How to remove the nRF9160's erase protection.

RE: How to remove the nRF9160's erase protection.

Dinesh Kumar K — Wed, 29 Nov 2023 14:55:42 GMT

Hi wasan
The issue was solved, I made a mistake by putting ERASEPROTECT.LOCK enable state and setting key to ERASEPROTECT.DISABLE.

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        if (NRF_UICR_S->ERASEPROTECT != UICR_ERASEPROTECT_PALL_Unprotected)
        {
                NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK = (uint32_t)0x00000001;
        }

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        if (NRF_UICR_S->ERASEPROTECT != UICR_ERASEPROTECT_PALL_Unprotected)
        {
            NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = key;
        }

Doing this locked out the device before setting the erase protect key. which in turn makes the device unrecoverable. it was clearly discussed here https://devzone.nordicsemi.com/f/nordic-q-a/100614/request-for-guidance-and-documentation-on-eraseprotect-approtect-secureapprotect

RE: How to remove the nRF9160's erase protection.

wasan — Thu, 09 Nov 2023 14:36:15 GMT

Could you provide output message when you run command scrip?

Sorry for reply late.

RE: How to remove the nRF9160's erase protection.

Dinesh Kumar K — Mon, 26 Jun 2023 12:41:36 GMT

Hi wasan ,
I read through the Q&A as I wanted to test the working of ERASEPROTECT and disable it using the Jlink script you have provided, I think I am also not able to disable erase protection. nrfjprog --recover is also not helping.

/*
 * Copyright (c) 2012-2014 Wind River Systems, Inc.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

#include <zephyr.h>

void main(void)
{
        const uint32_t key = 0xDEADBEEF;

        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Wen;

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        NRF_UICR->APPROTECT = 0x00000000;

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        NRF_UICR->ERASEPROTECT = 0x00000000;

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        NRF_UICR->SECUREAPPROTECT = 0x00000000;

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Ren;

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        if (NRF_UICR_S->ERASEPROTECT != UICR_ERASEPROTECT_PALL_Unprotected)
        {
                NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK = (uint32_t)0x00000001;
        }

        while (NRF_NVMC->READY == NVMC_READY_READY_Busy);
        if (NRF_UICR_S->ERASEPROTECT != UICR_ERASEPROTECT_PALL_Unprotected)
        {
            NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = key;
        }

        printk("Before Write Key.\n");
        printk("ERASEPROTECT     Addr    0x%p\n", &NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
        printk("ERASEPROTECT          0x%X\n",  NRF_UICR->ERASEPROTECT);
        printk("ERASEPROTECT.LOCK    0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
        printk("ERASEPROTECT.DISABLE 0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE);
        uint32_t count = 0;

        k_msleep(1000);

        while (count < 10)
        {
                k_msleep(1000);
                printk("Count:: %u\r\n", count++);
        }

}

output:

*** Booting Zephyr OS build zephyr-v2.3.0-22164-gb121d671c44c  ***                                                                     
Before Write Key.                                                                                                                      
ERASEPROTECT     Addr    0x0x50006500                                                                                                  
ERASEPROTECT          0x0                                                                                                              
ERASEPROTECT.LOCK    0x1                                                                                                               
ERASEPROTECT.DISABLE 0x0                                                                                                               
Count:: 0                                                                                                                              
Count:: 1                                                                                                                              
Count:: 2                                                                                                                              
Count:: 3                                                                                                                              
Count:: 4                                                                                                                              
Count:: 5                                                                                                                              
Count:: 6                                                                                                                              
Count:: 7                                                                                                                              
Count:: 8                                                                                                                              
Count:: 9

jlink script:

USB 960093400
SWDSelect
SWDWriteDP 1 0x50000000  
SWDWriteDP 2 0x04000010
SWDWriteAP 3 0xDEADBEEF

sleep 10000
SWDWriteDP 1 0x50000000
SWDWriteDP 2 0x04000000
SWDWriteAP 0 0x00000001
SWDReadAP 0
SWDReadAP 0
sleep 5000
SWDWriteAP 0 0x00000000
SWDReadAP 0
SWDReadAP 0
sleep 1000

exit

Help needed.

Thanks,
Dinesh Kumar K

RE: How to remove the nRF9160's erase protection.

wasan — Tue, 06 Dec 2022 08:45:03 GMT

Hi All,

When I remove some line in my code as below. My device is working.

Test base on:

SDK 2.1.2

MCU nRF9160

/*
 * Copyright (c) 2012-2014 Wind River Systems, Inc.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

#include <zephyr.h>
#include <drivers/gpio.h>

#define GPIO_DEV     gpio0 /**< The gpio blank name. */
#define BUTTON_A_PIN 12    /**< Pin number of factory button. */
#define BUTTON_B_PIN 18    /**< Pin number of factory button. */

static const struct device *gpio_dev;

void main(void)
{
    const uint32_t key = 0xDEADBEEF;

    gpio_dev = DEVICE_DT_GET(DT_NODELABEL(GPIO_DEV));
    if (gpio_dev == NULL)
    {
        LOG_ERR("Could not get GPIO Module.");
        return -EIO;
    }

    gpio_pin_configure(gpio_dev, BUTTON_A_PIN, GPIO_INPUT);
    gpio_pin_configure(gpio_dev, BUTTON_B_PIN, GPIO_INPUT);

    NRF_NVMC->CONFIG = ( (NVMC_CONFIG_WEN_Wen  ) << NVMC_CONFIG_WEN_Pos);
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_UICR->APPROTECT = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_UICR->ERASEPROTECT = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    NRF_UICR->SECUREAPPROTECT = 0x00000000;
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }


    NRF_NVMC->CONFIG = ( (NVMC_CONFIG_WEN_Ren  ) << NVMC_CONFIG_WEN_Pos);
    while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    { }

    /**
     * @brief When unuse unlock feature in this boot.
     *
     */
    // NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK = 0x00000001;
    // while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
    // { }

    printk("Before Write Key.\n");
    printk("ERASEPROTECT     Addr	 0x%X\n", &NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
    printk("ERASEPROTECT          0x%X\n",  NRF_UICR->ERASEPROTECT);
    printk("ERASEPROTECT.LOCK    0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.LOCK);
    printk("ERASEPROTECT.DISABLE 0x%X\n",   NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE);
    uint32_t count = 0;

    k_msleep(1000);
    while (1)
    {
        if (0 == gpio_pin_get(gpio_dev, BUTTON_A_PIN))
        {
            k_msleep(100);
            if (0 == gpio_pin_get(gpio_dev, BUTTON_A_PIN))
            {
                printk("Unlock with Key A:0x%x\r\n", count++);

                NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = 0xDEADBEEF;
                while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
                { }

                while (0 == gpio_pin_get(gpio_dev, BUTTON_A_PIN))
                {
                    k_msleep(1);
                }
            }
        }


        if (0 == gpio_pin_get(gpio_dev, BUTTON_B_PIN))
        {
            k_msleep(100);
            if (0 == gpio_pin_get(gpio_dev, BUTTON_B_PIN))
            {
                printk("Unlock with Key B:0x%x\r\n", count++);

                NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = 0x00000000;
                while (NRF_NVMC->READY == NVMC_READY_READY_Busy)
                { }

                while (0 == gpio_pin_get(gpio_dev, BUTTON_B_PIN))
                {
                    k_msleep(1);
                }
            }
        }

        k_msleep(1);
    }
} /* main */

Command to build this code:

$ west build -b nrf9160dk_nrf9160 .
Scrip file > setPassword.jlink
SWDSelect
SWDWriteDP 1 0x50000000  
SWDWriteDP 2 0x04000010  
SWDWriteAP 3 0xDEADBEEF

sleep 10000
SWDWriteDP 1 0x50000000  
SWDWriteDP 2 0x04000000  
SWDWriteAP 0 0x00000001
SWDReadAP 0
SWDReadAP 0
sleep 5000
SWDWriteAP 0 0x00000000
SWDReadAP 0
SWDReadAP 0
sleep 1000

exit

Command to run script
$ JLinkExe -Commandfile setPassword.jlink 
Noted:
1. The device can't  disable erase protection when set the register NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE = 0x00000000;  
2. Please use the "nrfjprog --recover" command to test the nRF91's erase protection that has been disabled.
Best regards
Wasan

RE: How to remove the nRF9160's erase protection.

Sigurd — Mon, 14 Nov 2022 15:31:42 GMT

Hi,

Looking at the whitepaper again, https://infocenter.nordicsemi.com/topic/nan_041/APP/nan_production_programming/device_protection.html , the order does not seem to matter, but, you need to wait to reset until all the protections are set.

RE: How to remove the nRF9160's erase protection.

wasan — Wed, 09 Nov 2022 02:57:40 GMT

Hi Sigurd,

Thank you for your information.

Do you know about how to config NRF_CTRL_AP_PERI_S->ERASEPROTECT.DISABLE?

When can I put the value to ERASEPROTECT.DISABLE before or after enalbe APPROTECT and ERASEPROTECT?

RE: How to remove the nRF9160's erase protection.

Sigurd — Thu, 03 Nov 2022 12:11:48 GMT

Hi,

I'm still doing some testing on this. We have this pynrfjprog script, originally developed for nRF53 by one of my colleagues, that looks like it can be used. In the script change "NRF53" and ap-id to 4, and it should in theory work.

Link to the pynrfjprog script:

https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/blob/main/ctrl-ap/eraseprotect/scripts/disable_eraseprotect.py

RE: How to remove the nRF9160's erase protection.

wasan — Fri, 28 Oct 2022 08:44:30 GMT

1) So nrfjprog --recover is not working?

Yes. It is not working.

[tdc@localhost script]$ nrfjprog --recover
Recovering device. This operation might take 30s.
ERROR: Recover failed. Please make sure that the correct device family is given
ERROR: and try again.
NOTE: For additional output, try running again with logging enabled (--log).
NOTE: Any generated log error messages will be displayed.

2) What is APPROTECT.STATUS register (0x00C) of the CTRL-AP returning? See this page

APPROTECT = Enable

SECUREAPPROTECT = Disable

My result.

Select SWD by sending SWD switching sequence.
Found SWD-DP with ID 0x6BA02477
J-Link>SWDWriteDP 1 0x50000000
Write DP register 1 = 0x50000000
J-Link>SWDWriteDP 2 0x04000000
Write DP register 2 = 0x04000000
J-Link>SWDReadAP 3
Read AP register 3 = 0x00000000
J-Link>SWDReadAP 3
Read AP register 3 = 0x00000002
J-Link>exit

Script processing completed.

RE: How to remove the nRF9160's erase protection.

Sigurd — Thu, 27 Oct 2022 15:21:53 GMT

Hi,

[quote user=""]setPassword.txt[/quote]

The script looks correct.

[quote user=""]

I found my board can't disable erase protection and I can't recover it.

[/quote]

1) So nrfjprog --recover is not working?

2) What is APPROTECT.STATUS register (0x00C) of the CTRL-AP returning? See this page