Set APPROTECT bit on nRF9160

[NelsonGoncalves]

Hello,

My application runs in non-secure mode on the nRF9160, and I would like to disable external access to CPU, RAM and Flash. 

I understand this is done by setting the APPROTECT bit in the UICR register. Ideally it will be done in production, with the nrfjprog tool.

However, can my non-secure application set this bit if it is not set ? Or must it be done in a secure context, e.g. the by SPM application ?  

If it can be done by the SPM, can you share an example of how it can be done ? 

[Albrecht Markus Schellenberger]

Hello Nelson,

According to chapter 4.4.4 in the nRF9160 product specification, you are not allowed to access the UICR register from non-secure code.

There is however a secure services library which makes secure firmware functions available from non-secure firmware. Unfortunately, writing to the UICR register is not included.

I will do some internal research and get this confirmed!

Regards,

Markus

[NelsonGoncalves]

Thanks Markus.

As is it stands, the best a non-secure app can do is to read the UICR and refuse to run if the APROTECT bit is not set.

Best regards,

 Nelson

[Albrecht Markus Schellenberger]

Hello again Nelson,

I just got confirmed that the UICR register only has read access from non-secure code.

It is however possible to define own secure functions in SPM that can be called from the non-secure domain.

Unfortunately, we do not have any concrete example for that. But there is a guideline written approximately one year ago, which might help you get an idea of how you can write such a function.

I hope this will help you!

Regards,

Markus

[NelsonGoncalves]

Thanks for the tip Markus.

I will try the guideline, and if it does not work we will need to set the bit during production.

Best regards,

 Nelson