how to enable readback protection

RE: how to enable readback protection

Hung Bui — Fri, 12 Jul 2019 11:21:05 GMT

@Eran: please create a devzone case for new question. Note that you can freely use sd_flash_write() to access flash. The fstorage flash library is just to help you with the operation queue and retry if the operation's failed.

RE: how to enable readback protection

Ron — Thu, 04 Jul 2019 09:06:49 GMT

Is there a possibility to write to flash from the firmware (without using the .hex file) without using the the flash manager library ?

Why is the flash manager necessary here and why doesn't sd_flash_write() work for me?

Thanks!

RE: how to enable readback protection

Hung Bui — Thu, 26 Mar 2015 10:07:53 GMT

As far as I understand, using KEEP tells the linker to keep the section even if it's not referenced. In this case there is a chance that the garbage colletion things that you don't use UICR_ADDR_0x04 anywhere so it might eliminate the area.

RE: how to enable readback protection

David García Polo — Thu, 26 Mar 2015 09:58:30 GMT

You could have just done the following:

In some code of yours, start of main for example, in seudocode:

If UICR-RBPCONF equal not protected: set NVMC.CONFIG to Write Enable wait for NVMC.READY write RBPCONF to desired value wait for NVMC.READY set NVMC.CONFIG to Read Enable system reset request

RE: how to enable readback protection

Hung Bui — Thu, 26 Mar 2015 09:56:16 GMT

@Clem: user supposed to use only 128 bytes UICR from 0x10001080 to 0x100010FF to store user data. Accessing UICR outside of that area is not recommended. Please have a look at chapter 8 in the nRF51 Reference Manual. I would suggest you to use a normal flash page to store your key and info.

RE: how to enable readback protection

Clem Taylor — Thu, 26 Mar 2015 09:08:06 GMT

Nope, I didn't get a reply and I never bother to ask support or my sales rep. I really should ask. I suspect the answer will be something like 'yes it is 1K but we don't test the full 1K in production'.

I still have some time to move the key data out of UICR and stick it someplace else, but UICR seemed like a good place for manufacturing time data.

I'd be willing to bet that FICR is also a full flash page as well. I need to take one of the bits of broken hardware I have lying around and see if I can stomp on bits in FICR just by setting NVMC_CONFIG = 2.

RE: how to enable readback protection

RK — Thu, 26 Mar 2015 05:31:02 GMT

Did you ever get proper confirmation that the UICR really is and is guaranteed to stay a full 1024 bytes of FLASH which can be used and not just the documented 160 bytes with 32 reserved for customer use?

RE: how to enable readback protection

Clem Taylor — Thu, 26 Mar 2015 05:20:57 GMT

I ended up putting quite a bit of stuff in UICR (128 bytes of user data and 512 bytes of crypto keys).

I have 2 sections, .infoUICR and .keysUICR, each contains a single structure (otherwise ld might swap the order)

xxxUICR.c:

xxxInfoUICR_t xxxInfoUICR __attribute__((section(".infoUICR"), used));
xxxKeysUICR_t xxxKeysUICR __attribute__((section(".keysUICR"), used));

xxx.ld:

MEMORY
{
        /* manufacturing time data (customer UICR region) */
        UICR (r)          : ORIGIN = 0x10001000, LENGTH = 0x080 /* 128 bytes */
        INFO_UICR (r)     : ORIGIN = 0x10001080, LENGTH = 0x180 /* 384 bytes */
        KEYS_UICR (r)     : ORIGIN = 0x10001200, LENGTH = 0x200 /* 512 bytes */
}
...
SECTIONS
{
        /* UICR info data (manufacturing time data) */
        .infoUICR (NOLOAD) :
        {
                KEEP(*(.infoUICR))
        } > INFO_UICR
 
        /* UICR key data (manufacturing time data) */
        .keysUICR (NOLOAD) :
        {
                KEEP(*(.keysUICR))
        } > KEYS_UICR
}

I ended up writing a host C program to build up the UICR data because I have several CRC values in the various data blocks. I also did not want the UICR data embedded in the bootloader hex file so the bootloader image for the factor and the bootloader image for DFU are exactly the same.

The host tool builds up the 1024 byte UICR page writes it to stdout as binary data which is converted to a hex file with bin2hex.py. The hex file I send the factory is a hexmerge.py of the softdevice, application, bootloader and uicr hex files.

RE: how to enable readback protection

nimalhuang — Wed, 25 Mar 2015 15:52:49 GMT

Hi, Hung, Thank you for your reply. I have figure out the problem. But without this line of code: KEEP((.uicrrbpconf) so is there any difference between have and havn't this line of code? Thank you

RE: how to enable readback protection

Hung Bui — Wed, 25 Mar 2015 08:55:50 GMT

@nimalhuang: Could you send me a sample hex file that you added section(".uicrrbpconf") the same way as I suggested ? And also another sample hex file that you use your configuration ?

I tested here and seeing no problem. Attached in the answer above is the project and hex file I compiled with address 0x10001004 is set = 0xffff0000.

RE: how to enable readback protection

nimalhuang — Mon, 23 Mar 2015 16:06:48 GMT

Hi, Hung,

I use jlink to debug the board, so it should be J flash I think. After I add the following code to the ld file. it works.
UICR (rw) : ORIGIN = 0x10001000, LENGTH = 0x0fd /* 0x10001000 ~ 0x100010fd-1 / .uicrrbpconf 0x10001004 : { KEEP((.uicrrbpconf)) } > UICR However, this takes much more time to compile. Do you have any crew what's going on?

RE: how to enable readback protection

Hung Bui — Mon, 23 Mar 2015 14:30:27 GMT

There should be no different between on the way to write to UICR. Could you try the example on github and check if the uicrBootStartAddress is written ? Which program you used to flash the chip ?

RE: how to enable readback protection

nimalhuang — Fri, 20 Mar 2015 22:21:02 GMT

Hi, Huang

I add code as you said, but it doesn't work. I add the following code in the main.c:

attribute((section(".uicrrbpconf"))) uint32_t UICR_ADDR_0x04 = 0xffff0000;

and define the ".uicrrbpconf" section in ld file:

.uicrrbpconf 0x10001004 : {

}

Is there anything that I have missed? Thank you

RE: how to enable readback protection

nimalhuang — Fri, 20 Mar 2015 22:17:08 GMT

Hi, Thank you for your reply. Because I enable softdevice s130, using function ble_flash while softdevice running will halt the cpu and hence cause hard fault, so this is not gonna work.

RE: how to enable readback protection

Hung Bui — Fri, 20 Mar 2015 13:00:47 GMT

I think you can follow what we did here to write the bootloader address to UICR:

__attribute__ ((section(".uicrBootStartAddress"))) uint32_t m_uicr_bootloader_start_address = BOOTLOADER_REGION_START;

Note: You would need to define the uicrBootStartAddress section in the .ld file as in gcc_nrf51_bootloader_xxaa.ld file.

Example project: bootloader - gcc - BLE - TestRBP.zip

RE: how to enable readback protection

endnode — Fri, 20 Mar 2015 10:50:28 GMT

Hi,

You can either write UICR->RBPCONF from within the application by something like this:

#if LOCK_UICR
    // Check if read-back mechanism is turned ON.
    if((uint32_t)((NRF_UICR->RBPCONF & UICR_RBPCONF_PALL_Msk) >> UICR_RBPCONF_PALL_Pos) != UICR_RBPCONF_PALL_Enabled) {
        ble_flash_word_write((uint32_t *)&NRF_UICR->RBPCONF, (NRF_UICR->RBPCONF & ~UICR_RBPCONF_PALL_Msk));
    }
#endif

or you can put something like this to the end of your HEX file:

:020000041000EA
:10100000FFFFFFFFFF00FFFFFFFFFFFFFFFFFFFFEF
:00000001FF

RE: how to enable readback protection

RK — Fri, 20 Mar 2015 00:37:59 GMT

A search in the forums shows this answer

devzone.nordicsemi.com/.../

which says it's not trivial and probably involves reading the ld manual. I assume you want to embed the data in your application so that when it's flashed the UICR is written. If I were going to do that I'd probably write a small .bin/.hex file with the values I want flashed in and add a step to merge it in with my code .hex file at the end using objcopy.