Enable/Disable JTAG in SLM nRF9160

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Mon, 31 May 2021 13:08:53 GMT

Hi Praveen,

If you have any faults in the nRF9160 you can make sure to save the latest URCs in the external MCUs Flash for example.

or
Just enable the necessary debug logging/UART GPIO changes for example in the spesific application that you use when re-flashing the device in the field.

Best regards,
Martin L.

RE: Enable/Disable JTAG in SLM nRF9160

praveenpalaparthi — Fri, 28 May 2021 11:39:25 GMT

Hi Martin,

The suggestion you gave is valid, but before re flashing the unit with debug code, if we want to read the logs from the faulty unit how we can get the logs.

Can we have AT Command to read RTT logs through serial interface.

Through serial AT command to enable disable RTT logs

With regards,

Praveen Palaparthi

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Tue, 18 May 2021 06:55:57 GMT

Hi Sharath,

Regarding security, I strongly suggest against another solution than using APPROTECT, e.g. where you could "disable"/"enable" JTAG with an AT command.

If you really need access to the JTAG port for a device in the field, then you could just connect, erase the application and re-flash the same application then you can debug as much as you'd like.
I think that is the best current solution and also secure against any other people getting access to the application.

Please specify why you would like to access the JTAG port for a device out in the field.

Best regards,
Martin L.

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Mon, 03 May 2021 08:32:46 GMT

Hi Sharath,

As mentioned earlier and referenced to the documentation:

[quote user="male"]

Martin Lesund said:
Only way to recover from only APPROTECT enabled is an full erase of the FLASH.

https://infocenter.nordicsemi.com/index.jsp?topic=%2Fnan_041%2FAPP%2Fnan_production_programming%2Fonly_APPROTECT_enabled.html

[/quote]

Best regards,

Martin L.

RE: Enable/Disable JTAG in SLM nRF9160

SharathMalve — Mon, 03 May 2021 05:27:47 GMT

Hi Martin

For a JTAG APPROTECT locked field returned unit , if a developer wants to analyze how to unlock jtag and debug/analyze (without erasing FLASH)

Any provision to inlock jtag APPROTECT?

Regards

Sharath

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Thu, 15 Apr 2021 07:18:44 GMT

Hi Sharath,

APPROTECT protects the physical debug interface. (see the doc.)

FOTA etc. is of course possible since that is not done over the debug port.

Best regards,
Martin L.

RE: Enable/Disable JTAG in SLM nRF9160

SharathMalve — Thu, 15 Apr 2021 07:16:40 GMT

If we need to do FOTA I think it will allow (when in APPROTECT MODE)....?

Regards

Sharath

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Thu, 15 Apr 2021 07:12:57 GMT

[quote user="male"]Only way to recover from only APPROTECT enabled is an full erase of the FLASH.[/quote]

https://infocenter.nordicsemi.com/index.jsp?topic=%2Fnan_041%2FAPP%2Fnan_production_programming%2Fonly_APPROTECT_enabled.html

RE: Enable/Disable JTAG in SLM nRF9160

SharathMalve — Thu, 15 Apr 2021 07:09:19 GMT

Thanks Martin

We will validate this

Other point: To unlock jtag APPROTECT , can I do a FOTA (FOTA file having function to unlock JTAG when it gets executed)

What are the options to unlock JTAG APPROTECT

Regards

Sharath

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Wed, 14 Apr 2021 14:44:06 GMT

Hi Sharath,

As referred in the documentation you can either use the standard SWD interface yourself or use our "nrfjprog" command line tool.

1. Option (in my opinion this is the easiest)

Open your command prompt -->

First command reads the UICR.APPROTECT register:

"APPROTECT blocks debugger read/write access to all CPU registers and memory mapped addresses."

nrfjprog --memrd 0x00FF8000

If this register has a value other than 0xFFFFFFFF, it is protected.

Here you can see my device is not protected:

So from the "device protection section" from my last post:

"write any value other than 0xFFFFFFFF to it, The protection activates after a reset"

So I write to this to the UICR.APPROTECT register with the command:

nrfjprog --memwr 0x00FF8000 --val 0x00000000

Then read out the register to make sure it is written using the previous command.

If I reset the device now it it will register the change and you will not be able to reach the device with the debugger.

As you see here I cannot read out any registers etc.

Only way to recover from only APPROTECT enabled is an full erase of the FLASH.

e.g.

nrfjprog --recover

----------------------------------------------------------------------

Another way to enable APPROTECT is to use the dedicated nrfjprog command:

nrfjprog --rbp ALL

Which basically does the same thing "under the hood" as shown with writing to the registers, but you do not need to reset the device for the readback protection to take in effect.

So if you want to make sure no-one can erase the flash as well you enable the ERASEPROTECT register as well.
However that should be avoided when only testing since it is very hard to recover from.
APPROTECT and ERASEPROTECT are enabled
It is recommended only under the final production phase when you know everything is set correctly and the device is ready.

2. Option (using the SWD protocol)

in this example we use the Jlink on board to access the CTRL-AP

Open up "J-Link commander"

Use command "?" to see full list of optional commands.

SWDSelect   // Activate SWD
SWDWriteDP 1 0x50000000  // Enable debug power
SWDWriteDP 2 0x04000000  // Selects the 0x04XXXXXX Access Port and 0xXXXX00XX Register bank in the access port

SWDReadAP 3 // CTRL-AP Bank 0, register offset 3 (APPROTECTSTATUS 0x00C): Access port protection status
SWDReadAP 3 // //Second read returns the value: 0: enabled 1: not enabled

So here you can see I get:

0x00000003

and that is

0000 0000 0000 0000 0000 0000 0000 0011

in binary, so we can see from the APPROTECT.STATUS that both APPROTECT and SECUREPROTECT is disabled:

(ONGOING, I WILL UPDATE the rest of the information SOON)

Best regards,

Martin L.

RE: Enable/Disable JTAG in SLM nRF9160

Martin Lesund — Tue, 23 Mar 2021 07:09:15 GMT

Hi Sharath,

This is already supported by for example using nrfjprog.

Please go through the Production Programming note in the device protection section.

Best regards,

Martin L.