I found out that in order to write to the NVM, you have to talk to it though the NVMC. (NVM controller).
The steps to changing the BOOTPROT fuses are as follows. (I extracted these steps from the source code of Black Magic Probe
- Read NVM User Row HIGH and LOW words and record them somewhere.
- Load the address of NVM User Row LOW word into the NVMC address register. (Right shifted by one)
- Issue the NVRAM Erase AUX Row command by writing 0xa505 to NVMC Control A register
- Modify the User Row Low as per requirements. (In order to unlock the whole bootloader region you have to set the 3 least significant bits to high)
- Write the modified User row LOW and HIGH back to the original addresses.
- Issue the NVRAM Write Aux Page command by writing 0xa506 to NVMC Control A register.
I did this on J-Link commander console, so the commands I issued were as follows.
mem32 0x0x00804000, 1 #Note this, this is the low word of NVM User Row
mem32 0x0x00804004, 1 #High word of NVM User row
w4 0x4100401c, 0x0x00402000 #Load the address of User row LOW to address register
#Datasheet says this address has to be right shifted by 1 for some reason
w4 0x41004000, 0xa505 #Issue the erase aux command
#write modified to low and high
w4 0x0x00804000, modified_low_word
w4 0x0x00804004, high_word
w4 0x41004000, 0xa506 #issue write command
Note that I did this by hand, so there was quite a bit of delay between the commands. If you're going to script this somehow, it's important to poll the NVMC Ready flag in between commands. (Bit 0 of NVMC INFLAG register)