APPROTEC can't be disabled

[Ernst Smirnov]

Hello everyone!

We've integrated the readout protection to our project, but unfortunately now we don't able to disable it.

The activation code presented below:

  if ((NRF_UICR->APPROTECT & UICR_APPROTECT_PALL_Msk) == UICR_APPROTECT_PALL_Enabled)
  {
    return false;
  }

  NRF_NVMC->CONFIG = (NVMC_CONFIG_WEN_Wen << NVMC_CONFIG_WEN_Pos);
  while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {}
  NRF_UICR->APPROTECT = UICR_APPROTECT_PALL_Enabled;
  while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {}
  NRF_NVMC->CONFIG = (NVMC_CONFIG_WEN_Ren << NVMC_CONFIG_WEN_Pos);
  while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}

  return true;

So we tried to use nrfjprog.exe --recover and did manipulations with jlinkcommander (access via control access port).

Each time everything looks like protection is disabled, but chip remains unflashable.

Could you help us please with this issue?

Many thanks in advance!

Best Regards

Ernst

[Elfving]

Hello Ernst!

What SoC are you using?

And in what way does it seem like it is disabled? Doesn't for instance the nRF Connect Programmer complain that it is locked?

Best regards,

Elfving

[Ernst Smirnov]

Hello Elfving!

Thanks for your answer!

We use nrf52840.

Elfving said:

And in what way does it seem like it is disabled?

So, we read the following register via JLinkCommander

SWDReadAP 3 //CTRL-AP Bank 0, register offset 3 (APPROTECTSTATUS 0x00C): Access port protection status
SWDReadAP 3 //Second read returns the value: 0: enabled 1: not enabled

And it is returned as 1.

nRF Connect doesn't warn anything after unlock, but after power re-connection it complain about the protection is activated.

Best Regards!

Ernst

[Elfving]

Hey Ernst!

That is weird. Could you try updating nrfjprog and trying again? And if that doesn't work give me your nrfjprog version.

Best regards,

Elfving

[Ernst Smirnov]

Hello Elfving!

I apologize for the late answer, it seems that I missed the notification.

Yeach, I tried updating but it didn't help unfortunately :(

>nrfjprog --version
nrfjprog version: 10.15.0 external
JLinkARM.dll version: 7.56a

Thank you for your time!

Best regards,

Ernst

[Elfving]

Hi Ernst! No worries!

That is really odd. Could you try again, and follow the steps outlined in this file?

Fullscreen demonstrate_nrfjprog_and_approtect.cmd.txt Download

:: For this demostration first ensure that the device is completly erased and power-cycled,
:: for instance by doing the following:
:: nrfjprog --recover
:: nrfjprog -e
:: power-cycle the board

:: First demonstrate that debugging is not possible (this read should fail):
nrfjprog.exe --memrd 0

:: To enable debugging/programming a empty device must first be recovered. Recover also writes a small
:: piece of startup code that enables debugging, as that must also be enabled from the CPU:
nrfjprog --recover

:: Now attempt to read from flash again (this time it should succeed):
nrfjprog.exe --memrd 0


:: Expected output from the three commands:
:: >nrfjprog.exe --memrd 0
:: ERROR: The operation attempted is unavailable due to readback protection in
:: ERROR: your device. Please use --recover to unlock the device.
:: NOTE: For additional output, try running again with logging enabled (--log).
:: NOTE: Any generated log error messages will be displayed.
:: 
:: >nrfjprog.exe --recover
:: Recovering device. This operation might take 30s.
:: Writing image to disable ap protect.
:: Erasing user code and UICR flash areas.
:: 
:: >nrfjprog.exe --memrd 0
:: 0x00000000: 20040000                              |... |

If that doesn't work, send me a hexdump by running:

nrfjprog --readcode --readuicr dump.hex

Best regards,

Elfving

[Ernst Smirnov]

Hello Elfving!

Thank you for the answer!

Yes, I tried according instruction you attached, but seems that it didn't help :(

I've attached the screenshot and the dump file.

6332.dump.hex

Many thanks for your concern!

Have a great day!

Best Regards,

Ernst