diff --git a/config/nrfconnect/chip-module/Kconfig b/config/nrfconnect/chip-module/Kconfig index 9bf628cdb1a63e..2fe7f24571eaff 100644 --- a/config/nrfconnect/chip-module/Kconfig +++ b/config/nrfconnect/chip-module/Kconfig @@ -78,6 +78,7 @@ config CHIP_DEBUG_SYMBOLS config CHIP_FACTORY_DATA bool "Enable Factory Data support" select ZCBOR + select FPROTECT help Enables support for reading factory data from flash memory partition. It requires factory_data partition to exist in the partition manager diff --git a/docs/guides/nrfconnect_factory_data_configuration.md b/docs/guides/nrfconnect_factory_data_configuration.md index e2e3c0c589f817..c481a0fac2b2be 100644 --- a/docs/guides/nrfconnect_factory_data_configuration.md +++ b/docs/guides/nrfconnect_factory_data_configuration.md @@ -22,6 +22,12 @@ For the nRF Connect platform, the factory data is stored by default in a separate partition of the internal flash memory. This helps to keep the factory data secure by applying hardware write protection. +> Note: Due to hardware limitations, in the nRF Connect platform, protection +> against writing can be applied only to the internal memory partition. The +> [Fprotect](https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/libraries/others/fprotect.html) +> is the hardware flash protection driver, and we used it to ensure write +> protection of the factory data partition in internal flash memory. +

Nordic Semiconductor logo nRF52840 DK diff --git a/src/platform/nrfconnect/FactoryDataProvider.cpp b/src/platform/nrfconnect/FactoryDataProvider.cpp index 42fd8ad3eb3b2a..d9febd8b9881d3 100644 --- a/src/platform/nrfconnect/FactoryDataProvider.cpp +++ b/src/platform/nrfconnect/FactoryDataProvider.cpp @@ -42,7 +42,15 @@ CHIP_ERROR FactoryDataProvider::Init() uint8_t * factoryData = nullptr; size_t factoryDataSize; - CHIP_ERROR error = mFlashFactoryData.GetFactoryDataPartition(factoryData, factoryDataSize); + CHIP_ERROR error = mFlashFactoryData.ProtectFactoryDataPartitionAgainstWrite(); + + if (error != CHIP_NO_ERROR) + { + ChipLogError(DeviceLayer, "Failed to protect the factory data partition"); + return error; + } + + error = mFlashFactoryData.GetFactoryDataPartition(factoryData, factoryDataSize); if (error != CHIP_NO_ERROR) { diff --git a/src/platform/nrfconnect/FactoryDataProvider.h b/src/platform/nrfconnect/FactoryDataProvider.h index 95099ba29f233e..c73c2f94a22ef7 100644 --- a/src/platform/nrfconnect/FactoryDataProvider.h +++ b/src/platform/nrfconnect/FactoryDataProvider.h @@ -22,6 +22,7 @@ #include #include +#include #include #include "FactoryDataParser.h" @@ -37,6 +38,12 @@ struct InternalFlashFactoryData dataSize = PM_FACTORY_DATA_SIZE; return CHIP_NO_ERROR; } + + CHIP_ERROR ProtectFactoryDataPartitionAgainstWrite() + { + int ret = fprotect_area(PM_FACTORY_DATA_ADDRESS, PM_FACTORY_DATA_SIZE); + return System::MapErrorZephyr(ret); + } }; struct ExternalFlashFactoryData @@ -56,6 +63,8 @@ struct ExternalFlashFactoryData return CHIP_NO_ERROR; } + CHIP_ERROR ProtectFactoryDataPartitionAgainstWrite() { return CHIP_ERROR_NOT_IMPLEMENTED; } + const struct device * mFlashDevice = DEVICE_DT_GET(DT_CHOSEN(zephyr_flash_controller)); uint8_t mFactoryDataBuffer[PM_FACTORY_DATA_SIZE]; };