nRF5 action!

mr_red

For Documentations sake:
I was having the same problems of the Ebyte E73 Module of being locked.
The ST_LinkV2 Clone Firmware are not able to recover the modules as the swd implementation is missing some direct register write capabilities.
The nfrjprog and nor openocd are working with the ST_LinkV2.

As suggested in this thread somewhere, I was able to get the modules unlocked with the Jlink clone and nrfjprog.
see also :
https://github.com/micooke/arduino-nRF5-smartwatches/blob/master/nrf52_disable_read_protection.txt

That (pirated) Firmware is working with swd and is able to recover the modules. Had to solve some dll-issues before, but got it working.
After the recovery with nrfjprog the stlink and the jlink are working as expected with openocd.

To find out if your wiring etc. is fine and it is really the locked devices you get this when starting your openocd interface.
The voltage is fine but the breakpoints are recognized.

Info : STLINK v2 JTAG v17 API v2 SWIM v4 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.241270
Info : nrf52.cpu: hardware has 0 breakpoints, 2 watchpoints
Error: timed out while waiting for target halted
TARGET: nrf52.cpu - Not halted

It should be

Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints

ileneken3

@mr_red
I can add some of my own "documentation" on this issue. I only recently was able to program an Ebyte E73 module, and it was a long struggle. I used the NRF DK, and had help from a Nordic engineer.

The recommended way to connect to the external device is:

Using the P20 and P1 headers, connect:
P20 VDD -> 3.3v on EBYTE 2G4M04S1B module
P20 SWDIO -> SWDIO on EBYTE 2G4M04S1B module
P20 SWDCLK -> SWDCLK on EBYTE 2G4M04S1B module
P20 VTG -> P1 VDD
P1 GND -> GND on EBYTE 2G4M04S1B module

To unlock the chip, execute:

nrfjprog -f nrf52 --recover

They also recommend using nrfjprog to program the device, because nRFgo Studio is deprecated. But I used the Studio and it worked fine. I gave Studio the .hex produced by the Arduino IDE using "Sketch" -> "Export compiled Binary".

As mentioned in the previous post, it is unlikely to unlock the board with anything but the NRF DK or a genuine J-Link. (Maybe a good fake J-Link).

Mistakes others may be able to learn from:

Soldering the module onto a custom board can be hard. If you miss a little solder on SWDCLK or SWDIO, there is no hope. Check continuity on every pin you need!
Make sure you don't order a NRF52810 module - only NRF52832 . You can program them, but Mysensors is not compatible. It's easy to hit the wrong link on AliExpress as they look identical.
The NRF DK seems to deliver only 2.8V to the device. I first thought there was a problem, and tried to connect external power sources. But it seems to work powered from the DK.

magkudjee

@nagelc

thank you

mr_red

@ileneken3
It is a struggle indeed. I wanted to stay "low cost" with clone stlink and clone jlink.
As this is in preparation for a local hackspace workshop the entry level should be as low as possible.
And I suceeded to get this running for under 10€. (only one Jlink needed to unlock the modules once)

I am using platform.io and arduino, which use openocd internally. No need for nrfgo or an second programm and take the hex somewhere else.
Highly recommend platform.io for this! Flashing & Serial output are superfast, nice IDE and my dev-cycle speed up by an order of magnitude.

Question:
I am using an second device for USB-Serial convertion to get some print-msg out of the nrf52832.
Is there any way to do this over the programmer?

You can define the RX/TX pins in the nrf52832 to the pins you want.
Hardware Workaround by Neverdie: Connector Board -openhardware.io

Toyman

@mr_red said in nRF5 action!:

Is there any way to do this over the programmer?

Not in Arduino. In KEIL you can use RTT (pretty cool stuff, debug via SWD)
But if you just want to decrease a number of programmers, you can use Black Magic Probe, made from BluePill ($2 at Ali). It is 2-in-1 SWD and USB-UART converter on one PCB

alowhum

@ileneken3 @mr_red Thanks for this! Glad to hear I wasn't going crazy, but that others have had the same issue.

Omemanti

A quick Google pointed me to https://github.com/AndruPol/nrf52832-recover/blob/master/README.md

I do have a STM32F103C8T6 laying around. But ATM no time to play with it.

Maybe that's the €3 solution for unlocking.

Toyman

@omemanti said in [nRF5 action!]Maybe that's the €3 solution for unlocking.

BMP is enough to unlock. BluePill costs ca. €2 and it's easily convertable to BMP

mr_red

@Omemanti Good find about the BMP to recover the Ebyte module. Can you point me to an aliexpress link? "stm32" "bluepill" are not the magic chinese keywords..

mfalkvidd

@mr_red https://medium.com/@paramaggarwal/converting-an-stm32f103-board-to-a-black-magic-probe-c013cf2cc38c has keywords and a direct link to Ali

alowhum

I created a BMP, both from a cheap ST-Link and an STM32, and it didn't help me break open those eByte NRF52 units.

mr_red

@alowhum where did you get stuck? Whats your process?

waspie

@monte do you have final code now ? :)

ileneken3

@mr_red

I got to the point where the stm32loader.py runs and outputs:

Bootloader version 22
Chip id: 0x410 (STM32 Medium-density)
Write 256 bytes at 0x8000000
Write 256 bytes at 0x8000100
[..snip..]
Write 256 bytes at 0x8001900
Write 256 bytes at 0x8001A00
Read 256 bytes at 0x8000000
Read 256 bytes at 0x8000100
[..snip..]
Read 256 bytes at 0x8001900
Read 256 bytes at 0x8001A00
Verification OK

After that, you're supposed to plug in to the USB directly. I get " USB device not recognized". Zadig doesn't help. It lists it as:

"Unknown USB Device (Device Descriptor Request Failed)"

Any ideas?

Thanks.

Toyman

@ileneken3 have you returned the jumpers back?

ileneken3

@toyman
Unfortunately, yes, I have returned the jumpers to their original settings, and have even tried all 4 combinations.
I also changed computers, changed OS's, changed cables.

The board LOOKS like it was well manufactured, but I suppose a bad board is a possibility. Other than that, I can't figure out what could be wrong.

sebi

@d00616 said in nRF5 action!:

@Nca78 said in nRF5 Bluetooth action!:

Does that mean I have to go the long hard way with a bluepill as programmer and openocd ? Anyone has other ideas to unlock and erase the device ?

Select in to Tools menu "None" Softdevice and then "Burn Bootloader". This raises an error but the device is erased completely.

I am having the same issue trying to write on a E73 module with read/write protections. I don't have a JLink, but a ST Link-V2 and OpenOCD.
Do you know how to remove the protections on the E73 with such tools? Thanks.

novicit

@sebi,
A couple weeks ago I began exploring deploying E73 modules and had to remove protections. I was successful and now have a working E73 ethernet gateway. Only had ST Link-V2, so I used a "blue pill" I had in inventory to load it with Black Magic Probe. This cleared the protections.

The instructions I followed to load the BMP are step-by-step at https://github.com/TamojitSaha/STM32f103_Black-Magic-Probe

The instructions followed to clear protections with BMP also are step-by-step and worked perfect. They are at https://github.com/AndruPol/nrf52832-recover

In item #4, the program arm-none-eabi-gdb.exe seems to be part of the Arduino tool chain as I found it just by doing a search in file explorer and it was already on my win10 machine. Also, in item #4, (gdb) is the prompt that the program arm-none-eabi-gdb.exe gives. In the first line, change the '/dev/ttyACM0' to your com port. Use 'quit' to exit the program. Also, use 'mon help' to see options.

There are apparently a number of ways to 'recover' the E73, but this worked easily for me, and was step-by-step.

ncollins

@NeverDie Hoping you can help me with an WTNRF51822-S4AT problem where my stop recognizing interrupt events 2ish days after the last interrupt.

The buttons sleep for 24 hours, then wake up and send battery level. Even though the interrupt stops triggering, they still send battery level.

Possible some kind of timer is expiring?

Any help is appreciated.

// General settings
#define SKETCH_NAME "ThinButton"
#define SENSOR_NAME SKETCH_NAME
#define SKETCH_VERSION "1.4"

#define MY_NODE_ID 37


#define MY_BAUD_RATE 115200
//#define MY_DEBUG

#define IS_NRF51 
#define PIR_DETECTION_PIN 3
#define SHORT_WAIT 50
#define DEBOUNCE_MS 1000

volatile bool motion_change=false;

#define MY_RADIO_NRF5_ESB

#include <MySensors.h>

#define SLEEP_MS 1000 * 60 * 60 * 24

#define   CHILD_ID_VOLT 1
MyMessage msgBattery(CHILD_ID_VOLT, V_VOLTAGE);

#define CHILD_ID_BTN 2
#define BTN_PIN PIR_DETECTION_PIN
MyMessage msgBtn(CHILD_ID_BTN, V_TRIPPED);

void disableNfc() {  //only applied to nRF52

  #ifndef IS_NRF51
    //Make pins 9 and 10 usable as GPIO pins.
    NRF_NFCT->TASKS_DISABLE=1;  //disable NFC
    NRF_NVMC->CONFIG=1;  // Write enable the UICR
    NRF_UICR->NFCPINS=0; //Make pins 9 and 10 usable as GPIO pins.
    NRF_NVMC->CONFIG=0;  // Put the UICR back into read-only mode.
  #endif
}

void turnOffRadio() {
  NRF_RADIO->TASKS_DISABLE=1;
  while (!(NRF_RADIO->EVENTS_DISABLED)) {}  //until radio is confirmed disabled
}

void turnOffUarte0() {
  #ifndef IS_NRF51  
    NRF_UARTE0->TASKS_STOPRX = 1;
    NRF_UARTE0->TASKS_STOPTX = 1;
    NRF_UARTE0->TASKS_SUSPEND = 1;
    NRF_UARTE0->ENABLE=0;  //disable UART0
    while (NRF_UARTE0->ENABLE!=0) {};  //wait until UART0 is confirmed disabled.
  #endif

  #ifdef IS_NRF51
    NRF_UART0->TASKS_STOPRX = 1;
    NRF_UART0->TASKS_STOPTX = 1;
    NRF_UART0->TASKS_SUSPEND = 1;
    NRF_UART0->ENABLE=0;  //disable UART0
    while (NRF_UART0->ENABLE!=0) {};  //wait until UART0 is confirmed disabled.
  #endif
}

void turnOffAdc() {
  #ifndef IS_NRF51
    if (NRF_SAADC->ENABLE) { //if enabled, then disable the SAADC
      NRF_SAADC->TASKS_STOP=1;
      while (NRF_SAADC->EVENTS_STOPPED) {} //wait until stopping of SAADC is confirmed
      NRF_SAADC->ENABLE=0;  //disable the SAADC
      while (NRF_SAADC->ENABLE) {} //wait until the disable is confirmed
    }
  #endif
}


void turnOffHighFrequencyClock() {
    NRF_CLOCK->TASKS_HFCLKSTOP = 1;
    while ((NRF_CLOCK->HFCLKSTAT) & 0x0100) {}  //wait as long as HF clock is still running.
}


void mySleepPrepare() {  //turn-off energy drains prior to sleep
  turnOffHighFrequencyClock();
  turnOffRadio();
  turnOffUarte0();
}
 

void activateLpComp() {
  NRF_LPCOMP->PSEL=4; // monitor AIN0 (i.e. pin P0.02 on nRF52832 PIR Motion Sensor v607).
  while (!(NRF_LPCOMP->PSEL==4)) {} //wait until confirmed
  NRF_LPCOMP->REFSEL=3;  // choose 1/2 VDD as the reference voltage
  while (!(NRF_LPCOMP->REFSEL==3)) {} //wait until confirmed
  NRF_LPCOMP->ANADETECT=0;  //detect CROSS events on PIR detection pin
  while (NRF_LPCOMP->ANADETECT!=0) {} //wait until confirmed
  NRF_LPCOMP->INTENSET=B1000;  //Enable interrupt for CROSS event
  while (!(((NRF_LPCOMP->INTENSET)&B1000)==B1000)) {} //wait until confirmed
  NRF_LPCOMP->ENABLE=1;  //Enable LPCOMP
  while (!(NRF_LPCOMP->ENABLE==1)) {} //wait until confirmed
  NRF_LPCOMP->TASKS_START=1;  //start the LPCOMP
  while (!(NRF_LPCOMP->EVENTS_READY)) {}  //wait until ready
  
  NVIC_SetPriority(LPCOMP_IRQn, 15);
  NVIC_ClearPendingIRQ(LPCOMP_IRQn);
  NVIC_EnableIRQ(LPCOMP_IRQn);
}

void suspendLpComp() { //suspend getting more interrupts from LPCOMP before the first interrupt can be handled
  if ((NRF_LPCOMP->ENABLE) && (NRF_LPCOMP->EVENTS_READY)) {  //if LPCOMP is enabled
    NRF_LPCOMP->INTENCLR=B0100;  //disable interrupt from LPCOMP
    while (((NRF_LPCOMP->INTENCLR)&B0100)==B0100) {} //wait until confirmed
  }
}

void resumeLpComp() { //suspend getting interrupts from LPCOMP
  NRF_LPCOMP->INTENSET=B0100;  //Enable interrupt for UP event
  while (((NRF_LPCOMP->INTENSET)&B1000)!=B0100) {} //wait until confirmed
}
// setup
void setup() {
  hwInit();
  hwPinMode(PIR_DETECTION_PIN,INPUT);

  disableNfc();  //remove unnecessary energy drains
  turnOffAdc();  //remove unnecessary energy drains
  activateLpComp();
  motion_change=false;
}

void mySleep(uint32_t ms) {
   mySleepPrepare();  //Take steps to reduce drains on battery current prior to sleeping
   sleep(ms);
}


// presentation
void presentation() {
  sendSketchInfo(SKETCH_NAME, SKETCH_VERSION);

  present(CHILD_ID_VOLT, S_MULTIMETER, SENSOR_NAME);
  wait(SHORT_WAIT);
  present(CHILD_ID_BTN, S_MOTION, SENSOR_NAME);
  wait(SHORT_WAIT);
}

unsigned long lastTripped = millis();

// loop
void loop() {
  mySleep(SLEEP_MS);
  
  if(motion_change){
    unsigned long ms = millis();
    long timeDiff = ms - lastTripped; 
    
    if(timeDiff < 0 || timeDiff > 1000){ 
      send(msgBtn.set((uint8_t) 1));
    }
     
    NRF_LPCOMP->EVENTS_CROSS=0;
    motion_change=false;
    lastTripped = millis();
  } else {
    
    send(msgBattery.set(getInternalVoltage(),3));
  }
}

float getInternalVoltage(){
  return ((float)hwCPUVoltage())/1000.0;
}


#if __CORTEX_M == 0x04
#define NRF5_RESET_EVENT(event)                                                 \
        event = 0;                                                                   \
        (void)event
#else
#define NRF5_RESET_EVENT(event) event = 0
#endif


// This must be in one line
extern "C" { void LPCOMP_IRQHandler(void) {motion_change=true; NRF5_RESET_EVENT(NRF_LPCOMP->EVENTS_CROSS); NRF_LPCOMP->EVENTS_CROSS=0; MY_HW_RTC->CC[0]=(MY_HW_RTC->COUNTER+2);}}

NeverDie

@ncollins

It has been a while. I may be switching to PIC: https://forum.mysensors.org/topic/10666/anyone-ever-look-into-ezbl-aka-easy-booloader-on-a-pic

The impression I get is that you just write the new hex file into flash, flip a switch in software, and bang, you switchover to the new firmware without skipping a beat. No need to even reboot.

I think anything with the best general solution for OTA updates is a better path than doing OTA firmware bootloader one-offs for each MCU. From what I've gathered, it seems PIC may be the only one with the generalized bootloader support that I'm looking for. I haven't tried PIC before, but I'll be receiving a PIC board on Tuesday to test out this new theory. I'm gravitating toward LoRa anyway, so for that I can't leverage anything from NRF5x anyway. LoRa is the closest thing to bulletproof wireless communications that I've found so far. It just works, with fantastic range and coverage while still fitting within FCC requirements.

PICs tend to consume less energy than both atmega's and nRF5x's while sleeping, so there may be some positive trade-offs to be had there as well.

I'll miss the tight integration possible with an nRF5x. Maybe someday there will be PICs with integrated LoRa radios? MicroChip makes both separately, so it could conceivably happen. They've already done it with SAM: https://pic-microcontroller.com/microchip-new-ultra-low-power-lora-sip/

nRF5 action!

17

11.7k

11.2k

113.0k