Skip to content

Add catnip restore command for CC1352 recovery via JTAG #52

Open
sabas1080 wants to merge 2 commits intomainfrom
feature/restore-cc1352
Open

Add catnip restore command for CC1352 recovery via JTAG #52
sabas1080 wants to merge 2 commits intomainfrom
feature/restore-cc1352

Conversation

@sabas1080
Copy link
Copy Markdown
Member

Summary

  • Adds catnip restore command that recovers a CC1352 when the serial bootloader is broken
  • Uses the RP2040 as a CMSIS-DAP JTAG programmer via OpenOCD
  • Auto-detects shell port, downloads required firmware, and handles the full restore flow

Problem

When flashing a firmware that doesn't configure the CCFG bootloader backdoor (e.g., TI
SDK examples built for LaunchPad), the CC1352 becomes unresponsive to the serial
bootloader. The only recovery is via JTAG, which previously required manual OpenOCD
commands and knowledge of the CC1352P7 TAPID.

Usage

catnip restore # restore with default CatSniffer firmware
catnip restore firmware.hex # restore with custom firmware
catnip restore firmware.hex -d 1 # target specific device
catnip restore --tapid 0x0BB4102F # CC1352P1 variant

How it works

  1. Auto-detects RP2040 shell port and sends reboot to enter BOOTSEL (or prompts user for
    manual BOOT button)
  2. Downloads and loads free_dap_catsniffer.uf2 onto RP2040 (cached in
    ~/.catnip/restore_cache/)
  3. Creates temporary OpenOCD config with correct TAPID for CC1352P7 (0x1BB7702F)
  4. Runs openocd to flash the CC1352 via JTAG — program, verify, reset
  5. Prompts user for BOOTSEL again to restore bridge firmware (catsniffer-v3.1.0.0.uf2)

Requirements

  • OpenOCD installed (sudo apt install openocd / brew install openocd)
  • CatSniffer v3.x (RP2040 connected to CC1352 JTAG)

Files changed

  • catnip/modules/restore.py — New module with full restore logic
  • catnip/modules/cli.py — Added restore command to CLI

Test plan

  • Tested on 2 CatSniffer v3.x boards with broken CC1352 bootloader
  • Verified auto-detection of shell port + reboot command
  • Verified free_dap download and CMSIS-DAP detection
  • Verified OpenOCD flash + verify on CC1352P7 (TAPID 0x1BB7702F)
  • Verified bridge firmware restore
  • catnip restore (no args) uses default sniffer_fw_Catsniffer_v3.x.hex
  • catnip restore firmware.hex uses custom firmware
  • pre-commit passes (black, trailing whitespace, yaml, conventional commit)

Recovers a CC1352 when the serial bootloader is broken by using
the RP2040 as a CMSIS-DAP JTAG programmer via OpenOCD.

Usage:
  catnip restore                    # default CatSniffer firmware
  catnip restore firmware.hex       # custom firmware
  catnip restore firmware.hex -d 1  # specific device

Flow:
  1. Auto-detects shell port and sends 'reboot' for BOOTSEL
  2. Loads free_dap CMSIS-DAP firmware onto RP2040
  3. Flashes CC1352 via OpenOCD JTAG (auto-patches TAPID for CC1352P7)
  4. Prompts user for BOOTSEL to restore bridge firmware

Features:
  - Auto-downloads free_dap_catsniffer.uf2 from GitHub release
  - Uses catnip's cached bridge UF2 (catsniffer-v3.1.0.0.uf2)
  - Default firmware: sniffer_fw_Catsniffer_v3.x.hex
  - Supports CC1352P7 (0x1BB7702F) and CC1352P1 (0x0BB4102F) via --tapid
  - Cross-platform: requires OpenOCD (apt/brew/choco)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sabas1080 sabas1080 requested a review from Darcko123 April 5, 2026 23:38
Changed restore flow from direct JTAG programming to erase-only via
JTAG (preserving bootloader in sector 0/CCFG), then flash via serial
bootloader using the existing Flasher class. Added cmsis_dap_backend
hid for reliable CMSIS-DAP communication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant