Manually debug Arduino project targeted for ESP32-WROOM-32 using Glasgow Interface Explorer as debugger (OCD-1272)

[maehw]

Development Kit

AZ-Delivery ESP32 NodeMCU

Module or chip used

ESP32-WROOM-32

Debug Adapter

Glasgow Interface Explorer

OpenOCD version

v0.12.0-esp32-20250422

Operating System

MacOS

Using an IDE ?

no (well actually yes, the Arduino IDE v2.3.2 but only for building the code and generating the image; and having ESP IDF tools available)

OpenOCD command line

./openocd -c 'adapter driver remote_bitbang; transport select jtag' -c 'remote_bitbang port 2222' -c 'reset_config none' -f target/esp32.cfg

JTAG Clock Speed

default

ESP-IDF version

v5.5-b66b5448-v1

Problem Description

Hi all!

I've so far only worked with ESP32 from the Arduino IDE or static analysis tools. I'd now like to try dynamic analysis/debugging. I haven't tried to start a debugging session from within the Arduino IDE because I think this way me even be harder and only supported by Arduino boards that have USB/serial + USB/JTAG, but I don't know.

I am using the Glasgow Interface Explorer (short: Glasgow) as the debugger. It comes with the jtag-openocd applet.

0. This is what the code in the Arduino sketch looks like:

const char test[] = {0x12, 0x34, 0x56, 0x78};
char test2[] = {0x9A, 0xBC, 0xDE, 0xF0};

void setup() {
  Serial.begin(115200);
  Serial.println("JTAG test");
  memset(test2, 0, sizeof(test2));
  Serial.println("another print statement");
  memcpy(test2, test, sizeof(test));
}

void loop() {
  delay(1000);
  Serial.println("hello from loop");
}

1. Run glasgow CLI:

glasgow run jtag-openocd tcp:localhost:2222 -VA=3.3
I: g.hardware.device: device already has bitstream ID 39b48083453360847041bf7998bf34a2
I: g.hardware.assembly: port A voltage set to 3.3 V
I: g.cli: running handler for applet 'jtag-openocd'
I: g.applet.bridge.jtag_openocd: socket: listening at tcp:localhost:2222

2. Run OpenOCD:

(from /Users/<redacted>/Library/Arduino15/packages/esp32/tools/openocd-esp32/v0.12.0-esp32-20250422/bin)

./openocd -c 'adapter driver remote_bitbang; transport select jtag' -c 'remote_bitbang port 2222' -c 'reset_config none' -f target/esp32.cfg
Open On-Chip Debugger v0.12.0-esp32-20250422 (2025-04-22-13:11)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
none separate
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:2222
Info : remote_bitbang driver initialized
Info : Note: The adapter "remote_bitbang" doesn't support configurable speed
Info : JTAG tap: esp32.tap0 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : JTAG tap: esp32.tap1 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : [esp32.cpu0] Examination succeed
Info : [esp32.cpu1] Examination succeed
Info : [esp32.cpu0] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections
Info : [esp32.cpu0] Debug controller was reset.
Info : [esp32.cpu0] Core was reset.
Info : [esp32.cpu1] Debug controller was reset.
Info : [esp32.cpu1] Core was reset.
Info : [esp32.cpu0] Target halted, PC=0xFFFFFFFF, debug_reason=00000003
Error: [esp32.cpu0] Timed out waiting for CPU to be reset, target state=2
Info : [esp32.cpu0] Reset cause (52) - (Unknown reset cause)
Warn : [esp32.cpu0] Timed out waiting for target to finish stepping. dsr=0x8000c000
Info : [esp32.cpu1] Debug controller was reset.
Info : [esp32.cpu1] Core was reset.
Info : [esp32.cpu0] Debug controller was reset.
Info : [esp32.cpu0] Core was reset.
Info : [esp32.cpu1] Target halted, PC=0xFFFFFFFF, debug_reason=00000003
Error: [esp32.cpu1] Timed out waiting for CPU to be reset, target state=2
Warn : [esp32.cpu1] Timed out waiting for target to finish stepping. dsr=0x8000c000
Info : [esp32.cpu0] Debug controller was reset.
Info : [esp32.cpu0] Core was reset.
Info : [esp32.cpu1] Debug controller was reset.
Info : [esp32.cpu1] Core was reset.
Info : [esp32.cpu0] Target halted, PC=0xFFFFFFFF, debug_reason=00000003
Error: [esp32.cpu0] Timed out waiting for CPU to be reset, target state=2
Info : [esp32.cpu0] Reset cause (52) - (Unknown reset cause)
Warn : [esp32.cpu0] Timed out waiting for target to finish stepping. dsr=0x8000c000
Info : [esp32.cpu1] Debug controller was reset.
Info : [esp32.cpu1] Core was reset.
Info : [esp32.cpu0] Debug controller was reset.
Info : [esp32.cpu0] Core was reset.
^C^C^CInfo : [esp32.cpu1] Target halted, PC=0x40085B36, debug_reason=00000000
Error: [esp32.cpu1] Timed out waiting for CPU to be reset, target state=2
Info : [esp32.cpu0] Debug controller was reset.
Info : [esp32.cpu0] Core was reset.
Info : [esp32.cpu1] Debug controller was reset.
Info : [esp32.cpu1] Core was reset.
shutdown command invoked
Info : remote_bitbang interface quit

I guess the debugger connection is working (glasgow CLI shows I: g.applet.bridge.jtag_openocd: socket: new connection from [::1]:52541 in its log) and the JTAG hardware wiring and JTAG chain connection also (JTAG tap: esp32.tap[0|1] tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)). The issue seems to be that the controller keeps resetting.

3. Connect to the serial interface:

hello from loop␍␊
hello from loop␍␊
hello from loop␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
hello from loop␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
hello from loop␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
hello from loop␍␊
hello from loop␍␊

I guess that the line containing TG1WDT_SYS_RESET comes from the bootloader and indicates a WDT reset. Those messages don't appear when I don't run openocd - the target keeps printing hello from loop instead.

Do I need to add some extra step to deactivate WDTs while debugging?

I've seen the section JTAG and ESP32-WROOM-32 AT Firmware Compatibility Issue in ESP-IDF Programming Guide > API Guides > JTAG Debugging> Tips and Quirks. Is this relevant for me? How can I check for "AT Firmware"?

4. Run gdb:

Continuing here probably only makes sense as soon as the other issues above have been resolved.

(from /Users/<redacted>/Library/Arduino15/packages/esp32/tools/xtensa-esp-elf-gdb/16.2_20250324/bin)

$ ./xtensa-esp32-elf-gdb -q -x build/gdbinit/symbols -x build/gdbinit/prefix_map -x build/gdbinit/connect /private/var/folders/8f/6c1j5jjs1gxdt8vbhzg6zxq80000gn/T/arduino/sketches/812687EBCD8B49EB2B69EED10F84C171/esp32JtagTest.ino.elf
Reading symbols from /private/var/folders/8f/6c1j5jjs1gxdt8vbhzg6zxq80000gn/T/arduino/sketches/812687EBCD8B49EB2B69EED10F84C171/esp32JtagTest.ino.elf...
build/gdbinit/symbols: No such file or directory.
build/gdbinit/prefix_map: No such file or directory.
build/gdbinit/connect: No such file or directory.
(gdb) break app_main
Breakpoint 1 at 0x400d31f7: file /Users/<redacted>/Library/Arduino15/packages/esp32/hardware/esp32/3.3.0/cores/esp32/main.cpp, line 89.
(gdb) mon reset halt
"monitor" command not supported by this target.
(gdb) run
Don't know how to run.  Try "help target".
(gdb) 

I think I need some pointers what build/gdbinit refers to. Is this a build-specific folder full of symbols that should be loaded? Or have those files been pre-built for the specific gdb environment?

Why the '"monitor" command not supported by this target' and the 'Don't know how to run'? What am I missing here? Do I really need to flash beforehand? Because the whole image has been generated and flashed to the SPI flash by the Arduino IDE using esptool before.

Your help is very much appreciated!

Debug Logs

see above

Expected behavior

• WDT does not reset the MCUs when OpenOCD is connected
• GDB can reset the target and start code execution

Screenshots

No response

[whitequark]

Try increasing Glasgow JTAG clock to something like 8000 or 24000.

[maehw]

Try increasing Glasgow JTAG clock to something like 8000 or 24000.

Thanks, @whitequark ! Did you suggest increasing the clock frequency as the debugging process may have been too slow?

I've tried both 8 MHz and 20 MHz as upper limit (as I am not aware of the CPU frequency right now, https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-guides/jtag-debugging/tips-and-quirks.html#optimize-jtag-speed) - and values in between.

Using 8 MHz instead of the default 100 kHz caused what I'd interpret as even more frequent resets (no more prints from the loop):

et␓a␒�ÁÚ␓rÿ¤Õ¹� 8 2016 00:22:57␍␊␍␊rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊
ets Jun  8 2016 00:22:57␍␊␍␊rst:0x8 (TG1WDT_SYS_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)␍␊configsip: 0, SPIWP:0xee␍␊clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00␍␊mode:DIO, clock div:1␍␊load:0x3fff0030,len:4980␍␊load:0x40078000,len:16612␍␊load:0x40080400,len:3480␍␊entry 0x400805b4␍␊
JTAG test␍␊another print statement␍␊

Using 20 MHz:

Open On-Chip Debugger v0.12.0-esp32-20250422 (2025-04-22-13:11)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
none separate
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:2222
Info : remote_bitbang driver initialized
Info : Note: The adapter "remote_bitbang" doesn't support configurable speed
Info : JTAG tap: esp32.tap0 tap/device found: 0x240069cb (mfg: 0x4e5 (Tecon MT), part: 0x4006, ver: 0x2)
Warn : JTAG tap: esp32.tap0       UNEXPECTED: 0x240069cb (mfg: 0x4e5 (Tecon MT), part: 0x4006, ver: 0x2)
Error: JTAG tap: esp32.tap0  expected 1 of 1: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : TAP esp32.tap1 does not have valid IDCODE (idcode=0x240069ca)
Info : JTAG tap: auto0.tap tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : JTAG tap: esp32.tap0 tap/device found: 0x240069cb (mfg: 0x4e5 (Tecon MT), part: 0x4006, ver: 0x2)
Warn : JTAG tap: esp32.tap0       UNEXPECTED: 0x240069cb (mfg: 0x4e5 (Tecon MT), part: 0x4006, ver: 0x2)
Error: JTAG tap: esp32.tap0  expected 1 of 1: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : TAP esp32.tap1 does not have valid IDCODE (idcode=0x240069ca)
Info : JTAG tap: auto0.tap tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
/Users/<redacted>/Library/Arduino15/packages/esp32/tools/openocd-esp32/v0.12.0-esp32-20250422/bin/../share/openocd/scripts/target/esp_common.cfg:9: Error: 
Traceback (most recent call last):
  File "/Users/<redacted>/Library/Arduino15/packages/esp32/tools/openocd-esp32/v0.12.0-esp32-20250422/bin/../share/openocd/scripts/target/esp_common.cfg", line 9, in script
/Users/<redacted>/Library/Arduino15/packages/esp32/tools/openocd-esp32/v0.12.0-esp32-20250422/bin/../share/openocd/scripts/target/esp_common.cfg:9: Error: 
Traceback (most recent call last):
  File "/Users/<redacted>/Library/Arduino15/packages/esp32/tools/openocd-esp32/v0.12.0-esp32-20250422/bin/../share/openocd/scripts/target/esp_common.cfg", line 9, in script
Info : remote_bitbang interface quit

I think this might be bitbang I/O errors due to bad signal integrity/shielding?

Similar behaviour for 16 MHz as for 20 MHz.

Similar behaviour for 12 MHz as for 8 MHz.

Do I need to understand what the OpenOCD configuration files for the target(s) do?

[maehw]

I've tried -f target/esp32-solo-1.cfg instead now - which shows different behaviour.

In my understanding it should be equivalent to using -c 'set ESP_ONLYCPU 1' -f target/esp32.cfg and I've also seen identical behaviour:

./openocd -c 'adapter driver remote_bitbang; transport select jtag' -c 'remote_bitbang port 2222' -c 'reset_config none' -c 'set ESP_ONLYCPU 1' -f target/esp32.cfg
Open On-Chip Debugger v0.12.0-esp32-20250422 (2025-04-22-13:11)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
none separate
1
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : Initializing remote_bitbang driver
Info : Connecting to localhost:2222
Info : remote_bitbang driver initialized
Info : Note: The adapter "remote_bitbang" doesn't support configurable speed
Info : JTAG tap: esp32.tap0 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : JTAG tap: esp32.tap1 tap/device found: 0x120034e5 (mfg: 0x272 (Tensilica), part: 0x2003, ver: 0x1)
Info : [esp32] Examination succeed
Info : [esp32] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections
Info : [esp32] Target halted, PC=0x40085B36, debug_reason=00000000
Error: [esp32] Timed out waiting for CPU to be reset, target state=2
Info : [esp32] Reset cause (52) - (Unknown reset cause)
Info : [esp32] Debug controller was reset.
Info : [esp32] Core was reset.
Info : [esp32] Target halted, PC=0x40085B36, debug_reason=00000000
Error: [esp32] Timed out waiting for CPU to be reset, target state=2
Info : [esp32] Reset cause (8) - (Main WDT1 core reset)
Info : [esp32] Debug controller was reset.
Info : [esp32] Core was reset.
Info : [esp32] Target halted, PC=0x4005D6BF, debug_reason=00000000
Error: [esp32] Timed out waiting for CPU to be reset, target state=2
Info : [esp32] Reset cause (8) - (Main WDT1 core reset)

Serial keeps spitting out:

hello from loop␍␊
hello from loop␍␊
hello from loop␍␊
hello from loop␍␊
...

So I guess this is a partial success. Now "only" need to figure out how to work with GDB.

Still curious about the WDT configuration... also when I'd like to debug some dual core executable in the future.

---

Edit:

Looks like ./xtensa-esp32-elf-gdb /private/var/folders/8f/6c1j5jjs1gxdt8vbhzg6zxq80000gn/T/arduino/sketches/812687EBCD8B49EB2B69EED10F84C171/esp32JtagTest.ino.elf plus (gdb) target remote :3333 plus (gdb) c does something. Now I could need some help figuring out what the gdbinit stuff is actually doing and whether the Arduino IDE does generate that somewhere.. or how to use it.

[whitequark]

I think this might be bitbang I/O errors due to bad signal integrity/shielding?

I think this is actually due to the specifics of the jtag-openocd applet. I think it's best to stick to 1..6 MHz TCK rates with this applet due to how it's implemented.