Erasing Flash memory with application loaded via open serial bootloader

RE: Erasing Flash memory with application loaded via open serial bootloader

Dimitris — Mon, 04 Oct 2021 05:31:57 GMT

Ok, I see. Thank you for the response!

RE: Erasing Flash memory with application loaded via open serial bootloader

Vidar Berg — Fri, 01 Oct 2021 13:47:02 GMT

Yes, it may behave differently in debug mode.

1) 2) There is no way to disable the protection after it has been enabled by the bootloader, so the MBR, bootloader, param page, and settings page cannot be erased.

RE: Erasing Flash memory with application loaded via open serial bootloader

Dimitris — Fri, 01 Oct 2021 13:44:55 GMT

To my understanding the Access control list is configured at startup by the bootloader and cannot be modified afterwards, only after a reset. Since a reset starts again from the bootloader I suppose there is no way to bypass this...

I suppose when we tried to program the erasing firmware with the Segger Embedded Studio and the J-Link, the bootloader was bypassed somehow and the code ran directly from the erasing firmware without setting the Access Control List after the reset(?) That is why the erasing firmware works then.

So my questions are these:

1) Is there a way to modify the Access Control List when the bootloader is used?

2) If there is no way to modify it, then the following cannot be implemented, correct?

[quote userid="77759" url="~/f/nordic-q-a/80205/erasing-flash-memory-with-application-loaded-via-open-serial-bootloader"]program an application via uart bootloader to erase anything but the bootloader and MBR[/quote]

RE: Erasing Flash memory with application loaded via open serial bootloader

Vidar Berg — Fri, 01 Oct 2021 13:29:55 GMT

Yes, the bootloader will protect these pages through the ACL — Access control lists, so you should not attempt to erase those.

RE: Erasing Flash memory with application loaded via open serial bootloader

Dimitris — Fri, 01 Oct 2021 13:28:14 GMT

[quote userid="4240" url="~/f/nordic-q-a/80205/erasing-flash-memory-with-application-loaded-via-open-serial-bootloader/332145#332145"]

It guess it should work if you erase that page last. Is the code that erase the chip is running from RAM?

[/quote]

In this test we tried two firmware versions: One with the code running from Flash and one from RAM. It worked in both cases. This is the last page erased as you mentioned.

[quote userid="4240" url="~/f/nordic-q-a/80205/erasing-flash-memory-with-application-loaded-via-open-serial-bootloader/332145#332145"]Is the application start address set to 0x1000 and ram to 0x20000008 in your linker configuration so it doesn't overlap with the MBR?[/quote]

Yes, the linker configuration is like the one you mentioned.

After some more experimentation it seems that the firmware is able to delete most of the pages (soft device, old firmware) but it gets stuck when trying to delete any of the following pages (probably a hard fault):

- The page starting from 0x1000 (where the erasing firmware is programmed): this is odd because the function that erases it runs from the RAM.
- The page that starts from 0x7F000 and 0x7E000 (which as I can understand are the MBR parameters, and Bootloader Settings Pages)

More specifically the problem happens when writing those addresses in the NVMC ERASE register (either one of them, we tried them all).

Is it possible that the bootloader "locks" those pages? Is there a way to bypass this lock?

RE: Erasing Flash memory with application loaded via open serial bootloader

Vidar Berg — Fri, 01 Oct 2021 12:24:31 GMT

Hello,

[quote user=""] 3.1) We programmed an empty device without a bootloader with the erasing firmware (Flash set to start at address 0x0) to test if it could erase itself and it could. The erasing function was set to run from RAM. We also tried it with the erasing function not run from RAM and it also worked, which is a bit confusing, we expected this not to work since when the page was erased, it was in use(?) [/quote]

It guess it should work if you erase that page last. Is the code that erase the chip is running from RAM?

[quote user=""]The function to erase firmware was set to run from RAM again. When the device is loaded with MBR, bootloader and the temporary firmware:
- if we program the erasing firmware via a J-Link debugger through embedded studio, the memory (soft device etc, previous application and the erasing firmware) is erased, leaving the bootloader intact. (in other words it works as it should)
- When the device is programmed via uart using the bootloader, it does not work (it seems to stop when writing to NVMC erase register.[/quote]

Is the application start address set to 0x1000 and ram to 0x20000008 in your linker configuration so it doesn't overlap with the MBR?

Best regards,

Vidar