[NRF52832] APPROTECT permanently enabled. Cannot attach to RTT service.

[j4cekc1dz]

Hi,

it seems like I'm struggling with issue mentioned here: https://infocenter.nordicsemi.com/pdf/nRF52832_Rev_3_Errata_v1.0.pdf#%5B%7B%22num%22%3A431%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C85.039%2C564.077%2Cnull%5D.

In my case device is locked every time after flashing and off/on sequence. It happens on custom board based on NRF52832 QFAAG1 2110AB. It looks like hardware issue, because I cannot reproduce it on NRF52DK with the same hex and repro steps. Every attaching to RTT erases chip.
So far I have found, that loading image to RAM using debugger and then attaching to RTT can be a workaround in this case but it is very awkward.

Repro steps for NRF52832 QFAAG1 2110AB and NRF52DK

Custom board NRF52832:


jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ west build -b nrf52dk_nrf52832
-- west build: generating a build system
Including boilerplate (Zephyr base): /home/jacek/projects/ncs/zephyr/cmake/app/boilerplate.cmake
-- Application: /home/jacek/projects/ncs/zephyr/samples/hello_world
-- Zephyr version: 2.6.99 (/home/jacek/projects/ncs/zephyr), build: v2.6.99-ncs1
-- Found Python3: /usr/bin/python3.8 (found suitable exact version "3.8.10") found components: Interpreter 
-- Found west (found suitable version "0.11.1", minimum required is "0.7.1")
-- Board: nrf52dk_nrf52832
-- Cache files will be written to: /home/jacek/.cache/zephyr
-- ZEPHYR_TOOLCHAIN_VARIANT not set, trying to locate Zephyr SDK
-- Using toolchain: zephyr 0.12.4 (/opt/zephyr-sdk)
-- Found dtc: /opt/zephyr-sdk/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6")
-- Found BOARD.dts: /home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832.dts
-- Generated zephyr.dts: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/dts.cmake
Parsing /home/jacek/projects/ncs/zephyr/Kconfig
Loaded configuration '/home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832_defconfig'
Merged configuration '/home/jacek/projects/ncs/zephyr/samples/hello_world/prj.conf'
Configuration saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/.config'
Kconfig header saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.2.0
-- The CXX compiler identification is GNU 10.2.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
-- Configuring done
-- Generating done
-- Build files have been written to: /home/jacek/projects/ncs/zephyr/samples/hello_world/build
-- west build: building application
[1/148] Preparing syscall dependency handling

[141/148] Linking C executable zephyr/zephyr_prebuilt.elf

[148/148] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       16588 B       512 KB      3.16%
            SRAM:        5376 B        64 KB      8.20%
        IDT_LIST:          0 GB         2 KB      0.00%
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
ERROR: The operation attempted is unavailable due to readback protection in
ERROR: your device. Please use --recover to unlock the device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog --recover
Recovering device. This operation might take 30s.
Writing image to disable ap protect.
Erasing user code and UICR flash areas.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.125V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.127V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
CTRL-AP indicates that the device is secured.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

Executing default behavior previously saved in the registry.
Device will be unsecured now.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

NRF52DK:

jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
Parsing image file.
Erasing page at address 0x0.
Erasing page at address 0x1000.
Erasing page at address 0x2000.
Erasing page at address 0x3000.
Erasing page at address 0x4000.
Applying system reset.
Checking that the area to write is not protected.
Programming device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

I'm using NCS 1.7.0 with Zephyr v2.6.99-ncs1 so workaround for above errata has been added.
Adding NRF_APPROTECT->DISABLE = APPROTECT_DISABLE_DISABLE_SwDisable;
in few additional places (SystemInit, beginning of main)  doesn't help.

Best regards,
Jacek

[j4cekc1dz]

FYI, I tested software with NRF_UICR->APPROTECT = UICR_APPROTECT_PALL_HwDisabled as well and APPROTECT is still enabled.

[Kenneth]

Make sure to download the latest nrf command line tools:
https://www.nordicsemi.com/Products/Development-tools/nrf-command-line-tools/download 

Then the only thing you should need to do is execute 'nrfjprog --recover' one time, this should disable approtect in UICR by writing 0x5A to the APPROTECT register in UICR:
https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.nrf52832.ps.v1.1/uicr.html#register.APPROTECT 

After that the system files should handle the APPROTECT in nrf52_handle_approtect(), which simply set:

/* Load APPROTECT soft branch from UICR.
If UICR->APPROTECT is disabled, POWER->APPROTECT will be disabled. */
NRF_APPROTECT->DISABLE = NRF_UICR->APPROTECT;

Best regards,
Kenneth

[j4cekc1dz]

Hello Nordic Crew,

could you please check your the latest versions of nrfjprog.
In my case everything works fine with version below 10.12.0.

"Writing image to disable ap protect." - nrfjprog which prints this string seems to be affected but not with all nordic's chip but for sure with nRF52832 QFAA G1.

BR, Jacek

[Kenneth]

I can't really think of anything, I suggest to keep trying to see if you can find the culpit. There should be a new v10.15 out soon (eta. next week) which might be worth trying out also when available. Let me know if you do new discoveries.

Kenneth