Cannot connect Segger RTT to custom board after reset

RE: Cannot connect Segger RTT to custom board after reset

RRWC — Tue, 18 Jul 2023 14:36:49 GMT

Hello Hung Bui,

You figured it out. What happened was basically:

The code was first deployed to the nRF52833 Development Kit.
The chip in the Development kit have the improved APPROTECT. In order to use it in Debug mode I updated both firmware and flashing process to ensure that 5A is written to address 0x10001208.
I received samples of the new custom board. The samples use an older version of the nRF52833 without the improved APPROTECT.
I didn't noticed that the chip in the custom board has the old version of APPROTECT. I also misunderstood that writing 5A to the 0x10001208 register would keep the chip unprotected even in the old APPROTECT version.

I removed all steps in both firmware and flashing process that ensures 5A written to 0x10001208 in debug mode and also ensured that 0xFFFFFFFF is written to it instead. Now I am able to debug and use Segger RTT perfectly in the custom board.

Thank you for all your help.

RE: Cannot connect Segger RTT to custom board after reset

Hung Bui — Mon, 17 Jul 2023 13:33:34 GMT

Hi RRWC,

It seems that the chip on your board is version 1 (build code A0 N52833QDAAA02214AF ) when the chip on the DK is version 2 (build code B0: N52833QIAAB02116AA)

https://infocenter.nordicsemi.com/topic/comp_matrix_nrf52833/COMP/nrf52833/nRF52833_ic_revision_overview.html?cp=5_1_3_0

If you take a look at the spec you will find that in version 1 of the chip has older version of APPROTECT.

In version 1 of the chip,UICR.APPROTECT (0x10001208) should be 0xFFFFFFFF to disable APPROTECT. In your case it was written 0xFFFFFF5A. This cause the chip to be protected.

We need to figure out what written 0xFFFFFF5A to the register
I did a quick test with the blinky example here and don't see that it's being written, 0x10001208 still 0xFFFFFFFF.

Could you double check to see at which point it's being written ? Try the following step by step:

1. Recover the chip using nrfjprog --recover

2. Read 0x10001208

3. Power reset

3. Read 0x10001208

5. Flash the blinky example, make sure the board is blinking

6. Read 0x10001208

7. Do a power reset

8. Read 0x10001208

I attached here my blinky hex file that works on the DK.

devzone.nordicsemi.com/.../blinky_5F00_pca10100e.hex

RE: Cannot connect Segger RTT to custom board after reset

RRWC — Fri, 14 Jul 2023 17:37:48 GMT

Hello Hung Bui,

Below are the requested information:

Reading UICR APPROTECT (addr 0x10001208)

This is the output of flashing the device and reading 0x10001208 in the development Kit (reading was done once before the nrfjprog -r and once after with the firmware running):

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --recover
Recovering device. This operation might take 30s.
Erasing user code and UICR flash areas.
Writing image to disable ap protect.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --eraseall
Erasing user available code and UICR flash areas.
Applying system reset.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --program ready.hex --verify
[ #################### ]   4.150s | Program file - Done programming
[ #################### ]   4.053s | Verify file - Done verifying

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memwr 0x0007FFF8 --val 0x00006B43
Parsing parameters.
Writing.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memwr 0x0007FFFC --val 0xFFFFEE00
Parsing parameters.
Writing.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memrd 0x10001208
0x10001208: 0000005A                              |Z...|

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog -r
Applying system reset.
Run.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memrd 0x10001208
0x10001208: 0000005A                              |Z...|

Now same test flashing the custom board:

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --recover
Recovering device. This operation might take 30s.
Erasing user code and UICR flash areas.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --eraseall
Erasing user available code and UICR flash areas.
Applying system reset.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --program ready.hex --verify
[ #################### ]   4.175s | Program file - Done programming
[ #################### ]   4.088s | Verify file - Done verifying

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memwr 0x0007FFF8 --val 0x00006B44
Parsing parameters.
Writing.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memwr 0x0007FFFC --val 0xFFFFEE00
Parsing parameters.
Writing.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memrd 0x10001208
0x10001208: FFFFFF5A                              |Z...|

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog -r
Applying system reset.
Run.
[error] [ Client] - Encountered error -90: Command go executed for 15 milliseconds with result -90
[error] [ Worker] - Access protection is enabled, can't start device.
ERROR: The operation attempted is unavailable due to readback protection in
ERROR: your device. Please use --recover to unlock the device.
NOTE: For additional output, try running again with logging enabled (--log).
NOTE: Any generated log error messages will be displayed.

C:\Users\Ricardo\Documents\Temp\Testes\ready>nrfjprog --memrd 0x10001208
[error] [ Worker] - Access protection is enabled, can't read device version.
[error] [ Client] - Encountered error -90: Command read_device_info executed for 15 milliseconds with result -90
[error] [ Client] - Encountered error -90: Command read_memory_descriptors executed for 14 milliseconds with result -90
[error] [ Worker] - Can't read memory descriptors, ap-protection is enabled.
[error] [ Client] - Encountered error -90: Command read executed for 371 milliseconds with result -90
[error] [ Worker] - Access protection is enabled, can't access memory.
ERROR: The operation attempted is unavailable due to readback protection in
ERROR: your device. Please use --recover to unlock the device.
NOTE: For additional output, try running again with logging enabled (--log).
NOTE: Any generated log error messages will be displayed.

The firmware file is exactly the same and as you can see in the code snippets above I used exactly the same commands in both cases.

Notice that in the DK, after the nrfjprog --recover command, the message "Writing image to disable ap protect." is displayed automatically. I don't know why, but this doesn't happens when recovering the custom board. I believe that this automatic disable of ap protect explains why the DK returned 0x000005A and the custom board returned 0xFFFFF5A at address 0x10001208. However in both cases the "0x5A" is correctly read at it's position before the nrfjprog -r command.

Laser markings

Development Kit: N52833QIAAB02116AA
Custom board: N52833QDAAA02214AF

Behaviour after power reset

After power reset the debug connection with the development kit is lost for some time (log from Segger RTT bellow)

LOG: J-Link RTT Viewer V7.88k: Logging started.
LOG: Terminal 0 added.
LOG: Connecting to J-Link via USB...
LOG: Device "NRF52833_XXAA" selected.
LOG: InitTarget() start
LOG: InitTarget() end - Took 14us
LOG: Found SW-DP with ID 0x2BA01477
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Attach to CPU failed. Executing connect under reset.
LOG: Failed to power up DAP
LOG: Connect fallback: Reset via Reset pin & Connect.
LOG: InitTarget() start
LOG: InitTarget() end - Took 4us
LOG: Found SW-DP with ID 0x2BA01477
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Attach to CPU failed. Executing connect under reset.
LOG: Failed to power up DAP
ERROR: Could not connect to target device.

However if I try dozens of seconds later the connection works normally again:

LOG: Connecting to J-Link via USB...
LOG: Device "NRF52833_XXAA" selected.
LOG: InitTarget() start
LOG: InitTarget() end - Took 9us
LOG: Found SW-DP with ID 0x2BA01477
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: AHB-AP (IDR: 0x24770011)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Core found
LOG: AP[0]: AHB-AP ROM base: 0xE00FF000
LOG: CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
LOG: Found Cortex-M4 r0p1, Little endian.
LOG: FPUnit: 6 code (BP) slots and 2 literal slots
LOG: CoreSight components:
LOG: ROMTbl[0] @ E00FF000
LOG: [0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
LOG: [0][1]: E0001000 CID B105E00D PID 003BB002 DWT
LOG: [0][2]: E0002000 CID B105E00D PID 002BB003 FPB
LOG: [0][3]: E0000000 CID B105E00D PID 003BB001 ITM
LOG: [0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
LOG: [0][5]: E0041000 CID B105900D PID 000BB925 ETM
LOG: RTT Viewer connected.

The behavior in the custom board is different. The message remains the same regardless of how much time passed after the power reset:

LOG: J-Link RTT Viewer V7.88k: Logging started.
LOG: Terminal 0 added.
LOG: Connecting to J-Link via USB...
LOG: Device "NRF52833_XXAA" selected.
LOG: InitTarget() start
LOG: InitTarget() end - Took 16us
LOG: Found SW-DP with ID 0x2BA01477
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Attach to CPU failed. Executing connect under reset.
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Could not find core in Coresight setup
LOG: Connect fallback: Reset via Reset pin & Connect.
LOG: InitTarget() start
LOG: InitTarget() end - Took 4us
LOG: Found SW-DP with ID 0x2BA01477
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Attach to CPU failed. Executing connect under reset.
LOG: DPIDR: 0x2BA01477
LOG: CoreSight SoC-400 or earlier
LOG: Scanning AP map to find all available APs
LOG: AP[2]: Stopped AP scan as end of AP map has been reached
LOG: AP[0]: JTAG-AP (IDR: 0x23000000)
LOG: AP[1]: JTAG-AP (IDR: 0x02880000)
LOG: Iterating through AP map to find AHB-AP to use
LOG: AP[0]: Skipped. Not an AHB-AP
LOG: AP[1]: Skipped. Not an AHB-AP
LOG: Could not find core in Coresight setup
ERROR: Could not connect to target device.

No debug is possible with the custom board.

RE: Cannot connect Segger RTT to custom board after reset

Hung Bui — Fri, 14 Jul 2023 08:40:18 GMT

Hi RRWC,

I'm running out of idea on why the issue happen on your board but not the DK.

Could you please read the laser marking on the chip on the nRF52833 DK you have and the laser marking on the chip on your board ?

Instead of doing nrfjprog -r could you try doing a power reset with the DK ?

Before you trigger a reset, could you read the UICR APPROTECT register at address 0x10001208 ?
nrfjprog --memrd 0x10001208

On both the DK and your board.

RE: Cannot connect Segger RTT to custom board after reset

RRWC — Thu, 13 Jul 2023 18:34:15 GMT

Hello Hung Bui.

I tested "ble_app_hids_keyboard_pca10100_s140" in debug. I chose this specific project only because it was the first example I found with project ready for PCA10100.

The behavior remains the same in both my custom board and DK:

In my custom board as soon as nrfjprog -r is received I lose debug connection. Advertising is normal.
In the nRF52833 DK debug still working after nrfjprog -r. Advertising is also normal.

RE: Cannot connect Segger RTT to custom board after reset

Hung Bui — Thu, 13 Jul 2023 08:09:35 GMT

Hi RRWC,

Please try testing an unmodified example from the SDK on your custom board. For example the RTC project, or a BLE project.

Make sure you do a nrfjprog --recover before you flash the application.

RE: Cannot connect Segger RTT to custom board after reset

RRWC — Wed, 12 Jul 2023 20:18:58 GMT

Hello Hung Bui,

Clarifying the behavior:

Flash my custom application in nRF52833 DK (PCA10100 -> N52833QIAAB02116AA):

Firmware operates normally (cannot find one device via I2C because the device is absent, but OK)
nrfjprog -r reports no error.
It is possible to connect and debug using Segger RTT
It is possible to send other commands using nrfjprog (ex. nrfjprog --memrd <addr>)

Flash my custom application (exactly the same from above) in nRF52833 custom board (N52833QDAAA02214AF):

Firmware appears to operate normally (at least from what I can test using BLE).
nrfjprog -r reports error on the last step of firmware flashing (screenshot in the original post)
It is not possible to connect nor debug using Segger RTT
It is not possible to send other commands using nrfjprog (except nrfjprog --recover, which works fine). All other commands report APPROTECT enabled.

Regarding nrf52_handle_approtect(), it is called from system_nrf52.c which is included in the project. I also tried calling it from my main, but with no change in the behavior.

I'm not sure if it's an APPROTEC issue, but I couldn't find anything else in all the tests I performed. If it is an firmware issue I cant understand why it works fine with the nRF52833 in the development kit.

It is also important to notice that if I flash the release version of the firmware (which defines ENABLE_APPROTECT) the nRF52833 development kit stops providing debug interface (as expected). The only diference is that no error message is displayed after the nrfjprog -r issued at the end of the flashing process (however if I try a second nrfjprog -r after the first one it fails, as expected for release version).

RE: Cannot connect Segger RTT to custom board after reset

Hung Bui — Wed, 12 Jul 2023 15:35:58 GMT

Hi RRWC,

Could you please clarify, if you flash an application in our SDK for example RTC , can you still start debugging after power reset ?

From what you described I haven't seen how you disable APPROTECT from the firmware.
By default it's handled automatically by this code in system_nrf52_approtect.h :

Meaning the firmware need to write to NRF_APPROTECT->DISABLE to disable approtect.

I am not sure if your code has nrf52_handle_approtect() called or not. (it by default called inside SystemInit in system_nrf52.c

It's explained by the spec here: