How to remove the nRF9160's erase protection.

Hello everyone,

I'm working on a project with nRF9160 and I used to this code to test the erase protection. But I found that the value of the "ERASEPROTECT->DISABLE" register does not match.

#include <zephyr.h>

void main(void)
{
    NRF_NVMC->CONFIG = ( (NVMC_CONFIG_WEN_Wen | NVMC_CONFIG_WEN_Een) << NVMC_CONFIG_WEN_Pos);
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }


    NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_UICR->APPROTECT = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_UICR->ERASEPROTECT = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = 0xDEADBEEF;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    printk("Before Write Key.\n");
    printk("ERASEPROTECT     Addr	 0x%X\n", &NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
    printk("ERASEPROTECT          0x%X\n",  NRF_UICR->ERASEPROTECT);
    printk("ERASEPROTECT.LOCK    0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
    printk("ERASEPROTECT.DISABLE 0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE);

    uint32_t count = 0;

    while (1)
    {
        k_msleep(1000);
        printk("Count:: %u\r\n", count++);
    }
} /* main */

Command to build this code:

$ west build -b nrf9160dk_nrf9160 .

My result on UART terminal.

*** Booting Zephyr OS build v3.0.99-ncs1 ***

Begin Unlock.
Before Write Key.
ERASEPROTECT Addr 0x50006500
ERASEPROTECT 0x0
ERASEPROTECT.LOCK 0x0
ERASEPROTECT.DISABLE 0x0

And then I try to write the value to "ERASEPROTECT->DISABLE" as the same c-code using this script.

setPassword.txt

SWDSelect
SWDWriteDP 1 0x50000000  
SWDWriteDP 2 0x04000010  
SWDWriteAP 3 0xDEADBEEF

sleep 10000
SWDWriteDP 1 0x50000000  
SWDWriteDP 2 0x04000000  
SWDWriteAP 0 0x00000001
SWDReadAP 0
SWDReadAP 0
sleep 5000
SWDWriteAP 0 0x00000000
SWDReadAP 0
SWDReadAP 0
sleep 1000

exit

Command to run script

$ JLinkExe -Commandfile setPassword.jlink 

The result:

SEGGER J-Link Commander V7.80c (Compiled Sep 27 2022 16:06:19)
DLL version V7.80c, compiled Sep 27 2022 16:05:56
J-Link Command File read successfully.
Processing script file...
J-Link>SWDSelect
J-Link connection not established yet but required for command.
Connecting to J-Link via USB...O.K.
Firmware: J-Link Ultra V5-1 compiled Sep 22 2022 14:54:27
Hardware version: V5.10
J-Link uptime (since boot): 0d 00h 13m 13s
S/N: 505101964
License(s): RDI, FlashBP, FlashDL, JFlash, GDB
USB speed mode: High speed (480 MBit/s)
VTref=3.270V
Select SWD by sending SWD switching sequence.
Found SWD-DP with ID 0x6BA02477
J-Link>SWDWriteDP 1 0x50000000
Write DP register 1 = 0x50000000
J-Link>SWDWriteDP 2 0x04000010
Write DP register 2 = 0x04000010
J-Link>SWDWriteAP 3 0xDEADBEEF
Write AP register 3 = 0xDEADBEEF
J-Link>sleep 10000
Sleep(10000)
J-Link>SWDWriteDP 1 0x50000000
Write DP register 1 = 0x50000000
J-Link>SWDWriteDP 2 0x04000000
Write DP register 2 = 0x04000000
J-Link>SWDWriteAP 0 0x00000001
Write AP register 0 = 0x00000001
J-Link>SWDReadAP 0
Read AP register 0 = 0x00000000
J-Link>SWDReadAP 0
Read AP register 0 = 0x00000001
J-Link>sleep 5000
Sleep(5000)
J-Link>SWDWriteAP 0 0x00000000
Write AP register 0 = 0x00000000
J-Link>SWDReadAP 0
Read AP register 0 = 0x00000001
J-Link>SWDReadAP 0
Read AP register 0 = 0x00000000
J-Link>sleep 1000
Sleep(1000)
J-Link>exit

Script processing completed.

I found my board can't disable erase protection and I can't recover it.

Helpful hints Exactly what is happening?

Best regards

Wasan

Parents
  • Hi,

    setPassword.txt

    The script looks correct.

    I found my board can't disable erase protection and I can't recover it.

    1) So nrfjprog --recover is not working?

    2) What is APPROTECT.STATUS register (0x00C) of the CTRL-AP returning? See this page

  • 1) So nrfjprog --recover is not working?

    Yes. It is not working.

    [tdc@localhost script]$ nrfjprog --recover
    Recovering device. This operation might take 30s.
    ERROR: Recover failed. Please make sure that the correct device family is given
    ERROR: and try again.
    NOTE: For additional output, try running again with logging enabled (--log).
    NOTE: Any generated log error messages will be displayed.

    2) What is APPROTECT.STATUS register (0x00C) of the CTRL-AP returning? See this page

    APPROTECT = Enable

    SECUREAPPROTECT = Disable

    My result.

    Select SWD by sending SWD switching sequence.
    Found SWD-DP with ID 0x6BA02477
    J-Link>SWDWriteDP 1 0x50000000
    Write DP register 1 = 0x50000000
    J-Link>SWDWriteDP 2 0x04000000
    Write DP register 2 = 0x04000000
    J-Link>SWDReadAP 3
    Read AP register 3 = 0x00000000
    J-Link>SWDReadAP 3
    Read AP register 3 = 0x00000002
    J-Link>exit
    
    Script processing completed.
    
    

Reply
  • 1) So nrfjprog --recover is not working?

    Yes. It is not working.

    [tdc@localhost script]$ nrfjprog --recover
    Recovering device. This operation might take 30s.
    ERROR: Recover failed. Please make sure that the correct device family is given
    ERROR: and try again.
    NOTE: For additional output, try running again with logging enabled (--log).
    NOTE: Any generated log error messages will be displayed.

    2) What is APPROTECT.STATUS register (0x00C) of the CTRL-AP returning? See this page

    APPROTECT = Enable

    SECUREAPPROTECT = Disable

    My result.

    Select SWD by sending SWD switching sequence.
    Found SWD-DP with ID 0x6BA02477
    J-Link>SWDWriteDP 1 0x50000000
    Write DP register 1 = 0x50000000
    J-Link>SWDWriteDP 2 0x04000000
    Write DP register 2 = 0x04000000
    J-Link>SWDReadAP 3
    Read AP register 3 = 0x00000000
    J-Link>SWDReadAP 3
    Read AP register 3 = 0x00000002
    J-Link>exit
    
    Script processing completed.
    
    

Children
No Data
Related