RE: How to enable/disable UICR custom registers writes through APPROTECT?

wpaul — Tue, 05 May 2020 17:36:18 GMT

Just to be very clear:

The UICR locations are not just arbitrarily writable. Initially the UICR locations are in the erased state (shows 0xFF when read). Individual locations can be written to set their values. But once written, a location can't be modified again _unless_ you issue the ERASEUICR command to return the entire UICR to the erased state and then program it all over again.

Enabling the APPPROTECT feature requires writing a 0x00 to NRF_UICR->APPROTECT. So once you do that, the only way to change it back to 0xFF is to erase the UICR.

Note that the reset pin selection is also stored in the UICR, so if you erase it, you should remember to restore it, otherwise the external reset button will stop working.

Here's an example of the code I wrote once for the nRF52840 to erase and reprogram the UICR:

https://github.com/netik/dc27_badge/blob/master/software/firmware/badge/main.c#L352

Also, enabling the APPROTECT feature does not "prevent writes to the UICR." What it does is disable the CPU's debug access port (DAP) so that you can no longer issue commands via the SWD pins to debug the CPU. This blocks the debugger from accessing anything on the CPU, not just the UICR fields.

In order to recover a device which has been setThis this way (and where the firmware loaded into the device has no option to do it for you), you have to issue an ERASEALL command via the CTRL-AP port (which is a vendor-specific access port separate from the debug AP). The ERASEALL command will blank both the flash and the UICR (i.e. returns the chip back to its "fresh off the assembly line" state). You can issue an ERASEALL command via the NVMC registers too, but if the APPROTECT feature is turned on, the NVMC registers will also be inaccessible via the debug port. The CTRL-AP access mechanism provides an alternate way to reset the chip. The difference is that while this lets you recover a locked device, it doesn't allow you to download the contents of the flash first (i.e. software in a locked device is still protected from unauthorized access).

Most of the time if you ask how to do this, you will be told to use the nrfjprog utility. However there are other ways to issue this command with a debugger. Here's an example of how to do it with OpenOCD and an arbitrary JTAG/SWD debugger:

https://github.com/netik/dc27_badge/blob/master/hardware/programming/debug.txt#L41

-Bill

RE: How to enable/disable UICR custom registers writes through APPROTECT?

bjorn-spockeli — Tue, 05 May 2020 13:39:21 GMT

Yes, access port protection blocks the debugger from read and write access to all CPU registers and memory-mapped addresses.

Access port protection is disabled by issuing an ERASEALL command via CTRL-AP. This command will erase the flash, UICR, and RAM.

RE: How to enable/disable UICR custom registers writes through APPROTECT?

Turbo J — Mon, 04 May 2020 23:16:19 GMT

UICR works like a flash page - you can erase it all at once only. Changing bits 1->0 is called "writing" but 0->1 can only be done with "erase".