CC2652 unbricking with Raspberry Pi and OpenOCD
I was a bit quick when flashing my generic CC2652R and ended up dowloading and flashing firmware for CC2652P.. Since it was the wrong firmware, the bootloader also didn't work anymore, making me unable to flash the correct firmware with the integrated USB serial programmer.
Luckily the module has a cJTAG debugging interface, that should make it possible to flash directly onto the chip without the bootloader. But I don't have any serial debuggers, so I have had to come up withj my own from various limited information I could find.
Using OpenOCD we can use a Raspberry Pi as a JTAG debugger. It does not support cJTAG for debugging, so it will instead send a signal to make the CC2652 switch to normal JTAG. We will then have to connect a few additional cables to the TDO and TDI pins for a full 4-pin JTAG connection.
Using telnet to connect to OpenOCD, we can then send debugging commands to the chip to flash the correct firmware.
I imagine this approach should be easily adoptable to other CC2xxx based modules.
- cJTAG breakout cable (5-pin JST-SH to female dupont)
- 2x male-female dupont cables
- Raspberry Pi
- Raspberry OS installed on RPi
- Correct firmware file (e.g. Koenkk's Z-stack coordinator firmware)
- a telnet client
Connect the CC2652 with the Raspberry Pi's GPIO pins
Using the following chart, connect the CC2652 with the Raspberry Pi's GPIO pins:
|Name||RPi GPIO#||RPi Pin||CC2652P Pin Name|
|3v3 Power||N/A||17||VDD (cJTAG)|
Note: The TDI and TDO pins of the CC2652P are specified in the datasheet. If you are trying this guide on another chip, you should look up its datasheet to make sure you connect it correctly.
You can check out pinout.xyz to easily find the correct GPIO pins.
It is possible to use different pins on the Raspberry. You will then just have to change the interface configuration file of OpenOCD.
From the cJTAG breakout cable, connect 3v3, GND, TMS, and CLK. Leave the RST pin unconnected.
Use the two single dupont cables to connect to the through-hole soldering points. There should be a bit of resistance, which will ensure a reasonable connection.
Install and configure the software
We need to install OpenOCD and a telnet client on the Raspberry Pi
sudo apt update sudo apt install openocd telnet
Now copy the preconfigured cc26x2 launchpad file for OpenOCD to your home directory
cp /usr/share/openocd/scripts/board/ti_cc26x2_launchpad.cfg openocd.cfg
We will need to change it a bit to use the Raspberry's GPIO as the JTAG interface, so change
source [find interface/xds110.cfg] adapter speed 5500
source [find interface/raspberrypi2-native.cfg] adapter speed 1000
If you are using a Raspberry Pi 1, then replace
The contents of
~/openocd.cfg should then be
# # TI CC26x2 LaunchPad Evaluation Kit # source [find interface/raspberrypi2-native.cfg] adapter speed 1000 transport select jtag source [find target/ti_cc26x2.cfg]
Different GPIO pins
You can connect the cables to different GPIO pins on the Raspberry Pi, edit
/usr/share/openocd/scripts/interface/raspberrypi2-native.cfg and set the used GPIO numbers (NOT pin numbers) on the line
bcm2835gpio_jtag_nums 11 25 10 9
This has to be the GPIO number, e.g. where GPIO 11 is on pin 23. See pinout.xyz for a reference guide.
Download the correct firmware. For reference, I am using Koenkk's compiled Z-stack coordinator firmware. Make sure to get the correct one this time! (that mistake is the reason I have had to do this, and I guess a similar reason as to why you are here too
wget https://github.com/Koenkk/Z-Stack-firmware/raw/develop/coordinator/Z-Stack_3.x.0/bin/CC2652R_coordinator_20221102.zip unzip CC2652R_coordinator_20221102.zip
Start the debugger
Now simply run
openocd. It will load the config located at
If you see
Info : JTAG tap: cc26x2.jrc tap/device found: 0x3bb4102f (mfg: 0x017 (Texas Instruments), part: 0xbb41, ver: 0x3) Info : JTAG tap: cc26x2.cpu enabled Info : cc26x2.cpu: hardware has 6 breakpoints, 4 watchpoints
in the output, the configuration should be loaded correctly
Connect with telnet and flash
In a new terminal, run
telnet localhost 4444
You should now be able to run the following commands in the telnet console to flash the firmware
init reset halt flash write_image erase CC2652R_coordinator_20221102.hex flash verify_image CC2652R_coordinator_20221102.hex
Hopefully you end up with a successful verification telling you that it is successfully flashed:
verified 179184 bytes from file CC2652R_coordinator_20221102.hex in 0.635823s (275.209 KiB/s)
This guide has been made by combining bits and pieces from the following places
Worked perfectly on my Sonoff ZBDongle-P (CC2652P) after tack soldering two wires directly to the IC pads.
The only change required on my Pi 4 was to drop the "adapter speed" to 500 to get a reliable JTAG connection.