JTAG debugging using OpenOCD and Olimex ARM-USB-TINY-H on M24SR-Discovery

Setup (notice the M24SR-Discovery and Olimex JTAG debugger):


First download openocd and configure it for stlink:




Ensure that libusb and libftdi libraries are all setup/installed (as in above URLs).

Next create the following file (call it say “olimex_arm_usb_tiny_h.cfg”):

# http://www.olimex.com/dev/arm-usb-tiny-h.html

interface ftdi
ftdi_device_desc “Olimex OpenOCD JTAG ARM-USB-TINY-H”
ftdi_vid_pid 0x15ba 0x002a

ftdi_layout_init 0x0808 0x0a1b
ftdi_layout_signal nSRST -oe 0x0200
ftdi_layout_signal nTRST -data 0x0100 -oe 0x0100
ftdi_layout_signal LED -data 0x0800

adapter_khz 100
adapter_nsrst_delay 100
jtag_ntrst_delay 100

And next run the following command:

sudo openocd -f ./olimex_arm_usb_tiny_h.cfg -f /usr/local/share/openocd/scripts/target/stm32f4x.cfg -d3

and in another terminal:

telnet localhost 4444

Here in the 2nd terminal you can issue commands that step the CPU through instructions.

Displaying memory:

> mdb 0x0 10   
0x00000000: 48 58 00 20 45 01 00 08 ed 7a

All the “reg” related command:

> usage reg    
  arm mcr cpnum op1 CRn CRm op2 value
  arm mrc cpnum op1 CRn CRm op2
  arm reg
  dap apid [ap_num]
  flash write_image [erase] [unlock] filename [offset [file_type]]
reg [(register_number|register_name) [(value|’force’)]]
    stm32f4x.cpu arm mcr cpnum op1 CRn CRm op2 value
    stm32f4x.cpu arm mrc cpnum op1 CRn CRm op2
    stm32f4x.cpu arm reg
    stm32f4x.cpu dap apid [ap_num]

All the registers:

> reg
===== arm v7m registers
(0) r0 (/32): 0x00000001
(1) r1 (/32): 0x00000020
(2) r2 (/32): 0x40010C00
(3) r3 (/32): 0x0000FFF6
(4) r4 (/32): 0x00000000
(5) r5 (/32): 0x00000000
(6) r6 (/32): 0xFE396247
(7) r7 (/32): 0xEDC477F9
(8) r8 (/32): 0xFDB4F1FF
(9) r9 (/32): 0x8A5FF960
(10) r10 (/32): 0xEC772E9E
(11) r11 (/32): 0x7D5BD5C2
(12) r12 (/32): 0x00000008
(13) sp (/32): 0x20005830
(14) lr (/32): 0x08008327
(15) pc (/32): 0x0800833A
(16) xPSR (/32): 0x01000000
(17) msp (/32): 0x20005830
(18) psp (/32): 0x3DFD7268
(19) primask (/1): 0x00
(20) basepri (/8): 0x00
(21) faultmask (/1): 0x00
(22) control (/2): 0x00
===== Cortex-M DWT registers
(23) dwt_ctrl (/32)
(24) dwt_cyccnt (/32)
(25) dwt_0_comp (/32)
(26) dwt_0_mask (/4)
(27) dwt_0_function (/32)
(28) dwt_1_comp (/32)
(29) dwt_1_mask (/4)
(30) dwt_1_function (/32)
(31) dwt_2_comp (/32)
(32) dwt_2_mask (/4)
(33) dwt_2_function (/32)
(34) dwt_3_comp (/32)
(35) dwt_3_mask (/4)
(36) dwt_3_function (/32)

Next is disassembling instructions:

 arm disassemble 0x0 256

0x000001ee  0xd3f6        BCC    0x000001de
0x000001f0  0xf7ffffa2    BL    0x00000138
0x000001f4  0x7b9c        LDRB    r4, [r3, #0xe]
0x000001f6  0x080f        LSRS    r7, r1, #0x20
0x000001f8  0x7bbc        LDRB    r4, [r7, #0xe]
0x000001fa  0x080f        LSRS    r7, r1, #0x20
0x000001fc  0xb570      PUSH    {r4, r5, r6, r14}
0x000001fe  0xeb010402    ADD.W    r4, r1, r2
0x00000202  0xf8105b01    LDRB    r5, [r0], #1    ; 0x00000001
0x00000206  0xf0150307    ANDS    r3, r5, #7    ; 0x00000007
0x0000020a  0xd101        BNE    0x00000210
0x0000020c  0xf8103b01    LDRB    r3, [r0], #1    ; 0x00000001
0x00000210  0x112a        ASRS    r2, r5, #0x04
0x00000212  0xd106        BNE    0x00000222
0x00000214  0xf8102b01    LDRB    r2, [r0], #1    ; 0x00000001
0x00000218  0xe003        B    0x00000222
0x0000021a  0xf8106b01    LDRB    r6, [r0], #1    ; 0x00000001
0x0000021e  0xf8016b01    STRB    r6, [r1], #1    ; 0x01
0x00000222  0x1e5b        SUBS    r3, r3, #1
And if you want to single step through the processor, “halt” first, then “step” through.
> step
target state: halted
target halted due to single-step, current mode: Thread
xPSR: 0x01000000 pc: 0x0800833e msp: 0x20005830
> step
target state: halted
target halted due to single-step, current mode: Thread
xPSR: 0x01000000 pc: 0x08008340 msp: 0x20005830
> step
target state: halted
target halted due to single-step, current mode: Thread
xPSR: 0x01000000 pc: 0x08002f6a msp: 0x20005830

If you are interested to know how to create binaries (using linker script) for this board:


(to be noted is that M24SR-Discovery comes with F103 STM32 core, whereas the openocd config file labelled as “F4” is used and it worked.   “F1x” configuration files does not work.   Not sure why?)

One response to this post.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: