always finishes by listing the current configuration. If 1060 parameters are provided, it first reconfigures the vector catch 1061 hardware to intercept 'all' of the hardware vectors, 'none' of 1062 them, or a list with one or more of the following: 'reset' 'undef' 1063 'swi' 'pabt' 'dabt' 'irq' 'fiq'. 1064 106516.4.4 ARM920T specific commands 1066-------------------------------- 1067 1068These commands are available to ARM920T based CPUs, which are 1069implementations of the ARMv4T architecture built using the ARM9TDMI 1070integer core. They are available in addition to the ARM, ARM7/ARM9, and 1071ARM9 commands. 1072 1073 -- Command: arm920t cache_info 1074 Print information about the caches found. This allows to see 1075 whether your target is an ARM920T (2x16kByte cache) or ARM922T 1076 (2x8kByte cache). 1077 1078 -- Command: arm920t cp15 regnum [value] 1079 Display cp15 register REGNUM; else if a VALUE is provided, that 1080 value is written to that register. This uses "physical access" and 1081 the register number is as shown in bits 38..33 of table 9-9 in the 1082 ARM920T TRM. (Not all registers can be written.) 1083 1084 -- Command: arm920t cp15i opcode [value [address]] 1085 _DEPRECATED - avoid using this. Use the 'arm mrc' or 'arm mcr' 1086 commands instead._ 1087 1088 Interpreted access using ARM instruction OPCODE, which should be 1089 the value of either an MRC or MCR instruction (as shown tables 1090 9-11, 9-12, and 9-13 in the ARM920T TRM). If no VALUE is provided, 1091 the result is displayed. Else if that value is written using the 1092 specified ADDRESS, or using zero if no other address is provided. 1093 1094 -- Command: arm920t read_cache filename 1095 Dump the content of ICache and DCache to a file named 'filename'. 1096 1097 -- Command: arm920t read_mmu filename 1098 Dump the content of the ITLB and DTLB to a file named 'filename'. 1099 110016.4.5 ARM926ej-s specific commands 1101----------------------------------- 1102 1103These commands are available to ARM926ej-s based CPUs, which are 1104implementations of the ARMv5TEJ architecture based on the ARM9EJ-S 1105integer core. They are available in addition to the ARM, ARM7/ARM9, and 1106ARM9 commands. 1107 1108The Feroceon cores also support these commands, although they are not 1109built from ARM926ej-s designs. 1110 1111 -- Command: arm926ejs cache_info 1112 Print information about the caches found. 1113 111416.4.6 ARM966E specific commands 1115-------------------------------- 1116 1117These commands are available to ARM966 based CPUs, which are 1118implementations of the ARMv5TE architecture. They are available in 1119addition to the ARM, ARM7/ARM9, and ARM9 commands. 1120 1121 -- Command: arm966e cp15 regnum [value] 1122 Display cp15 register REGNUM; else if a VALUE is provided, that 1123 value is written to that register. The six bit REGNUM values are 1124 bits 37..32 from table 7-2 of the ARM966E-S TRM. There is no 1125 current control over bits 31..30 from that table, as required for 1126 BIST support. 1127 112816.4.7 XScale specific commands 1129------------------------------- 1130 1131Some notes about the debug implementation on the XScale CPUs: 1132 1133The XScale CPU provides a special debug-only mini-instruction cache 1134(mini-IC) in which exception vectors and target-resident debug handler 1135code are placed by OpenOCD. In order to get access to the CPU, OpenOCD 1136must point vector 0 (the reset vector) to the entry of the debug 1137handler. However, this means that the complete first cacheline in the 1138mini-IC is marked valid, which makes the CPU fetch all exception 1139handlers from the mini-IC, ignoring the code in RAM. 1140 1141To address this situation, OpenOCD provides the 'xscale vector_table' 1142command, which allows the user to explicitly write individual entries to 1143either the high or low vector table stored in the mini-IC. 1144 1145It is recommended to place a pc-relative indirect branch in the vector 1146table, and put the branch destination somewhere in memory. Doing so 1147makes sure the code in the vector table stays constant regardless of 1148code layout in memory: 1149 _vectors: 1150 ldr pc,[pc,#0x100-8] 1151 ldr pc,[pc,#0x100-8] 1152 ldr pc,[pc,#0x100-8] 1153 ldr pc,[pc,#0x100-8] 1154 ldr pc,[pc,#0x100-8] 1155 ldr pc,[pc,#0x100-8] 1156 ldr pc,[pc,#0x100-8] 1157 ldr pc,[pc,#0x100-8] 1158 .org 0x100 1159 .long real_reset_vector 1160 .long real_ui_handler 1161 .long real_swi_handler 1162 .long real_pf_abort 1163 .long real_data_abort 1164 .long 0 /* unused */ 1165 .long real_irq_handler 1166 .long real_fiq_handler 1167 1168Alternatively, you may choose to keep some or all of the mini-IC vector 1169table entries synced with those written to memory by your system 1170software. The mini-IC can not be modified while the processor is 1171executing, but for each vector table entry not previously defined using 1172the 'xscale vector_table' command, OpenOCD will copy the value from 1173memory to the mini-IC every time execution resumes from a halt. This is 1174done for both high and low vector tables (although the table not in use 1175may not be mapped to valid memory, and in this case that copy operation 1176will silently fail). This means that you will need to briefly halt 1177execution at some strategic point during system start-up; e.g., after 1178the software has initialized the vector table, but before exceptions are 1179enabled. A breakpoint can be used to accomplish this once the 1180appropriate location in the start-up code has been identified. A 1181watchpoint over the vector table region is helpful in finding the 1182location if you're not sure. Note that the same situation exists any 1183time the vector table is modified by the system software. 1184 1185The debug handler must be placed somewhere in the address space using 1186the 'xscale debug_handler' command. The allowed locations for the debug 1187handler are either (0x800 - 0x1fef800) or (0xfe000800 - 0xfffff800). 1188The default value is 0xfe000800. 1189 1190XScale has resources to support two hardware breakpoints and two 1191watchpoints. However, the following restrictions on watchpoint 1192functionality apply: (1) the value and mask arguments to the 'wp' 1193command are not supported, (2) the watchpoint length must be a power of 1194two and not less than four, and can not be greater than the watchpoint 1195address, and (3) a watchpoint with a length greater than four consumes 1196all the watchpoint hardware resources. This means that at any one time, 1197you can have enabled either two watchpoints with a length of four, or 1198one watchpoint with a length greater than four. 1199 1200These commands are available to XScale based CPUs, which are 1201implementations of the ARMv5TE architecture. 1202 1203 -- Command: xscale analyze_trace 1204 Displays the contents of the trace buffer. 1205 1206 -- Command: xscale cache_clean_address address 1207 Changes the address used when cleaning the data cache. 1208 1209 -- Command: xscale cache_info 1210 Displays information about the CPU caches. 1211 1212 -- Command: xscale cp15 regnum [value] 1213 Display cp15 register REGNUM; else if a VALUE is provided, that 1214 value is written to that register. 1215 1216 -- Command: xscale debug_handler target address 1217 Changes the address used for the specified target's debug handler. 1218 1219 -- Command: xscale dcache ['enable'|'disable'] 1220 Enables or disable the CPU's data cache. 1221 1222 -- Command: xscale dump_trace filename 1223 Dumps the raw contents of the trace buffer to 'filename'. 1224 1225 -- Command: xscale icache ['enable'|'disable'] 1226 Enables or disable the CPU's instruction cache. 1227 1228 -- Command: xscale mmu ['enable'|'disable'] 1229 Enables or disable the CPU's memory management unit. 1230 1231 -- Command: xscale trace_buffer ['enable'|'disable' ['fill' [n] | 1232 'wrap']] 1233 Displays the trace buffer status, after optionally enabling or 1234 disabling the trace buffer and modifying how it is emptied. 1235 1236 -- Command: xscale trace_image filename [offset [type]] 1237 Opens a trace image from 'filename', optionally rebasing its 1238 segment addresses by OFFSET. The image TYPE may be one of 'bin' 1239 (binary), 'ihex' (Intel hex), 'elf' (ELF file), 's19' (Motorola 1240 s19), 'mem', or 'builder'. 1241 1242 -- Command: xscale vector_catch [mask] 1243 Display a bitmask showing the hardware vectors to catch. If the 1244 optional parameter is provided, first set the bitmask to that 1245 value. 1246 1247 The mask bits correspond with bit 16..23 in the DCSR: 1248 0x01 Trap Reset 1249 0x02 Trap Undefined Instructions 1250 0x04 Trap Software Interrupt 1251 0x08 Trap Prefetch Abort 1252 0x10 Trap Data Abort 1253 0x20 reserved 1254 0x40 Trap IRQ 1255 0x80 Trap FIQ 1256 1257 -- Command: xscale vector_table [('low'|'high') index value] 1258 1259 Set an entry in the mini-IC vector table. There are two tables: 1260 one for low vectors (at 0x00000000), and one for high vectors 1261 (0xFFFF0000), each holding the 8 exception vectors. INDEX can be 1262 1-7, because vector 0 points to the debug handler entry and can not 1263 be overwritten. VALUE holds the 32-bit opcode that is placed in 1264 the mini-IC. 1265 1266 Without arguments, the current settings are displayed. 1267 126816.5 ARMv6 Architecture 1269======================= 1270 127116.5.1 ARM11 specific commands 1272------------------------------ 1273 1274 -- Command: arm11 memwrite burst ['enable'|'disable'] 1275 Displays the value of the memwrite burst-enable flag, which is 1276 enabled by default. If a boolean parameter is provided, first 1277 assigns that flag. Burst writes are only used for memory writes 1278 larger than 1 word. They improve performance by assuming that the 1279 CPU has read each data word over JTAG and completed its write 1280 before the next word arrives, instead of polling for a status flag 1281 to verify that completion. This is usually safe, because JTAG runs 1282 much slower than the CPU. 1283 1284 -- Command: arm11 memwrite error_fatal ['enable'|'disable'] 1285 Displays the value of the memwrite error_fatal flag, which is 1286 enabled by default. If a boolean parameter is provided, first 1287 assigns that flag. When set, certain memory write errors cause 1288 earlier transfer termination. 1289 1290 -- Command: arm11 step_irq_enable ['enable'|'disable'] 1291 Displays the value of the flag controlling whether IRQs are enabled 1292 during single stepping; they are disabled by default. If a boolean 1293 parameter is provided, first assigns that. 1294 1295 -- Command: arm11 vcr [value] 1296 Displays the value of the _Vector Catch Register (VCR)_, 1297 coprocessor 14 register 7. If VALUE is defined, first assigns 1298 that. 1299 1300 Vector Catch hardware provides dedicated breakpoints for certain 1301 hardware events. The specific bit values are core-specific (as in 1302 fact is using coprocessor 14 register 7 itself) but all current 1303 ARM11 cores _except the ARM1176_ use the same six bits. 1304 130516.6 ARMv7 and ARMv8 Architecture 1306================================= 1307 130816.6.1 ARMv7-A specific commands 1309-------------------------------- 1310 1311 -- Command: cortex_a cache_info 1312 display information about target caches 1313 1314 -- Command: cortex_a dacrfixup ['on'|'off'] 1315 Work around issues with software breakpoints when the program text 1316 is mapped read-only by the operating system. This option sets the 1317 CP15 DACR to "all-manager" to bypass MMU permission checks on 1318 memory access. Defaults to 'off'. 1319 1320 -- Command: cortex_a dbginit 1321 Initialize core debug Enables debug by unlocking the Software Lock 1322 and clearing sticky powerdown indications 1323 1324 -- Command: cortex_a smp [on|off] 1325 Display/set the current SMP mode 1326 1327 -- Command: cortex_a smp_gdb [core_id] 1328 Display/set the current core displayed in GDB 1329 1330 -- Command: cortex_a maskisr ['on'|'off'] 1331 Selects whether interrupts will be processed when single stepping 1332 1333 -- Command: cache_config l2x [base way] 1334 configure l2x cache 1335 1336 -- Command: cortex_a mmu dump ['0'|'1'|'addr' address ['num_entries']] 1337 Dump the MMU translation table from TTB0 or TTB1 register, or from 1338 physical memory location ADDRESS. When dumping the table from 1339 ADDRESS, print at most NUM_ENTRIES page table entries. NUM_ENTRIES 1340 is optional, if omitted, the maximum possible (4096) entries are 1341 printed. 1342 134316.6.2 ARMv7-R specific commands 1344-------------------------------- 1345 1346 -- Command: cortex_r dbginit 1347 Initialize core debug Enables debug by unlocking the Software Lock 1348 and clearing sticky powerdown indications 1349 1350 -- Command: cortex_r maskisr ['on'|'off'] 1351 Selects whether interrupts will be processed when single stepping 1352 135316.6.3 ARMv7-M specific commands 1354-------------------------------- 1355 1356 -- Command: tpiu config ('disable' | (('external' | 'internal (FILENAME 1357 | :PORT | -)') ('sync PORT_WIDTH' | (('manchester' | 'uart') 1358 FORMATTER_ENABLE)) TRACECLKIN_FREQ [TRACE_FREQ])) 1359 1360 ARMv7-M architecture provides several modules to generate debugging 1361 information internally (ITM, DWT and ETM). Their output is directed 1362 through TPIU to be captured externally either on an SWO pin (this 1363 configuration is called SWV) or on a synchronous parallel trace 1364 port. 1365 1366 This command configures the TPIU module of the target and, if 1367 internal capture mode is selected, starts to capture trace output 1368 by using the debugger adapter features. 1369 1370 Some targets require additional actions to be performed in the 1371 trace-config handler for trace port to be activated. 1372 1373 Command options: 1374 - 'disable' disable TPIU handling; 1375 - 'external' configure TPIU to let user capture trace output 1376 externally (with an additional UART or logic analyzer 1377 hardware). 1378 - 'internal (FILENAME | :PORT | -)' configure TPIU and debug 1379 adapter to gather trace data then: 1380 1381 - append it to a regular file or a named pipe if FILENAME 1382 is specified. 1383 - listen to a TCP/IP port if :PORT is specified, then 1384 broadcast the trace data over this port. 1385 - if '-' is specified, OpenOCD will forward trace data to 1386 'tcl_trace' command. 1387 Note: while broadcasting to file or TCP, the forwarding 1388 to 'tcl_trace' will remain active. 1389 1390 - 'sync PORT_WIDTH' use synchronous parallel trace output mode, 1391 and set port width to PORT_WIDTH. 1392 - 'manchester' use asynchronous SWO mode with Manchester coding. 1393 - 'uart' use asynchronous SWO mode with NRZ (same as regular 1394 UART 8N1) coding. 1395 - FORMATTER_ENABLE is 'on' or 'off' to enable or disable TPIU 1396 formatter which needs to be used when both ITM and ETM data is 1397 to be output via SWO. 1398 - TRACECLKIN_FREQ this should be specified to match target's 1399 current TRACECLKIN frequency (usually the same as HCLK). 1400 - TRACE_FREQ trace port frequency. Can be omitted in internal 1401 mode to let the adapter driver select the maximum supported 1402 rate automatically. 1403 1404 Example usage: 1405 1. STM32L152 board is programmed with an application that 1406 configures PLL to provide core clock with 24MHz frequency; to 1407 use ITM output it's enough to: 1408 #include <libopencm3/cm3/itm.h> 1409 ... 1410 ITM_STIM8(0) = c; 1411 ... 1412 (the most obvious way is to use the first stimulus port for 1413 printf, for that this ITM_STIM8 assignment can be used inside 1414 _write(); to make it blocking to avoid data loss, add 'while 1415 (!(ITM_STIM8(0) & ITM_STIM_FIFOREADY));'); 1416 2. An FT2232H UART is connected to the SWO pin of the board; 1417 3. Commands to configure UART for 12MHz baud rate: 1418 $ setserial /dev/ttyUSB1 spd_cust divisor 5 1419 $ stty -F /dev/ttyUSB1 38400 1420 (FT2232H's base frequency is 60MHz, spd_cust allows to alias 1421 38400 baud with our custom divisor to get 12MHz) 1422 4. 'itmdump -f /dev/ttyUSB1 -d1' 1423 5. OpenOCD invocation line: 1424 openocd -f interface/stlink.cfg \ 1425 -c "transport select hla_swd" \ 1426 -f target/stm32l1.cfg \ 1427 -c "tpiu config external uart off 24000000 12000000" 1428 1429 -- Command: itm port PORT ('0'|'1'|'on'|'off') 1430 Enable or disable trace output for ITM stimulus PORT (counting from 1431 0). Port 0 is enabled on target creation automatically. 1432 1433 -- Command: itm ports ('0'|'1'|'on'|'off') 1434 Enable or disable trace output for all ITM stimulus ports. 1435 143616.6.4 Cortex-M specific commands 1437--------------------------------- 1438 1439 -- Command: cortex_m maskisr ('auto'|'on'|'off'|'steponly') 1440 Control masking (disabling) interrupts during target step/resume. 1441 1442 The 'auto' option handles interrupts during stepping in a way that 1443 they get served but don't disturb the program flow. The step 1444 command first allows pending interrupt handlers to execute, then 1445 disables interrupts and steps over the next instruction where the 1446 core was halted. After the step interrupts are enabled again. If 1447 the interrupt handlers don't complete within 500ms, the step 1448 command leaves with the core running. 1449 1450 The 'steponly' option disables interrupts during single-stepping 1451 but enables them during normal execution. This can be used as a 1452 partial workaround for 702596 erratum in Cortex-M7 r0p1. See 1453 "Cortex-M7 (AT610) and Cortex-M7 with FPU (AT611) Software 1454 Developer Errata Notice" from ARM for further details. 1455 1456 Note that a free hardware (FPB) breakpoint is required for the 1457 'auto' option. If no breakpoint is available at the time of the 1458 step, then the step is taken with interrupts enabled, i.e. the 1459 same way the 'off' option does. 1460 1461 Default is 'auto'. 1462 1463 -- Command: cortex_m vector_catch ['all'|'none'|list] 1464 Vector Catch hardware provides dedicated breakpoints for certain 1465 hardware events. 1466 1467 Parameters request interception of 'all' of these hardware event 1468 vectors, 'none' of them, or one or more of the following: 1469 'hard_err' for a HardFault exception; 'mm_err' for a MemManage 1470 exception; 'bus_err' for a BusFault exception; 'irq_err', 1471 'state_err', 'chk_err', or 'nocp_err' for various UsageFault 1472 exceptions; or 'reset'. If NVIC setup code does not enable them, 1473 MemManage, BusFault, and UsageFault exceptions are mapped to 1474 HardFault. UsageFault checks for divide-by-zero and unaligned 1475 access must also be explicitly enabled. 1476 1477 This finishes by listing the current vector catch configuration. 1478 1479 -- Command: cortex_m reset_config ('sysresetreq'|'vectreset') 1480 Control reset handling if hardware srst is not fitted *Note 1481 reset_config: reset_config. 1482 1483 - 'sysresetreq' use AIRCR SYSRESETREQ to reset system. 1484 - 'vectreset' use AIRCR VECTRESET to reset system (default). 1485 1486 Using 'vectreset' is a safe option for Cortex-M3, M4 and M7 cores. 1487 This however has the disadvantage of only resetting the core, all 1488 peripherals are unaffected. A solution would be to use a 1489 'reset-init' event handler to manually reset the peripherals. 1490 *Note Target Events: targetevents. 1491 1492 Cortex-M0, M0+ and M1 do not support 'vectreset', use 'sysresetreq' 1493 instead. 1494 149516.6.5 ARMv8-A specific commands 1496-------------------------------- 1497 1498 -- Command: aarch64 cache_info 1499 Display information about target caches 1500 1501 -- Command: aarch64 dbginit 1502 This command enables debugging by clearing the OS Lock and sticky 1503 power-down and reset indications. It also establishes the 1504 expected, basic cross-trigger configuration the aarch64 target code 1505 relies on. In a configuration file, the command would typically be 1506 called from a 'reset-end' or 'reset-deassert-post' handler, to 1507 re-enable debugging after a system reset. However, normally it is 1508 not necessary to use the command at all. 1509 1510 -- Command: aarch64 disassemble address [count] 1511 Disassembles COUNT instructions starting at ADDRESS. If COUNT is 1512 not specified, a single instruction is disassembled. 1513 1514 -- Command: aarch64 smp [on|off] 1515 Display, enable or disable SMP handling mode. The state of SMP 1516 handling influences the way targets in an SMP group are handled by 1517 the run control. With SMP handling enabled, issuing halt or resume 1518 to one core will trigger halting or resuming of all cores in the 1519 group. The command 'target smp' defines which targets are in the 1520 SMP group. With SMP handling disabled, all targets need to be 1521 treated individually. 1522 1523 -- Command: aarch64 maskisr ['on'|'off'] 1524 Selects whether interrupts will be processed when single stepping. 1525 The default configuration is 'on'. 1526 1527 -- Command: $target_name catch_exc 1528 ['off'|'sec_el1'|'sec_el3'|'nsec_el1'|'nsec_el2']+ 1529 Cause '$target_name' to halt when an exception is taken. Any 1530 combination of Secure (sec) EL1/EL3 or Non-Secure (nsec) EL1/EL2 is 1531 valid. The target '$target_name' will halt before taking the 1532 exception. In order to resume the target, the exception catch must 1533 be disabled again with '$target_name catch_exc off'. Issuing the 1534 command without options prints the current configuration. 1535 153616.7 EnSilica eSi-RISC Architecture 1537=================================== 1538 1539eSi-RISC is a highly configurable microprocessor architecture for 1540embedded systems provided by EnSilica. (See: 1541<http://www.ensilica.com/risc-ip/>.) 1542 154316.7.1 eSi-RISC Configuration 1544----------------------------- 1545 1546 -- Command: esirisc cache_arch ('harvard'|'von_neumann') 1547 Configure the caching architecture. Targets with the 1548 'UNIFIED_ADDRESS_SPACE' option disabled employ a Harvard 1549 architecture. By default, 'von_neumann' is assumed. 1550 1551 -- Command: esirisc hwdc ('all'|'none'|mask ...) 1552 Configure hardware debug control. The HWDC register controls which 1553 exceptions return control back to the debugger. Possible masks are 1554 'all', 'none', 'reset', 'interrupt', 'syscall', 'error', and 1555 'debug'. By default, 'reset', 'error', and 'debug' are enabled. 1556 155716.7.2 eSi-RISC Operation 1558------------------------- 1559 1560 -- Command: esirisc flush_caches 1561 Flush instruction and data caches. This command requires that the 1562 target is halted when the command is issued and configured with an 1563 instruction or data cache. 1564 156516.7.3 eSi-Trace Configuration 1566------------------------------ 1567 1568eSi-RISC targets may be configured with support for instruction tracing. 1569Trace data may be written to an in-memory buffer or FIFO. If a FIFO is 1570configured, DMA is typically employed to move trace data off-device 1571using a high-speed peripheral (eg. SPI). Collected trace data is 1572encoded in one of three different formats. At a minimum, 'esirisc trace 1573buffer' or 'esirisc trace fifo' must be issued along with 'esirisc trace 1574format' before trace data can be collected. 1575 1576OpenOCD provides rudimentary analysis of collected trace data. If more 1577detail is needed, collected trace data can be dumped to a file and 1578processed by external tooling. 1579 1580 Issues: OpenOCD is unable to process trace data sent to a FIFO. A 1581 potential workaround for this issue is to configure DMA to copy 1582 trace data to an in-memory buffer, which can then be passed to the 1583 'esirisc trace analyze' and 'esirisc trace dump' commands. 1584 1585 It is possible to corrupt trace data when using a FIFO if the 1586 peripheral responsible for draining data from the FIFO is not fast 1587 enough. This can be managed by enabling flow control, however this 1588 can impact timing-sensitive software operation on the CPU. 1589 1590 -- Command: esirisc trace buffer address size ['wrap'] 1591 Configure trace buffer using the provided address and size. If the 1592 'wrap' option is specified, trace collection will continue once the 1593 end of the buffer is reached. By default, wrap is disabled. 1594 1595 -- Command: esirisc trace fifo address 1596 Configure trace FIFO using the provided address. 1597 1598 -- Command: esirisc trace flow_control ('enable'|'disable') 1599 Enable or disable stalling the CPU to collect trace data. By 1600 default, flow control is disabled. 1601 1602 -- Command: esirisc trace format ('full'|'branch'|'icache') pc_bits 1603 Configure trace format and number of PC bits to be captured. 1604 'pc_bits' must be within 1 and 31 as the LSB is not collected. If 1605 external tooling is used to analyze collected trace data, these 1606 values must match. 1607 1608 Supported trace formats: 1609 * 'full' capture full trace data, allowing execution history and 1610 timing to be determined. 1611 * 'branch' capture taken branch instructions and branch target 1612 addresses. 1613 * 'icache' capture instruction cache misses. 1614 1615 -- Command: esirisc trace trigger start ('condition') [start_data 1616 start_mask] 1617 Configure trigger start condition using the provided start data and 1618 mask. A brief description of each condition is provided below; for 1619 more detail on how these values are used, see the eSi-RISC 1620 Architecture Manual. 1621 1622 Supported conditions: 1623 * 'none' manual tracing (see 'esirisc trace start'). 1624 * 'pc' start tracing if the PC matches start data and mask. 1625 * 'load' start tracing if the effective address of a load 1626 instruction matches start data and mask. 1627 * 'store' start tracing if the effective address of a store 1628 instruction matches start data and mask. 1629 * 'exception' start tracing if the EID of an exception matches 1630 start data and mask. 1631 * 'eret' start tracing when an 'ERET' instruction is executed. 1632 * 'wait' start tracing when a 'WAIT' instruction is executed. 1633 * 'stop' start tracing when a 'STOP' instruction is executed. 1634 * 'high' start tracing when an external signal is a logical 1635 high. 1636 * 'low' start tracing when an external signal is a logical low. 1637 1638 -- Command: esirisc trace trigger stop ('condition') [stop_data 1639 stop_mask] 1640 Configure trigger stop condition using the provided stop data and 1641 mask. A brief description of each condition is provided below; for 1642 more detail on how these values are used, see the eSi-RISC 1643 Architecture Manual. 1644 1645 Supported conditions: 1646 * 'none' manual tracing (see 'esirisc trace stop'). 1647 * 'pc' stop tracing if the PC matches stop data and mask. 1648 * 'load' stop tracing if the effective address of a load 1649 instruction matches stop data and mask. 1650 * 'store' stop tracing if the effective address of a store 1651 instruction matches stop data and mask. 1652 * 'exception' stop tracing if the EID of an exception matches 1653 stop data and mask. 1654 * 'eret' stop tracing when an 'ERET' instruction is executed. 1655 * 'wait' stop tracing when a 'WAIT' instruction is executed. 1656 * 'stop' stop tracing when a 'STOP' instruction is executed. 1657 1658 -- Command: esirisc trace trigger delay ('trigger') [cycles] 1659 Configure trigger start/stop delay in clock cycles. 1660 1661 Supported triggers: 1662 * 'none' no delay to start or stop collection. 1663 * 'start' delay 'cycles' after trigger to start collection. 1664 * 'stop' delay 'cycles' after trigger to stop collection. 1665 * 'both' delay 'cycles' after both triggers to start or stop 1666 collection. 1667 166816.7.4 eSi-Trace Operation 1669-------------------------- 1670 1671 -- Command: esirisc trace init 1672 Initialize trace collection. This command must be called any time 1673 the configuration changes. If a trace buffer has been configured, 1674 the contents will be overwritten when trace collection starts. 1675 1676 -- Command: esirisc trace info 1677 Display trace configuration. 1678 1679 -- Command: esirisc trace status 1680 Display trace collection status. 1681 1682 -- Command: esirisc trace start 1683 Start manual trace collection. 1684 1685 -- Command: esirisc trace stop 1686 Stop manual trace collection. 1687 1688 -- Command: esirisc trace analyze [address size] 1689 Analyze collected trace data. This command may only be used if a 1690 trace buffer has been configured. If a trace FIFO has been 1691 configured, trace data must be copied to an in-memory buffer 1692 identified by the 'address' and 'size' options using DMA. 1693 1694 -- Command: esirisc trace dump [address size] 'filename' 1695 Dump collected trace data to file. This command may only be used 1696 if a trace buffer has been configured. If a trace FIFO has been 1697 configured, trace data must be copied to an in-memory buffer 1698 identified by the 'address' and 'size' options using DMA. 1699 170016.8 Intel Architecture 1701======================= 1702 1703Intel Quark X10xx is the first product in the Quark family of SoCs. It 1704is an IA-32 (Pentium x86 ISA) compatible SoC. The core CPU in the X10xx 1705is codenamed Lakemont. Lakemont version 1 (LMT1) is used in X10xx. The 1706CPU TAP (Lakemont TAP) is used for software debug and the CLTAP is used 1707for SoC level operations. Useful docs are here: 1708https://communities.intel.com/community/makers/documentation 1709 * Intel Quark SoC X1000 OpenOCD/GDB/Eclipse App Note (web search for 1710 doc num 330015) 1711 * Intel Quark SoC X1000 Debug Operations User Guide (web search for 1712 doc num 329866) 1713 * Intel Quark SoC X1000 Datasheet (web search for doc num 329676) 1714 171516.8.1 x86 32-bit specific commands 1716----------------------------------- 1717 1718The three main address spaces for x86 are memory, I/O and configuration 1719space. These commands allow a user to read and write to the 64Kbyte I/O 1720address space. 1721 1722 -- Command: x86_32 idw address 1723 Display the contents of a 32-bit I/O port from address range 0x0000 1724 - 0xffff. 1725 1726 -- Command: x86_32 idh address 1727 Display the contents of a 16-bit I/O port from address range 0x0000 1728 - 0xffff. 1729 1730 -- Command: x86_32 idb address 1731 Display the contents of a 8-bit I/O port from address range 0x0000 1732 - 0xffff. 1733 1734 -- Command: x86_32 iww address 1735 Write the contents of a 32-bit I/O port to address range 0x0000 - 1736 0xffff. 1737 1738 -- Command: x86_32 iwh address 1739 Write the contents of a 16-bit I/O port to address range 0x0000 - 1740 0xffff. 1741 1742 -- Command: x86_32 iwb address 1743 Write the contents of a 8-bit I/O port to address range 0x0000 - 1744 0xffff. 1745 174616.9 OpenRISC Architecture 1747========================== 1748 1749The OpenRISC CPU is a soft core. It is used in a programmable SoC which 1750can be configured with any of the TAP / Debug Unit available. 1751 175216.9.1 TAP and Debug Unit selection commands 1753-------------------------------------------- 1754 1755 -- Command: tap_select ('vjtag'|'mohor'|'xilinx_bscan') 1756 Select between the Altera Virtual JTAG , Xilinx Virtual JTAG and 1757 Mohor TAP. 1758 -- Command: du_select ('adv'|'mohor') [option] 1759 Select between the Advanced Debug Interface and the classic one. 1760 1761 An option can be passed as a second argument to the debug unit. 1762 1763 When using the Advanced Debug Interface, option = 1 means the RTL 1764 core is configured with ADBG_USE_HISPEED = 1. This configuration 1765 skips status checking between bytes while doing read or write 1766 bursts. 1767 176816.9.2 Registers commands 1769------------------------- 1770 1771 -- Command: addreg [name] [address] [feature] [reg_group] 1772 Add a new register in the cpu register list. This register will be 1773 included in the generated target descriptor file. 1774 1775 *[feature]* must be "org.gnu.gdb.or1k.group[0..10]". 1776 1777 *[reg_group]* can be anything. The default register list defines 1778 "system", "dmmu", "immu", "dcache", "icache", "mac", "debug", 1779 "perf", "power", "pic" and "timer" groups. 1780 1781 _example:_ 1782 addreg rtest 0x1234 org.gnu.gdb.or1k.group0 system 1783 1784 -- Command: readgroup ('group') 1785 Display all registers in _group_. 1786 1787 _group_ can be "system", "dmmu", "immu", "dcache", "icache", "mac", 1788 "debug", "perf", "power", "pic", "timer" or any new group created 1789 with addreg command. 1790 179116.10 RISC-V Architecture 1792========================= 1793 1794RISC-V (http://riscv.org/) is a free and open ISA. OpenOCD supports JTAG 1795debug of RV32 and RV64 cores in heterogeneous multicore systems of up to 179632 harts. (It's possible to increase this limit to 1024 by changing 1797RISCV_MAX_HARTS in riscv.h.) OpenOCD primarily supports 0.13 of the 1798RISC-V Debug Specification, but there is also support for legacy targets 1799that implement version 0.11. 1800 180116.10.1 RISC-V Terminology 1802-------------------------- 1803 1804A _hart_ is a hardware thread. A hart may share resources (eg. FPU) 1805with another hart, or may be a separate core. RISC-V treats those the 1806same, and OpenOCD exposes each hart as a separate core. 1807 180816.10.2 RISC-V Debug Configuration Commands 1809------------------------------------------- 1810 1811 -- Command: riscv expose_csrs n0[-m0][,n1[-m1]]... 1812 Configure a list of inclusive ranges for CSRs to expose in addition 1813 to the standard ones. This must be executed before 'init'. 1814 1815 By default OpenOCD attempts to expose only CSRs that are mentioned 1816 in a spec, and then only if the corresponding extension appears to 1817 be implemented. This command can be used if OpenOCD gets this 1818 wrong, or a target implements custom CSRs. 1819 1820 -- Command: riscv expose_custom n0[-m0][,n1[-m1]]... 1821 The RISC-V Debug Specification allows targets to expose custom 1822 registers through abstract commands. (See Section 3.5.1.1 in that 1823 document.) This command configures a list of inclusive ranges of 1824 those registers to expose. Number 0 indicates the first custom 1825 register, whose abstract command number is 0xc000. This command 1826 must be executed before 'init'. 1827 1828 -- Command: riscv set_command_timeout_sec [seconds] 1829 Set the wall-clock timeout (in seconds) for individual commands. 1830 The default should work fine for all but the slowest targets (eg. 1831 simulators). 1832 1833 -- Command: riscv set_reset_timeout_sec [seconds] 1834 Set the maximum time to wait for a hart to come out of reset after 1835 reset is deasserted. 1836 1837 -- Command: riscv set_scratch_ram none|[address] 1838 Set the address of 16 bytes of scratch RAM the debugger can use, or 1839 'none'. This is used to access 64-bit floating point registers on 1840 32-bit targets. 1841 1842 -- Command: riscv set_prefer_sba on|off 1843 When on, prefer to use System Bus Access to access memory. When 1844 off (default), prefer to use the Program Buffer to access memory. 1845 1846 -- Command: riscv set_enable_virtual on|off 1847 When on, memory accesses are performed on physical or virtual 1848 memory depending on the current system configuration. When off 1849 (default), all memory accessses are performed on physical memory. 1850 1851 -- Command: riscv set_enable_virt2phys on|off 1852 When on (default), memory accesses are performed on physical or 1853 virtual memory depending on the current satp configuration. When 1854 off, all memory accessses are performed on physical memory. 1855 1856 -- Command: riscv resume_order normal|reversed 1857 Some software assumes all harts are executing nearly continuously. 1858 Such software may be sensitive to the order that harts are resumed 1859 in. On harts that don't support hasel, this option allows the user 1860 to choose the order the harts are resumed in. If you are using 1861 this option, it's probably masking a race condition problem in your 1862 code. 1863 1864 Normal order is from lowest hart index to highest. This is the 1865 default behavior. Reversed order is from highest hart index to 1866 lowest. 1867 1868 -- Command: riscv set_ir ('idcode'|'dtmcs'|'dmi') [value] 1869 Set the IR value for the specified JTAG register. This is useful, 1870 for example, when using the existing JTAG interface on a Xilinx 1871 FPGA by way of BSCANE2 primitives that only permit a limited 1872 selection of IR values. 1873 1874 When utilizing version 0.11 of the RISC-V Debug Specification, 1875 'dtmcs' and 'dmi' set the IR values for the DTMCONTROL and DBUS 1876 registers, respectively. 1877 1878 -- Command: riscv use_bscan_tunnel value 1879 Enable or disable use of a BSCAN tunnel to reach DM. Supply the 1880 width of the DM transport TAP's instruction register to enable. 1881 Supply a value of 0 to disable. 1882 1883 -- Command: riscv set_ebreakm on|off 1884 Control dcsr.ebreakm. When on (default), M-mode ebreak 1885 instructions trap to OpenOCD. When off, they generate a breakpoint 1886 exception handled internally. 1887 1888 -- Command: riscv set_ebreaks on|off 1889 Control dcsr.ebreaks. When on (default), S-mode ebreak 1890 instructions trap to OpenOCD. When off, they generate a breakpoint 1891 exception handled internally. 1892 1893 -- Command: riscv set_ebreaku on|off 1894 Control dcsr.ebreaku. When on (default), U-mode ebreak 1895 instructions trap to OpenOCD. When off, they generate a breakpoint 1896 exception handled internally. 1897 189816.10.3 RISC-V Authentication Commands 1899-------------------------------------- 1900 1901The following commands can be used to authenticate to a RISC-V system. 1902Eg. a trivial challenge-response protocol could be implemented as 1903follows in a configuration file, immediately following 'init': 1904 set challenge [riscv authdata_read] 1905 riscv authdata_write [expr $challenge + 1] 1906 1907 -- Command: riscv authdata_read 1908 Return the 32-bit value read from authdata. 1909 1910 -- Command: riscv authdata_write value 1911 Write the 32-bit value to authdata. 1912 191316.10.4 RISC-V DMI Commands 1914--------------------------- 1915 1916The following commands allow direct access to the Debug Module 1917Interface, which can be used to interact with custom debug features. 1918 1919 -- Command: riscv dmi_read address 1920 Perform a 32-bit DMI read at address, returning the value. 1921 1922 -- Command: riscv dmi_write address value 1923 Perform a 32-bit DMI write of value at address. 1924 192516.11 ARC Architecture 1926====================== 1927 1928Synopsys DesignWare ARC Processors are a family of 32-bit CPUs that SoC 1929designers can optimize for a wide range of uses, from deeply embedded to 1930high-performance host applications in a variety of market segments. See 1931more at: 1932<http://www.synopsys.com/IP/ProcessorIP/ARCProcessors/Pages/default.aspx>. 1933OpenOCD currently supports ARC EM processors. There is a set 1934ARC-specific OpenOCD commands that allow low-level access to the core 1935and provide necessary support for ARC extensibility and configurability 1936capabilities. ARC processors has much more configuration capabilities 1937than most of the other processors and in addition there is an extension 1938interface that allows SoC designers to add custom registers and 1939instructions. For the OpenOCD that mostly means that set of core and 1940AUX registers in target will vary and is not fixed for a particular 1941processor model. To enable extensibility several TCL commands are 1942provided that allow to describe those optional registers in OpenOCD 1943configuration files. Moreover those commands allow for a dynamic target 1944features discovery. 1945 194616.11.1 General ARC commands 1947---------------------------- 1948 1949 -- Config Command: arc add-reg configparams 1950 1951 Add a new register to processor target. By default newly created 1952 register is marked as not existing. CONFIGPARAMS must have 1953 following required arguments: 1954 1955 * '-name' name 1956 Name of a register. 1957 1958 * '-num' number 1959 Architectural register number: core register number or AUX 1960 register number. 1961 1962 * '-feature' XML_feature 1963 Name of GDB XML target description feature. 1964 1965 CONFIGPARAMS may have following optional arguments: 1966 1967 * '-gdbnum' number 1968 GDB register number. It is recommended to not assign GDB 1969 register number manually, because there would be a risk that 1970 two register will have same number. When register GDB number 1971 is not set with this option, then register will get a previous 1972 register number + 1. This option is required only for those 1973 registers that must be at particular address expected by GDB. 1974 1975 * '-core' 1976 This option specifies that register is a core registers. If 1977 not - this is an AUX register. AUX registers and core 1978 registers reside in different address spaces. 1979 1980 * '-bcr' 1981 This options specifies that register is a BCR register. BCR 1982 means Build Configuration Registers - this is a special type 1983 of AUX registers that are read only and non-volatile, that is 1984 - they never change their value. Therefore OpenOCD never 1985 invalidates values of those registers in internal caches. 1986 Because BCR is a type of AUX registers, this option cannot be 1987 used with '-core'. 1988 1989 * '-type' type_name 1990 Name of type of this register. This can be either one of the 1991 basic GDB types, or a custom types described with 'arc 1992 add-reg-type-[flags|struct]'. 1993 1994 * '-g' 1995 If specified then this is a "general" register. General 1996 registers are always read by OpenOCD on context save (when 1997 core has just been halted) and is always transferred to GDB 1998 client in a response to g-packet. Contrary to this, 1999 non-general registers are read and sent to GDB client 2000 on-demand. In general it is not recommended to apply this 2001 option to custom registers. 2002 2003 -- Config Command: arc add-reg-type-flags -name name flags... 2004 Adds new register type of "flags" class. "Flags" types can contain 2005 only one-bit fields. Each flag definition looks like '-flag name 2006 bit-position'. 2007 2008 -- Config Command: arc add-reg-type-struct -name name structs... 2009 Adds new register type of "struct" class. "Struct" types can 2010 contain either bit-fields or fields of other types, however at the 2011 moment only bit fields are supported. Structure bit field 2012 definition looks like '-bitfield name startbit endbit'. 2013 2014 -- Command: arc get-reg-field reg-name field-name 2015 Returns value of bit-field in a register. Register must be 2016 "struct" register type, *Note add-reg-type-struct:: command 2017 definition. 2018 2019 -- Command: arc set-reg-exists reg-names... 2020 Specify that some register exists. Any amount of names can be 2021 passed as an argument for a single command invocation. 2022 202316.11.2 ARC JTAG commands 2024------------------------- 2025 2026 -- Command: arc jtag set-aux-reg regnum value 2027 This command writes value to AUX register via its number. This 2028 command access register in target directly via JTAG, bypassing any 2029 OpenOCD internal caches, therefore it is unsafe to use if that 2030 register can be operated by other means. 2031 2032 -- Command: arc jtag set-core-reg regnum value 2033 This command is similar to 'arc jtag set-aux-reg' but is for core 2034 registers. 2035 2036 -- Command: arc jtag get-aux-reg regnum 2037 This command returns the value storded in AUX register via its 2038 number. This commands access register in target directly via JTAG, 2039 bypassing any OpenOCD internal caches, therefore it is unsafe to 2040 use if that register can be operated by other means. 2041 2042 -- Command: arc jtag get-core-reg regnum 2043 This command is similar to 'arc jtag get-aux-reg' but is for core 2044 registers. 2045 204616.12 STM8 Architecture 2047======================= 2048 2049STM8 (http://st.com/stm8/) is a 8-bit microcontroller platform from 2050STMicroelectronics, based on a proprietary 8-bit core architecture. 2051 2052OpenOCD supports debugging STM8 through the STMicroelectronics debug 2053protocol SWIM, *note SWIM: swimtransport. 2054 205516.13 Software Debug Messages and Tracing 2056========================================= 2057 2058OpenOCD can process certain requests from target software, when the 2059target uses appropriate libraries. The most powerful mechanism is 2060semihosting, but there is also a lighter weight mechanism using only the 2061DCC channel. 2062 2063Currently 'target_request debugmsgs' is supported only for 'arm7_9' and 2064'cortex_m' cores. These messages are received as part of target 2065polling, so you need to have 'poll on' active to receive them. They are 2066intrusive in that they will affect program execution times. If that is 2067a problem, *note ARM Hardware Tracing: armhardwaretracing. 2068 2069See 'libdcc' in the contrib dir for more details. In addition to 2070sending strings, characters, and arrays of various size integers from 2071the target, 'libdcc' also exports a software trace point mechanism. The 2072target being debugged may issue trace messages which include a 24-bit 2073"trace point" number. Trace point support includes two distinct 2074mechanisms, each supported by a command: 2075 2076 * _History_ ... A circular buffer of trace points can be set up, and 2077 then displayed at any time. This tracks where code has been, which 2078 can be invaluable in finding out how some fault was triggered. 2079 2080 The buffer may overflow, since it collects records continuously. 2081 It may be useful to use some of the 24 bits to represent a 2082 particular event, and other bits to hold data. 2083 2084 * _Counting_ ... An array of counters can be set up, and then 2085 displayed at any time. This can help establish code coverage and 2086 identify hot spots. 2087 2088 The array of counters is directly indexed by the trace point 2089 number, so trace points with higher numbers are not counted. 2090 2091Linux-ARM kernels have a "Kernel low-level debugging via EmbeddedICE DCC 2092channel" option (CONFIG_DEBUG_ICEDCC, depends on CONFIG_DEBUG_LL) which 2093uses this mechanism to deliver messages before a serial console can be 2094activated. This is not the same format used by 'libdcc'. Other 2095software, such as the U-Boot boot loader, sometimes does the same thing. 2096 2097 -- Command: target_request debugmsgs ['enable'|'disable'|'charmsg'] 2098 Displays current handling of target DCC message requests. These 2099 messages may be sent to the debugger while the target is running. 2100 The optional 'enable' and 'charmsg' parameters both enable the 2101 messages, while 'disable' disables them. 2102 2103 With 'charmsg' the DCC words each contain one character, as used by 2104 Linux with CONFIG_DEBUG_ICEDCC; otherwise the libdcc format is 2105 used. 2106 2107 -- Command: trace history ['clear'|count] 2108 With no parameter, displays all the trace points that have 2109 triggered in the order they triggered. With the parameter 'clear', 2110 erases all current trace history records. With a COUNT parameter, 2111 allocates space for that many history records. 2112 2113 -- Command: trace point ['clear'|identifier] 2114 With no parameter, displays all trace point identifiers and how 2115 many times they have been triggered. With the parameter 'clear', 2116 erases all current trace point counters. With a numeric IDENTIFIER 2117 parameter, creates a new a trace point counter and associates it 2118 with that identifier. 2119 2120 _Important:_ The identifier and the trace point number are not 2121 related except by this command. These trace point numbers always 2122 start at zero (from server startup, or after 'trace point clear') 2123 and count up from there. 2124 2125 2126File: openocd.info, Node: JTAG Commands, Next: Boundary Scan Commands, Prev: Architecture and Core Commands, Up: Top 2127 212817 JTAG Commands 2129**************** 2130 2131Most general purpose JTAG commands have been presented earlier. (*Note 2132JTAG Speed: jtagspeed, *note Reset Configuration::, and *note TAP 2133Declaration::.) Lower level JTAG commands, as presented here, may be 2134needed to work with targets which require special attention during 2135operations such as reset or initialization. 2136 2137To use these commands you will need to understand some of the basics of 2138JTAG, including: 2139 2140 * A JTAG scan chain consists of a sequence of individual TAP devices 2141 such as a CPUs. 2142 * Control operations involve moving each TAP through the same 2143 standard state machine (in parallel) using their shared TMS and 2144 clock signals. 2145 * Data transfer involves shifting data through the chain of 2146 instruction or data registers of each TAP, writing new register 2147 values while the reading previous ones. 2148 * Data register sizes are a function of the instruction active in a 2149 given TAP, while instruction register sizes are fixed for each TAP. 2150 All TAPs support a BYPASS instruction with a single bit data 2151 register. 2152 * The way OpenOCD differentiates between TAP devices is by shifting 2153 different instructions into (and out of) their instruction 2154 registers. 2155 215617.1 Low Level JTAG Commands 2157============================ 2158 2159These commands are used by developers who need to access JTAG 2160instruction or data registers, possibly controlling the order of TAP 2161state transitions. If you're not debugging OpenOCD internals, or 2162bringing up a new JTAG adapter or a new type of TAP device (like a CPU 2163or JTAG router), you probably won't need to use these commands. In a 2164debug session that doesn't use JTAG for its transport protocol, these 2165commands are not available. 2166 2167 -- Command: drscan tap [numbits value]+ ['-endstate' tap_state] 2168 Loads the data register of TAP with a series of bit fields that 2169 specify the entire register. Each field is NUMBITS bits long with 2170 a numeric VALUE (hexadecimal encouraged). The return value holds 2171 the original value of each of those fields. 2172 2173 For example, a 38 bit number might be specified as one field of 32 2174 bits then one of 6 bits. _For portability, never pass fields which 2175 are more than 32 bits long. Many OpenOCD implementations do not 2176 support 64-bit (or larger) integer values._ 2177 2178 All TAPs other than TAP must be in BYPASS mode. The single bit in 2179 their data registers does not matter. 2180 2181 When TAP_STATE is specified, the JTAG state machine is left in that 2182 state. For example DRPAUSE might be specified, so that more 2183 instructions can be issued before re-entering the RUN/IDLE state. 2184 If the end state is not specified, the RUN/IDLE state is entered. 2185 2186 Warning: OpenOCD does not record information about data 2187 register lengths, so _it is important that you get the bit 2188 field lengths right_. Remember that different JTAG 2189 instructions refer to different data registers, which may have 2190 different lengths. Moreover, those lengths may not be fixed; 2191 the SCAN_N instruction can change the length of the register 2192 accessed by the INTEST instruction (by connecting a different 2193 scan chain). 2194 2195 -- Command: flush_count 2196 Returns the number of times the JTAG queue has been flushed. This 2197 may be used for performance tuning. 2198 2199 For example, flushing a queue over USB involves a minimum latency, 2200 often several milliseconds, which does not change with the amount 2201 of data which is written. You may be able to identify performance 2202 problems by finding tasks which waste bandwidth by flushing small 2203 transfers too often, instead of batching them into larger 2204 operations. 2205 2206 -- Command: irscan [tap instruction]+ ['-endstate' tap_state] 2207 For each TAP listed, loads the instruction register with its 2208 associated numeric INSTRUCTION. (The number of bits in that 2209 instruction may be displayed using the 'scan_chain' command.) For 2210 other TAPs, a BYPASS instruction is loaded. 2211 2212 When TAP_STATE is specified, the JTAG state machine is left in that 2213 state. For example IRPAUSE might be specified, so the data 2214 register can be loaded before re-entering the RUN/IDLE state. If 2215 the end state is not specified, the RUN/IDLE state is entered. 2216 2217 Note: OpenOCD currently supports only a single field for 2218 instruction register values, unlike data register values. For 2219 TAPs where the instruction register length is more than 32 2220 bits, portable scripts currently must issue only BYPASS 2221 instructions. 2222 2223 -- Command: pathmove start_state [next_state ...] 2224 Start by moving to START_STATE, which must be one of the _stable_ 2225 states. Unless it is the only state given, this will often be the 2226 current state, so that no TCK transitions are needed. Then, in a 2227 series of single state transitions (conforming to the JTAG state 2228 machine) shift to each NEXT_STATE in sequence, one per TCK cycle. 2229 The final state must also be stable. 2230 2231 -- Command: runtest NUM_CYCLES 2232 Move to the RUN/IDLE state, and execute at least NUM_CYCLES of the 2233 JTAG clock (TCK). Instructions often need some time to execute 2234 before they take effect. 2235 2236 -- Command: verify_ircapture ('enable'|'disable') 2237 Verify values captured during IRCAPTURE and returned during IR 2238 scans. Default is enabled, but this can be overridden by 2239 'verify_jtag'. This flag is ignored when validating JTAG chain 2240 configuration. 2241 2242 -- Command: verify_jtag ('enable'|'disable') 2243 Enables verification of DR and IR scans, to help detect programming 2244 errors. For IR scans, 'verify_ircapture' must also be enabled. 2245 Default is enabled. 2246 224717.2 TAP state names 2248==================== 2249 2250The TAP_STATE names used by OpenOCD in the 'drscan', 'irscan', and 2251'pathmove' commands are the same as those used in SVF boundary scan 2252documents, except that SVF uses IDLE instead of RUN/IDLE. 2253 2254 * RESET ... _stable_ (with TMS high); acts as if TRST were pulsed 2255 * RUN/IDLE ... _stable_; don't assume this always means IDLE 2256 * DRSELECT 2257 * DRCAPTURE 2258 * DRSHIFT ... _stable_; TDI/TDO shifting through the data register 2259 * DREXIT1 2260 * DRPAUSE ... _stable_; data register ready for update or more 2261 shifting 2262 * DREXIT2 2263 * DRUPDATE 2264 * IRSELECT 2265 * IRCAPTURE 2266 * IRSHIFT ... _stable_; TDI/TDO shifting through the instruction 2267 register 2268 * IREXIT1 2269 * IRPAUSE ... _stable_; instruction register ready for update or 2270 more shifting 2271 * IREXIT2 2272 * IRUPDATE 2273 2274Note that only six of those states are fully "stable" in the face of TMS 2275fixed (low except for RESET) and a free-running JTAG clock. For all the 2276others, the next TCK transition changes to a new state. 2277 2278 * From DRSHIFT and IRSHIFT, clock transitions will produce side 2279 effects by changing register contents. The values to be latched in 2280 upcoming DRUPDATE or IRUPDATE states may not be as expected. 2281 * RUN/IDLE, DRPAUSE, and IRPAUSE are reasonable choices after 2282 'drscan' or 'irscan' commands, since they are free of JTAG side 2283 effects. 2284 * RUN/IDLE may have side effects that appear at non-JTAG levels, such 2285 as advancing the ARM9E-S instruction pipeline. Consult the 2286 documentation for the TAP(s) you are working with. 2287 2288 2289File: openocd.info, Node: Boundary Scan Commands, Next: Utility Commands, Prev: JTAG Commands, Up: Top 2290 229118 Boundary Scan Commands 2292************************* 2293 2294One of the original purposes of JTAG was to support boundary scan based 2295hardware testing. Although its primary focus is to support On-Chip 2296Debugging, OpenOCD also includes some boundary scan commands. 2297 229818.1 SVF: Serial Vector Format 2299============================== 2300 2301The Serial Vector Format, better known as "SVF", is a way to represent 2302JTAG test patterns in text files. In a debug session using JTAG for its 2303transport protocol, OpenOCD supports running such test files. 2304 2305 -- Command: svf 'filename' ['-tap TAPNAME'] ['[-]quiet'] ['[-]nil'] 2306 ['[-]progress'] ['[-]ignore_error'] 2307 This issues a JTAG reset (Test-Logic-Reset) and then runs the SVF 2308 script from 'filename'. 2309 2310 Arguments can be specified in any order; the optional dash doesn't 2311 affect their semantics. 2312 2313 Command options: 2314 - '-tap TAPNAME' ignore IR and DR headers and footers specified 2315 by the SVF file with HIR, TIR, HDR and TDR commands; instead, 2316 calculate them automatically according to the current JTAG 2317 chain configuration, targeting TAPNAME; 2318 - '[-]quiet' do not log every command before execution; 2319 - '[-]nil' "dry run", i.e., do not perform any operations on the 2320 real interface; 2321 - '[-]progress' enable progress indication; 2322 - '[-]ignore_error' continue execution despite TDO check errors. 2323 232418.2 XSVF: Xilinx Serial Vector Format 2325====================================== 2326 2327The Xilinx Serial Vector Format, better known as "XSVF", is a binary 2328representation of SVF which is optimized for use with Xilinx devices. 2329In a debug session using JTAG for its transport protocol, OpenOCD 2330supports running such test files. 2331 2332 Important: Not all XSVF commands are supported. 2333 2334 -- Command: xsvf (tapname|'plain') filename ['virt2'] ['quiet'] 2335 This issues a JTAG reset (Test-Logic-Reset) and then runs the XSVF 2336 script from 'filename'. When a TAPNAME is specified, the commands 2337 are directed at that TAP. When 'virt2' is specified, the XRUNTEST 2338 command counts are interpreted as TCK cycles instead of 2339 microseconds. Unless the 'quiet' option is specified, messages are 2340 logged for comments and some retries. 2341 2342The OpenOCD sources also include two utility scripts for working with 2343XSVF; they are not currently installed after building the software. You 2344may find them useful: 2345 2346 * _svf2xsvf_ ... converts SVF files into the extended XSVF syntax 2347 understood by the 'xsvf' command; see notes below. 2348 * _xsvfdump_ ... converts XSVF files into a text output format; 2349 understands the OpenOCD extensions. 2350 2351The input format accepts a handful of non-standard extensions. These 2352include three opcodes corresponding to SVF extensions from Lattice 2353Semiconductor (LCOUNT, LDELAY, LDSR), and two opcodes supporting a more 2354accurate translation of SVF (XTRST, XWAITSTATE). If _xsvfdump_ shows a 2355file is using those opcodes, it probably will not be usable with other 2356XSVF tools. 2357 2358 2359File: openocd.info, Node: Utility Commands, Next: GDB and OpenOCD, Prev: Boundary Scan Commands, Up: Top 2360 236119 Utility Commands 2362******************* 2363 236419.1 RAM testing 2365================ 2366 2367There is often a need to stress-test random access memory (RAM) for 2368errors. OpenOCD comes with a Tcl implementation of well-known memory 2369testing procedures allowing the detection of all sorts of issues with 2370electrical wiring, defective chips, PCB layout and other common hardware 2371problems. 2372 2373To use them, you usually need to initialise your RAM controller first; 2374consult your SoC's documentation to get the recommended list of register 2375operations and translate them to the corresponding 'mww'/'mwb' commands. 2376 2377Load the memory testing functions with 2378 2379 source [find tools/memtest.tcl] 2380 2381to get access to the following facilities: 2382 2383 -- Command: memTestDataBus address 2384 Test the data bus wiring in a memory region by performing a walking 2385 1's test at a fixed address within that region. 2386 2387 -- Command: memTestAddressBus baseaddress size 2388 Perform a walking 1's test on the relevant bits of the address and 2389 check for aliasing. This test will find single-bit address 2390 failures such as stuck-high, stuck-low, and shorted pins. 2391 2392 -- Command: memTestDevice baseaddress size 2393 Test the integrity of a physical memory device by performing an 2394 increment/decrement test over the entire region. In the process 2395 every storage bit in the device is tested as zero and as one. 2396 2397 -- Command: runAllMemTests baseaddress size 2398 Run all of the above tests over a specified memory region. 2399 240019.2 Firmware recovery helpers 2401============================== 2402 2403OpenOCD includes an easy-to-use script to facilitate mass-market devices 2404recovery with JTAG. 2405 2406For quickstart instructions run: 2407 openocd -f tools/firmware-recovery.tcl -c firmware_help 2408 2409 2410File: openocd.info, Node: GDB and OpenOCD, Next: Tcl Scripting API, Prev: Utility Commands, Up: Top 2411 241220 GDB and OpenOCD 2413****************** 2414 2415OpenOCD complies with the remote gdbserver protocol and, as such, can be 2416used to debug remote targets. Setting up GDB to work with OpenOCD can 2417involve several components: 2418 2419 * The OpenOCD server support for GDB may need to be configured. 2420 *Note GDB Configuration: gdbconfiguration. 2421 * GDB's support for OpenOCD may need configuration, as shown in this 2422 chapter. 2423 * If you have a GUI environment like Eclipse, that also will probably 2424 need to be configured. 2425 2426Of course, the version of GDB you use will need to be one which has been 2427built to know about the target CPU you're using. It's probably part of 2428the tool chain you're using. For example, if you are doing 2429cross-development for ARM on an x86 PC, instead of using the native x86 2430'gdb' command you might use 'arm-none-eabi-gdb' if that's the tool chain 2431used to compile your code. 2432 243320.1 Connecting to GDB 2434====================== 2435 2436Use GDB 6.7 or newer with OpenOCD if you run into trouble. For instance 2437GDB 6.3 has a known bug that produces bogus memory access errors, which 2438has since been fixed; see 2439<http://osdir.com/ml/gdb.bugs.discuss/2004-12/msg00018.html> 2440 2441OpenOCD can communicate with GDB in two ways: 2442 2443 1. A socket (TCP/IP) connection is typically started as follows: 2444 target extended-remote localhost:3333 2445 This would cause GDB to connect to the gdbserver on the local pc 2446 using port 3333. 2447 2448 The extended remote protocol is a super-set of the remote protocol 2449 and should be the preferred choice. More details are available in 2450 GDB documentation 2451 <https://sourceware.org/gdb/onlinedocs/gdb/Connecting.html> 2452 2453 To speed-up typing, any GDB command can be abbreviated, including 2454 the extended remote command above that becomes: 2455 tar ext :3333 2456 2457 Note: If any backward compatibility issue requires using the old 2458 remote protocol in place of the extended remote one, the former 2459 protocol is still available through the command: 2460 target remote localhost:3333 2461 2462 2. A pipe connection is typically started as follows: 2463 target extended-remote | \ 2464 openocd -c "gdb_port pipe; log_output openocd.log" 2465 This would cause GDB to run OpenOCD and communicate using pipes 2466 (stdin/stdout). Using this method has the advantage of GDB 2467 starting/stopping OpenOCD for the debug session. log_output sends 2468 the log output to a file to ensure that the pipe is not saturated 2469 when using higher debug level outputs. 2470 2471To list the available OpenOCD commands type 'monitor help' on the GDB 2472command line. 2473 247420.2 Sample GDB session startup 2475=============================== 2476 2477With the remote protocol, GDB sessions start a little differently than 2478they do when you're debugging locally. Here's an example showing how to 2479start a debug session with a small ARM program. In this case the 2480program was linked to be loaded into SRAM on a Cortex-M3. Most programs 2481would be written into flash (address 0) and run from there. 2482 2483 $ arm-none-eabi-gdb example.elf 2484 (gdb) target extended-remote localhost:3333 2485 Remote debugging using localhost:3333 2486 ... 2487 (gdb) monitor reset halt 2488 ... 2489 (gdb) load 2490 Loading section .vectors, size 0x100 lma 0x20000000 2491 Loading section .text, size 0x5a0 lma 0x20000100 2492 Loading section .data, size 0x18 lma 0x200006a0 2493 Start address 0x2000061c, load size 1720 2494 Transfer rate: 22 KB/sec, 573 bytes/write. 2495 (gdb) continue 2496 Continuing. 2497 ... 2498 2499You could then interrupt the GDB session to make the program break, type 2500'where' to show the stack, 'list' to show the code around the program 2501counter, 'step' through code, set breakpoints or watchpoints, and so on. 2502 250320.3 Configuring GDB for OpenOCD 2504================================ 2505 2506OpenOCD supports the gdb 'qSupported' packet, this enables information 2507to be sent by the GDB remote server (i.e. OpenOCD) to GDB. Typical 2508information includes packet size and the device's memory map. You do 2509not need to configure the packet size by hand, and the relevant parts of 2510the memory map should be automatically set up when you declare (NOR) 2511flash banks. 2512 2513However, there are other things which GDB can't currently query. You 2514may need to set those up by hand. As OpenOCD starts up, you will often 2515see a line reporting something like: 2516 2517 Info : lm3s.cpu: hardware has 6 breakpoints, 4 watchpoints 2518 2519You can pass that information to GDB with these commands: 2520 2521 set remote hardware-breakpoint-limit 6 2522 set remote hardware-watchpoint-limit 4 2523 2524With that particular hardware (Cortex-M3) the hardware breakpoints only 2525work for code running from flash memory. Most other ARM systems do not 2526have such restrictions. 2527 2528Rather than typing such commands interactively, you may prefer to save 2529them in a file and have GDB execute them as it starts, perhaps using a 2530'.gdbinit' in your project directory or starting GDB using 'gdb -x 2531filename'. 2532 253320.4 Programming using GDB 2534========================== 2535 2536By default the target memory map is sent to GDB. This can be disabled by 2537the following OpenOCD configuration option: 2538 gdb_memory_map disable 2539For this to function correctly a valid flash configuration must also be 2540set in OpenOCD. For faster performance you should also configure a valid 2541working area. 2542 2543Informing GDB of the memory map of the target will enable GDB to protect 2544any flash areas of the target and use hardware breakpoints by default. 2545This means that the OpenOCD option 'gdb_breakpoint_override' is not 2546required when using a memory map. *Note gdb_breakpoint_override: 2547gdbbreakpointoverride. 2548 2549To view the configured memory map in GDB, use the GDB command 'info 2550mem'. All other unassigned addresses within GDB are treated as RAM. 2551 2552GDB 6.8 and higher set any memory area not in the memory map as 2553inaccessible. This can be changed to the old behaviour by using the 2554following GDB command 2555 set mem inaccessible-by-default off 2556 2557If 'gdb_flash_program enable' is also used, GDB will be able to program 2558any flash memory using the vFlash interface. 2559 2560GDB will look at the target memory map when a load command is given, if 2561any areas to be programmed lie within the target flash area the vFlash 2562packets will be used. 2563 2564If the target needs configuring before GDB programming, set target event 2565gdb-flash-erase-start: 2566 $_TARGETNAME configure -event gdb-flash-erase-start BODY 2567*Note Target Events: targetevents, for other GDB programming related 2568events. 2569 2570To verify any flash programming the GDB command 'compare-sections' can 2571be used. 2572 257320.5 Using GDB as a non-intrusive memory inspector 2574================================================== 2575 2576If your project controls more than a blinking LED, let's say a heavy 2577industrial robot or an experimental nuclear reactor, stopping the 2578controlling process just because you want to attach GDB is not a good 2579option. 2580 2581OpenOCD does not support GDB non-stop mode (might be implemented in the 2582future). Though there is a possible setup where the target does not get 2583stopped and GDB treats it as it were running. If the target supports 2584background access to memory while it is running, you can use GDB in this 2585mode to inspect memory (mainly global variables) without any intrusion 2586of the target process. 2587 2588Remove default setting of gdb-attach event. *Note Target Events: 2589targetevents. Place following command after target configuration: 2590 $_TARGETNAME configure -event gdb-attach {} 2591 2592If any of installed flash banks does not support probe on running 2593target, switch off gdb_memory_map: 2594 gdb_memory_map disable 2595 2596Ensure GDB is configured without interrupt-on-connect. Some GDB 2597versions set it by default, some does not. 2598 set remote interrupt-on-connect off 2599 2600If you switched gdb_memory_map off, you may want to setup GDB memory map 2601manually or issue 'set mem inaccessible-by-default off' 2602 2603Now you can issue GDB command 'target extended-remote ...' and inspect 2604memory of a running target. Do not use GDB commands 'continue', 'step' 2605or 'next' as they synchronize GDB with your target and GDB would require 2606stopping the target to get the prompt back. 2607 2608Do not use this mode under an IDE like Eclipse as it caches values of 2609previously shown variables. 2610 2611It's also possible to connect more than one GDB to the same target by 2612the target's configuration option '-gdb-max-connections'. This allows, 2613for example, one GDB to run a script that continuously polls a set of 2614variables while other GDB can be used interactively. Be extremely 2615careful in this case, because the two GDB can easily get out-of-sync. 2616 261720.6 RTOS Support 2618================= 2619 2620OpenOCD includes RTOS support, this will however need enabling as it 2621defaults to disabled. It can be enabled by passing '-rtos' arg to the 2622target. *Note RTOS Type: rtostype. 2623 2624*Note Debugging Programs with Multiple Threads: (gdb)Threads, for 2625details about relevant GDB commands. 2626 2627 2628An example setup is below: 2629 2630 $_TARGETNAME configure -rtos auto 2631 2632This will attempt to auto detect the RTOS within your application. 2633 2634Currently supported rtos's include: 2635 * 'eCos' 2636 * 'ThreadX' 2637 * 'FreeRTOS' 2638 * 'linux' 2639 * 'ChibiOS' 2640 * 'embKernel' 2641 * 'mqx' 2642 * 'uCOS-III' 2643 * 'nuttx' 2644 * 'RIOT' 2645 * 'hwthread' (This is not an actual RTOS. *Note Using OpenOCD SMP 2646 with GDB: usingopenocdsmpwithgdb.) 2647 2648Before an RTOS can be detected, it must export certain symbols; 2649otherwise, it cannot be used by OpenOCD. Below is a list of the required 2650symbols for each supported RTOS. 2651 2652'eCos symbols' 2653 Cyg_Thread::thread_list, Cyg_Scheduler_Base::current_thread. 2654'ThreadX symbols' 2655 _tx_thread_current_ptr, _tx_thread_created_ptr, 2656 _tx_thread_created_count. 2657'FreeRTOS symbols' 2658 pxCurrentTCB, pxReadyTasksLists, xDelayedTaskList1, 2659 xDelayedTaskList2, pxDelayedTaskList, pxOverflowDelayedTaskList, 2660 xPendingReadyList, uxCurrentNumberOfTasks, uxTopUsedPriority. 2661'linux symbols' 2662 init_task. 2663'ChibiOS symbols' 2664 rlist, ch_debug, chSysInit. 2665'embKernel symbols' 2666 Rtos::sCurrentTask, Rtos::sListReady, Rtos::sListSleep, 2667 Rtos::sListSuspended, Rtos::sMaxPriorities, 2668 Rtos::sCurrentTaskCount. 2669'mqx symbols' 2670 _mqx_kernel_data, MQX_init_struct. 2671'uC/OS-III symbols' 2672 OSRunning, OSTCBCurPtr, OSTaskDbgListPtr, OSTaskQty. 2673'nuttx symbols' 2674 g_readytorun, g_tasklisttable. 2675'RIOT symbols' 2676 sched_threads, sched_num_threads, sched_active_pid, max_threads, 2677 _tcb_name_offset. 2678 2679For most RTOS supported the above symbols will be exported by default. 2680However for some, eg. FreeRTOS and uC/OS-III, extra steps must be 2681taken. 2682 2683These RTOSes may require additional OpenOCD-specific file to be linked 2684along with the project: 2685 2686'FreeRTOS' 2687 contrib/rtos-helpers/FreeRTOS-openocd.c 2688'uC/OS-III' 2689 contrib/rtos-helpers/uCOS-III-openocd.c 2690 269120.7 Using OpenOCD SMP with GDB 2692=============================== 2693 2694OpenOCD includes a pseudo RTOS called _hwthread_ that presents CPU cores 2695("hardware threads") in an SMP system as threads to GDB. With this 2696extension, GDB can be used to inspect the state of an SMP system in a 2697natural way. After halting the system, using the GDB command 'info 2698threads' will list the context of each active CPU core in the system. 2699GDB's 'thread' command can be used to switch the view to a different CPU 2700core. The 'step' and 'stepi' commands can be used to step a specific 2701core while other cores are free-running or remain halted, depending on 2702the scheduler-locking mode configured in GDB. 2703 270420.8 Legacy SMP core switching support 2705====================================== 2706 2707 Note: This method is deprecated in favor of the _hwthread_ pseudo 2708 RTOS. 2709 2710For SMP support following GDB serial protocol packet have been defined : 2711 * j - smp status request 2712 * J - smp set request 2713 2714OpenOCD implements : 2715 * 'jc' packet for reading core id displayed by GDB connection. Reply 2716 is 'XXXXXXXX' (8 hex digits giving core id) or 'E01' for target not 2717 smp. 2718 * 'JcXXXXXXXX' (8 hex digits) packet for setting core id displayed at 2719 next GDB continue (core id -1 is reserved for returning to normal 2720 resume mode). Reply 'E01' for target not smp or 'OK' on success. 2721 2722Handling of this packet within GDB can be done : 2723 * by the creation of an internal variable (i.e '_core') by mean of 2724 function allocate_computed_value allowing following GDB command. 2725 set $_core 1 2726 #Jc01 packet is sent 2727 print $_core 2728 #jc packet is sent and result is affected in $ 2729 2730 * by the usage of GDB maintenance command as described in following 2731 example (2 cpus in SMP with core id 0 and 1 *note Define CPU 2732 targets working in SMP: definecputargetsworkinginsmp.). 2733 2734 # toggle0 : force display of coreid 0 2735 define toggle0 2736 maint packet Jc0 2737 continue 2738 main packet Jc-1 2739 end 2740 # toggle1 : force display of coreid 1 2741 define toggle1 2742 maint packet Jc1 2743 continue 2744 main packet Jc-1 2745 end 2746 2747 2748File: openocd.info, Node: Tcl Scripting API, Next: FAQ, Prev: GDB and OpenOCD, Up: Top 2749 275021 Tcl Scripting API 2751******************** 2752 275321.1 API rules 2754============== 2755 2756Tcl commands are stateless; e.g. the 'telnet' command has a concept of 2757currently active target, the Tcl API proc's take this sort of state 2758information as an argument to each proc. 2759 2760There are three main types of return values: single value, name value 2761pair list and lists. 2762 2763Name value pair. The proc 'foo' below returns a name/value pair list. 2764 2765 > set foo(me) Duane 2766 > set foo(you) Oyvind 2767 > set foo(mouse) Micky 2768 > set foo(duck) Donald 2769 2770If one does this: 2771 2772 > set foo 2773 2774The result is: 2775 2776 me Duane you Oyvind mouse Micky duck Donald 2777 2778Thus, to get the names of the associative array is easy: 2779 2780foreach { name value } [set foo] { 2781 puts "Name: $name, Value: $value" 2782} 2783 2784Lists returned should be relatively small. Otherwise, a range should be 2785passed in to the proc in question. 2786 278721.2 Internal low-level Commands 2788================================ 2789 2790By "low-level," we mean commands that a human would typically not invoke 2791directly. 2792 2793 * mem2array <VARNAME> <WIDTH> <ADDR> <NELEMS> 2794 2795 Read memory and return as a Tcl array for script processing 2796 * array2mem <VARNAME> <WIDTH> <ADDR> <NELEMS> 2797 2798 Convert a Tcl array to memory locations and write the values 2799 * flash banks <DRIVER> <BASE> <SIZE> <CHIP_WIDTH> <BUS_WIDTH> 2800 <TARGET> ['driver options' ...] 2801 2802 Return information about the flash banks 2803 2804 * capture <COMMAND> 2805 2806 Run <COMMAND> and return full log output that was produced during 2807 its execution. Example: 2808 2809 > capture "reset init" 2810 2811OpenOCD commands can consist of two words, e.g. "flash banks". The 2812'startup.tcl' "unknown" proc will translate this into a Tcl proc called 2813"flash_banks". 2814 281521.3 OpenOCD specific Global Variables 2816====================================== 2817 2818Real Tcl has ::tcl_platform(), and platform::identify, and many other 2819variables. JimTCL, as implemented in OpenOCD creates $ocd_HOSTOS which 2820holds one of the following values: 2821 2822 * cygwin Running under Cygwin 2823 * darwin Darwin (Mac-OS) is the underlying operating system. 2824 * freebsd Running under FreeBSD 2825 * openbsd Running under OpenBSD 2826 * netbsd Running under NetBSD 2827 * linux Linux is the underlying operating system 2828 * mingw32 Running under MingW32 2829 * winxx Built using Microsoft Visual Studio 2830 * ecos Running under eCos 2831 * other Unknown, none of the above. 2832 2833Note: 'winxx' was chosen because today (March-2009) no distinction is 2834made between Win32 and Win64. 2835 2836 Note: We should add support for a variable like Tcl variable 2837 'tcl_platform(platform)', it should be called 'jim_platform' 2838 (because it is jim, not real tcl). 2839 284021.4 Tcl RPC server 2841=================== 2842 2843OpenOCD provides a simple RPC server that allows to run arbitrary Tcl 2844commands and receive the results. 2845 2846To access it, your application needs to connect to a configured TCP port 2847(see 'tcl_port'). Then it can pass any string to the interpreter 2848terminating it with '0x1a' and wait for the return value (it will be 2849terminated with '0x1a' as well). This can be repeated as many times as 2850desired without reopening the connection. 2851 2852It is not needed anymore to prefix the OpenOCD commands with 'ocd_' to 2853get the results back. But sometimes you might need the 'capture' 2854command. 2855 2856See 'contrib/rpc_examples/' for specific client implementations. 2857 285821.5 Tcl RPC server notifications 2859================================= 2860 2861Notifications are sent asynchronously to other commands being executed 2862over the RPC server, so the port must be polled continuously. 2863 2864Target event, state and reset notifications are emitted as Tcl 2865associative arrays in the following format. 2866 2867type target_event event [event-name] 2868type target_state state [state-name] 2869type target_reset mode [reset-mode] 2870 2871 -- Command: tcl_notifications [on/off] 2872 Toggle output of target notifications to the current Tcl RPC 2873 server. Only available from the Tcl RPC server. Defaults to off. 2874 287521.6 Tcl RPC server trace output 2876================================ 2877 2878Trace data is sent asynchronously to other commands being executed over 2879the RPC server, so the port must be polled continuously. 2880 2881Target trace data is emitted as a Tcl associative array in the following 2882format. 2883 2884type target_trace data [trace-data-hex-encoded] 2885 2886 -- Command: tcl_trace [on/off] 2887 Toggle output of target trace data to the current Tcl RPC server. 2888 Only available from the Tcl RPC server. Defaults to off. 2889 2890 See an example application here: 2891 <https://github.com/apmorton/OpenOcdTraceUtil> [OpenOcdTraceUtil] 2892 2893 2894File: openocd.info, Node: FAQ, Next: Tcl Crash Course, Prev: Tcl Scripting API, Up: Top 2895 289622 FAQ 2897****** 2898 2899 1. RTCK, also known as: Adaptive Clocking - What is it? 2900 2901 In digital circuit design it is often referred to as "clock 2902 synchronisation" the JTAG interface uses one clock (TCK or TCLK) 2903 operating at some speed, your CPU target is operating at another. 2904 The two clocks are not synchronised, they are "asynchronous" 2905 2906 In order for the two to work together they must be synchronised 2907 well enough to work; JTAG can't go ten times faster than the CPU, 2908 for example. There are 2 basic options: 2909 1. Use a special "adaptive clocking" circuit to change the JTAG 2910 clock rate to match what the CPU currently supports. 2911 2. The JTAG clock must be fixed at some speed that's enough 2912 slower than the CPU clock that all TMS and TDI transitions can 2913 be detected. 2914 2915 Does this really matter? For some chips and some situations, this 2916 is a non-issue, like a 500MHz ARM926 with a 5 MHz JTAG link; the 2917 CPU has no difficulty keeping up with JTAG. Startup sequences are 2918 often problematic though, as are other situations where the CPU 2919 clock rate changes (perhaps to save power). 2920 2921 For example, Atmel AT91SAM chips start operation from reset with a 2922 32kHz system clock. Boot firmware may activate the main oscillator 2923 and PLL before switching to a faster clock (perhaps that 500 MHz 2924 ARM926 scenario). If you're using JTAG to debug that startup 2925 sequence, you must slow the JTAG clock to sometimes 1 to 4kHz. 2926 After startup completes, JTAG can use a faster clock. 2927 2928 Consider also debugging a 500MHz ARM926 hand held battery powered 2929 device that enters a low power "deep sleep" mode, at 32kHz CPU 2930 clock, between keystrokes unless it has work to do. When would 2931 that 5 MHz JTAG clock be usable? 2932 2933 Solution #1 - A special circuit 2934 2935 In order to make use of this, your CPU, board, and JTAG adapter 2936 must all support the RTCK feature. Not all of them support this; 2937 keep reading! 2938 2939 The RTCK ("Return TCK") signal in some ARM chips is used to help 2940 with this problem. ARM has a good description of the problem 2941 described at this link: 2942 <http://www.arm.com/support/faqdev/4170.html> [checked 2943 28/nov/2008]. Link title: "How does the JTAG synchronisation logic 2944 work? / how does adaptive clocking work?". 2945 2946 The nice thing about adaptive clocking is that "battery powered 2947 hand held device example" - the adaptiveness works perfectly all 2948 the time. One can set a break point or halt the system in the deep 2949 power down code, slow step out until the system speeds up. 2950 2951 Note that adaptive clocking may also need to work at the board 2952 level, when a board-level scan chain has multiple chips. Parallel 2953 clock voting schemes are good way to implement this, both within 2954 and between chips, and can easily be implemented with a CPLD. It's 2955 not difficult to have logic fan a module's input TCK signal out to 2956 each TAP in the scan chain, and then wait until each TAP's RTCK 2957 comes back with the right polarity before changing the output RTCK 2958 signal. Texas Instruments makes some clock voting logic available 2959 for free (with no support) in VHDL form; see 2960 <http://tiexpressdsp.com/index.php/Adaptive_Clocking> 2961 2962 Solution #2 - Always works - but may be slower 2963 2964 Often this is a perfectly acceptable solution. 2965 2966 In most simple terms: Often the JTAG clock must be 1/10 to 1/12 of 2967 the target clock speed. But what that "magic division" is varies 2968 depending on the chips on your board. ARM rule of thumb Most ARM 2969 based systems require an 6:1 division; ARM11 cores use an 8:1 2970 division. Xilinx rule of thumb is 1/12 the clock speed. 2971 2972 Note: most full speed FT2232 based JTAG adapters are limited to a 2973 maximum of 6MHz. The ones using USB high speed chips (FT2232H) 2974 often support faster clock rates (and adaptive clocking). 2975 2976 You can still debug the 'low power' situations - you just need to 2977 either use a fixed and very slow JTAG clock rate ... or else 2978 manually adjust the clock speed at every step. (Adjusting is 2979 painful and tedious, and is not always practical.) 2980 2981 It is however easy to "code your way around it" - i.e.: Cheat a 2982 little, have a special debug mode in your application that does a 2983 "high power sleep". If you are careful - 98% of your problems can 2984 be debugged this way. 2985 2986 Note that on ARM you may need to avoid using the _wait for 2987 interrupt_ operation in your idle loops even if you don't otherwise 2988 change the CPU clock rate. That operation gates the CPU clock, and 2989 thus the JTAG clock; which prevents JTAG access. One consequence 2990 is not being able to 'halt' cores which are executing that _wait 2991 for interrupt_ operation. 2992 2993 To set the JTAG frequency use the command: 2994 2995 # Example: 1.234MHz 2996 adapter speed 1234 2997 2998 2. Win32 Pathnames Why don't backslashes work in Windows paths? 2999 3000 OpenOCD uses Tcl and a backslash is an escape char. Use { and } 3001 around Windows filenames. 3002 3003 > echo \a 3004 3005 > echo {\a} 3006 \a 3007 > echo "\a" 3008 3009 > 3010 3011 3. Missing: cygwin1.dll OpenOCD complains about a missing cygwin1.dll. 3012 3013 Make sure you have Cygwin installed, or at least a version of 3014 OpenOCD that claims to come with all the necessary DLLs. When 3015 using Cygwin, try launching OpenOCD from the Cygwin shell. 3016 3017 4. Breakpoint Issue I'm trying to set a breakpoint using GDB (or a 3018 front-end like Insight or Eclipse), but OpenOCD complains that 3019 "Info: arm7_9_common.c:213 arm7_9_add_breakpoint(): sw breakpoint 3020 requested, but software breakpoints not enabled". 3021 3022 GDB issues software breakpoints when a normal breakpoint is 3023 requested, or to implement source-line single-stepping. On ARMv4T 3024 systems, like ARM7TDMI, ARM720T or ARM920T, software breakpoints 3025 consume one of the two available hardware breakpoints. 3026 3027 5. LPC2000 Flash When erasing or writing LPC2000 on-chip flash, the 3028 operation fails at random. 3029 3030 Make sure the core frequency specified in the 'flash lpc2000' line 3031 matches the clock at the time you're programming the flash. If 3032 you've specified the crystal's frequency, make sure the PLL is 3033 disabled. If you've specified the full core speed (e.g. 60MHz), 3034 make sure the PLL is enabled. 3035 3036 6. Amontec Chameleon When debugging using an Amontec Chameleon in its 3037 JTAG Accelerator configuration, I keep getting "Error: 3038 amt_jtagaccel.c:184 amt_wait_scan_busy(): amt_jtagaccel timed out 3039 while waiting for end of scan, rtck was disabled". 3040 3041 Make sure your PC's parallel port operates in EPP mode. You might 3042 have to try several settings in your PC BIOS (ECP, EPP, and 3043 different versions of those). 3044 3045 7. Data Aborts When debugging with OpenOCD and GDB (plain GDB, 3046 Insight, or Eclipse), I get lots of "Error: arm7_9_common.c:1771 3047 arm7_9_read_memory(): memory read caused data abort". 3048 3049 The errors are non-fatal, and are the result of GDB trying to trace 3050 stack frames beyond the last valid frame. It might be possible to 3051 prevent this by setting up a proper "initial" stack frame, if you 3052 happen to know what exactly has to be done, feel free to add this 3053 here. 3054 3055 Simple: In your startup code - push 8 registers of zeros onto the 3056 stack before calling main(). What GDB is doing is "climbing" the 3057 run time stack by reading various values on the stack using the 3058 standard call frame for the target. GDB keeps going - until one of 3059 2 things happen #1 an invalid frame is found, or #2 some huge 3060 number of stackframes have been processed. By pushing zeros on the 3061 stack, GDB gracefully stops. 3062 3063 Debugging Interrupt Service Routines - In your ISR before you call 3064 your C code, do the same - artificially push some zeros onto the 3065 stack, remember to pop them off when the ISR is done. 3066 3067 Also note: If you have a multi-threaded operating system, they 3068 often do not in the intrest of saving memory waste these few bytes. 3069 Painful... 3070 3071 8. JTAG Reset Config I get the following message in the OpenOCD 3072 console (or log file): "Warning: arm7_9_common.c:679 3073 arm7_9_assert_reset(): srst resets test logic, too". 3074 3075 This warning doesn't indicate any serious problem, as long as you 3076 don't want to debug your core right out of reset. Your .cfg file 3077 specified 'reset_config trst_and_srst srst_pulls_trst' to tell 3078 OpenOCD that either your board, your debugger or your target uC 3079 (e.g. LPC2000) can't assert the two reset signals independently. 3080 With this setup, it's not possible to halt the core right out of 3081 reset, everything else should work fine. 3082 3083 9. USB Power When using OpenOCD in conjunction with Amontec JTAGkey 3084 and the Yagarto toolchain (Eclipse, arm-elf-gcc, arm-elf-gdb), the 3085 debugging seems to be unstable. When single-stepping over large 3086 blocks of code, GDB and OpenOCD quit with an error message. Is 3087 there a stability issue with OpenOCD? 3088 3089 No, this is not a stability issue concerning OpenOCD. Most users 3090 have solved this issue by simply using a self-powered USB hub, 3091 which they connect their Amontec JTAGkey to. Apparently, some 3092 computers do not provide a USB power supply stable enough for the 3093 Amontec JTAGkey to be operated. 3094 3095 Laptops running on battery have this problem too... 3096 3097 10. GDB Disconnects When using the Amontec JTAGkey, sometimes OpenOCD 3098 crashes with the following error message: "Error: gdb_server.c:101 3099 gdb_get_char(): read: 10054". What does that mean and what might 3100 be the reason for this? 3101 3102 Error code 10054 corresponds to WSAECONNRESET, which means that the 3103 debugger (GDB) has closed the connection to OpenOCD. This might be 3104 a GDB issue. 3105 3106 11. LPC2000 Flash In the configuration file in the section where flash 3107 device configurations are described, there is a parameter for 3108 specifying the clock frequency for LPC2000 internal flash devices 3109 (e.g. 'flash bank $_FLASHNAME lpc2000 0x0 0x40000 0 0 $_TARGETNAME 3110 lpc2000_v1 14746 calc_checksum'), which must be specified in 3111 kilohertz. However, I do have a quartz crystal of a frequency that 3112 contains fractions of kilohertz (e.g. 14,745,600 Hz, i.e. 3113 14,745.600 kHz). Is it possible to specify real numbers for the 3114 clock frequency? 3115 3116 No. The clock frequency specified here must be given as an 3117 integral number. However, this clock frequency is used by the 3118 In-Application-Programming (IAP) routines of the LPC2000 family 3119 only, which seems to be very tolerant concerning the given clock 3120 frequency, so a slight difference between the specified clock 3121 frequency and the actual clock frequency will not cause any 3122 trouble. 3123 3124 12. Command Order Do I have to keep a specific order for the commands 3125 in the configuration file? 3126 3127 Well, yes and no. Commands can be given in arbitrary order, yet 3128 the devices listed for the JTAG scan chain must be given in the 3129 right order (jtag newdevice), with the device closest to the 3130 TDO-Pin being listed first. In general, whenever objects of the 3131 same type exist which require an index number, then these objects 3132 must be given in the right order (jtag newtap, targets and flash 3133 banks - a target references a jtag newtap and a flash bank 3134 references a target). 3135 3136 You can use the "scan_chain" command to verify and display the tap 3137 order. 3138 3139 Also, some commands can't execute until after 'init' has been 3140 processed. Such commands include 'nand probe' and everything else 3141 that needs to write to controller registers, perhaps for setting up 3142 DRAM and loading it with code. 3143 3144 13. JTAG TAP Order Do I have to declare the TAPS in some particular 3145 order? 3146 3147 Yes; whenever you have more than one, you must declare them in the 3148 same order used by the hardware. 3149 3150 Many newer devices have multiple JTAG TAPs. For example: 3151 STMicroelectronics STM32 chips have two TAPs, a "boundary scan TAP" 3152 and "Cortex-M3" TAP. Example: The STM32 reference manual, Document 3153 ID: RM0008, Section 26.5, Figure 259, page 651/681, the "TDI" pin 3154 is connected to the boundary scan TAP, which then connects to the 3155 Cortex-M3 TAP, which then connects to the TDO pin. 3156 3157 Thus, the proper order for the STM32 chip is: (1) The Cortex-M3, 3158 then (2) The boundary scan TAP. If your board includes an 3159 additional JTAG chip in the scan chain (for example a Xilinx CPLD 3160 or FPGA) you could place it before or after the STM32 chip in the 3161 chain. For example: 3162 3163 * OpenOCD_TDI(output) -> STM32 TDI Pin (BS Input) 3164 * STM32 BS TDO (output) -> STM32 Cortex-M3 TDI (input) 3165 * STM32 Cortex-M3 TDO (output) -> SM32 TDO Pin 3166 * STM32 TDO Pin (output) -> Xilinx TDI Pin (input) 3167 * Xilinx TDO Pin -> OpenOCD TDO (input) 3168 3169 The "jtag device" commands would thus be in the order shown below. 3170 Note: 3171 3172 * jtag newtap Xilinx tap -irlen ... 3173 * jtag newtap stm32 cpu -irlen ... 3174 * jtag newtap stm32 bs -irlen ... 3175 * # Create the debug target and say where it is 3176 * target create stm32.cpu -chain-position stm32.cpu ... 3177 3178 14. SYSCOMP Sometimes my debugging session terminates with an error. 3179 When I look into the log file, I can see these error messages: 3180 Error: arm7_9_common.c:561 arm7_9_execute_sys_speed(): timeout 3181 waiting for SYSCOMP 3182 3183 TODO. 3184 3185 3186File: openocd.info, Node: Tcl Crash Course, Next: License, Prev: FAQ, Up: Top 3187 318823 Tcl Crash Course 3189******************* 3190 3191Not everyone knows Tcl - this is not intended to be a replacement for 3192learning Tcl, the intent of this chapter is to give you some idea of how 3193the Tcl scripts work. 3194 3195This chapter is written with two audiences in mind. (1) OpenOCD users 3196who need to understand a bit more of how Jim-Tcl works so they can do 3197something useful, and (2) those that want to add a new command to 3198OpenOCD. 3199 320023.1 Tcl Rule #1 3201================ 3202 3203There is a famous joke, it goes like this: 3204 1. Rule #1: The wife is always correct 3205 2. Rule #2: If you think otherwise, See Rule #1 3206 3207The Tcl equal is this: 3208 3209 1. Rule #1: Everything is a string 3210 2. Rule #2: If you think otherwise, See Rule #1 3211 3212As in the famous joke, the consequences of Rule #1 are profound. Once 3213you understand Rule #1, you will understand Tcl. 3214 321523.2 Tcl Rule #1b 3216================= 3217 3218There is a second pair of rules. 3219 1. Rule #1: Control flow does not exist. Only commands 3220 For example: the classic FOR loop or IF statement is not a control 3221 flow item, they are commands, there is no such thing as control 3222 flow in Tcl. 3223 2. Rule #2: If you think otherwise, See Rule #1 3224 Actually what happens is this: There are commands that by 3225 convention, act like control flow key words in other languages. 3226 One of those commands is the word "for", another command is "if". 3227 322823.3 Per Rule #1 - All Results are strings 3229========================================== 3230 3231Every Tcl command results in a string. The word "result" is used 3232deliberately. No result is just an empty string. Remember: Rule #1 - 3233Everything is a string 3234 323523.4 Tcl Quoting Operators 3236========================== 3237 3238In life of a Tcl script, there are two important periods of time, the 3239difference is subtle. 3240 1. Parse Time 3241 2. Evaluation Time 3242 3243The two key items here are how "quoted things" work in Tcl. Tcl has 3244three primary quoting constructs, the [square-brackets] the 3245{curly-braces} and "double-quotes" 3246 3247By now you should know $VARIABLES always start with a $DOLLAR sign. 3248BTW: To set a variable, you actually use the command "set", as in "set 3249VARNAME VALUE" much like the ancient BASIC language "let x = 1" 3250statement, but without the equal sign. 3251 3252 * [square-brackets] 3253 [square-brackets] are command substitutions. It operates much like 3254 Unix Shell 'back-ticks'. The result of a [square-bracket] 3255 operation is exactly 1 string. Remember Rule #1 - Everything is a 3256 string. These two statements are roughly identical: 3257 # bash example 3258 X=`date` 3259 echo "The Date is: $X" 3260 # Tcl example 3261 set X [date] 3262 puts "The Date is: $X" 3263 * "double-quoted-things" 3264 "double-quoted-things" are just simply quoted text. $VARIABLES and 3265 [square-brackets] are expanded in place - the result however is 3266 exactly 1 string. Remember Rule #1 - Everything is a string 3267 set x "Dinner" 3268 puts "It is now \"[date]\", $x is in 1 hour" 3269 * {Curly-Braces} 3270 {Curly-Braces} are magic: $VARIABLES and [square-brackets] are 3271 parsed, but are NOT expanded or executed. {Curly-Braces} are like 3272 'single-quote' operators in BASH shell scripts, with the added 3273 feature: {curly-braces} can be nested, single quotes can not. 3274 {{{this is nested 3 times}}} NOTE: [date] is a bad example; at this 3275 writing, Jim/OpenOCD does not have a date command. 3276 327723.5 Consequences of Rule 1/2/3/4 3278================================= 3279 3280The consequences of Rule 1 are profound. 3281 328223.5.1 Tokenisation & Execution. 3283-------------------------------- 3284 3285Of course, whitespace, blank lines and #comment lines are handled in the 3286normal way. 3287 3288As a script is parsed, each (multi) line in the script file is tokenised 3289and according to the quoting rules. After tokenisation, that line is 3290immediately executed. 3291 3292Multi line statements end with one or more "still-open" {curly-braces} 3293which - eventually - closes a few lines later. 3294 329523.5.2 Command Execution 3296------------------------ 3297 3298Remember earlier: There are no "control flow" statements in Tcl. 3299Instead there are COMMANDS that simply act like control flow operators. 3300 3301Commands are executed like this: 3302 3303 1. Parse the next line into (argc) and (argv[]). 3304 2. Look up (argv[0]) in a table and call its function. 3305 3. Repeat until End Of File. 3306 3307It sort of works like this: 3308 for(;;){ 3309 ReadAndParse( &argc, &argv ); 3310 3311 cmdPtr = LookupCommand( argv[0] ); 3312 3313 (*cmdPtr->Execute)( argc, argv ); 3314 } 3315 3316When the command "proc" is parsed (which creates a procedure function) 3317it gets 3 parameters on the command line. 1 the name of the proc 3318(function), 2 the list of parameters, and 3 the body of the function. 3319Not the choice of words: LIST and BODY. The PROC command stores these 3320items in a table somewhere so it can be found by "LookupCommand()" 3321 332223.5.3 The FOR command 3323---------------------- 3324 3325The most interesting command to look at is the FOR command. In Tcl, the 3326FOR command is normally implemented in C. Remember, FOR is a command 3327just like any other command. 3328 3329When the ascii text containing the FOR command is parsed, the parser 3330produces 5 parameter strings, (If in doubt: Refer to Rule #1) they are: 3331 3332 0. The ascii text 'for' 3333 1. The start text 3334 2. The test expression 3335 3. The next text 3336 4. The body text 3337 3338Sort of reminds you of "main( int argc, char **argv )" does it not? 3339Remember Rule #1 - Everything is a string. The key point is this: Often 3340many of those parameters are in {curly-braces} - thus the variables 3341inside are not expanded or replaced until later. 3342 3343Remember that every Tcl command looks like the classic "main( argc, argv 3344)" function in C. In JimTCL - they actually look like this: 3345 3346 int 3347 MyCommand( Jim_Interp *interp, 3348 int *argc, 3349 Jim_Obj * const *argvs ); 3350 3351Real Tcl is nearly identical. Although the newer versions have 3352introduced a byte-code parser and interpreter, but at the core, it still 3353operates in the same basic way. 3354 335523.5.4 FOR command implementation 3356--------------------------------- 3357 3358To understand Tcl it is perhaps most helpful to see the FOR command. 3359Remember, it is a COMMAND not a control flow structure. 3360 3361In Tcl there are two underlying C helper functions. 3362 3363Remember Rule #1 - You are a string. 3364 3365The first helper parses and executes commands found in an ascii string. 3366Commands can be separated by semicolons, or newlines. While parsing, 3367variables are expanded via the quoting rules. 3368 3369The second helper evaluates an ascii string as a numerical expression 3370and returns a value. 3371 3372Here is an example of how the FOR command could be implemented. The 3373pseudo code below does not show error handling. 3374 void Execute_AsciiString( void *interp, const char *string ); 3375 3376 int Evaluate_AsciiExpression( void *interp, const char *string ); 3377 3378 int 3379 MyForCommand( void *interp, 3380 int argc, 3381 char **argv ) 3382 { 3383 if( argc != 5 ){ 3384 SetResult( interp, "WRONG number of parameters"); 3385 return ERROR; 3386 } 3387 3388 // argv[0] = the ascii string just like C 3389 3390 // Execute the start statement. 3391 Execute_AsciiString( interp, argv[1] ); 3392 3393 // Top of loop test 3394 for(;;){ 3395 i = Evaluate_AsciiExpression(interp, argv[2]); 3396 if( i == 0 ) 3397 break; 3398 3399 // Execute the body 3400 Execute_AsciiString( interp, argv[3] ); 3401 3402 // Execute the LOOP part 3403 Execute_AsciiString( interp, argv[4] ); 3404 } 3405 3406 // Return no error 3407 SetResult( interp, "" ); 3408 return SUCCESS; 3409 } 3410 3411Every other command IF, WHILE, FORMAT, PUTS, EXPR, everything works in 3412the same basic way. 3413 341423.6 OpenOCD Tcl Usage 3415====================== 3416 341723.6.1 source and find commands 3418------------------------------- 3419 3420Where: In many configuration files 3421Example: source [find FILENAME] 3422Remember the parsing rules 3423 1. The 'find' command is in square brackets, and is executed with the 3424 parameter FILENAME. It should find and return the full path to a 3425 file with that name; it uses an internal search path. The RESULT 3426 is a string, which is substituted into the command line in place of 3427 the bracketed 'find' command. (Don't try to use a FILENAME which 3428 includes the "#" character. That character begins Tcl comments.) 3429 2. The 'source' command is executed with the resulting filename; it 3430 reads a file and executes as a script. 3431 343223.6.2 format command 3433--------------------- 3434 3435Where: Generally occurs in numerous places. 3436Tcl has no command like printf(), instead it has format, which is really 3437more like sprintf(). Example 3438 set x 6 3439 set y 7 3440 puts [format "The answer: %d" [expr $x * $y]] 3441 1. The SET command creates 2 variables, X and Y. 3442 2. The double [nested] EXPR command performs math 3443 The EXPR command produces numerical result as a string. 3444 Refer to Rule #1 3445 3. The format command is executed, producing a single string 3446 Refer to Rule #1. 3447 4. The PUTS command outputs the text. 3448 344923.6.3 Body or Inlined Text 3450--------------------------- 3451 3452Where: Various TARGET scripts. 3453 #1 Good 3454 proc someproc {} { 3455 ... multiple lines of stuff ... 3456 } 3457 $_TARGETNAME configure -event FOO someproc 3458 #2 Good - no variables 3459 $_TARGETNAME configure -event foo "this ; that;" 3460 #3 Good Curly Braces 3461 $_TARGETNAME configure -event FOO { 3462 puts "Time: [date]" 3463 } 3464 #4 DANGER DANGER DANGER 3465 $_TARGETNAME configure -event foo "puts \"Time: [date]\"" 3466 1. The $_TARGETNAME is an OpenOCD variable convention. 3467 $_TARGETNAME represents the last target created, the value changes 3468 each time a new target is created. Remember the parsing rules. 3469 When the ascii text is parsed, the $_TARGETNAME becomes a simple 3470 string, the name of the target which happens to be a TARGET 3471 (object) command. 3472 2. The 2nd parameter to the '-event' parameter is a TCBODY 3473 There are 4 examples: 3474 1. The TCLBODY is a simple string that happens to be a proc name 3475 2. The TCLBODY is several simple commands separated by semicolons 3476 3. The TCLBODY is a multi-line {curly-brace} quoted string 3477 4. The TCLBODY is a string with variables that get expanded. 3478 3479 In the end, when the target event FOO occurs the TCLBODY is 3480 evaluated. Method #1 and #2 are functionally identical. For 3481 Method #3 and #4 it is more interesting. What is the TCLBODY? 3482 3483 Remember the parsing rules. In case #3, {curly-braces} mean the 3484 $VARS and [square-brackets] are expanded later, when the EVENT 3485 occurs, and the text is evaluated. In case #4, they are replaced 3486 before the "Target Object Command" is executed. This occurs at the 3487 same time $_TARGETNAME is replaced. In case #4 the date will never 3488 change. {BTW: [date] is a bad example; at this writing, 3489 Jim/OpenOCD does not have a date command} 3490 349123.6.4 Global Variables 3492----------------------- 3493 3494Where: You might discover this when writing your own procs 3495In simple terms: Inside a PROC, if you need to access a global variable 3496you must say so. See also "upvar". Example: 3497 proc myproc { } { 3498 set y 0 #Local variable Y 3499 global x #Global variable X 3500 puts [format "X=%d, Y=%d" $x $y] 3501 } 3502 350323.7 Other Tcl Hacks 3504==================== 3505 3506Dynamic variable creation 3507 # Dynamically create a bunch of variables. 3508 for { set x 0 } { $x < 32 } { set x [expr $x + 1]} { 3509 # Create var name 3510 set vn [format "BIT%d" $x] 3511 # Make it a global 3512 global $vn 3513 # Set it. 3514 set $vn [expr (1 << $x)] 3515 } 3516Dynamic proc/command creation 3517 # One "X" function - 5 uart functions. 3518 foreach who {A B C D E} 3519 proc [format "show_uart%c" $who] { } "show_UARTx $who" 3520 } 3521 3522 3523File: openocd.info, Node: License, Next: OpenOCD Concept Index, Prev: Tcl Crash Course, Up: Top 3524 3525Appendix A The GNU Free Documentation License. 3526********************************************** 3527 3528 Version 1.2, November 2002 3529 3530 Copyright (C) 2000,2001,2002 Free Software Foundation, Inc. 3531 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA 3532 3533 Everyone is permitted to copy and distribute verbatim copies 3534 of this license document, but changing it is not allowed. 3535 3536 0. PREAMBLE 3537 3538 The purpose of this License is to make a manual, textbook, or other 3539 functional and useful document "free" in the sense of freedom: to 3540 assure everyone the effective freedom to copy and redistribute it, 3541 with or without modifying it, either commercially or 3542 noncommercially. Secondarily, this License preserves for the 3543 author and publisher a way to get credit for their work, while not 3544 being considered responsible for modifications made by others. 3545 3546 This License is a kind of "copyleft", which means that derivative 3547 works of the document must themselves be free in the same sense. 3548 It complements the GNU General Public License, which is a copyleft 3549 license designed for free software. 3550 3551 We have designed this License in order to use it for manuals for 3552 free software, because free software needs free documentation: a 3553 free program should come with manuals providing the same freedoms 3554 that the software does. But this License is not limited to 3555 software manuals; it can be used for any textual work, regardless 3556 of subject matter or whether it is published as a printed book. We 3557 recommend this License principally for works whose purpose is 3558 instruction or reference. 3559 3560 1. APPLICABILITY AND DEFINITIONS 3561 3562 This License applies to any manual or other work, in any medium, 3563 that contains a notice placed by the copyright holder saying it can 3564 be distributed under the terms of this License. Such a notice 3565 grants a world-wide, royalty-free license, unlimited in duration, 3566 to use that work under the conditions stated herein. The 3567 "Document", below, refers to any such manual or work. Any member 3568 of the public is a licensee, and is addressed as "you". You accept 3569 the license if you copy, modify or distribute the work in a way 3570 requiring permission under copyright law. 3571 3572 A "Modified Version" of the Document means any work containing the 3573 Document or a portion of it, either copied verbatim, or with 3574 modifications and/or translated into another language. 3575 3576 A "Secondary Section" is a named appendix or a front-matter section 3577 of the Document that deals exclusively with the relationship of the 3578 publishers or authors of the Document to the Document's overall 3579 subject (or to related matters) and contains nothing that could 3580 fall directly within that overall subject. (Thus, if the Document 3581 is in part a textbook of mathematics, a Secondary Section may not 3582 explain any mathematics.) The relationship could be a matter of 3583 historical connection with the subject or with related matters, or 3584 of legal, commercial, philosophical, ethical or political position 3585 regarding them. 3586 3587 The "Invariant Sections" are certain Secondary Sections whose 3588 titles are designated, as being those of Invariant Sections, in the 3589 notice that says that the Document is released under this License. 3590 If a section does not fit the above definition of Secondary then it 3591 is not allowed to be designated as Invariant. The Document may 3592 contain zero Invariant Sections. If the Document does not identify 3593 any Invariant Sections then there are none. 3594 3595 The "Cover Texts" are certain short passages of text that are 3596 listed, as Front-Cover Texts or Back-Cover Texts, in the notice 3597 that says that the Document is released under this License. A 3598 Front-Cover Text may be at most 5 words, and a Back-Cover Text may 3599 be at most 25 words. 3600 3601 A "Transparent" copy of the Document means a machine-readable copy, 3602 represented in a format whose specification is available to the 3603 general public, that is suitable for revising the document 3604 straightforwardly with generic text editors or (for images composed 3605 of pixels) generic paint programs or (for drawings) some widely 3606 available drawing editor, and that is suitable for input to text 3607 formatters or for automatic translation to a variety of formats 3608 suitable for input to text formatters. A copy made in an otherwise 3609 Transparent file format whose markup, or absence of markup, has 3610 been arranged to thwart or discourage subsequent modification by 3611 readers is not Transparent. An image format is not Transparent if 3612 used for any substantial amount of text. A copy that is not 3613 "Transparent" is called "Opaque". 3614 3615 Examples of suitable formats for Transparent copies include plain 3616 ASCII without markup, Texinfo input format, LaTeX input format, 3617 SGML or XML using a publicly available DTD, and standard-conforming 3618 simple HTML, PostScript or PDF designed for human modification. 3619 Examples of transparent image formats include PNG, XCF and JPG. 3620 Opaque formats include proprietary formats that can be read and 3621 edited only by proprietary word processors, SGML or XML for which 3622 the DTD and/or processing tools are not generally available, and 3623 the machine-generated HTML, PostScript or PDF produced by some word 3624 processors for output purposes only. 3625 3626 The "Title Page" means, for a printed book, the title page itself, 3627 plus such following pages as are needed to hold, legibly, the 3628 material this License requires to appear in the title page. For 3629 works in formats which do not have any title page as such, "Title 3630 Page" means the text near the most prominent appearance of the 3631 work's title, preceding the beginning of the body of the text. 3632 3633 A section "Entitled XYZ" means a named subunit of the Document 3634 whose title either is precisely XYZ or contains XYZ in parentheses 3635 following text that translates XYZ in another language. (Here XYZ 3636 stands for a specific section name mentioned below, such as 3637 "Acknowledgements", "Dedications", "Endorsements", or "History".) 3638 To "Preserve the Title" of such a section when you modify the 3639 Document means that it remains a section "Entitled XYZ" according 3640 to this definition. 3641 3642 The Document may include Warranty Disclaimers next to the notice 3643 which states that this License applies to the Document. These 3644 Warranty Disclaimers are considered to be included by reference in 3645 this License, but only as regards disclaiming warranties: any other 3646 implication that these Warranty Disclaimers may have is void and 3647 has no effect on the meaning of this License. 3648 3649 2. VERBATIM COPYING 3650 3651 You may copy and distribute the Document in any medium, either 3652 commercially or noncommercially, provided that this License, the 3653 copyright notices, and the license notice saying this License 3654 applies to the Document are reproduced in all copies, and that you 3655 add no other conditions whatsoever to those of this License. You 3656 may not use technical measures to obstruct or control the reading 3657 or further copying of the copies you make or distribute. However, 3658 you may accept compensation in exchange for copies. If you 3659 distribute a large enough number of copies you must also follow the 3660 conditions in section 3. 3661 3662 You may also lend copies, under the same conditions stated above, 3663 and you may publicly display copies. 3664 3665 3. COPYING IN QUANTITY 3666 3667 If you publish printed copies (or copies in media that commonly 3668 have printed covers) of the Document, numbering more than 100, and 3669 the Document's license notice requires Cover Texts, you must 3670 enclose the copies in covers that carry, clearly and legibly, all 3671 these Cover Texts: Front-Cover Texts on the front cover, and 3672 Back-Cover Texts on the back cover. Both covers must also clearly 3673 and legibly identify you as the publisher of these copies. The 3674 front cover must present the full title with all words of the title 3675 equally prominent and visible. You may add other material on the 3676 covers in addition. Copying with changes limited to the covers, as 3677 long as they preserve the title of the Document and satisfy these 3678 conditions, can be treated as verbatim copying in other respects. 3679 3680 If the required texts for either cover are too voluminous to fit 3681 legibly, you should put the first ones listed (as many as fit 3682 reasonably) on the actual cover, and continue the rest onto 3683 adjacent pages. 3684 3685 If you publish or distribute Opaque copies of the Document 3686 numbering more than 100, you must either include a machine-readable 3687 Transparent copy along with each Opaque copy, or state in or with 3688 each Opaque copy a computer-network location from which the general 3689 network-using public has access to download using public-standard 3690 network protocols a complete Transparent copy of the Document, free 3691 of added material. If you use the latter option, you must take 3692 reasonably prudent steps, when you begin distribution of Opaque 3693 copies in quantity, to ensure that this Transparent copy will 3694 remain thus accessible at the stated location until at least one 3695 year after the last time you distribute an Opaque copy (directly or 3696 through your agents or retailers) of that edition to the public. 3697 3698 It is requested, but not required, that you contact the authors of 3699 the Document well before redistributing any large number of copies, 3700 to give them a chance to provide you with an updated version of the 3701 Document. 3702 3703 4. MODIFICATIONS 3704 3705 You may copy and distribute a Modified Version of the Document 3706 under the conditions of sections 2 and 3 above, provided that you 3707 release the Modified Version under precisely this License, with the 3708 Modified Version filling the role of the Document, thus licensing 3709 distribution and modification of the Modified Version to whoever 3710 possesses a copy of it. In addition, you must do these things in 3711 the Modified Version: 3712 3713 A. Use in the Title Page (and on the covers, if any) a title 3714 distinct from that of the Document, and from those of previous 3715 versions (which should, if there were any, be listed in the 3716 History section of the Document). You may use the same title 3717 as a previous version if the original publisher of that 3718 version gives permission. 3719 3720 B. List on the Title Page, as authors, one or more persons or 3721 entities responsible for authorship of the modifications in 3722 the Modified Version, together with at least five of the 3723 principal authors of the Document (all of its principal 3724 authors, if it has fewer than five), unless they release you 3725 from this requirement. 3726 3727 C. State on the Title page the name of the publisher of the 3728 Modified Version, as the publisher. 3729 3730 D. Preserve all the copyright notices of the Document. 3731 3732 E. Add an appropriate copyright notice for your modifications 3733 adjacent to the other copyright notices. 3734 3735 F. Include, immediately after the copyright notices, a license 3736 notice giving the public permission to use the Modified 3737 Version under the terms of this License, in the form shown in 3738 the Addendum below. 3739 3740 G. Preserve in that license notice the full lists of Invariant 3741 Sections and required Cover Texts given in the Document's 3742 license notice. 3743 3744 H. Include an unaltered copy of this License. 3745 3746 I. Preserve the section Entitled "History", Preserve its Title, 3747 and add to it an item stating at least the title, year, new 3748 authors, and publisher of the Modified Version as given on the 3749 Title Page. If there is no section Entitled "History" in the 3750 Document, create one stating the title, year, authors, and 3751 publisher of the Document as given on its Title Page, then add 3752 an item describing the Modified Version as stated in the 3753 previous sentence. 3754 3755 J. Preserve the network location, if any, given in the Document 3756 for public access to a Transparent copy of the Document, and 3757 likewise the network locations given in the Document for 3758 previous versions it was based on. These may be placed in the 3759 "History" section. You may omit a network location for a work 3760 that was published at least four years before the Document 3761 itself, or if the original publisher of the version it refers 3762 to gives permission. 3763 3764 K. For any section Entitled "Acknowledgements" or "Dedications", 3765 Preserve the Title of the section, and preserve in the section 3766 all the substance and tone of each of the contributor 3767 acknowledgements and/or dedications given therein. 3768 3769 L. Preserve all the Invariant Sections of the Document, unaltered 3770 in their text and in their titles. Section numbers or the 3771 equivalent are not considered part of the section titles. 3772 3773 M. Delete any section Entitled "Endorsements". Such a section 3774 may not be included in the Modified Version. 3775 3776 N. Do not retitle any existing section to be Entitled 3777 "Endorsements" or to conflict in title with any Invariant 3778 Section. 3779 3780 O. Preserve any Warranty Disclaimers. 3781 3782 If the Modified Version includes new front-matter sections or 3783 appendices that qualify as Secondary Sections and contain no 3784 material copied from the Document, you may at your option designate 3785 some or all of these sections as invariant. To do this, add their 3786 titles to the list of Invariant Sections in the Modified Version's 3787 license notice. These titles must be distinct from any other 3788 section titles. 3789 3790 You may add a section Entitled "Endorsements", provided it contains 3791 nothing but endorsements of your Modified Version by various 3792 parties--for example, statements of peer review or that the text 3793 has been approved by an organization as the authoritative 3794 definition of a standard. 3795 3796 You may add a passage of up to five words as a Front-Cover Text, 3797 and a passage of up to 25 words as a Back-Cover Text, to the end of 3798 the list of Cover Texts in the Modified Version. Only one passage 3799 of Front-Cover Text and one of Back-Cover Text may be added by (or 3800 through arrangements made by) any one entity. If the Document 3801 already includes a cover text for the same cover, previously added 3802 by you or by arrangement made by the same entity you are acting on 3803 behalf of, you may not add another; but you may replace the old 3804 one, on explicit permission from the previous publisher that added 3805 the old one. 3806 3807 The author(s) and publisher(s) of the Document do not by this 3808 License give permission to use their names for publicity for or to 3809 assert or imply endorsement of any Modified Version. 3810 3811 5. COMBINING DOCUMENTS 3812 3813 You may combine the Document with other documents released under 3814 this License, under the terms defined in section 4 above for 3815 modified versions, provided that you include in the combination all 3816 of the Invariant Sections of all of the original documents, 3817 unmodified, and list them all as Invariant Sections of your 3818 combined work in its license notice, and that you preserve all 3819 their Warranty Disclaimers. 3820 3821 The combined work need only contain one copy of this License, and 3822 multiple identical Invariant Sections may be replaced with a single 3823 copy. If there are multiple Invariant Sections with the same name 3824 but different contents, make the title of each such section unique 3825 by adding at the end of it, in parentheses, the name of the 3826 original author or publisher of that section if known, or else a 3827 unique number. Make the same adjustment to the section titles in 3828 the list of Invariant Sections in the license notice of the 3829 combined work. 3830 3831 In the combination, you must combine any sections Entitled 3832 "History" in the various original documents, forming one section 3833 Entitled "History"; likewise combine any sections Entitled 3834 "Acknowledgements", and any sections Entitled "Dedications". You 3835 must delete all sections Entitled "Endorsements." 3836 3837 6. COLLECTIONS OF DOCUMENTS 3838 3839 You may make a collection consisting of the Document and other 3840 documents released under this License, and replace the individual 3841 copies of this License in the various documents with a single copy 3842 that is included in the collection, provided that you follow the 3843 rules of this License for verbatim copying of each of the documents 3844 in all other respects. 3845 3846 You may extract a single document from such a collection, and 3847 distribute it individually under this License, provided you insert 3848 a copy of this License into the extracted document, and follow this 3849 License in all other respects regarding verbatim copying of that 3850 document. 3851 3852 7. AGGREGATION WITH INDEPENDENT WORKS 3853 3854 A compilation of the Document or its derivatives with other 3855 separate and independent documents or works, in or on a volume of a 3856 storage or distribution medium, is called an "aggregate" if the 3857 copyright resulting from the compilation is not used to limit the 3858 legal rights of the compilation's users beyond what the individual 3859 works permit. When the Document is included in an aggregate, this 3860 License does not apply to the other works in the aggregate which 3861 are not themselves derivative works of the Document. 3862 3863 If the Cover Text requirement of section 3 is applicable to these 3864 copies of the Document, then if the Document is less than one half 3865 of the entire aggregate, the Document's Cover Texts may be placed 3866 on covers that bracket the Document within the aggregate, or the 3867 electronic equivalent of covers if the Document is in electronic 3868 form. Otherwise they must appear on printed covers that bracket 3869 the whole aggregate. 3870 3871 8. TRANSLATION 3872 3873 Translation is considered a kind of modification, so you may 3874 distribute translations of the Document under the terms of section 3875 4. Replacing Invariant Sections with translations requires special 3876 permission from their copyright holders, but you may include 3877 translations of some or all Invariant Sections in addition to the 3878 original versions of these Invariant Sections. You may include a 3879 translation of this License, and all the license notices in the 3880 Document, and any Warranty Disclaimers, provided that you also 3881 include the original English version of this License and the 3882 original versions of those notices and disclaimers. In case of a 3883 disagreement between the translation and the original version of 3884 this License or a notice or disclaimer, the original version will 3885 prevail. 3886 3887 If a section in the Document is Entitled "Acknowledgements", 3888 "Dedications", or "History", the requirement (section 4) to 3889 Preserve its Title (section 1) will typically require changing the 3890 actual title. 3891 3892 9. TERMINATION 3893 3894 You may not copy, modify, sublicense, or distribute the Document 3895 except as expressly provided for under this License. Any other 3896 attempt to copy, modify, sublicense or distribute the Document is 3897 void, and will automatically terminate your rights under this 3898 License. However, parties who have received copies, or rights, 3899 from you under this License will not have their licenses terminated 3900 so long as such parties remain in full compliance. 3901 3902 10. FUTURE REVISIONS OF THIS LICENSE 3903 3904 The Free Software Foundation may publish new, revised versions of 3905 the GNU Free Documentation License from time to time. Such new 3906 versions will be similar in spirit to the present version, but may 3907 differ in detail to address new problems or concerns. See 3908 <http://www.gnu.org/copyleft/>. 3909 3910 Each version of the License is given a distinguishing version 3911 number. If the Document specifies that a particular numbered 3912 version of this License "or any later version" applies to it, you 3913 have the option of following the terms and conditions either of 3914 that specified version or of any later version that has been 3915 published (not as a draft) by the Free Software Foundation. If the 3916 Document does not specify a version number of this License, you may 3917 choose any version ever published (not as a draft) by the Free 3918 Software Foundation. 3919 3920ADDENDUM: How to use this License for your documents 3921==================================================== 3922 3923To use this License in a document you have written, include a copy of 3924the License in the document and put the following copyright and license 3925notices just after the title page: 3926 3927 Copyright (C) YEAR YOUR NAME. 3928 Permission is granted to copy, distribute and/or modify this document 3929 under the terms of the GNU Free Documentation License, Version 1.2 3930 or any later version published by the Free Software Foundation; 3931 with no Invariant Sections, no Front-Cover Texts, and no Back-Cover 3932 Texts. A copy of the license is included in the section entitled ``GNU 3933 Free Documentation License''. 3934 3935If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, 3936replace the "with...Texts." line with this: 3937 3938 with the Invariant Sections being LIST THEIR TITLES, with 3939 the Front-Cover Texts being LIST, and with the Back-Cover Texts 3940 being LIST. 3941 3942If you have Invariant Sections without Cover Texts, or some other 3943combination of the three, merge those two alternatives to suit the 3944situation. 3945 3946If your document contains nontrivial examples of program code, we 3947recommend releasing these examples in parallel under your choice of free 3948software license, such as the GNU General Public License, to permit 3949their use in free software. 3950 3951 3952File: openocd.info, Node: OpenOCD Concept Index, Next: Command and Driver Index, Prev: License, Up: Top 3953 3954OpenOCD Concept Index 3955********************* 3956 3957�[index�] 3958* Menu: 3959 3960* aarch64: Architecture and Core Commands. 3961 (line 896) 3962* about: About. (line 6) 3963* adaptive clocking: Debug Adapter Configuration. 3964 (line 1007) 3965* adaptive clocking <1>: FAQ. (line 6) 3966* ambiqmicro: Flash Commands. (line 608) 3967* apollo: Flash Commands. (line 608) 3968* ARC: Architecture and Core Commands. 3969 (line 1326) 3970* Architecture Specific Commands: Architecture and Core Commands. 3971 (line 6) 3972* ARM: Architecture and Core Commands. 3973 (line 290) 3974* ARM semihosting: OpenOCD Project Setup. 3975 (line 314) 3976* ARM semihosting <1>: Architecture and Core Commands. 3977 (line 331) 3978* ARM semihosting <2>: Architecture and Core Commands. 3979 (line 342) 3980* ARM semihosting <3>: Architecture and Core Commands. 3981 (line 353) 3982* ARM semihosting <4>: Architecture and Core Commands. 3983 (line 362) 3984* ARM11: Architecture and Core Commands. 3985 (line 672) 3986* ARM7: Architecture and Core Commands. 3987 (line 392) 3988* ARM720T: Architecture and Core Commands. 3989 (line 430) 3990* ARM9: Architecture and Core Commands. 3991 (line 392) 3992* ARM9 <1>: Architecture and Core Commands. 3993 (line 446) 3994* ARM920T: Architecture and Core Commands. 3995 (line 466) 3996* ARM926ej-s: Architecture and Core Commands. 3997 (line 501) 3998* ARM966E: Architecture and Core Commands. 3999 (line 515) 4000* ARMv4: Architecture and Core Commands. 4001 (line 385) 4002* ARMv5: Architecture and Core Commands. 4003 (line 385) 4004* ARMv6: Architecture and Core Commands. 4005 (line 668) 4006* ARMv7: Architecture and Core Commands. 4007 (line 706) 4008* ARMv8: Architecture and Core Commands. 4009 (line 705) 4010* ARMv8-A: Architecture and Core Commands. 4011 (line 896) 4012* at91sam3: Flash Commands. (line 724) 4013* at91sam4: Flash Commands. (line 779) 4014* at91sam4l: Flash Commands. (line 784) 4015* at91samd: Flash Commands. (line 646) 4016* ath79: Flash Commands. (line 557) 4017* Atheros ath79 SPI driver: Flash Commands. (line 557) 4018* atsame5: Flash Commands. (line 795) 4019* atsamv: Flash Commands. (line 848) 4020* autoprobe: TAP Declaration. (line 318) 4021* board config file: Config File Guidelines. 4022 (line 60) 4023* breakpoint: General Commands. (line 366) 4024* bscan_spi: Flash Commands. (line 329) 4025* CFI: Flash Commands. (line 294) 4026* command line options: Running. (line 6) 4027* commands: General Commands. (line 6) 4028* Common Flash Interface: Flash Commands. (line 294) 4029* config command: Server Configuration. 4030 (line 13) 4031* config file, board: Config File Guidelines. 4032 (line 60) 4033* config file, interface: Debug Adapter Configuration. 4034 (line 6) 4035* config file, overview: OpenOCD Project Setup. 4036 (line 139) 4037* config file, target: Config File Guidelines. 4038 (line 290) 4039* config file, user: OpenOCD Project Setup. 4040 (line 139) 4041* configuration stage: Server Configuration. 4042 (line 13) 4043* Connecting to GDB: GDB and OpenOCD. (line 27) 4044* Core Specific Commands: Architecture and Core Commands. 4045 (line 6) 4046* Cortex-A: Architecture and Core Commands. 4047 (line 709) 4048* Cortex-M: Architecture and Core Commands. 4049 (line 837) 4050* Cortex-R: Architecture and Core Commands. 4051 (line 744) 4052* CPU type: CPU Configuration. (line 60) 4053* CTI: Architecture and Core Commands. 4054 (line 244) 4055* DAP declaration: TAP Declaration. (line 374) 4056* DCC: Architecture and Core Commands. 4057 (line 408) 4058* DCC <1>: Architecture and Core Commands. 4059 (line 1456) 4060* developers: Developers. (line 6) 4061* directory search: Running. (line 6) 4062* disassemble: Architecture and Core Commands. 4063 (line 301) 4064* disassemble <1>: Architecture and Core Commands. 4065 (line 909) 4066* dongles: Debug Adapter Hardware. 4067 (line 6) 4068* dotted name: TAP Declaration. (line 98) 4069* ETB: Architecture and Core Commands. 4070 (line 14) 4071* ETM: Architecture and Core Commands. 4072 (line 14) 4073* ETM <1>: Architecture and Core Commands. 4074 (line 754) 4075* event, reset-init: Config File Guidelines. 4076 (line 176) 4077* events: Reset Configuration. 4078 (line 226) 4079* events <1>: TAP Declaration. (line 217) 4080* events <2>: CPU Configuration. (line 416) 4081* faq: FAQ. (line 6) 4082* fespi: Flash Commands. (line 590) 4083* Firmware recovery: Utility Commands. (line 45) 4084* flash configuration: Flash Commands. (line 36) 4085* flash erasing: Flash Commands. (line 102) 4086* flash programming: Flash Commands. (line 102) 4087* flash protection: Flash Commands. (line 230) 4088* flash reading: Flash Commands. (line 102) 4089* flash writing: Flash Commands. (line 102) 4090* FPGA: PLD/FPGA Commands. (line 6) 4091* Freedom E SPI: Flash Commands. (line 590) 4092* FTDI: Debug Adapter Hardware. 4093 (line 6) 4094* GDB: Server Configuration. 4095 (line 142) 4096* GDB <1>: GDB and OpenOCD. (line 6) 4097* GDB configuration: Server Configuration. 4098 (line 142) 4099* GDB server: Server Configuration. 4100 (line 91) 4101* GDB target: CPU Configuration. (line 6) 4102* Generic JTAG2SPI driver: Flash Commands. (line 329) 4103* halt: General Commands. (line 97) 4104* hwthread: GDB and OpenOCD. (line 285) 4105* image dumping: General Commands. (line 312) 4106* image loading: General Commands. (line 312) 4107* initialization: Server Configuration. 4108 (line 6) 4109* init_board procedure: Config File Guidelines. 4110 (line 241) 4111* init_targets procedure: Config File Guidelines. 4112 (line 514) 4113* init_target_events procedure: Config File Guidelines. 4114 (line 559) 4115* interface config file: Debug Adapter Configuration. 4116 (line 6) 4117* ITM: Architecture and Core Commands. 4118 (line 754) 4119* Jim-Tcl: About Jim-Tcl. (line 6) 4120* jrc: TAP Declaration. (line 255) 4121* JTAG: About. (line 15) 4122* JTAG <1>: Debug Adapter Configuration. 4123 (line 894) 4124* JTAG autoprobe: TAP Declaration. (line 318) 4125* JTAG Commands: JTAG Commands. (line 6) 4126* JTAG Route Controller: TAP Declaration. (line 255) 4127* jtagspi: Flash Commands. (line 329) 4128* kinetis: Flash Commands. (line 998) 4129* kinetis_ke: Flash Commands. (line 1085) 4130* libdcc: Architecture and Core Commands. 4131 (line 1456) 4132* Linux-ARM DCC support: Architecture and Core Commands. 4133 (line 1456) 4134* logfile: Running. (line 6) 4135* lpcspifi: Flash Commands. (line 399) 4136* memory access: General Commands. (line 274) 4137* message level: General Commands. (line 67) 4138* NAND: Flash Commands. (line 2031) 4139* NAND configuration: Flash Commands. (line 2086) 4140* NAND erasing: Flash Commands. (line 2166) 4141* NAND other commands: Flash Commands. (line 2257) 4142* NAND programming: Flash Commands. (line 2166) 4143* NAND programming <1>: Flash Commands. (line 2179) 4144* NAND programming <2>: Flash Commands. (line 2232) 4145* NAND reading: Flash Commands. (line 2133) 4146* NAND verification: Flash Commands. (line 2232) 4147* NAND writing: Flash Commands. (line 2179) 4148* NXP SPI Flash Interface: Flash Commands. (line 399) 4149* object command: CPU Configuration. (line 299) 4150* OctoSPI: Flash Commands. (line 436) 4151* PLD: PLD/FPGA Commands. (line 6) 4152* port: Server Configuration. 4153 (line 81) 4154* printer port: Debug Adapter Hardware. 4155 (line 6) 4156* profiling: General Commands. (line 471) 4157* Programming using GDB: GDB and OpenOCD. (line 127) 4158* QuadSPI: Flash Commands. (line 436) 4159* RAM testing: Utility Commands. (line 9) 4160* reset: General Commands. (line 97) 4161* Reset Configuration: Reset Configuration. 4162 (line 6) 4163* reset-init handler: Config File Guidelines. 4164 (line 176) 4165* RPC: Tcl Scripting API. (line 96) 4166* RPC Notifications: Tcl Scripting API. (line 114) 4167* RPC trace output: Tcl Scripting API. (line 131) 4168* RTCK: Debug Adapter Hardware. 4169 (line 6) 4170* RTCK <1>: Debug Adapter Configuration. 4171 (line 1007) 4172* RTCK <2>: FAQ. (line 6) 4173* RTOS: GDB and OpenOCD. (line 285) 4174* RTOS Support: GDB and OpenOCD. (line 211) 4175* scan chain: TAP Declaration. (line 28) 4176* security: Server Configuration. 4177 (line 81) 4178* Serial Peripheral Interface: Debug Adapter Configuration. 4179 (line 931) 4180* Serial Vector Format: Boundary Scan Commands. 4181 (line 13) 4182* Serial Wire Debug: Debug Adapter Configuration. 4183 (line 909) 4184* server: Server Configuration. 4185 (line 81) 4186* Single Wire Interface Module: Debug Adapter Configuration. 4187 (line 938) 4188* SMI: Flash Commands. (line 416) 4189* SMP: Config File Guidelines. 4190 (line 417) 4191* SMP <1>: GDB and OpenOCD. (line 285) 4192* SPI: Debug Adapter Configuration. 4193 (line 931) 4194* SPI <1>: Flash Commands. (line 329) 4195* SPIFI: Flash Commands. (line 399) 4196* STMicroelectronics QuadSPI/OctoSPI Interface: Flash Commands. 4197 (line 436) 4198* STMicroelectronics Serial Memory Interface: Flash Commands. 4199 (line 416) 4200* stmqspi: Flash Commands. (line 436) 4201* stmsmi: Flash Commands. (line 416) 4202* str9xpec: Flash Commands. (line 1896) 4203* SVF: Boundary Scan Commands. 4204 (line 13) 4205* SWD: Debug Adapter Configuration. 4206 (line 909) 4207* SWIM: Debug Adapter Configuration. 4208 (line 938) 4209* swm050: Flash Commands. (line 1974) 4210* SWO: Architecture and Core Commands. 4211 (line 754) 4212* SWV: Architecture and Core Commands. 4213 (line 754) 4214* TAP: About. (line 15) 4215* TAP configuration: TAP Declaration. (line 6) 4216* TAP declaration: TAP Declaration. (line 6) 4217* TAP events: TAP Declaration. (line 217) 4218* TAP naming convention: TAP Declaration. (line 121) 4219* TAP state names: JTAG Commands. (line 125) 4220* target config file: Config File Guidelines. 4221 (line 290) 4222* target events: CPU Configuration. (line 416) 4223* target initialization: General Commands. (line 97) 4224* target type: CPU Configuration. (line 60) 4225* target, current: CPU Configuration. (line 18) 4226* target, list: CPU Configuration. (line 18) 4227* tcl: About Jim-Tcl. (line 6) 4228* Tcl: Tcl Crash Course. (line 6) 4229* Tcl Scripting API: Tcl Scripting API. (line 6) 4230* Tcl scripts: Tcl Scripting API. (line 5) 4231* TCP port: Server Configuration. 4232 (line 81) 4233* TPIU: Architecture and Core Commands. 4234 (line 754) 4235* tracing: Architecture and Core Commands. 4236 (line 14) 4237* tracing <1>: Architecture and Core Commands. 4238 (line 754) 4239* tracing <2>: Architecture and Core Commands. 4240 (line 1456) 4241* translation: Config File Guidelines. 4242 (line 604) 4243* Transport: Debug Adapter Configuration. 4244 (line 868) 4245* USB Adapter: Debug Adapter Hardware. 4246 (line 6) 4247* user config file: OpenOCD Project Setup. 4248 (line 139) 4249* Using GDB as a non-intrusive memory inspector: GDB and OpenOCD. 4250 (line 167) 4251* Utility Commands: Utility Commands. (line 5) 4252* variable names: Config File Guidelines. 4253 (line 144) 4254* vector_catch: OpenOCD Project Setup. 4255 (line 213) 4256* vector_catch <1>: Architecture and Core Commands. 4257 (line 451) 4258* vector_catch <2>: Architecture and Core Commands. 4259 (line 641) 4260* vector_catch <3>: Architecture and Core Commands. 4261 (line 694) 4262* vector_catch <4>: Architecture and Core Commands. 4263 (line 862) 4264* vector_table: Architecture and Core Commands. 4265 (line 656) 4266* watchpoint: General Commands. (line 366) 4267* wiggler: Debug Adapter Hardware. 4268 (line 6) 4269* xcf: Flash Commands. (line 363) 4270* Xilinx Platform flash driver: Flash Commands. (line 363) 4271* Xilinx Serial Vector Format: Boundary Scan Commands. 4272 (line 39) 4273* XScale: Architecture and Core Commands. 4274 (line 529) 4275* XSVF: Boundary Scan Commands. 4276 (line 39) 4277* zy1000: Debug Adapter Hardware. 4278 (line 6) 4279 4280 4281File: openocd.info, Node: Command and Driver Index, Prev: OpenOCD Concept Index, Up: Top 4282 4283Command and Driver Index 4284************************ 4285 4286�[index�] 4287* Menu: 4288 4289* $cti_name ack: Architecture and Core Commands. 4290 (line 272) 4291* $cti_name channel: Architecture and Core Commands. 4292 (line 275) 4293* $cti_name dump: Architecture and Core Commands. 4294 (line 262) 4295* $cti_name enable: Architecture and Core Commands. 4296 (line 259) 4297* $cti_name read: Architecture and Core Commands. 4298 (line 268) 4299* $cti_name testmode: Architecture and Core Commands. 4300 (line 279) 4301* $cti_name write: Architecture and Core Commands. 4302 (line 265) 4303* $dap_name apcsw: TAP Declaration. (line 450) 4304* $dap_name apid: TAP Declaration. (line 417) 4305* $dap_name apreg: TAP Declaration. (line 421) 4306* $dap_name apsel: TAP Declaration. (line 426) 4307* $dap_name baseaddr: TAP Declaration. (line 441) 4308* $dap_name dpreg: TAP Declaration. (line 429) 4309* $dap_name info: TAP Declaration. (line 413) 4310* $dap_name memaccess: TAP Declaration. (line 445) 4311* $dap_name ti_be_32_quirks: TAP Declaration. (line 485) 4312* $target_name arp_examine: CPU Configuration. (line 324) 4313* $target_name arp_halt: CPU Configuration. (line 325) 4314* $target_name arp_poll: CPU Configuration. (line 326) 4315* $target_name arp_reset: CPU Configuration. (line 327) 4316* $target_name arp_waitstate: CPU Configuration. (line 328) 4317* $target_name array2mem: CPU Configuration. (line 333) 4318* $target_name catch_exc: Architecture and Core Commands. 4319 (line 925) 4320* $target_name cget: CPU Configuration. (line 351) 4321* $target_name configure: CPU Configuration. (line 213) 4322* $target_name curstate: CPU Configuration. (line 374) 4323* $target_name eventlist: CPU Configuration. (line 379) 4324* $target_name invoke-event: CPU Configuration. (line 383) 4325* $target_name mdb: CPU Configuration. (line 391) 4326* $target_name mdd: CPU Configuration. (line 388) 4327* $target_name mdh: CPU Configuration. (line 390) 4328* $target_name mdw: CPU Configuration. (line 389) 4329* $target_name mem2array: CPU Configuration. (line 334) 4330* $target_name mwb: CPU Configuration. (line 404) 4331* $target_name mwd: CPU Configuration. (line 401) 4332* $target_name mwh: CPU Configuration. (line 403) 4333* $target_name mww: CPU Configuration. (line 402) 4334* aarch64 cache_info: Architecture and Core Commands. 4335 (line 896) 4336* aarch64 dbginit: Architecture and Core Commands. 4337 (line 899) 4338* aarch64 disassemble: Architecture and Core Commands. 4339 (line 908) 4340* aarch64 maskisr: Architecture and Core Commands. 4341 (line 921) 4342* aarch64 smp: Architecture and Core Commands. 4343 (line 912) 4344* adapter: Debug Adapter Configuration. 4345 (line 990) 4346* adapter <1>: Reset Configuration. 4347 (line 121) 4348* adapter <2>: Reset Configuration. 4349 (line 126) 4350* adapter assert: General Commands. (line 202) 4351* adapter deassert: General Commands. (line 203) 4352* adapter driver: Debug Adapter Configuration. 4353 (line 43) 4354* adapter list: Debug Adapter Configuration. 4355 (line 46) 4356* adapter name: Debug Adapter Configuration. 4357 (line 55) 4358* adapter transports: Debug Adapter Configuration. 4359 (line 49) 4360* adapter usb location: Debug Adapter Configuration. 4361 (line 58) 4362* addreg: Architecture and Core Commands. 4363 (line 1169) 4364* add_script_search_dir: General Commands. (line 85) 4365* aduc702x: Flash Commands. (line 598) 4366* ambiqmicro: Flash Commands. (line 607) 4367* ambiqmicro mass_erase: Flash Commands. (line 635) 4368* ambiqmicro page_erase: Flash Commands. (line 637) 4369* ambiqmicro program_otp: Flash Commands. (line 639) 4370* amt_jtagaccel: Debug Adapter Configuration. 4371 (line 75) 4372* append_file: General Commands. (line 235) 4373* arc add-reg: Architecture and Core Commands. 4374 (line 1347) 4375* arc add-reg-type-flags: Architecture and Core Commands. 4376 (line 1401) 4377* arc add-reg-type-struct: Architecture and Core Commands. 4378 (line 1406) 4379* arc get-reg-field: Architecture and Core Commands. 4380 (line 1412) 4381* arc jtag get-aux-reg: Architecture and Core Commands. 4382 (line 1434) 4383* arc jtag get-core-reg: Architecture and Core Commands. 4384 (line 1440) 4385* arc jtag set-aux-reg: Architecture and Core Commands. 4386 (line 1424) 4387* arc jtag set-core-reg: Architecture and Core Commands. 4388 (line 1430) 4389* arc set-reg-exists: Architecture and Core Commands. 4390 (line 1417) 4391* arm core_state: Architecture and Core Commands. 4392 (line 294) 4393* arm disassemble: Architecture and Core Commands. 4394 (line 300) 4395* arm mcr: Architecture and Core Commands. 4396 (line 314) 4397* arm mrc: Architecture and Core Commands. 4398 (line 320) 4399* arm reg: Architecture and Core Commands. 4400 (line 326) 4401* arm semihosting: Architecture and Core Commands. 4402 (line 330) 4403* arm semihosting_cmdline: Architecture and Core Commands. 4404 (line 341) 4405* arm semihosting_fileio: Architecture and Core Commands. 4406 (line 352) 4407* arm semihosting_resexit: Architecture and Core Commands. 4408 (line 361) 4409* arm-jtag-ew: Debug Adapter Configuration. 4410 (line 88) 4411* arm11 memwrite burst: Architecture and Core Commands. 4412 (line 672) 4413* arm11 memwrite error_fatal: Architecture and Core Commands. 4414 (line 682) 4415* arm11 step_irq_enable: Architecture and Core Commands. 4416 (line 688) 4417* arm11 vcr: Architecture and Core Commands. 4418 (line 693) 4419* arm720t cp15: Architecture and Core Commands. 4420 (line 435) 4421* arm7_9 dbgrq: Architecture and Core Commands. 4422 (line 397) 4423* arm7_9 dcc_downloads: Architecture and Core Commands. 4424 (line 407) 4425* arm7_9 fast_memory_access: Architecture and Core Commands. 4426 (line 418) 4427* arm9 vector_catch: Architecture and Core Commands. 4428 (line 450) 4429* arm920t cache_info: Architecture and Core Commands. 4430 (line 471) 4431* arm920t cp15: Architecture and Core Commands. 4432 (line 476) 4433* arm920t cp15i: Architecture and Core Commands. 4434 (line 482) 4435* arm920t read_cache: Architecture and Core Commands. 4436 (line 492) 4437* arm920t read_mmu: Architecture and Core Commands. 4438 (line 495) 4439* arm926ejs cache_info: Architecture and Core Commands. 4440 (line 509) 4441* arm966e cp15: Architecture and Core Commands. 4442 (line 519) 4443* armjtagew_info: Debug Adapter Configuration. 4444 (line 92) 4445* at91rm9200: Debug Adapter Configuration. 4446 (line 95) 4447* at91sam3: Flash Commands. (line 723) 4448* at91sam3 gpnvm: Flash Commands. (line 755) 4449* at91sam3 gpnvm clear: Flash Commands. (line 756) 4450* at91sam3 gpnvm set: Flash Commands. (line 757) 4451* at91sam3 gpnvm show: Flash Commands. (line 758) 4452* at91sam3 info: Flash Commands. (line 764) 4453* at91sam3 slowclk: Flash Commands. (line 774) 4454* at91sam4: Flash Commands. (line 778) 4455* at91sam4l: Flash Commands. (line 783) 4456* at91sam4l smap_reset_deassert: Flash Commands. (line 789) 4457* at91sam7: Flash Commands. (line 852) 4458* at91sam7 gpnvm: Flash Commands. (line 885) 4459* at91sam9: Flash Commands. (line 2298) 4460* at91sam9 ale: Flash Commands. (line 2312) 4461* at91sam9 ce: Flash Commands. (line 2323) 4462* at91sam9 cle: Flash Commands. (line 2309) 4463* at91sam9 rdy_busy: Flash Commands. (line 2318) 4464* at91samd: Flash Commands. (line 645) 4465* at91samd bootloader: Flash Commands. (line 686) 4466* at91samd chip-erase: Flash Commands. (line 656) 4467* at91samd dsu_reset_deassert: Flash Commands. (line 698) 4468* at91samd eeprom: Flash Commands. (line 672) 4469* at91samd nvmuserrow: Flash Commands. (line 703) 4470* at91samd set-security: Flash Commands. (line 661) 4471* ath79: Flash Commands. (line 556) 4472* atsame5: Flash Commands. (line 794) 4473* atsame5 bootloader: Flash Commands. (line 805) 4474* atsame5 chip-erase: Flash Commands. (line 817) 4475* atsame5 dsu_reset_deassert: Flash Commands. (line 822) 4476* atsame5 userpage: Flash Commands. (line 827) 4477* atsamv: Flash Commands. (line 847) 4478* avr: Flash Commands. (line 893) 4479* bcm2835gpio: Debug Adapter Configuration. 4480 (line 799) 4481* bindto: General Commands. (line 88) 4482* bluenrg-x: Flash Commands. (line 897) 4483* bp: General Commands. (line 370) 4484* cache_config l2x: Architecture and Core Commands. 4485 (line 731) 4486* cat: General Commands. (line 240) 4487* cc26xx: Flash Commands. (line 915) 4488* cc3220sf: Flash Commands. (line 925) 4489* cfi: Flash Commands. (line 293) 4490* cmsis-dap: Debug Adapter Configuration. 4491 (line 99) 4492* cmsis-dap info: Debug Adapter Configuration. 4493 (line 129) 4494* cmsis_dap_backend: Debug Adapter Configuration. 4495 (line 114) 4496* cmsis_dap_serial: Debug Adapter Configuration. 4497 (line 110) 4498* cmsis_dap_usb interface: Debug Adapter Configuration. 4499 (line 123) 4500* cmsis_dap_vid_pid: Debug Adapter Configuration. 4501 (line 103) 4502* cortex_a cache_info: Architecture and Core Commands. 4503 (line 709) 4504* cortex_a dacrfixup [on|off]: Architecture and Core Commands. 4505 (line 712) 4506* cortex_a dbginit: Architecture and Core Commands. 4507 (line 718) 4508* cortex_a maskisr: Architecture and Core Commands. 4509 (line 728) 4510* cortex_a mmu dump: Architecture and Core Commands. 4511 (line 734) 4512* cortex_a smp: Architecture and Core Commands. 4513 (line 722) 4514* cortex_a smp_gdb: Architecture and Core Commands. 4515 (line 725) 4516* cortex_m maskisr: Architecture and Core Commands. 4517 (line 837) 4518* cortex_m reset_config: Architecture and Core Commands. 4519 (line 877) 4520* cortex_m vector_catch: Architecture and Core Commands. 4521 (line 861) 4522* cortex_r dbginit: Architecture and Core Commands. 4523 (line 744) 4524* cortex_r maskisr: Architecture and Core Commands. 4525 (line 748) 4526* cp: General Commands. (line 243) 4527* cti create: Architecture and Core Commands. 4528 (line 251) 4529* cti names: Architecture and Core Commands. 4530 (line 283) 4531* dap create: TAP Declaration. (line 382) 4532* dap info: TAP Declaration. (line 402) 4533* dap init: TAP Declaration. (line 406) 4534* dap names: TAP Declaration. (line 398) 4535* davinci: Flash Commands. (line 2329) 4536* debug_level: General Commands. (line 66) 4537* drscan: JTAG Commands. (line 42) 4538* dummy: Debug Adapter Configuration. 4539 (line 133) 4540* dummy <1>: Architecture and Core Commands. 4541 (line 190) 4542* dump_image: General Commands. (line 312) 4543* du_select: Architecture and Core Commands. 4544 (line 1156) 4545* echo: General Commands. (line 76) 4546* efm32: Flash Commands. (line 937) 4547* ep93xx: Debug Adapter Configuration. 4548 (line 136) 4549* esirisc: Flash Commands. (line 953) 4550* esirisc cache_arch: Architecture and Core Commands. 4551 (line 944) 4552* esirisc flash mass_erase: Flash Commands. (line 964) 4553* esirisc flash ref_erase: Flash Commands. (line 968) 4554* esirisc flush_caches: Architecture and Core Commands. 4555 (line 958) 4556* esirisc hwdc: Architecture and Core Commands. 4557 (line 949) 4558* esirisc trace analyze: Architecture and Core Commands. 4559 (line 1086) 4560* esirisc trace buffer: Architecture and Core Commands. 4561 (line 988) 4562* esirisc trace dump: Architecture and Core Commands. 4563 (line 1092) 4564* esirisc trace fifo: Architecture and Core Commands. 4565 (line 993) 4566* esirisc trace flow_control: Architecture and Core Commands. 4567 (line 996) 4568* esirisc trace format: Architecture and Core Commands. 4569 (line 1000) 4570* esirisc trace info: Architecture and Core Commands. 4571 (line 1074) 4572* esirisc trace init: Architecture and Core Commands. 4573 (line 1069) 4574* esirisc trace start: Architecture and Core Commands. 4575 (line 1080) 4576* esirisc trace status: Architecture and Core Commands. 4577 (line 1077) 4578* esirisc trace stop: Architecture and Core Commands. 4579 (line 1083) 4580* esirisc trace trigger delay: Architecture and Core Commands. 4581 (line 1056) 4582* esirisc trace trigger start: Architecture and Core Commands. 4583 (line 1013) 4584* esirisc trace trigger stop: Architecture and Core Commands. 4585 (line 1036) 4586* etb: Architecture and Core Commands. 4587 (line 198) 4588* etb config: Architecture and Core Commands. 4589 (line 201) 4590* etb trigger_percent: Architecture and Core Commands. 4591 (line 204) 4592* etm analyze: Architecture and Core Commands. 4593 (line 166) 4594* etm config: Architecture and Core Commands. 4595 (line 63) 4596* etm dump: Architecture and Core Commands. 4597 (line 170) 4598* etm image: Architecture and Core Commands. 4599 (line 173) 4600* etm info: Architecture and Core Commands. 4601 (line 89) 4602* etm load: Architecture and Core Commands. 4603 (line 176) 4604* etm start: Architecture and Core Commands. 4605 (line 179) 4606* etm status: Architecture and Core Commands. 4607 (line 95) 4608* etm stop: Architecture and Core Commands. 4609 (line 182) 4610* etm tracemode: Architecture and Core Commands. 4611 (line 100) 4612* etm trigger_debug: Architecture and Core Commands. 4613 (line 119) 4614* etm_dummy config: Architecture and Core Commands. 4615 (line 195) 4616* exit: General Commands. (line 30) 4617* fast_load: General Commands. (line 316) 4618* fast_load_image: General Commands. (line 320) 4619* fespi: Flash Commands. (line 589) 4620* flash bank: Flash Commands. (line 36) 4621* flash banks: Flash Commands. (line 67) 4622* flash erase_address: Flash Commands. (line 135) 4623* flash erase_check: Flash Commands. (line 230) 4624* flash erase_sector: Flash Commands. (line 129) 4625* flash fillb: Flash Commands. (line 149) 4626* flash filld: Flash Commands. (line 146) 4627* flash fillh: Flash Commands. (line 148) 4628* flash fillw: Flash Commands. (line 147) 4629* flash info: Flash Commands. (line 234) 4630* flash list: Flash Commands. (line 72) 4631* flash mdb: Flash Commands. (line 162) 4632* flash mdh: Flash Commands. (line 161) 4633* flash mdw: Flash Commands. (line 160) 4634* flash padded_value: Flash Commands. (line 252) 4635* flash probe: Flash Commands. (line 77) 4636* flash protect: Flash Commands. (line 242) 4637* flash read_bank: Flash Commands. (line 176) 4638* flash verify_bank: Flash Commands. (line 183) 4639* flash verify_image: Flash Commands. (line 217) 4640* flash write_bank: Flash Commands. (line 170) 4641* flash write_image: Flash Commands. (line 189) 4642* flush_count: JTAG Commands. (line 70) 4643* fm3: Flash Commands. (line 972) 4644* fm4: Flash Commands. (line 981) 4645* ft232r: Debug Adapter Configuration. 4646 (line 290) 4647* ft232r_jtag_nums: Debug Adapter Configuration. 4648 (line 336) 4649* ft232r_restore_serial: Debug Adapter Configuration. 4650 (line 364) 4651* ft232r_serial_desc: Debug Adapter Configuration. 4652 (line 330) 4653* ft232r_srst_num: Debug Adapter Configuration. 4654 (line 360) 4655* ft232r_tck_num: Debug Adapter Configuration. 4656 (line 340) 4657* ft232r_tdi_num: Debug Adapter Configuration. 4658 (line 348) 4659* ft232r_tdo_num: Debug Adapter Configuration. 4660 (line 352) 4661* ft232r_tms_num: Debug Adapter Configuration. 4662 (line 344) 4663* ft232r_trst_num: Debug Adapter Configuration. 4664 (line 356) 4665* ft232r_vid_pid: Debug Adapter Configuration. 4666 (line 326) 4667* ftdi: Debug Adapter Configuration. 4668 (line 140) 4669* ftdi_channel: Debug Adapter Configuration. 4670 (line 214) 4671* ftdi_device_desc: Debug Adapter Configuration. 4672 (line 187) 4673* ftdi_get_signal: Debug Adapter Configuration. 4674 (line 271) 4675* ftdi_layout_init: Debug Adapter Configuration. 4676 (line 219) 4677* ftdi_layout_signal: Debug Adapter Configuration. 4678 (line 229) 4679* ftdi_location: Debug Adapter Configuration. 4680 (line 200) 4681* ftdi_serial: Debug Adapter Configuration. 4682 (line 192) 4683* ftdi_set_signal: Debug Adapter Configuration. 4684 (line 265) 4685* ftdi_tdo_sample_edge: Debug Adapter Configuration. 4686 (line 274) 4687* ftdi_vid_pid: Debug Adapter Configuration. 4688 (line 182) 4689* gdb_breakpoint_override: Server Configuration. 4690 (line 147) 4691* gdb_flash_program: Server Configuration. 4692 (line 154) 4693* gdb_memory_map: Server Configuration. 4694 (line 158) 4695* gdb_port: Server Configuration. 4696 (line 90) 4697* gdb_report_data_abort: Server Configuration. 4698 (line 166) 4699* gdb_report_register_access_error: Server Configuration. 4700 (line 171) 4701* gdb_save_tdesc: Server Configuration. 4702 (line 182) 4703* gdb_target_description: Server Configuration. 4704 (line 177) 4705* gw16012: Debug Adapter Configuration. 4706 (line 444) 4707* halt: General Commands. (line 137) 4708* help: General Commands. (line 33) 4709* hla: Debug Adapter Configuration. 4710 (line 694) 4711* hla_command: Debug Adapter Configuration. 4712 (line 718) 4713* hla_device_desc: Debug Adapter Configuration. 4714 (line 706) 4715* hla_layout: Debug Adapter Configuration. 4716 (line 712) 4717* hla_serial: Debug Adapter Configuration. 4718 (line 709) 4719* hla_vid_pid: Debug Adapter Configuration. 4720 (line 715) 4721* imx_gpio: Debug Adapter Configuration. 4722 (line 813) 4723* init: Server Configuration. 4724 (line 47) 4725* init_reset: Reset Configuration. 4726 (line 258) 4727* ip: General Commands. (line 246) 4728* irscan: JTAG Commands. (line 81) 4729* itm port: Architecture and Core Commands. 4730 (line 827) 4731* itm ports: Architecture and Core Commands. 4732 (line 831) 4733* jlink: Debug Adapter Configuration. 4734 (line 454) 4735* jlink config: Debug Adapter Configuration. 4736 (line 479) 4737* jlink config ip: Debug Adapter Configuration. 4738 (line 487) 4739* jlink config mac: Debug Adapter Configuration. 4740 (line 484) 4741* jlink config reset: Debug Adapter Configuration. 4742 (line 495) 4743* jlink config targetpower: Debug Adapter Configuration. 4744 (line 481) 4745* jlink config usb: Debug Adapter Configuration. 4746 (line 491) 4747* jlink config write: Debug Adapter Configuration. 4748 (line 497) 4749* jlink emucom read <channel> <length>: Debug Adapter Configuration. 4750 (line 507) 4751* jlink emucom write <channel> <data>: Debug Adapter Configuration. 4752 (line 500) 4753* jlink freemem: Debug Adapter Configuration. 4754 (line 474) 4755* jlink hwstatus: Debug Adapter Configuration. 4756 (line 471) 4757* jlink jtag: Debug Adapter Configuration. 4758 (line 476) 4759* jlink serial: Debug Adapter Configuration. 4760 (line 523) 4761* jlink usb: Debug Adapter Configuration. 4762 (line 515) 4763* jtag arp_init: Reset Configuration. 4764 (line 276) 4765* jtag arp_init-reset: Reset Configuration. 4766 (line 286) 4767* jtag cget: TAP Declaration. (line 200) 4768* jtag cget <1>: TAP Declaration. (line 203) 4769* jtag configure: TAP Declaration. (line 204) 4770* jtag names: TAP Declaration. (line 81) 4771* jtag newtap: TAP Declaration. (line 113) 4772* jtag tapdisable: TAP Declaration. (line 298) 4773* jtag tapenable: TAP Declaration. (line 303) 4774* jtag tapisenabled: TAP Declaration. (line 308) 4775* jtagspi: Flash Commands. (line 328) 4776* jtag_dpi: Debug Adapter Configuration. 4777 (line 852) 4778* jtag_dpi_set_address: Debug Adapter Configuration. 4779 (line 861) 4780* jtag_dpi_set_port: Debug Adapter Configuration. 4781 (line 857) 4782* jtag_init: Server Configuration. 4783 (line 65) 4784* jtag_ntrst_assert_width: Reset Configuration. 4785 (line 133) 4786* jtag_ntrst_delay: Reset Configuration. 4787 (line 138) 4788* jtag_rclk: Debug Adapter Configuration. 4789 (line 1006) 4790* kinetis: Flash Commands. (line 997) 4791* kinetis create_banks: Flash Commands. (line 1012) 4792* kinetis disable_wdog: Flash Commands. (line 1080) 4793* kinetis fcf_source: Flash Commands. (line 1018) 4794* kinetis fopt: Flash Commands. (line 1030) 4795* kinetis mdm check_security: Flash Commands. (line 1034) 4796* kinetis mdm halt: Flash Commands. (line 1038) 4797* kinetis mdm mass_erase: Flash Commands. (line 1043) 4798* kinetis mdm reset: Flash Commands. (line 1075) 4799* kinetis nvm_partition: Flash Commands. (line 1050) 4800* kinetis_ke: Flash Commands. (line 1084) 4801* kinetis_ke disable_wdog: Flash Commands. (line 1103) 4802* kinetis_ke mdm check_security: Flash Commands. (line 1093) 4803* kinetis_ke mdm mass_erase: Flash Commands. (line 1097) 4804* kitprog: Debug Adapter Configuration. 4805 (line 530) 4806* kitprog acquire_psoc: Debug Adapter Configuration. 4807 (line 575) 4808* kitprog info: Debug Adapter Configuration. 4809 (line 582) 4810* kitprog_init_acquire_psoc: Debug Adapter Configuration. 4811 (line 566) 4812* kitprog_serial: Debug Adapter Configuration. 4813 (line 571) 4814* linuxgpiod: Debug Adapter Configuration. 4815 (line 821) 4816* load_image: General Commands. (line 331) 4817* log_output: General Commands. (line 81) 4818* lpc2000: Flash Commands. (line 1106) 4819* lpc2000 part_id: Flash Commands. (line 1147) 4820* lpc288x: Flash Commands. (line 1151) 4821* lpc2900: Flash Commands. (line 1159) 4822* lpc2900 password: Flash Commands. (line 1215) 4823* lpc2900 read_custom: Flash Commands. (line 1204) 4824* lpc2900 secure_jtag: Flash Commands. (line 1250) 4825* lpc2900 secure_sector: Flash Commands. (line 1236) 4826* lpc2900 signature: Flash Commands. (line 1195) 4827* lpc2900 write_custom: Flash Commands. (line 1225) 4828* lpc3180: Flash Commands. (line 2342) 4829* lpc3180 select: Flash Commands. (line 2345) 4830* lpcspifi: Flash Commands. (line 398) 4831* ls: General Commands. (line 249) 4832* mac: General Commands. (line 252) 4833* mdb: General Commands. (line 287) 4834* mdd: General Commands. (line 284) 4835* mdh: General Commands. (line 286) 4836* mdr: Flash Commands. (line 1257) 4837* mdw: General Commands. (line 285) 4838* meminfo: General Commands. (line 255) 4839* memTestAddressBus: Utility Commands. (line 29) 4840* memTestDataBus: Utility Commands. (line 25) 4841* memTestDevice: Utility Commands. (line 34) 4842* mrvlqspi: Flash Commands. (line 547) 4843* msp432: Flash Commands. (line 1278) 4844* msp432 bsl: Flash Commands. (line 1297) 4845* msp432 mass_erase: Flash Commands. (line 1288) 4846* mwb: General Commands. (line 300) 4847* mwd: General Commands. (line 297) 4848* mwh: General Commands. (line 299) 4849* mww: General Commands. (line 298) 4850* mx3: Flash Commands. (line 2355) 4851* mxc: Flash Commands. (line 2359) 4852* mxc biswap: Flash Commands. (line 2367) 4853* nand check_bad_blocks: Flash Commands. (line 2257) 4854* nand device: Flash Commands. (line 2089) 4855* nand dump: Flash Commands. (line 2132) 4856* nand erase: Flash Commands. (line 2165) 4857* nand info: Flash Commands. (line 2269) 4858* nand list: Flash Commands. (line 2112) 4859* nand probe: Flash Commands. (line 2122) 4860* nand raw_access: Flash Commands. (line 2274) 4861* nand verify: Flash Commands. (line 2231) 4862* nand write: Flash Commands. (line 2178) 4863* niietcm4: Flash Commands. (line 1309) 4864* niietcm4 bflash_info_remap: Flash Commands. (line 1349) 4865* niietcm4 driver_info: Flash Commands. (line 1362) 4866* niietcm4 extmem_cfg: Flash Commands. (line 1353) 4867* niietcm4 service_mode_erase: Flash Commands. (line 1358) 4868* niietcm4 uflash_erase: Flash Commands. (line 1336) 4869* niietcm4 uflash_full_erase: Flash Commands. (line 1333) 4870* niietcm4 uflash_protect: Flash Commands. (line 1344) 4871* niietcm4 uflash_protect_check: Flash Commands. (line 1341) 4872* niietcm4 uflash_read_byte: Flash Commands. (line 1326) 4873* niietcm4 uflash_write_byte: Flash Commands. (line 1329) 4874* nrf5: Flash Commands. (line 1365) 4875* nrf5 info: Flash Commands. (line 1381) 4876* nrf5 mass_erase: Flash Commands. (line 1375) 4877* ocl: Flash Commands. (line 1384) 4878* oocd_trace: Architecture and Core Commands. 4879 (line 222) 4880* oocd_trace config: Architecture and Core Commands. 4881 (line 231) 4882* oocd_trace resync: Architecture and Core Commands. 4883 (line 235) 4884* oocd_trace status: Architecture and Core Commands. 4885 (line 238) 4886* opendous: Debug Adapter Configuration. 4887 (line 742) 4888* openjtag: Debug Adapter Configuration. 4889 (line 834) 4890* openjtag_device_desc: Debug Adapter Configuration. 4891 (line 848) 4892* openjtag_variant: Debug Adapter Configuration. 4893 (line 838) 4894* orion: Flash Commands. (line 2371) 4895* parport: Debug Adapter Configuration. 4896 (line 586) 4897* parport_cable: Debug Adapter Configuration. 4898 (line 592) 4899* parport_port: Debug Adapter Configuration. 4900 (line 80) 4901* parport_port <1>: Debug Adapter Configuration. 4902 (line 448) 4903* parport_port <2>: Debug Adapter Configuration. 4904 (line 621) 4905* parport_toggling_time: Debug Adapter Configuration. 4906 (line 631) 4907* parport_write_on_exit: Debug Adapter Configuration. 4908 (line 665) 4909* pathmove: JTAG Commands. (line 98) 4910* peek: General Commands. (line 259) 4911* pic32mx: Flash Commands. (line 1395) 4912* pic32mx pgm_word: Flash Commands. (line 1403) 4913* pic32mx unlock: Flash Commands. (line 1406) 4914* pld device: PLD/FPGA Commands. (line 23) 4915* pld devices: PLD/FPGA Commands. (line 28) 4916* pld load: PLD/FPGA Commands. (line 31) 4917* poke: General Commands. (line 262) 4918* poll: Server Configuration. 4919 (line 222) 4920* power: Debug Adapter Configuration. 4921 (line 796) 4922* presto: Debug Adapter Configuration. 4923 (line 677) 4924* presto_serial: Debug Adapter Configuration. 4925 (line 679) 4926* profile: General Commands. (line 471) 4927* program: Flash Commands. (line 258) 4928* psoc4: Flash Commands. (line 1410) 4929* psoc4 flash_autoerase: Flash Commands. (line 1422) 4930* psoc4 mass_erase: Flash Commands. (line 1435) 4931* psoc5lp: Flash Commands. (line 1441) 4932* psoc5lp mass_erase: Flash Commands. (line 1460) 4933* psoc5lp_eeprom: Flash Commands. (line 1465) 4934* psoc5lp_nvl: Flash Commands. (line 1474) 4935* psoc6: Flash Commands. (line 1494) 4936* psoc6 mass_erase: Flash Commands. (line 1554) 4937* psoc6 reset_halt: Flash Commands. (line 1545) 4938* rbp: General Commands. (line 380) 4939* readgroup: Architecture and Core Commands. 4940 (line 1182) 4941* reg: General Commands. (line 103) 4942* remote_bitbang: Debug Adapter Configuration. 4943 (line 374) 4944* remote_bitbang_host: Debug Adapter Configuration. 4945 (line 386) 4946* remote_bitbang_port: Debug Adapter Configuration. 4947 (line 382) 4948* reset: General Commands. (line 176) 4949* reset halt: General Commands. (line 178) 4950* reset init: General Commands. (line 179) 4951* reset run: General Commands. (line 177) 4952* reset_config: Reset Configuration. 4953 (line 143) 4954* resume: General Commands. (line 167) 4955* riscv authdata_read: Architecture and Core Commands. 4956 (line 1305) 4957* riscv authdata_write: Architecture and Core Commands. 4958 (line 1308) 4959* riscv dmi_read: Architecture and Core Commands. 4960 (line 1317) 4961* riscv dmi_write: Architecture and Core Commands. 4962 (line 1320) 4963* riscv expose_csrs: Architecture and Core Commands. 4964 (line 1209) 4965* riscv expose_custom: Architecture and Core Commands. 4966 (line 1218) 4967* riscv resume_order: Architecture and Core Commands. 4968 (line 1254) 4969* riscv set_command_timeout_sec: Architecture and Core Commands. 4970 (line 1226) 4971* riscv set_ebreakm: Architecture and Core Commands. 4972 (line 1281) 4973* riscv set_ebreaks: Architecture and Core Commands. 4974 (line 1286) 4975* riscv set_ebreaku: Architecture and Core Commands. 4976 (line 1291) 4977* riscv set_enable_virt2phys: Architecture and Core Commands. 4978 (line 1249) 4979* riscv set_enable_virtual: Architecture and Core Commands. 4980 (line 1244) 4981* riscv set_ir: Architecture and Core Commands. 4982 (line 1266) 4983* riscv set_prefer_sba: Architecture and Core Commands. 4984 (line 1240) 4985* riscv set_reset_timeout_sec: Architecture and Core Commands. 4986 (line 1231) 4987* riscv set_scratch_ram: Architecture and Core Commands. 4988 (line 1235) 4989* riscv use_bscan_tunnel: Architecture and Core Commands. 4990 (line 1276) 4991* rlink: Debug Adapter Configuration. 4992 (line 682) 4993* rm: General Commands. (line 265) 4994* rtck: Debug Adapter Configuration. 4995 (line 84) 4996* rtt channellist: General Commands. (line 444) 4997* rtt channels: General Commands. (line 441) 4998* rtt polling_interval [interval]: General Commands. (line 436) 4999* rtt server start: General Commands. (line 448) 5000* rtt server stop: General Commands. (line 451) 5001* rtt setup: General Commands. (line 423) 5002* rtt start: General Commands. (line 429) 5003* rtt stop: General Commands. (line 433) 5004* runAllMemTests: Utility Commands. (line 39) 5005* runtest: JTAG Commands. (line 106) 5006* rwp: General Commands. (line 383) 5007* s3c2410: Flash Commands. (line 2379) 5008* s3c2412: Flash Commands. (line 2380) 5009* s3c2440: Flash Commands. (line 2381) 5010* s3c2443: Flash Commands. (line 2382) 5011* s3c6400: Flash Commands. (line 2383) 5012* scan_chain: TAP Declaration. (line 89) 5013* shutdown: General Commands. (line 49) 5014* sim3x: Flash Commands. (line 1559) 5015* sim3x lock: Flash Commands. (line 1575) 5016* sim3x mass_erase: Flash Commands. (line 1570) 5017* sleep: General Commands. (line 43) 5018* soft_reset_halt: General Commands. (line 194) 5019* st-link: Debug Adapter Configuration. 5020 (line 722) 5021* st-link serial: Debug Adapter Configuration. 5022 (line 736) 5023* st-link vid_pid: Debug Adapter Configuration. 5024 (line 739) 5025* stellaris: Flash Commands. (line 1578) 5026* stellaris recover: Flash Commands. (line 1586) 5027* step: General Commands. (line 172) 5028* stm32f1x: Flash Commands. (line 1599) 5029* stm32f1x lock: Flash Commands. (line 1620) 5030* stm32f1x mass_erase: Flash Commands. (line 1630) 5031* stm32f1x options_load: Flash Commands. (line 1647) 5032* stm32f1x options_read: Flash Commands. (line 1634) 5033* stm32f1x options_write: Flash Commands. (line 1639) 5034* stm32f1x unlock: Flash Commands. (line 1624) 5035* stm32f2x: Flash Commands. (line 1654) 5036* stm32f2x lock: Flash Commands. (line 1679) 5037* stm32f2x mass_erase: Flash Commands. (line 1687) 5038* stm32f2x optcr2_write: Flash Commands. (line 1705) 5039* stm32f2x options_read: Flash Commands. (line 1691) 5040* stm32f2x options_write: Flash Commands. (line 1696) 5041* stm32f2x otp: Flash Commands. (line 1667) 5042* stm32f2x unlock: Flash Commands. (line 1683) 5043* stm32h7x: Flash Commands. (line 1710) 5044* stm32h7x lock: Flash Commands. (line 1726) 5045* stm32h7x mass_erase: Flash Commands. (line 1734) 5046* stm32h7x option_read: Flash Commands. (line 1738) 5047* stm32h7x option_write: Flash Commands. (line 1753) 5048* stm32h7x unlock: Flash Commands. (line 1730) 5049* stm32l4x: Flash Commands. (line 1798) 5050* stm32l4x lock: Flash Commands. (line 1817) 5051* stm32l4x mass_erase: Flash Commands. (line 1825) 5052* stm32l4x option_load: Flash Commands. (line 1859) 5053* stm32l4x option_read: Flash Commands. (line 1829) 5054* stm32l4x option_write: Flash Commands. (line 1844) 5055* stm32l4x unlock: Flash Commands. (line 1821) 5056* stm32lx: Flash Commands. (line 1765) 5057* stm32lx lock: Flash Commands. (line 1784) 5058* stm32lx mass_erase: Flash Commands. (line 1792) 5059* stm32lx unlock: Flash Commands. (line 1788) 5060* stmqspi: Flash Commands. (line 435) 5061* stmqspi cmd: Flash Commands. (line 517) 5062* stmqspi mass_erase: Flash Commands. (line 496) 5063* stmqspi set: Flash Commands. (line 500) 5064* stmsmi: Flash Commands. (line 415) 5065* str7x: Flash Commands. (line 1864) 5066* str7x disable_jtag: Flash Commands. (line 1873) 5067* str9x: Flash Commands. (line 1877) 5068* str9x flash_config: Flash Commands. (line 1886) 5069* str9xpec: Flash Commands. (line 1895) 5070* str9xpec disable_turbo: Flash Commands. (line 1938) 5071* str9xpec enable_turbo: Flash Commands. (line 1941) 5072* str9xpec lock: Flash Commands. (line 1945) 5073* str9xpec options_cmap: Flash Commands. (line 1952) 5074* str9xpec options_lvdsel: Flash Commands. (line 1955) 5075* str9xpec options_lvdthd: Flash Commands. (line 1958) 5076* str9xpec options_lvdwarn: Flash Commands. (line 1961) 5077* str9xpec options_read: Flash Commands. (line 1964) 5078* str9xpec options_write: Flash Commands. (line 1967) 5079* str9xpec part_id: Flash Commands. (line 1949) 5080* str9xpec unlock: Flash Commands. (line 1970) 5081* svf: Boundary Scan Commands. 5082 (line 17) 5083* swd newdap: Debug Adapter Configuration. 5084 (line 921) 5085* swd wcr trn prescale: Debug Adapter Configuration. 5086 (line 924) 5087* swm050: Flash Commands. (line 1973) 5088* swm050 mass_erase: Flash Commands. (line 1981) 5089* sysfsgpio: Debug Adapter Configuration. 5090 (line 828) 5091* tap_select: Architecture and Core Commands. 5092 (line 1153) 5093* target create: CPU Configuration. (line 190) 5094* target current: CPU Configuration. (line 37) 5095* target names: CPU Configuration. (line 40) 5096* target types: CPU Configuration. (line 71) 5097* targets: CPU Configuration. (line 46) 5098* target_request debugmsgs: Architecture and Core Commands. 5099 (line 1495) 5100* tcl_notifications: Tcl Scripting API. (line 124) 5101* tcl_port: Server Configuration. 5102 (line 124) 5103* tcl_trace: Tcl Scripting API. (line 139) 5104* telnet_port: Server Configuration. 5105 (line 132) 5106* test_image: General Commands. (line 346) 5107* tms470: Flash Commands. (line 1984) 5108* tms470 flash_keyset: Flash Commands. (line 1991) 5109* tms470 osc_mhz: Flash Commands. (line 1995) 5110* tms470 plldis: Flash Commands. (line 1998) 5111* tpiu config: Architecture and Core Commands. 5112 (line 754) 5113* trace history: Architecture and Core Commands. 5114 (line 1505) 5115* trace point: Architecture and Core Commands. 5116 (line 1511) 5117* transport list: Debug Adapter Configuration. 5118 (line 871) 5119* transport select: Debug Adapter Configuration. 5120 (line 875) 5121* trunc: General Commands. (line 268) 5122* ulink: Debug Adapter Configuration. 5123 (line 745) 5124* usbprog: Debug Adapter Configuration. 5125 (line 685) 5126* usb_blaster: Debug Adapter Configuration. 5127 (line 405) 5128* usb_blaster_device_desc: Debug Adapter Configuration. 5129 (line 411) 5130* usb_blaster_firmware: Debug Adapter Configuration. 5131 (line 440) 5132* usb_blaster_lowlevel_driver: Debug Adapter Configuration. 5133 (line 435) 5134* usb_blaster_pin: Debug Adapter Configuration. 5135 (line 425) 5136* usb_blaster_vid_pid: Debug Adapter Configuration. 5137 (line 417) 5138* verify_image: General Commands. (line 352) 5139* verify_image_checksum: General Commands. (line 358) 5140* verify_ircapture: JTAG Commands. (line 111) 5141* verify_jtag: JTAG Commands. (line 117) 5142* version: General Commands. (line 477) 5143* virt2phys: General Commands. (line 480) 5144* virtex2: PLD/FPGA Commands. (line 42) 5145* virtex2 read_stat: PLD/FPGA Commands. (line 50) 5146* virtual: Flash Commands. (line 271) 5147* vsllink: Debug Adapter Configuration. 5148 (line 688) 5149* w600: Flash Commands. (line 2002) 5150* wait_halt: General Commands. (line 138) 5151* wp: General Commands. (line 386) 5152* x86_32 idb: Architecture and Core Commands. 5153 (line 1128) 5154* x86_32 idh: Architecture and Core Commands. 5155 (line 1124) 5156* x86_32 idw: Architecture and Core Commands. 5157 (line 1120) 5158* x86_32 iwb: Architecture and Core Commands. 5159 (line 1140) 5160* x86_32 iwh: Architecture and Core Commands. 5161 (line 1136) 5162* x86_32 iww: Architecture and Core Commands. 5163 (line 1132) 5164* xcf: Flash Commands. (line 362) 5165* xcf ccb: Flash Commands. (line 370) 5166* xcf configure: Flash Commands. (line 386) 5167* xds110: Debug Adapter Configuration. 5168 (line 748) 5169* xds110 info: Debug Adapter Configuration. 5170 (line 765) 5171* xds110 serial: Debug Adapter Configuration. 5172 (line 755) 5173* xds110 supply: Debug Adapter Configuration. 5174 (line 759) 5175* xlnx_pcie_xvc: Debug Adapter Configuration. 5176 (line 769) 5177* xlnx_pcie_xvc_config: Debug Adapter Configuration. 5178 (line 780) 5179* xmc1xxx: Flash Commands. (line 2009) 5180* xmc4xxx: Flash Commands. (line 2014) 5181* xmc4xxx flash_password: Flash Commands. (line 2021) 5182* xmc4xxx flash_unprotect: Flash Commands. (line 2025) 5183* xscale analyze_trace: Architecture and Core Commands. 5184 (line 601) 5185* xscale cache_clean_address: Architecture and Core Commands. 5186 (line 604) 5187* xscale cache_info: Architecture and Core Commands. 5188 (line 607) 5189* xscale cp15: Architecture and Core Commands. 5190 (line 610) 5191* xscale dcache: Architecture and Core Commands. 5192 (line 617) 5193* xscale debug_handler: Architecture and Core Commands. 5194 (line 614) 5195* xscale dump_trace: Architecture and Core Commands. 5196 (line 620) 5197* xscale icache: Architecture and Core Commands. 5198 (line 623) 5199* xscale mmu: Architecture and Core Commands. 5200 (line 626) 5201* xscale trace_buffer: Architecture and Core Commands. 5202 (line 629) 5203* xscale trace_image: Architecture and Core Commands. 5204 (line 634) 5205* xscale vector_catch: Architecture and Core Commands. 5206 (line 640) 5207* xscale vector_table: Architecture and Core Commands. 5208 (line 655) 5209* xsvf: Boundary Scan Commands. 5210 (line 46) 5211* ZY1000: Debug Adapter Configuration. 5212 (line 790) 5213 5214