RE: How to enable APPPROTECT, SECUREAPPROTECT and ERASEPROTECT on nRF5340?

wasan — Tue, 30 Jan 2024 08:50:58 GMT

HI Sigurd

Thank you for your information.

Actually, I work with nRF9160 to enable APPPROTECT, SECUREAPPROTECT, and ERASEPROTECT of the nRF device before using nRF5340. In this post, I've submitted a ticket providing information on how to enable it:

https://devzone.nordicsemi.com/f/nordic-q-a/93169/how-to-remove-the-nrf9160-s-erase-protection

However, I've discovered that the same process doesn't work when applied to nRF5340. After studying your playground and reviewing the information, I found differences between nRF9160 and nRF5340 regarding the mechanism to lock. Here are the key distinctions:

nRF9160 has only one core, while nRF5340 has two cores – an application core and a network core, both of which need to be locked .
If I lock only the application core of nRF5340, the device can still unlock the J-Link port when attempting to recover the network core.
I have found a new method using nrfjprog to enable app-protect and enable erase-protect. This approach is easier compared to using J-Link scripts as mentioned above.

Example script for using to enable APPPROTECT, SECUREAPPROTECT and ERASEPROTECT of nRF5340

# Enable APPPROTECT and ERASEPROTECT of network core
nrfjprog.exe -f NRF53 --coprocessor CP_NETWORK --memwr 0x01FF8004 --val 0x00000000 --verify
nrfjprog.exe -f NRF53 --coprocessor CP_NETWORK --memwr 0x01FF8000 --val 0x00000000 --verify

# Enable APPPROTECT, SECUREAPPROTECT and ERASEPROTECT of application core
nrfjprog.exe -f NRF53 --coprocessor CP_APPLICATION --memwr 0x00FF8020 --val 0x00000000 --verify
nrfjprog.exe -f NRF53 --coprocessor CP_APPLICATION --memwr 0x00FF801C --val 0x00000000 --verify
nrfjprog.exe -f NRF53 --coprocessor CP_APPLICATION --memwr 0x00FF8000 --val 0x00000000 --verify

nrfjprog.exe -p
#Noted: Noted: Before using this command, please ensure that your application has a method to #disable ERASEPROTECT both the network core and application core.


Best Regards
Wasan

RE: How to enable APPPROTECT, SECUREAPPROTECT and ERASEPROTECT on nRF5340?

Sigurd Hellesvik — Thu, 11 Jan 2024 15:49:30 GMT

Hi,

Firstly, I advise you to be very careful when doing this. If you enable ERASEPROTECT and APPROTECT at the same time and do not have firmware running on the nRF to unlock the ERASEPROTECT or APPROTECT you will no longer be able to reprogram your chip.

Can I suggest that you implement a timeout that will automatically unlock the nRF after X seconds when you are developing?

Then I suggest you try to use the features standalone one by one first.

For approtect, see Enabling access port protection mechanism.

For eraseprotect, see my unofficial sample, but mark its disclaimers.

PS: For the nRF5340, I think you might have to enable approtect for the network core as well.

Regards,
Sigurd Hellesvik