NRF52840 FLASH PROTECTION WITH SDK 15.0.0

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

sne_333 — Wed, 04 Aug 2021 12:35:18 GMT

okay. Thank you so much for your reply.

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

Sigurd — Wed, 04 Aug 2021 11:50:26 GMT

[quote user="snehal_2789"]What will be the right way to upload the 4 files?? [/quote]

You could use mergehex, to merge these 4 files into a single hex file.

https://infocenter.nordicsemi.com/topic/ug_nrf_cltools/UG/cltools/nrf_mergehex.html

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

sne_333 — Wed, 04 Aug 2021 11:41:29 GMT

Thank you for your reply. I am using SDK15, so this feature "NRF_BL_DEBUG_PORT_DISABLE" is not available.

Yes I have commented the system reset line. What happens is I have to upload 4 files

1) Bootloader file

2)Softdevice file

3)Application Hex file

4)Config file.

Now what happens if I uncomment this line"NVIC_SystemReset();" , I upload the bootloader file first, after uploading it automatically gives a reset to board and then I am not able to upload the rest 3 files in the device as it blocks SWD. Thts the reason I commented "NVIC_SystemReset();".

What will be the right way to upload the 4 files??

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

Sigurd — Wed, 04 Aug 2021 10:54:53 GMT

Looks like you have commented out the system reset.

This is what the bootloader will do if NRF_BL_DEBUG_PORT_DISABLE is set( NRF_BL_DEBUG_PORT_DISABLE was first introduced in SDK v16):

void nrf_bootloader_debug_port_disable(void)
{
    if (NRF_UICR->APPROTECT != 0x0)
    {
        nrf_nvmc_write_word((uint32_t)&NRF_UICR->APPROTECT, 0x0);
        NVIC_SystemReset();
    }
#if (!defined (NRF52810_XXAA) && !defined (NRF52811_XXAA) && !defined (NRF52832_XXAA) && !defined (NRF52832_XXAB))
    if (NRF_UICR->DEBUGCTRL != 0x0)
    {
        nrf_nvmc_write_word((uint32_t)&NRF_UICR->DEBUGCTRL, 0x0);
        NVIC_SystemReset();
    }
#endif
}

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

sne_333 — Wed, 04 Aug 2021 10:23:16 GMT

Hi.. Thank you for your reply. I have added the below code in my firmware in main.c:-

uint32_t APPPROTECT_reg;

APPPROTECT_reg = NRF_UICR->APPROTECT;
NRF_LOG_INFO("APPROTECT REG VAL IS %x",APPPROTECT_reg);

if (NRF_UICR->APPROTECT == 0xFFFFFFFF)
{
NRF_LOG_INFO("PROTECTING FIRMWARE...SETTING APPROTECT");
nrf_nvmc_write_word((uint32_t)&(NRF_UICR->APPROTECT), 0xFFFFFF00);

//NVIC_SystemReset();
}

static void nrf_nvmc_write_word(uint32_t address, uint32_t value)
{
// Enable write.
NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Wen;
__ISB();
__DSB();

*(uint32_t*)address = value;
while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {;}

NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Ren;
__ISB();
__DSB();
}

It seems to be working.I have added this in DFU BLE firmware as well. SWD,JTAG,USB gets blocked but OTA works fine.

Is it the right way to do?

RE: NRF52840 FLASH PROTECTION WITH SDK 15.0.0

Sigurd — Wed, 04 Aug 2021 09:01:48 GMT

Hi,

You can call "nrfjprog --rbp ALL && nrfjprog --reset" to readback protect and reset the device (to latch the new configuration). This is the equivalent to writing to this register, and then do a reset.

In addition, you can build the bootloader with NRF_BL_DEBUG_PORT_DISABLE set to 1 in sdk_config.h, the bootloader will then check if approtect is enabled, and if not, enable it and reset.

[quote user=""]

4) Want to protect firmware of DFU as well.

[/quote]

DFU: To protect the target device against malicious attackers trying to impersonate the rightful sender of the firmware update, the init packet of the firmware package must be signed. But the package is not encrypted. See this post: https://devzone.nordicsemi.com/f/nordic-q-a/60249/official-encrypted-secure-dfu/