secure boot on the nRF52840

RE: secure boot on the nRF52840

Sigurd — Thu, 24 Jun 2021 15:05:50 GMT

[quote user="Wendel"]Is there any solutions to disable the SWD pins? [/quote]

No. It's not possible to disable it in such a way that it prevents a debugger the possibility to trigger a erase-all operation.

RE: secure boot on the nRF52840

Wendel — Thu, 24 Jun 2021 05:07:34 GMT

Hi Sigurd

[quote userid="15146" url="~/f/nordic-q-a/76403/secure-boot-on-the-nrf52840/315907#315907"]No. If someone have access to the SWD pins, they can use a debugger to erase the chip.[/quote]

Is there any solutions to disable the SWD pins?

RE: secure boot on the nRF52840

Wendel — Fri, 18 Jun 2021 01:26:50 GMT

Thanks for your reply.

RE: secure boot on the nRF52840

Sigurd — Thu, 17 Jun 2021 13:52:32 GMT

Hi,

[quote user=""]But is there any way to protect the chip from erased with "nrfjprog -f nrf52 --eraseall"?[/quote]

No. If someone have access to the SWD pins, they can use a debugger to erase the chip.

[quote user="Wendel"]does that means the signature check happened after DFU?[/quote]

The NRF_BL_APP_SIGNATURE_CHECK_REQUIRED setting is to require signature Boot validation. Signature is checked on each boot.

You might find these cases interesting:

https://devzone.nordicsemi.com/f/nordic-q-a/70726/how-to-validate-signature-check-requirements

https://devzone.nordicsemi.com/f/nordic-q-a/74838/dfu-error-invalid_parameter-after-uploading-of-all-packets-via-dfu/

[quote user="Wendel"]Can I combine the init packet with bootloader+softdevice+application+bootloader setting, and program it into the chip directly?[/quote]

You are not flashing the init packet, but you can merge bootloader+softdevice+application+bootloader setting into a hex-file, and program it directly, yes.

RE: secure boot on the nRF52840

Wendel — Wed, 16 Jun 2021 08:48:42 GMT

Besides, the comment of NRF_BL_APP_SIGNATURE_CHECK_REQUIRED in sdk_config.h is "Perform signature check on the app. Requires the signature to be sent in the init packet.", does that means the signature check happened after DFU?

Can I combine the init packet with bootloader+softdevice+application+bootloader setting, and program it into the chip directly?