NRF52 RBP (Readback protection) unexpected behavior

[Farhang]

We are currently going in production with NRF52 and we are facing the following issue with RBP on NRF52832QFAAB0.

Basically looks like the processor enters an unknown state when RBP command is issued to it.

Here are the steps I take to reproduce the problem:

1. "nrfjprog -f nrf52 --recover --log" for a clean starting state.
2. "nrfjprog -f nrf52 --program programRev4.hex --verify -r --log" to program the board. At this point my program is running and I can verify by looking at advertising data on BLE.
3. "nrfjprog -f nrf52 --rbp ALL --log" stops the device from advertising. Looks like it stops my program from running.
4. Issuing a "nrfjprog -f nrf52 --reset" command (Although it reports that "the operation attempted is unavailable due to readback protection") is the only way i can get my program running. Clearly the SWD port is still open for this command to succeed. Although this seems like the solution, i would still like to know why the device halts after issuing the RBP command (step 3)

My understanding was that --rbp ALL only writes to the APPPROTECT register and that locks access to SWD port. Is that correct or are there other things that it does, possibly causing the processor core to lock up and stop the program from running?

Please find the nrfjprog log attached (i ran all commands with --log option).

Fullscreen log_rbp.log Download

--------------------------------------------------------------------------------
nrfjprog -f nrf52 --recover --log
nrfjprog verion 9.7.2
--------------------------------------------------------------------------------
FUNCTION: open_dll.
FUNCTION: open_dll.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: enum_emu_snr.
Device "NRF52832_XXAA" selected.
FUNCTION: recover.
FUNCTION: recover.
Found SW-DP with ID 0x2BA01477
Found SW-DP with ID 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
FUNCTION: close_dll.
FUNCTION: close_dll.
--------------------------------------------------------------------------------
nrfjprog -f nrf52 --program programRev4.hex --verify -r --log
nrfjprog verion 9.7.2
--------------------------------------------------------------------------------
FUNCTION: open_dll.
FUNCTION: open_dll.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: enum_emu_snr.
Device "NRF52832_XXAA" selected.
FUNCTION: read_device_version.
FUNCTION: read_device_version.
Found SW-DP with ID 0x2BA01477
Found SW-DP with ID 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
FUNCTION: readback_status.
FUNCTION: readback_status.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: power_ram_all.
FUNCTION: power_ram_all.
FUNCTION: read_region_0_size_and_source.
FUNCTION: read_region_0_size_and_source.
FUNCTION: disable_bprot.
FUNCTION: disable_bprot.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: write.
FUNCTION: is_qspi_init.
FUNCTION: is_qspi_init.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: read.
FUNCTION: is_qspi_init.
FUNCTION: is_qspi_init.
FUNCTION: sys_reset.
FUNCTION: sys_reset.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
FUNCTION: go.
FUNCTION: go.
FUNCTION: close_dll.
FUNCTION: close_dll.
--------------------------------------------------------------------------------
nrfjprog -f nrf52 --rbp ALL --log
nrfjprog verion 9.7.2
--------------------------------------------------------------------------------
FUNCTION: open_dll.
FUNCTION: open_dll.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: enum_emu_snr.
Device "NRF52832_XXAA" selected.
FUNCTION: read_device_version.
FUNCTION: read_device_version.
Found SW-DP with ID 0x2BA01477
Found SW-DP with ID 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
FUNCTION: readback_protect.
FUNCTION: readback_protect.
FUNCTION: connect_to_emu_with_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: enum_emu_snr.
Device "NRF52832_XXAA" selected.
FUNCTION: close_dll.
FUNCTION: close_dll.
--------------------------------------------------------------------------------
nrfjprog -f nrf52 -r --log
nrfjprog verion 9.7.2
--------------------------------------------------------------------------------
FUNCTION: open_dll.
FUNCTION: open_dll.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: enum_emu_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: connect_to_emu_without_snr.
FUNCTION: enum_emu_snr.
Device "NRF52832_XXAA" selected.
FUNCTION: read_device_version.
FUNCTION: read_device_version.
FUNCTION: close_dll.
FUNCTION: close_dll.

[Simen August Tinderholt]

Hi, is the device permanently halted, or does it come back after a while? 

Although it is not strictly necessary for readback_protect, it halts the device to ensure data integrity while writing.

The procedure is finalized with a debug_reset to load the changes, this should also have released your device.

[Farhang]

It is permanently halted.

So you're saying that "nrfjprog -f nrf52 --rbp ALL" already performs a debug_reset at the end?
What is your source of information? I tried to find the source code for nrfjprog but no luck yet.

[Sigurd]

Hi Farhang,

Thank you for this bug report. I see the same behavior as you describe. This is not the intended behavior and it have been reported internally. I will let you know when a new version with a fix have been released.

Best regards,

Sigurd