nRF52 APPPROTECT

[Eric Stutzenberger]

Hi,

Is there a way on the nRF52 to clear the APPPROTECT bits once they have been set?

On the nRF51, it was still possible to erase the chip to clear the readback protection. However, on the nRF52, the APPPROTECT bits seem to fully disable the debugger.

Thanks,

Eric

[Eric Stutzenberger]

The tools don't seem to support this yet (unless my nRF GO Studio is out of date) but using JLink from the command line I was able to clear these by manually executing the following commands:

Erase Enable: w4 4001e504 2

Erase all: w4 4001e50c 1

Update

I tried to reproduce this after having cleared these bits, but now I again cannot get the the JLink to recognize the core. I'm not sure what caused it to work this morning such that I could do this.

[David García Polo]

The public documentation of the unprotection mechanism is missing, but you can either do:

1. Use nrfjprog.exe -f NRF52 --recover
2. Use nrfjprog.dll function recover() or use the pynrfjprog recover()
3. Manually, a) write 1 to register 0x4 of debug access port 1, b) read register 0x8 of debug access port until its value is 0, c) write 0 to register 0x4 of debug access port 1, d) write 1 to register 0x0 of debug access port 1, e) write 0 to register 0 of debug access port 1.

I understand that option 3 is the only option available if you do not use nrfjprog. What do you use?

[David García Polo]

I do not think you had reset the device after writing the APPROTECT register. A reset is needed to load the configuration from UICR. That is why you could still access the core and the NVMC module. Once reset the debug access port connected to the core and the system bus is disabled. Only a special access port in address 1 is available.

[Eric Stutzenberger]

I was able to use option 1. It is not that option 3 is the only one available to me but that I was unaware of the trick with nrfjprog.exe. When using nRF Go Studio and trying to recover a board with app protect bits set, the Recover button is disabled.

Is there a plan to improve this erasure method? I ask because we program firmware in our factory to our modules that we want protected. However, we also want customers to be able to easily erase the part. I was unable to access the part with nRF Go Studio. Perhaps this is a change that has not yet been made to it?

[Eric Stutzenberger]

I had definitely power cycled the board. I asked the question specifically because it was in this state. I then had unplugged it and was using another board. In the morning, I plugged the same board back in and was able to recover it through above method. Probably a fluke.