Skip to content

Instantly share code, notes, and snippets.

@mpater

mpater/unlock nrf52.md

Last active January 9, 2023 22:20
Show Gist options
  • Save mpater/749652b007db3337292b436327a162ec to your computer and use it in GitHub Desktop.
Save mpater/749652b007db3337292b436327a162ec to your computer and use it in GitHub Desktop.
Download ZIP
unlocking nRF52 with bluepill and STLinkV2
Raw
unlock nrf52.md

Flash DAPlink onto NUCLEO STLink v2

Had a NUCELO-F302R8 around, used it for the onboard STLink v2.
Broke out 'reserved' programming pins (SB4, SB6, SB8 and SB10) for SWD. Connected to STLink v2 clone.
Programmed DAPlink bootloader (stm32f103xb_bl_crc.bin) to 0x8000000 and firmware (0257_stm32f103xb__0x0000.bin) to 0x800C000.
Kept going into bootloader, jumpered 'button' (CN4-pin5 to JP1-pin1).
lsusb shows 'NXP ARM mbed' (okay text bug but works!).
Fired up 'opocd', installed 'nrf52' package.

$ pyocd commander --target nrf52 -O auto_unlock
0000611 W NRF52832 APPROTECT enabled: will try to unlock via mass erase [target_nRF52]
Connected to NRF52832 [Lockup]: 00000080066aff544949838281164947a5a5a5a597969908
pyocd> status
Core 0:  Lockup
pyocd> readap 1 0x00C
AP register 0x100000c = 0x00000001
pyocd> read32 0x10000000
10000000:  55aa55aa                               |U.U.|
pyocd> read32 0x10000104
10000104:  41414630                               |AAF0|
pyocd> read32 0x10000108
10000108:  00002004                               |.. .|
pyocd> read32 0x10000100
10000100:  00052840                               |..(@|

AAF0

SoC revisions and variants matrix of build code AAF0-> F0-> nRF52840 SoC revision 3.
SDK and SoftDevices compatibility:

item VESC nRF52 new rev
nRF5 SDK 15.3.0 17.1.0
S140 SD 6.1.1 7.2.0

Previous revs only work with hardware revision 1 and 2, new one is revision 3.

Old way that was unclear if it worked. Keped for reference.

  1. Load STLinkV2 with stock firmware Update STLinkV2 with stsw-link007 back to stock/latest stsw-link007. Run with java -jar STLinkUpgrade.jar. PC to STLinkV2 via USB.

  2. Flash bluepill with CMSIS-DAP Flash Bluepill using STLinkV2 via swd port. Get STM32-DAP. Use STM32CubeProgrammer to flash f103_cmsis_dap.hex. Programmer knows how to flash hex vs usual bin.

  3. Flash nRF52 with bluepill PC via USB to bluepill. Bluepill via swd to nRF52. A4: SWDIO; A5: SWCLK Get openOCD with cmsis-dap enabled (either compile with CMSIS-DAP option or pre-comiled from xpack). ./openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/nrf52.cfg -c "init;nrf52_recover" You will see "Warning" and AP lock enagned then nrf52.cpu device has been successfully erased and unlocked.

Unlock

xpack-openocd-0.11.0-1/bin$ ./openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/nrf52.cfg -c "init;nrf52_recover"
xPack OpenOCD, x86_64 Open On-Chip Debugger 0.11.0-00155-ge392e485e (2021-03-15-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
swd
Info : CMSIS-DAP: SWD  Supported
Info : CMSIS-DAP: FW Version = 1.0
Info : CMSIS-DAP: Interface Initialised (SWD)
Info : SWCLK/TCK = 1 SWDIO/TMS = 1 TDI = 0 TDO = 0 nTRST = 0 nRESET = 0
Info : CMSIS-DAP: Interface ready
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x2ba01477
Error: Could not find MEM-AP to control the core
****** WARNING ******
nRF52 device has AP lock engaged (see UICR APPROTECT register).
Debug access is denied.
Use 'nrf52_recover' to erase and unlock the device.

Warn : target nrf52.cpu examination failed
Info : starting gdb server for nrf52.cpu on 3333
Info : Listening on port 3333 for gdb connections
Waiting for chip erase...
nrf52.cpu device has been successfully erased and unlocked.
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Error: nrf52.cpu -- clearing lockup after double fault
Polling target nrf52.cpu failed, trying to reexamine
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
^Cshutdown command invoked

verify

xpack-openocd-0.11.0-1/bin$ ./openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/nrf52.cfg
xPack OpenOCD, x86_64 Open On-Chip Debugger 0.11.0-00155-ge392e485e (2021-03-15-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
swd
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : CMSIS-DAP: SWD  Supported
Info : CMSIS-DAP: FW Version = 1.0
Info : CMSIS-DAP: Interface Initialised (SWD)
Info : SWCLK/TCK = 1 SWDIO/TMS = 1 TDI = 0 TDO = 0 nTRST = 0 nRESET = 0
Info : CMSIS-DAP: Interface ready
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x2ba01477
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : starting gdb server for nrf52.cpu on 3333
Info : Listening on port 3333 for gdb connections
^Cshutdown command invoked

notes

Having JLlink via nRF52840 DK from farnell would be simplest.

nordic thread outlines issue and how to disable via JLink.

Others shared same issue with openOCD, like this write up.

openOCD and nF52

CMSIS-DAP on STM32F103 not sure of pinout but hex files for STLinkV2 and bluepill.

hex vs bin file

st-flash $ st-flash write firmware.bin 0x8000000

nrfmico great readthrough, same issue.

stlink-tool bin flasher, not hex?

gdb commands

nrfjprog

matt@matt-ThinkPad-X1-Carbon-3rd:~/Programs/xpack-openocd-0.11.0-1/bin$ ./openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/nrf52.cfg -c "init;nrf52_recover" -c "program /home/matt/Programs/nRF5_SDK_15.3.0_59ac345/components/softdevice/s140/hex/s140_nrf52_6.1.1_softdevice.hex verify reset exit"
xPack OpenOCD, x86_64 Open On-Chip Debugger 0.11.0-00155-ge392e485e (2021-03-15-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
swd
Info : CMSIS-DAP: SWD  Supported
Info : CMSIS-DAP: FW Version = 1.0
Info : CMSIS-DAP: Interface Initialised (SWD)
Info : SWCLK/TCK = 1 SWDIO/TMS = 1 TDI = 0 TDO = 0 nTRST = 0 nRESET = 0
Info : CMSIS-DAP: Interface ready
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x2ba01477
Error: Could not find MEM-AP to control the core
****** WARNING ******
nRF52 device has AP lock engaged (see UICR APPROTECT register).
Debug access is denied.
Use 'nrf52_recover' to erase and unlock the device.

Warn : target nrf52.cpu examination failed
Info : starting gdb server for nrf52.cpu on 3333
Info : Listening on port 3333 for gdb connections
Waiting for chip erase...
nrf52.cpu device has been successfully erased and unlocked.
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
Error: nrf52.cpu -- clearing lockup after double fault
Polling target nrf52.cpu failed, trying to reexamine
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0xfffffffe msp: 0xfffffffc
** Programming Started **
Info : nRF52840-xxAA(build code: F0) 1024kB Flash, 256kB RAM
Info : Padding image section 0 at 0x00000b00 with 1280 bytes
Warn : Adding extra erase range, 0x00025de8 .. 0x00025fff
** Programming Finished **
** Verify Started **
** Verified OK **
** Resetting Target **
shutdown command invoked

matt@matt-ThinkPad-X1-Carbon-3rd:~/Programs/xpack-openocd-0.11.0-1/bin$ ./openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/nrf52.cfg -c "init" -c "program /home/matt/Programs/nrf52_vesc/build_all/nrf52840_vesc_ble_rx29_tx31_led6.bin verify reset exit"
xPack OpenOCD, x86_64 Open On-Chip Debugger 0.11.0-00155-ge392e485e (2021-03-15-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
swd
Info : CMSIS-DAP: SWD  Supported
Info : CMSIS-DAP: FW Version = 1.0
Info : CMSIS-DAP: Interface Initialised (SWD)
Info : SWCLK/TCK = 1 SWDIO/TMS = 1 TDI = 0 TDO = 0 nTRST = 0 nRESET = 0
Info : CMSIS-DAP: Interface ready
Info : clock speed 1000 kHz
Info : SWD DPIDR 0x2ba01477
Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : starting gdb server for nrf52.cpu on 3333
Info : Listening on port 3333 for gdb connections
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0x00000a80 msp: 0x20000400
** Programming Started **
Info : nRF52840-xxAA(build code: F0) 1024kB Flash, 256kB RAM
Warn : Adding extra erase range, 0x0003502c .. 0x00035fff
** Programming Finished **
** Verify Started **
** Verified OK **
** Resetting Target **
shutdown command invoked



nRF52840 dongle: led pin:p6; tx

SDK_ROOT := /home/matt/Programs/nRF5_SDK_15.3.0_59ac345
SD_PATH := $(SDK_ROOT)/components/softdevice/s140/hex/s140_nrf52_6.1.1_softdevice.hex

openocd -f openocd.cfg -c "init" -c "halt" -c "nrf5 mass_erase" -c "exit"
openocd -f openocd.cfg -c "program $(SD_PATH) verify reset exit"
openocd -f openocd.cfg -c "program $(TARGET_PATH) verify reset exit"
endif
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment