unlocking NRF52480

[Ivo H]

Dear all,

I have pca10059 nrf52480 dongle which I accidentally erased and I could not upload any elf file to run moreover it was not blinking red anymore, no presence in system.

I managed to restore the bootloader with this procedure:

https://devzone.nordicsemi.com/f/nordic-q-a/87495/nrf52480-dongle-bricked-after-recover-in-openocd/365842

Thenafter, the dongle started to flash red again and I could flash the dongle with my custom blinky example and the diode was blinking again.

The problem I am facing now is, I want to have a look at the running process via OpenOCD, but anytime I start openocd with this command:

openocd -f rpi_as_debugger.cfg -c "transport select swd" -c "adapter speed 100" -f target/nrf52.cfg

I get following problem:

(THE DONGLE IS RUNNING JUST FINE, I CAN SEE THE DIODE BLINKING, BUT AFTER FIRMWARE RESTORATION, IT SEEMS THE CHIP IS LOCKED, BUT WHY? AFTER I RECEIVED THE DONGLE FROM MOUSER, I COULD EASILY DEBUG THE SAME EXAMPLE AND OPENOCD WAS NOT PRINTING ANY PROBLEM, ANYWAY I AM USING SWD OVER RASPBERRY)

Is the chip detecting any internal error at startup being the reason it gets locked?

Open On-Chip Debugger 0.11.0+dev-00651-g9de084e00 (2022-04-24-10:22)
Licensed under GNU GPL v2
For bug reports, read
openocd.org/.../bugs.html
BCM2835 GPIO nums: swclk = 24, swdio = 25

swd
adapter speed: 100 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Info : SWD DPIDR 0x2ba01477
Error: [nrf52.cpu] Could not find MEM-AP to control the core
****** WARNING ******
nRF52 device has AP lock engaged (see UICR APPROTECT register).
Debug access is denied.
Use 'nrf52_recover' to erase and unlock the device.

Warn : target nrf52.cpu examination failed
Info : starting gdb server for nrf52.cpu on 3333
Info : Listening on port 3333 for gdb connections

During firmware restoration, I was also facing this, which I haven't a clue what it might be:

Warn : [nrf52.cpu] target was in unknown state when halt was requested
Info : SWD DPIDR 0x2ba01477
Error: Wrong parity detected

Thank you

[Edvin]

There was a HW update for the nRF52 series where the APPROTECT is enabled instead of disabled by default, and this needs to be disabled from UICR and from the SW. I am not sure whether there exists any precompiled bootloader that takes this into account.

That being said. Do you really need to disable the APPROTECT? The point of the bootloader is that you can program it over USB, and skip the bootloader, right? If you have a debugger (your OpenOCD), then why do you need the bootloader in the first place?

BR,
Edvin

[Ivo H]

Dear sir, I am a complete newbie in microcontrollers.I just needed to unlock it to have debugging capability of the dongle via SWD.

Before the accident,I could debug the code easily,now I have to add these unlocking lines of code beforecmy code runs.I am fine with that anyway.I was just curious whether ir is possible to unlock the device without those lines of code.I had an idea to dump factory firmware from my another dongle which is unlocked from factory a flash the locked dongle,but I am wondering why this procedure does not work as the devices are identical,but hardware versions are different.

[Edvin]

It sounds like there was a different bootloader.hex file flashed on the dongle before you erased it. One that turned off the APPROTECT. I guess the bootloader file from the first link doesn't have this patch. 

However, the dongle is not really a development board, as it doesn't have a debugger. This is why it has a bootloader in the first place. The bootloader is a way to update the FW on the dongle without a debugger. 

If you have a programmer that you can use on the dongle, I suggest you just erase the bootloader, and debug without the bootloader being present. Then, when you are happy with your application, you can flash the bootloader back in together with the application (and softdevice/MBR) if you want to keep the possibility to update FW without a debugger/programmer. 

Another option would be to build your own bootloader. The bootloader on the dongle is heavily based on the nRF5 SDK\examples\dfu\open_bootloader\pca10059_usb\ and then you can apply the fix from here:

https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/working-with-the-nrf52-series-improved-approtect

("fix", as in disabling the approtect in your bootloader code, e.g. in main.c).

Debugging is usually easier when a bootloader is not present either way, so I suggest you just add it when you are done developing.

Best regards,

Edvin

[Ivo H]

Actually,I was not able to program the dongle via OpenOCD,therefore I was able to successfully prpgram the dongle via nrfutil and debug via OpenOCD.But I still do not know how to program it via OpenOCD correctly,I know the commands to flash elf file,but ut simply does not run.,yet.

[Edvin]

Oh. I thought you were. I am not at all familiar with OpenOCD, and it is not a tool that we support from Nordic's side. If you have erased the bootloader, you need a debugger/programmer to program it back in. 

If you have a programmer, you can use nRF Command Line Tools and the command "nrfjprog --recover" to disable the APPROTECT. If you do not program the bootloader back in, you can't use the dongle with nRF Connect for Desktop, but you can still program applications directly (if you have a working programmer). If you don't have a programmer, an nRF DK will also work as an external programmer, if you have the correct cables to connect the programming pins on the dongle to the debug out port from the DK. Search for "program external device DK" here on DevZone for more details.

Best regards,

Edvin