SECUREAPPROTECT and Non Secure code loading

RE: SECUREAPPROTECT and Non Secure code loading

erik.johnson — Fri, 10 Jul 2020 20:06:43 GMT

Has there been any kind of resolution on this? I'm also hitting this exact barrier with a similar setup.

RE: SECUREAPPROTECT and Non Secure code loading

Nico_ID — Thu, 14 Mar 2019 15:51:14 GMT

I can't find any detailled description of the modifications performed by "ALL" level set on read back protection.

I would like to be sure that it does not lock the whole board without any possibility to recover it (SECUREAPPROTECT + APPROTECT + ERASEPROTECT).

Back to my objective, I would like to lock the board from the secure code. How can I achieve that ?
Have you been able to reproduce the issue ?

RE: SECUREAPPROTECT and Non Secure code loading

Hakon — Thu, 14 Mar 2019 13:31:10 GMT

Another way of enabling read back protection is to use nrfjprog. Write "nrfjprog --rbp ALL". Try that and see if you are able to read the non-secure memory after that.

RE: SECUREAPPROTECT and Non Secure code loading

Nico_ID — Tue, 12 Mar 2019 15:39:37 GMT

I guess that I'm doing something wrong. I read many times to document you mentionned and to be honest some parts are not so easy to understand, in particular the fact that we can ERASE the flash even if ERASEPORTECT is set (using a key through CTRL-AP). But that is another story.

I do set SECUREAPPROTECT, switching it from 0xFFFFFFFF (default state) to 0x0.
However, after that manipulation, the non secure part is no longer programmable. Or at least the methods I use (those listed in my original post) are no longer usable.

Can you elaborate please on how to "properly" set SECUREAPPROTECT ?

Here is what I'm doing, am I missing something to enable non secure loading ?

void UICR_SecureProtect(void) {
  // Enabling Write in Config
  NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Wen << NVMC_CONFIG_WEN_Pos;
  while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
  // Issunig Protect command
  NRF_UICR_S->SECUREAPPROTECT = 0;
}

RE: SECUREAPPROTECT and Non Secure code loading

Hakon — Tue, 12 Mar 2019 14:43:59 GMT

[quote user=""]Is that possible with nRF9160 to load and lock the Secure part, give the board to another dev team that will load and lock the non secure part without having the possibility to dump or debug secure part ?[/quote]

Yes, it is possible. You should not be able to access the secure part or debug it once SECUREAPPROTECT is set properly. See https://www.nordicsemi.com/DocLib/Content/Product_Spec/nRF9160/latest/nRF9160_html5_keyfeatures for further details of how it's done.