nRF5340 NVS and readback_protection

[mnvcsUDT]

Hi Everybody,

We found little or no literature about readback_protection on the nRF5340 SOC. Our issue is that for development and debugging it is not practical to use nrfjprog -recover in order to re-flash as that completely erases the storage partition too. What is the right way to retain NVS data?

Thank you.

Regards,

Milan 

[Einar Thorsrud]

Hi Milan,

You can find documentation about access port protection in the CTRL-AP - Control access port chapter in the product specification.

If I understand you correctly, then this question is about how you handle this during development. And in that case it typically does not make sense to prevent debugging, so then you simply disable access port protection. If you program an application that has been built without ENABLE_APPROTECT defined then you should be good to go (as nrfjprog --recover will have written to UICR.APPROTECT allready, and as long as you do not do a full chip erase or write more to that register, it retains its value and debugging will continue to be enabled as long as you do not program firmware built with ENABLE_APPROTECT defined.

[mnvcsUDT]

Almost all clear.

Except, it is still totally unclear how this is done in practice. There are mentions of using a 32-bit key (?) for both the 

NRF_CTRLAP_S->APPROTECT.DISABLE register and the debugger. But again this is just speculation. Can you please point me to a guide how to disable this? And re-enable in case. 

[Einar Thorsrud]

Hello,

I tested now with nRF Connect SDK 1.7.0 and your changes to the network_coordinator sample. I tested building for both nrf5340dk_nrf5340_cpuapp_ns and nrf5340dk_nrf5340_cpuapp, but in both cases I was able to program repeatedly using west flash.

This is a bit of a mystery. Can you write how you build the application? And the DK version you are reproducing this on? Any other information that could help me reproduce would also be useful.

[mnvcsUDT]

Okay. This is indeed a mistery now.

I attached the build log. The DK version is 0.11.0. The nrf SDK is at 1.7.0. Zephyr is 2.6.99-ncs1

..@.. network_coordinator % west build -b nrf5340dk_nrf5340_cpuapp
-- west build: generating a build system
Including boilerplate (Zephyr base (cached)):  /../../zephyr/cmake/app/boilerplate.cmake
-- Application:  /../../network_coordinator
-- Zephyr version: 2.6.99 ( /../../zephyr), build: v2.6.99-ncs1
-- Found west (found suitable version "0.11.1", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpuapp
-- Cache files will be written to:  /../Library/Caches/zephyr
-- Found dtc: /usr/local/bin/dtc (found suitable version "1.6.0", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (/usr/local/gcc_arm/gcc-arm-none-eabi-10-2020-q4-major)
-- Found BOARD.dts:  /../../zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp.dts
-- Generated zephyr.dts:  /../../network_coordinator/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h:  /../../network_coordinator/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h:  /../../network_coordinator/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file:  /../../network_coordinator/build/zephyr/dts.cmake
Parsing  /../../zephyr/Kconfig
Loaded configuration ' /../../zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpuapp_defconfig'
Merged configuration ' /../../network_coordinator/prj_nrf5340dk_nrf5340_cpuapp.conf'
Configuration saved to ' /../../network_coordinator/build/zephyr/.config'
Kconfig header saved to ' /../../network_coordinator/build/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.2.1
-- The CXX compiler identification is GNU 10.2.1
-- The ASM compiler identification is GNU
-- Found assembler: /usr/local/gcc_arm/gcc-arm-none-eabi-10-2020-q4-major/bin/arm-none-eabi-gcc
Adding '802154_rpmsg' firmware as child image since CONFIG_NRF_802154_SER_HOST is set to y

=== child image 802154_rpmsg - CPUNET begin ===
Including boilerplate (Zephyr base):  /../../zephyr/cmake/app/boilerplate.cmake
-- Application:  /../../zephyr/samples/boards/nrf/ieee802154/802154_rpmsg
-- Zephyr version: 2.6.99 ( /../../zephyr), build: v2.6.99-ncs1
-- Found Python3: /usr/local/bin/python3.9 (found suitable exact version "3.9.7") found components: Interpreter 
-- Found west (found suitable version "0.11.1", minimum required is "0.7.1")
-- Board: nrf5340dk_nrf5340_cpunet
-- Cache files will be written to:  /../Library/Caches/zephyr
-- Found dtc: /usr/local/bin/dtc (found suitable version "1.6.0", minimum required is "1.4.6")
-- Found toolchain: gnuarmemb (/usr/local/gcc_arm/gcc-arm-none-eabi-10-2020-q4-major)
-- Found BOARD.dts:  /../../zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpunet.dts
-- Generated zephyr.dts:  /../../network_coordinator/build/802154_rpmsg/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h:  /../../network_coordinator/build/802154_rpmsg/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h:  /../../network_coordinator/build/802154_rpmsg/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file:  /../../network_coordinator/build/802154_rpmsg/zephyr/dts.cmake
Parsing  /../../zephyr/Kconfig
Loaded configuration ' /../../zephyr/boards/arm/nrf5340dk_nrf5340/nrf5340dk_nrf5340_cpunet_defconfig'
Merged configuration ' /../../zephyr/samples/boards/nrf/ieee802154/802154_rpmsg/prj.conf'
Merged configuration ' /../../nrf/subsys/partition_manager/partition_manager_enabled.conf'
Configuration saved to ' /../../network_coordinator/build/802154_rpmsg/zephyr/.config'
Kconfig header saved to ' /../../network_coordinator/build/802154_rpmsg/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.2.1
-- The CXX compiler identification is GNU 10.2.1
-- The ASM compiler identification is GNU
-- Found assembler: /usr/local/gcc_arm/gcc-arm-none-eabi-10-2020-q4-major/bin/arm-none-eabi-gcc
-- libmetal version: 1.0.0 ( /../../zephyr/samples/boards/nrf/ieee802154/802154_rpmsg)
-- Build type:  
-- Host:    Darwin/x86_64
-- Target:  Generic/arm
-- Machine: cortexm
-- Looking for include file stdatomic.h
-- Looking for include file stdatomic.h - found
-- open-amp version: 1.0.0 ( /../../modules/lib/open-amp/open-amp)
-- Host:    Darwin/x86_64
-- Target:  Generic/arm
-- Machine: cortexm
-- C_FLAGS :  -Wall -Wextra
-- Looking for include file fcntl.h
-- Looking for include file fcntl.h - found
-- Configuring done
-- Generating done
-- Build files have been written to:  /../../network_coordinator/build/802154_rpmsg
=== child image 802154_rpmsg - CPUNET end ===

-- libmetal version: 1.0.0 ( /../../network_coordinator)
-- Build type:  
-- Host:    Darwin/x86_64
-- Target:  Generic/arm
-- Machine: cortexm
-- Looking for include file stdatomic.h
-- Looking for include file stdatomic.h - found
-- open-amp version: 1.0.0 ( /../../modules/lib/open-amp/open-amp)
-- Host:    Darwin/x86_64
-- Target:  Generic/arm
-- Machine: cortexm
-- C_FLAGS :  -Wall -Wextra
-- Looking for include file fcntl.h
-- Looking for include file fcntl.h - found
CMake Warning at  /../../nrfxlib/nrf_802154/sl/sl/CMakeLists.txt:14 (message):
  This combination of SoC and floating point ABI is not supported by the
  nrf_802154_sl
  lib.( /../../nrfxlib/nrf_802154/sl/sl/lib/nRF5340_CPUAPP/hard-float
  doesn't exist.)


CMake Warning at  /../../zephyr/CMakeLists.txt:1612 (message):
  __ASSERT() statements are globally ENABLED


-- Configuring done
-- Generating done
-- Build files have been written to:  /../../network_coordinator/build
-- west build: building application
[1/330] Preparing syscall dependency handling

[7/330] Performing build step for '802154_rpmsg_subimage'
[1/248] Preparing syscall dependency handling

[239/248] Linking C executable zephyr/zephyr_prebuilt.elf

[246/248] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       67996 B       256 KB     25.94%
            SRAM:       26856 B        64 KB     40.98%
           SRAM1:          0 GB        64 KB      0.00%
        IDT_LIST:          0 GB         2 KB      0.00%
[248/248] Generating zephyr/merged_CPUNET.hex
[318/330] Linking C executable zephyr/zephyr_prebuilt.elf

[328/330] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:      298692 B       976 KB     29.89%
            SRAM:       69688 B       512 KB     13.29%
        IDT_LIST:          0 GB         2 KB      0.00%
[330/330] Generating zephyr/merged_domains.hex
..@.. network_coordinator % 

[j4cekc1dz]

Hi,

I'm struggling the same issue and whole day I spent today to understand, why I was not able to attach to RTT. Turned out, that simply flash is cleared during attaching to RTT service , what can be found below. In my case device is locked every time after flashing and off/on sequence. It happens on custom board based on NRF52832 and what is more interesting, I cannot reproduce it on NRF52DK with exactly the same hex file and steps.
I found this topic because I was looking for CONFIG_NRF_SECURE_APPROTECT_LOCK.
This is hello_world app, so no sophisticated features, watchdogs, etc.
So far I have found, that loading image to RAM using debugger and then attaching to RTT can be a workaround in this case.

Steps:

Custom board NRF52832:


jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ west build -b nrf52dk_nrf52832
-- west build: generating a build system
Including boilerplate (Zephyr base): /home/jacek/projects/ncs/zephyr/cmake/app/boilerplate.cmake
-- Application: /home/jacek/projects/ncs/zephyr/samples/hello_world
-- Zephyr version: 2.6.99 (/home/jacek/projects/ncs/zephyr), build: v2.6.99-ncs1
-- Found Python3: /usr/bin/python3.8 (found suitable exact version "3.8.10") found components: Interpreter 
-- Found west (found suitable version "0.11.1", minimum required is "0.7.1")
-- Board: nrf52dk_nrf52832
-- Cache files will be written to: /home/jacek/.cache/zephyr
-- ZEPHYR_TOOLCHAIN_VARIANT not set, trying to locate Zephyr SDK
-- Using toolchain: zephyr 0.12.4 (/opt/zephyr-sdk)
-- Found dtc: /opt/zephyr-sdk/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6")
-- Found BOARD.dts: /home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832.dts
-- Generated zephyr.dts: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/dts.cmake
Parsing /home/jacek/projects/ncs/zephyr/Kconfig
Loaded configuration '/home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832_defconfig'
Merged configuration '/home/jacek/projects/ncs/zephyr/samples/hello_world/prj.conf'
Configuration saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/.config'
Kconfig header saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.2.0
-- The CXX compiler identification is GNU 10.2.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
-- Configuring done
-- Generating done
-- Build files have been written to: /home/jacek/projects/ncs/zephyr/samples/hello_world/build
-- west build: building application
[1/148] Preparing syscall dependency handling

[141/148] Linking C executable zephyr/zephyr_prebuilt.elf

[148/148] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       16588 B       512 KB      3.16%
            SRAM:        5376 B        64 KB      8.20%
        IDT_LIST:          0 GB         2 KB      0.00%
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
ERROR: The operation attempted is unavailable due to readback protection in
ERROR: your device. Please use --recover to unlock the device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog --recover
Recovering device. This operation might take 30s.
Writing image to disable ap protect.
Erasing user code and UICR flash areas.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.125V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.127V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
CTRL-AP indicates that the device is secured.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

Executing default behavior previously saved in the registry.
Device will be unsecured now.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

NRF52DK:

jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
Parsing image file.
Erasing page at address 0x0.
Erasing page at address 0x1000.
Erasing page at address 0x2000.
Erasing page at address 0x3000.
Erasing page at address 0x4000.
Applying system reset.
Checking that the area to write is not protected.
Programming device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

Best regards,
Jacek

[j4cekc1dz]

Ok. It seems like my case is related to infocenter.nordicsemi.com/.../nRF52832_Rev_3_Errata_v1.0.pdf

but workaround doesn't work.

[Einar Thorsrud]

I understand you are seeing issues related to the improve AP protect mechanism on the latest revisions of the nRF52 series devices, but it is not clear that it is the same issue as discussed in this thread. Please open a new question for for the issue you are seeing instead of discussing it in this thread.