Read back protection on nRF52840 old and new build codes/hardware revisions

[lanwer]

Hi there, 

I am trying to enable the Read Back Protection in the software itself to avoid the FLASH, RAM etc. from being read with a debugger after being flashed for production. I succeeded to do so with the code below running on Zephyr OS, which works fine for our device nRF52840 of the hardware version "AAD0". My question is: would the same code work also for build codes Fxx and later? If not, what should I do to achieve the readback protection capability on the newer devices (Fxx and later)?

Another question, because I am not able to test this, as I don't have a device with build code Fxx: does the enabled Access Port Protection in any way limit the software from internally reading/writing Flash/Ram (not using the debugger)?

void nrf_nvmc_write_word(uint32_t address, uint32_t value)
{
	// Enable flash write access and wait until the NVMC is ready
    NRF_NVMC->CONFIG = (NVMC_CONFIG_WEN_Wen << NVMC_CONFIG_WEN_Pos);
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {;}

    // Write to the register and wait until the NVMC is ready
    *(uint32_t*)address = value;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {;}

	// Disable flash write access and wait until the NVMC is ready
    NRF_NVMC->CONFIG = (NVMC_CONFIG_WEN_Ren << NVMC_CONFIG_WEN_Pos);
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy) {;}
}

void nrf_debug_port_disable(void)
{
	k_sleep(K_MSEC(1000));
	if (NRF_UICR->APPROTECT == 0xFFFFFFFF)
    {
		LOG_WRN("Access Port Protection is not enabled --> Enable Access Port Protection now");
		/* Enable Access Port Protection
		 * Access through debugger to CPU registers, mapped-memory and RAM will be disabled
		 * To disable protection ERASEALL command must be applied. */
		nrf_nvmc_write_word((uint32_t)&NRF_UICR->APPROTECT, 0xFFFFFF00);
		LOG_INF("Access Port Protection is now enabled --> Reboot to apply the config...");

		// Sleep is only necessary to show the logs before reboot for debug purposes
		k_sleep(K_MSEC(2000));

		//NVIC_SystemReset();
		sys_reboot(SYS_REBOOT_COLD);
    }
	else
	{
		LOG_INF("Access Port Protection is already enabled");
	}
}

Thanks!

[Simonr]

Hi

What version of the nRFConnect SDK or Zephyr are you using? Due to the changes in the MDK there is a requirement to use firmware based on nRFConnect SDK v1.6.0 (Zephyr v2.6.0) or later. You can see IN-141 for more information. 

Best regards,

Simon

[lanwer]

Hi, 

Thanks for your reply. I am using Zephyr v2.7.0. I hope this helps you to answer my questions. 

If I got it right, then the only thing I need to do for newer hardware versions (Fxx and later) is to add to my code above (that already writes 0xFFFFFF00 to UICR->APPROTECT and does a cold reset) the following step:

--> "write APPROTECT.FORCEPROTECT to Force (0x00)" after the mcu reboots. 

Could you please confirm my understanding?

Is there a Zephyr Conf "ENABLE_APPROTECT" that I need to do? As I said, for the device of build code "AAD0", the code above works without problems. 

[Simonr]

Hi

According to the nrf52840_bitfields.h you can force enable the APPROTECT by setting APPROTECT_FORCEPROTECT_FORCEPROTECT_Force.

ENABLE_APPROTECT can be set in the CMakeLists.txt of your project.

Best regards,

Simon

[yoyou]

Hi

in CmakeLists.txt:

set( ENABLE_APPROTECT 1 )   

     

  

 APPROTECT_FORCEPROTECT_FORCEPROTECT_Force

nrf_nvmc_write_word((uint32_t)&NRF_UICR->APPROTECT, 0xFFFFFF00);

       

Is it correct？

   

    

Best regards,

[Simonr]

You can see how ENABLE_APPROTECT is enabled in CMakeLists.txt in this file ...\<Your NCS folder>\v2.2.0\zephyr\modules\hal_nordic\nrfx\CMakeLists.txt

Best regards,

Simon