March 13, 2026

Using OpenOCD to dump the RP2040 bootrom

OpenOCD worked fine for me back in 2023, then I got a bunch of weird errors in 2026, then it suddenly began working just fine.
Who knows?

I am using OpenOCD from the Fedora package.

The weird error 

Error: [rp2040.cpu] Could not find MEM-AP to control the core
You can search on this and find a variety of more or less useless information. Before I sorted it all out, things began working. Sort of.

Version number negligence

I ran into this back in 2023, and now 3 years later, it is still an issue. OpenOCD reports its version number as 0.12.0. It always has and probably always will. In other words the version number is totally meaningless, useless, and entirely worthless.

For all we know, the Fedora package building machinery may be packaging a version of OpenOCD from 1982 and will continue to do so until it detects a version number change. The bottom line is that the version number is misleading and useless. Someone should be punished.

Just dump the ROM -- 3-13-2026

I have "picoprobe" firmware in one pico and am using it to debug another.
I do this to start openocd: 
openocd -f interface/cmsis-dap.cfg -c "adapter speed 5000" -f target/rp2040.cfg -s tcl
We do this and see all of this: 
Open On-Chip Debugger 0.12.0
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
adapter speed: 5000 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : Using CMSIS-DAPv2 interface with VID:PID=0x2e8a:0x000c, serial=E6616407E36C3227
Info : CMSIS-DAP: SWD supported
Info : CMSIS-DAP: Atomic commands supported
Info : CMSIS-DAP: Test domain timer supported
Info : CMSIS-DAP: FW Version = 2.0.0
Info : CMSIS-DAP: Interface Initialised (SWD)
Info : SWCLK/TCK = 0 SWDIO/TMS = 0 TDI = 0 TDO = 0 nTRST = 0 nRESET = 0
Info : CMSIS-DAP: Interface ready
Info : clock speed 5000 kHz
Info : SWD DPIDR 0x0bc12477, DLPIDR 0x00000001
Info : SWD DPIDR 0x0bc12477, DLPIDR 0x10000001
Info : [rp2040.core0] Cortex-M0+ r0p1 processor detected
Info : [rp2040.core0] target has 4 breakpoints, 2 watchpoints
Info : [rp2040.core1] Cortex-M0+ r0p1 processor detected
Info : [rp2040.core1] target has 4 breakpoints, 2 watchpoints
Info : starting gdb server for rp2040.core0 on 3333
Info : Listening on port 3333 for gdb connections
Info : starting gdb server for rp2040.core1 on 3334
Info : Listening on port 3334 for gdb connections
Info : accepting 'telnet' connection on tcp/4444
Of particular interest in the above are these lines: 
Info : [rp2040.core0] Cortex-M0+ r0p1 processor detected
Info : [rp2040.core0] target has 4 breakpoints, 2 watchpoints
Info : [rp2040.core1] Cortex-M0+ r0p1 processor detected
Info : [rp2040.core1] target has 4 breakpoints, 2 watchpoints
These demonstrate that OpenOCD has correctly discovered the RP2040.
Next I do this: 
telnet localhost 4444
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> reset halt
[rp2040.core0] halted due to debug-request, current mode: Thread
xPSR: 0xf1000000 pc: 0x000000ee msp: 0x20041f00
[rp2040.core1] halted due to debug-request, current mode: Thread
xPSR: 0xf1000000 pc: 0x000000ee msp: 0x20041f00
> dump_image bootrom.bin 0 0x4000
dumped 16384 bytes in 0.173681s (92.123 KiB/s)
This give me the file "bootrom.bin" -- which in this case contains a binary image of the on chip bootrom in the RP2040 -- the very thing that got me started doing all of this in the first place.

Have any comments? Questions? Drop me a line!

Tom's software pages / tom@mmto.org