nRF5340 NVS and readback_protection

[mnvcsUDT]

Hi Everybody,

We found little or no literature about readback_protection on the nRF5340 SOC. Our issue is that for development and debugging it is not practical to use nrfjprog -recover in order to re-flash as that completely erases the storage partition too. What is the right way to retain NVS data?

Thank you.

Regards,

Milan 

[Einar Thorsrud]

Hi Milan,

You can find documentation about access port protection in the CTRL-AP - Control access port chapter in the product specification.

If I understand you correctly, then this question is about how you handle this during development. And in that case it typically does not make sense to prevent debugging, so then you simply disable access port protection. If you program an application that has been built without ENABLE_APPROTECT defined then you should be good to go (as nrfjprog --recover will have written to UICR.APPROTECT allready, and as long as you do not do a full chip erase or write more to that register, it retains its value and debugging will continue to be enabled as long as you do not program firmware built with ENABLE_APPROTECT defined.

[mnvcsUDT]

Almost all clear.

Except, it is still totally unclear how this is done in practice. There are mentions of using a 32-bit key (?) for both the 

NRF_CTRLAP_S->APPROTECT.DISABLE register and the debugger. But again this is just speculation. Can you please point me to a guide how to disable this? And re-enable in case. 

[j4cekc1dz]

Hi,

I'm struggling the same issue and whole day I spent today to understand, why I was not able to attach to RTT. Turned out, that simply flash is cleared during attaching to RTT service , what can be found below. In my case device is locked every time after flashing and off/on sequence. It happens on custom board based on NRF52832 and what is more interesting, I cannot reproduce it on NRF52DK with exactly the same hex file and steps.
I found this topic because I was looking for CONFIG_NRF_SECURE_APPROTECT_LOCK.
This is hello_world app, so no sophisticated features, watchdogs, etc.
So far I have found, that loading image to RAM using debugger and then attaching to RTT can be a workaround in this case.

Steps:

Custom board NRF52832:


jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ west build -b nrf52dk_nrf52832
-- west build: generating a build system
Including boilerplate (Zephyr base): /home/jacek/projects/ncs/zephyr/cmake/app/boilerplate.cmake
-- Application: /home/jacek/projects/ncs/zephyr/samples/hello_world
-- Zephyr version: 2.6.99 (/home/jacek/projects/ncs/zephyr), build: v2.6.99-ncs1
-- Found Python3: /usr/bin/python3.8 (found suitable exact version "3.8.10") found components: Interpreter 
-- Found west (found suitable version "0.11.1", minimum required is "0.7.1")
-- Board: nrf52dk_nrf52832
-- Cache files will be written to: /home/jacek/.cache/zephyr
-- ZEPHYR_TOOLCHAIN_VARIANT not set, trying to locate Zephyr SDK
-- Using toolchain: zephyr 0.12.4 (/opt/zephyr-sdk)
-- Found dtc: /opt/zephyr-sdk/sysroots/x86_64-pokysdk-linux/usr/bin/dtc (found suitable version "1.5.0", minimum required is "1.4.6")
-- Found BOARD.dts: /home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832.dts
-- Generated zephyr.dts: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/zephyr.dts
-- Generated devicetree_unfixed.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/devicetree_unfixed.h
-- Generated device_extern.h: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/device_extern.h
-- Including generated dts.cmake file: /home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/dts.cmake
Parsing /home/jacek/projects/ncs/zephyr/Kconfig
Loaded configuration '/home/jacek/projects/ncs/zephyr/boards/arm/nrf52dk_nrf52832/nrf52dk_nrf52832_defconfig'
Merged configuration '/home/jacek/projects/ncs/zephyr/samples/hello_world/prj.conf'
Configuration saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/.config'
Kconfig header saved to '/home/jacek/projects/ncs/zephyr/samples/hello_world/build/zephyr/include/generated/autoconf.h'
-- The C compiler identification is GNU 10.2.0
-- The CXX compiler identification is GNU 10.2.0
-- The ASM compiler identification is GNU
-- Found assembler: /opt/zephyr-sdk/arm-zephyr-eabi/bin/arm-zephyr-eabi-gcc
-- Configuring done
-- Generating done
-- Build files have been written to: /home/jacek/projects/ncs/zephyr/samples/hello_world/build
-- west build: building application
[1/148] Preparing syscall dependency handling

[141/148] Linking C executable zephyr/zephyr_prebuilt.elf

[148/148] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       16588 B       512 KB      3.16%
            SRAM:        5376 B        64 KB      8.20%
        IDT_LIST:          0 GB         2 KB      0.00%
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
ERROR: The operation attempted is unavailable due to readback protection in
ERROR: your device. Please use --recover to unlock the device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog --recover
Recovering device. This operation might take 30s.
Writing image to disable ap protect.
Erasing user code and UICR flash areas.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.125V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link Pro V4 compiled Sep 24 2021 16:41:59
Hardware version: V4.00
S/N: 174402102
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
IP-Addr: DHCP (no addr. received yet)
VTref=3.127V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
CTRL-AP indicates that the device is secured.
For debugger connection the device needs to be unsecured.
Note: Unsecuring will trigger a mass erase of the internal flash.

Executing default behavior previously saved in the registry.
Device will be unsecured now.
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

NRF52DK:

jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --program build/zephyr/zephyr.hex --sectorerase
Parsing image file.
Erasing page at address 0x0.
Erasing page at address 0x1000.
Erasing page at address 0x2000.
Erasing page at address 0x3000.
Erasing page at address 0x4000.
Applying system reset.
Checking that the area to write is not protected.
Programming device.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ nrfjprog -f nrf52 --reset
Applying system reset.
Run.
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ # power supply off/on sequence
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$ /opt/SEGGER/JLink/JLinkExe -device NRF52832_xxAA -if swd -speed auto -AutoConnect 1 -RTTTelnetPort 36601
SEGGER J-Link Commander V7.56a (Compiled Oct 11 2021 16:31:53)
DLL version V7.56a, compiled Oct 11 2021 16:31:37

RTT Telnet Port set to 36601
Connecting to J-Link via USB...O.K.
Firmware: J-Link OB-SAM3U128-V2-NordicSemi compiled Feb  2 2021 16:47:20
Hardware version: V1.00
S/N: 682192662
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
VTref=3.300V
Device "NRF52832_XXAA" selected.


Connecting to target via SWD
InitTarget() start
InitTarget() end
Found SW-DP with ID 0x2BA01477
DPIDR: 0x2BA01477
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: JTAG-AP (IDR: 0x02880000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][5]: E0041000 CID B105900D PID 000BB925 ETM
Cortex-M4 identified.
J-Link>q
jacek@zbook:~/projects/ncs/zephyr/samples/hello_world$

Best regards,
Jacek

[j4cekc1dz]

Ok. It seems like my case is related to infocenter.nordicsemi.com/.../nRF52832_Rev_3_Errata_v1.0.pdf

but workaround doesn't work.

[Einar Thorsrud]

I understand you are seeing issues related to the improve AP protect mechanism on the latest revisions of the nRF52 series devices, but it is not clear that it is the same issue as discussed in this thread. Please open a new question for for the issue you are seeing instead of discussing it in this thread.

[mnvcsUDT]

Hi Einar,

Did we get any closer to this or the conclusion is the nrf5340 simply cannot be used with a watchdog?

[Einar Thorsrud]

Hi,

Sorry, I missed your previous reply. No, I do not think we can conclude with that. I am not able to reproduce what you are seeing and the WDT does not prevent debugging on my desk using NCS 1.7.0 and teh nRF5340 DK 0.11.0. I do not doubt your observations, though.

In order to try to reproduce, perhaps you can upload the exact project you use to test? Not just diffs or singe files, but the entire project folder. For instance use a clean NCS 1.7 checkout, and modify only the network_coordinator sample. Then upload the entire sample here. Can you also include the hex files so that I can see if I am able to reproduce the issue using the firmware you have built on my DK?

[mnvcsUDT]

Hi, 

I did as you recommended. I kept the binaries in /build/zephyr folder. network_coordinator.zip

[Einar Thorsrud]

Hi,

I am not able to reproduce even with the firmware you built. Do you by any chance have a second nRF5340 DK you can test, to see if that has an effect (I dobt it, but I am running out of ideas)?

[mnvcsUDT]

Hi Einar,

It does happen with a second DK, unfortunately. I am having some nrf5340 based prototypes soon and I can test those as well.

Well, I will try with another installation of the whole SDK and Zephyr. Will get back on this.