List all connected CMSIS-DAP debug probes. Call this first to discover available probes.

Get detailed information about a specific debug probe.

Connect to a debug probe and open a debug session. Must be called before any target/register/memory operations. Only one session can be active at a time.

Close the current debug session and release the probe.

Check if a debug session is active and get connection info.

Program a firmware file (.hex/.bin/.elf) to the target flash. For armclang-compiled firmware, prefer .hex format to avoid ELF compatibility issues. When programming a .elf or .axf file, automatically attaches it for symbol resolution. Sends progress notifications to prevent AI client timeouts during programming.

Erase the target flash memory (chip erase or sector erase). Sends progress notifications to prevent AI client timeouts.

Verify the target's Flash content matches a firmware file. Reads Flash and compares segment by segment. Supports .hex, .bin, .elf, and .axf formats. Returns verified:true if match, or first mismatch address if different. Sends progress notifications to prevent AI client timeouts during verification.

Halt (pause) the target CPU immediately. Returns current PC.

Single-step the target CPU. Target must be halted first.

Resume target execution (run until next breakpoint or halt).

Reset the target MCU. By default resets and halts at the entry point.

Get current target state (halted/running) and key registers if halted.

Read a CPU core register by name (e.g. 'pc', 'sp', 'r0', 'xpsr').

Write a value to a CPU core register.

Read all CPU core registers at once. Useful for getting full CPU state.

Read memory at a given address. Returns hex value.

Write a value to memory at a given address.

Write a block of bytes to memory.

Dump memory in hex dump format (address, hex bytes, ASCII). Useful for inspecting data structures.

Set a hardware breakpoint at an address or symbol name (requires ELF). Supports hw (hardware), sw (software), or auto breakpoint types. Software breakpoints survive across more addresses but are lost on reset; hardware breakpoints are limited in number but don't modify flash.

Remove a breakpoint at an address or symbol.

Remove all active breakpoints.

List all active breakpoints.

Attach an ELF file for symbol resolution. Enables using function names for breakpoints and provides richer debug info. Note: For flashing, prefer .hex format over .elf for armclang compatibility.

List symbols (functions/variables) from the attached ELF file.

Look up a symbol's address by name.

Get information about the attached ELF file (arch, entry point, sections).

Resolve a memory address to its symbol name (function or variable). Essential for interpreting PC, LR, and stack return addresses during debugging. Returns function name + offset (e.g. 'main+0x1A').

Attach an SVD file for peripheral register access. SVD files describe the register layout of MCU peripherals (GPIO, UART, SPI, etc).

List all peripherals defined in the attached SVD file.

List all registers of a specific peripheral.

Read a peripheral register by name. Returns value with bit-field decoding. Example: pyocd.svd.read('GPIOA', 'IDR') to read GPIO input data register.

Write a value to a peripheral register by name.

List all bit fields of a peripheral register, showing name, bit range, width, and description.

Set a single bit field of a peripheral register using read-modify-write. Only the specified field is changed; other fields are preserved. Example: set_field('GPIOA', 'MODER', 'MODER0', 1) sets pin 0 to output mode.

Set multiple bit fields of a register in a single read-modify-write. Accepts a dict mapping field names to integer values or enum name strings. All fields are updated atomically. Example: update_fields('GPIOA', 'MODER', {'MODER0': 1, 'MODER1': 2})

Return full description of a peripheral or specific register. Without register_name, lists all registers with descriptions. With register_name, shows all fields with bit ranges, descriptions, and enumerated values.

Set a hardware watchpoint (data breakpoint). Triggers a halt when the target reads/writes a specific memory address. Essential for catching wild pointers, buffer overflows, and unexpected memory writes. Cortex-M4 typically has 4 DWT comparators available.

Remove a watchpoint at the given address.

Remove all active watchpoints.

List all active watchpoints.

Resume target execution and wait for it to halt (breakpoint hit, watchpoint triggered, or manual halt). This is the KEY tool for 'set breakpoint → run → wait for hit → inspect' debugging workflow. Returns halt reason, PC, and registers when the target stops. Sends progress notifications to prevent AI client timeouts during long waits. Automatically includes a compact backtrace (top 4 frames) showing the call chain when halted. Also detects CPU LOCKUP state (double fault) immediately.

Analyze a HardFault/BusFault/MemManage/UsageFault/SecureFault crash. Reads all SCB fault registers, decodes fault bits, reads the exception stack frame to find the fault PC (crash address) and caller LR. Also decodes EXC_RETURN for FPU/MSP/PSP context. Call this when target is halted in a fault handler.

Check if a thread's stack has overflowed by comparing SP against the TCB's stack bounds. For RT-Thread: provide TCB address, offsets default to 0x24 (stack_addr) and 0x28 (stack_size). Reports usage percentage and watermark integrity.

Periodically sample a memory location (global variable). Reads a variable every N seconds for M samples while target is running. Returns all samples with timestamps and statistics. Sends progress notifications to prevent AI client timeouts during long sampling sessions.

List all MCU targets supported by pyocd (206+ built-in targets). Includes HC32, STM32, NXP, Nordic, Cypress and more. Use filter_text to search (e.g. 'hc32', 'stm32f4').

Read a global variable's value by symbol name. Combines ELF symbol lookup and memory read in one call. Returns address, raw bytes, and interpreted value. For structs/arrays, returns a hex dump.

Execute until the current function returns (step out). Sets a temporary breakpoint at the LR (return address), resumes, waits for the breakpoint hit, then cleans up. Returns the new position after returning from the function.

Perform precise stack backtrace to show the full call chain. Uses DWARF CFI (.debug_frame) or EHABI (.ARM.exidx) for frame-accurate unwinding across all ARM toolchains (AC5/AC6/GCC). Falls back to heuristic stack scanning with BL validation if precise unwinding fails. Returns ordered frames: depth 0 = current PC, deeper = callers. Essential for understanding HOW code reached the current point.

Start RTT (Real-Time Transfer) and discover channels. Searches target RAM for the SEGGER RTT control block. Returns up/down channel names and sizes. Target must be halted or have RTT initialized.

Stop RTT and release resources.

Read data from an RTT up channel. Returns text (decoded) and hex. Non-blocking: returns empty if no data available.

Write data to an RTT down channel. The data string is encoded before sending. Returns bytes written.

Get RTT status: running/stopped, channel info, bytes available.

Load project debug configuration from .pyocd-debug.json, or auto-discover firmware/ELF/SVD files if no config exists. Call this FIRST before any debug session to get file paths. Returns target type, firmware path, ELF path, SVD path, and probe ID.

Create .pyocd-debug.json config file in a project directory. Stores target type, firmware, ELF, SVD, and probe paths so that debug sessions can be started reliably without manual file discovery. Paths under the project directory are automatically converted to relative paths.

Attach a built-in SVD from pyocd's bundled svd_data.zip as a TEMPORARY fallback. ⚠️ Built-in SVDs are generic/simplified versions that may lack peripheral definitions specific to your exact chip variant/package. STRONGLY RECOMMENDED: use a vendor-provided SVD file via pyocd_svd_attach() instead. Only use this as a last resort when no vendor SVD is available. Extracts the SVD to a temp directory and attaches it.