Failure to eraseall via NVMC access from segger JLink

[OwainIncus]

I am working on some production scripting and as I want this to be able to run under both windows and linux I have been trying to erase all the NRF52840 using NVMC accesses rather than nrfjprog;.

Till now I have always used nrfjprog to do this eraseall and it works fine.

I write the NVMC config with erase enable followed by erase to the eraseall register; but on reset of go the device just comes up like nothing has been erased.
What Am I doing wrong?

J-Link>halt
PC = 0003E5BE, CycleCnt = C91BFE9B
R0 = 00000000, R1 = 20002D88, R2 = 00000273, R3 = 00000000
R4 = 20001380, R5 = 00001000, R6 = 10001000, R7 = 000FE000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 20003A50
SP(R13)= 2003FE50, MSP= 2003FE50, PSP= 00000000, R14(LR) = 00027169
XPSR = 61000000: APSR = nZCvq, EPSR = 01000000, IPSR = E7805800000000 (d±Å)
CFBP = 04000000, CONTROL = 04, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPS0 = 41C80000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 41C80000, FPS14= 00000000, FPS15= 00000000
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 00000000
J-Link>w4 4001e504 2
Writing 00000002 -> 4001E504
J-Link>w4 4001e50c 1
Writing 00000001 -> 4001E50C
J-Link>go
J-Link>

[OwainIncus]

I also found this and have tried it; same result. My device does the NVMC writes; but then resets and runs. Device has not been erased.

https://github.com/ssfrr/nrfjprog.sh

Whats going on? NRF52840 does not support some kind of protection I must turn off?
Dual bank?

????

[Håkon Alseth]

Hi,

 

This sequence should work:

halt
w4 4001e504 2
w4 4001e50c 1
r

Here's my JLink Commander screenshot of the progress:

 

An alternative is to run the "recover" mechanism, which is for nrf9160, posted here: https://devzone.nordicsemi.com/f/nordic-q-a/60813/nrf9160-ctrl-ap-access-using-j-link-commander-gdb

This is the "ported" to nRF52 (Access port only changed) :

SWDSelect   // Activate SWD
SWDWriteDP 1 0x50000000  // Enable debug power
SWDWriteDP 2 0x01000000  // Selects the 0x01XXXXXX Access Port and 0xXXXX00XX Register bank in the access port
SWDWriteAP 1 0x00000001  // CTRL-AP Bank 0, register offset 1 (ERASEALL 0x004): Erase all command

SWDReadAP 2 // CTRL-AP Bank 0, register offset 2 (ERASEALLSTATUS 0x008): Erase all command status
SWDReadAP 2 // Must read twice to get the value.

// Wait a good amount of time, so eraseall process is done.
sleep 500

// Perform a pin reset
r0
sleep 10
r1
sleep 10

SWDSelect   // Activate SWD
SWDWriteDP 1 0x50000000  // Enable debug power
SWDWriteDP 2 0x01000000  // Selects the 0x01XXXXXX Access Port and 0xXXXX00XX Register bank in the access port

SWDReadAP 3 // CTRL-AP Bank 0, register offset 3 (APPROTECTSTATUS 0x00C): Access port protection status
SWDReadAP 3 // //Second read returns the value: 0: enabled 1: not enabled

exit

 

Here's a screenshot of the above recover script sequence (note: device is power cycled after nrfjprog --rbp is called):

 

Kind regards,

Håkon

[OwainIncus]

Hi  Hakon,

Tried sequence; doesn't work.....

SEGGER J-Link Commander V6.70d (Compiled Apr 16 2020 17:57:43)
DLL version V6.70d, compiled Apr 16 2020 17:56:51

Connecting to J-Link via USB...O.K.
Firmware: J-Link Ultra V4 compiled Jul 17 2020 16:24:36
Hardware version: V4.00
S/N: 504404802
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.311V

Type "connect" to establish a target connection, '?' for help
J-Link>device NRF52840_xxAA
J-Link>connect
Please specify target interface:
J) JTAG (Default)
S) SWD
T) cJTAG
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "NRF52840_XXAA" selected.

Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB00C SCS-M7
ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 003BB002 DWT
ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 002BB003 FPB
ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 003BB001 ITM
ROMTbl[0][4]: E0040000, CID: B105900D, PID: 000BB9A1 TPIU
ROMTbl[0][5]: E0041000, CID: B105900D, PID: 000BB925 ETM
Cortex-M4 identified.
J-Link>h
PC = 00029E42, CycleCnt = 13A74755
R0 = 00000000, R1 = E000E100, R2 = 00000000, R3 = 00000000
R4 = 20001380, R5 = 00001000, R6 = 10001000, R7 = 000FE000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 2003FDBC
SP(R13)= 2003FEA0, MSP= 2003FEA0, PSP= 00000000, R14(LR) = 00029E1D
XPSR = 61000000: APSR = nZCvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 04000000, CONTROL = 04, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPS0 = 41C80000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 41C80000, FPS14= 00000000, FPS15= 00000000
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 00000000
J-Link>mem 0,4
00000000 = 00 04 00 20 ...
J-Link>w4 4001e504 2
Writing 00000002 -> 4001E504
J-Link>w4 4001e50c 1
Writing 00000001 -> 4001E50C
J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
J-Link>mem 0, 4
00000000 = 00 04 00 20 ...
J-Link>

[OwainIncus]

Also does your JLink have sepecial "Nordic Semi" firmware on it?
COuld this be the reason?

[Håkon Alseth]

Hi,

 

OwainIncus said:

Also does your JLink have sepecial "Nordic Semi" firmware on it?
COuld this be the reason?

I don't think this is the reason. Did you try the recover script?

 

OwainIncus said:

SEGGER J-Link Commander V6.70d (Compiled Apr 16 2020 17:57:43)

Could you try to update to a newer version of the Segger driver? I'm on v6.80c

 

Kind regards,

Håkon