Skip to content

Instantly share code, notes, and snippets.

What would you like to do?

CC2652 unbricking with Raspberry Pi and OpenOCD

I was a bit quick when flashing my generic CC2652R and ended up dowloading and flashing firmware for CC2652P.. Since it was the wrong firmware, the bootloader also didn't work anymore, making me unable to flash the correct firmware with the integrated USB serial programmer.

Luckily the module has a cJTAG debugging interface, that should make it possible to flash directly onto the chip without the bootloader. But I don't have any serial debuggers, so I have had to come up withj my own from various limited information I could find.


Using OpenOCD we can use a Raspberry Pi as a JTAG debugger. It does not support cJTAG for debugging, so it will instead send a signal to make the CC2652 switch to normal JTAG. We will then have to connect a few additional cables to the TDO and TDI pins for a full 4-pin JTAG connection.

Using telnet to connect to OpenOCD, we can then send debugging commands to the chip to flash the correct firmware.

I imagine this approach should be easily adoptable to other CC2xxx based modules.



  • cJTAG breakout cable (5-pin JST-SH to female dupont)
  • 2x male-female dupont cables
  • Raspberry Pi



Connect the CC2652 with the Raspberry Pi's GPIO pins

Using the following chart, connect the CC2652 with the Raspberry Pi's GPIO pins:

Name RPi GPIO# RPi Pin CC2652P Pin Name
3v3 Power N/A 17 VDD (cJTAG)
JTAG_TDI 10 19 DIO_17
JTAG_TDO 9 21 DIO_16

Note: The TDI and TDO pins of the CC2652P are specified in the datasheet. If you are trying this guide on another chip, you should look up its datasheet to make sure you connect it correctly.

You can check out to easily find the correct GPIO pins.

It is possible to use different pins on the Raspberry. You will then just have to change the interface configuration file of OpenOCD.

From the cJTAG breakout cable, connect 3v3, GND, TMS, and CLK. Leave the RST pin unconnected.

Use the two single dupont cables to connect to the through-hole soldering points. There should be a bit of resistance, which will ensure a reasonable connection.

Install and configure the software

We need to install OpenOCD and a telnet client on the Raspberry Pi

sudo apt update
sudo apt install openocd telnet

Now copy the preconfigured cc26x2 launchpad file for OpenOCD to your home directory

cp /usr/share/openocd/scripts/board/ti_cc26x2_launchpad.cfg openocd.cfg

We will need to change it a bit to use the Raspberry's GPIO as the JTAG interface, so change

source [find interface/xds110.cfg]
adapter speed 5500


source [find interface/raspberrypi2-native.cfg]
adapter speed 1000

If you are using a Raspberry Pi 1, then replace raspberrypi2-native.cfg with raspberrypi-native.cfg

The contents of ~/openocd.cfg should then be

# TI CC26x2 LaunchPad Evaluation Kit
source [find interface/raspberrypi2-native.cfg]
adapter speed 1000
transport select jtag
source [find target/ti_cc26x2.cfg]

Different GPIO pins

You can connect the cables to different GPIO pins on the Raspberry Pi, edit /usr/share/openocd/scripts/interface/raspberrypi2-native.cfg and set the used GPIO numbers (NOT pin numbers) on the line

bcm2835gpio_jtag_nums 11 25 10 9

This has to be the GPIO number, e.g. where GPIO 11 is on pin 23. See for a reference guide.

Download firmware

Download the correct firmware. For reference, I am using Koenkk's compiled Z-stack coordinator firmware. Make sure to get the correct one this time! (that mistake is the reason I have had to do this, and I guess a similar reason as to why you are here too 😅)


Start the debugger

Now simply run openocd. It will load the config located at ~/openocd.cfg automatically.

If you see

Info : JTAG tap: cc26x2.jrc tap/device found: 0x3bb4102f (mfg: 0x017 (Texas Instruments), part: 0xbb41, ver: 0x3)
Info : JTAG tap: cc26x2.cpu enabled
Info : cc26x2.cpu: hardware has 6 breakpoints, 4 watchpoints

in the output, the configuration should be loaded correctly

Connect with telnet and flash

In a new terminal, run

telnet localhost 4444

You should now be able to run the following commands in the telnet console to flash the firmware

flash write_image erase CC2652R_coordinator_20221102.hex
flash verify_image CC2652R_coordinator_20221102.hex

Hopefully you end up with a successful verification telling you that it is successfully flashed:

verified 179184 bytes from file CC2652R_coordinator_20221102.hex in 0.635823s (275.209 KiB/s)


This guide has been made by combining bits and pieces from the following places

Copy link

Worked perfectly on my Sonoff ZBDongle-P (CC2652P) after tack soldering two wires directly to the IC pads.
The only change required on my Pi 4 was to drop the "adapter speed" to 500 to get a reliable JTAG connection.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment