ERASE_ALL protection disable nrf54

[vladL]

Hello,

I've been working on a feature lately that involves writing the OTP registers in UICR on nrf54L15; after writing the registers I also wrote the protected value (0x50FA50FA) to the ERASEPROTECT registers and this locked the OTP values in place.

Now I want to revert the development kit the previous state to perform some more testing and I saw that the erase protection can be disabled through the handshake mechanism where both the firmware and the debugger write the same key to the respective ERASEPROTECT.DISABLE register in the CTRL-AP.

I added the following piece of code to my application and reflashed it on the board:

NRF_CTRLAP_S->ERASEPROTECT.DISABLE = 0x12345678;

And tried the following sequence of commands on the JLink CLI:

SWDSelect

SWDWriteDP 1 0x50000000 // power up

SWDWriteDP 2 0x02000000 // select AP2 (CTRL-AP)

SWDWriteAP 4 0x12345678 // write erase prot. disable key (register index 4 in AP

I was expecting the ERASE_ALL procedure to be completed automatically as per the data sheet, but nothing happened to the UICR registers. I also tried to manually trigger the ERASE_ALL procedure by writing the debug-side registers through SWD, then reset the board and still no change.

 

There is obviously something I'm missing here, but I couldn't figure out what else needs to be done from the documentation. Could someone please confirm if my understanding of this feature is wrong and how should the code actually look like?

Thank you!

Vlad

[Elfving]

Sorry about the wait.

Similar things have been asked about in the past though, have you seen this one from a coworker of mine? There is a script there that might be worth having a look at. For more than this though, I'll have to get back to you next week.

What you are writing here does immediately look ok to me though.

Regards,

Elfving

[vladL]

Hi, Elfving!

Thanks for replying! I checked the inquiry you linked, it does confirm that my understanding of the feature is correct, but I'm still not able to trigger the erase_all using the keys.

Just to be sure, this should work even if the app protect is disabled, right? I'm now in a state where I enabled erase protect to lock down the UICR values and I want to make sure that this erase protect disable mechanism works before I also write the app protect (I did brick a couple of boards working on this feature, so I'm proceeding with caution )

Another note that could help maybe: the ERASEPROTECT.DISABLE register on the debugger side has R/W access type according to the data sheet, so I was expecting to be able to read back the key, to confirm it's there - however, when I read this register (SWDReadAP 4) it always returns 0 (does this mean the key is not actually written?). Also, reading the erase protect status (SWDReadAP 3) always returns 1, meaning erase protection is enabled, regardless of what I do with these keys.

 

Any idea on what could be wrong here is highly appreciated. Thanks!

Vlad