ERASEUICR not erasing UICR

RE: ERASEUICR not erasing UICR

Sigurd Hellesvik — Tue, 12 Mar 2024 14:28:00 GMT

I realize that this is not possible after all with the new APPROTECT version. See my colleguas answer at NRF52840: UICR not erasable when RBP is set?

RE: ERASEUICR not erasing UICR

DaRu — Mon, 11 Mar 2024 16:52:32 GMT

I've taken a loot at the approctect disabling, only did

NRF_APPROTECT->DISABLE = APPROTECT_DISABLE_DISABLE_SwDisable;

as first thing in main().

I've added code to disable the NRF_UICR approtect as follows;

int main(void)
{
    __NOP();
    __NOP();
    __NOP();
    
    //Configure for write
    NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Wen << NVMC_CONFIG_WEN_Pos;
    while(NRF_NVMC->READY == NVMC_READY_READY_Busy){;}
    
    //Disable protection
    NRF_UICR->APPROTECT = UICR_APPROTECT_PALL_HwDisabled << UICR_APPROTECT_PALL_Pos;
    while(NRF_NVMC->READY == NVMC_READY_READY_Busy){;}

    //Undo configuration
    NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Ren << NVMC_CONFIG_WEN_Pos;
    while(NRF_NVMC->READY == NVMC_READY_READY_Busy){;}


    NRF_APPROTECT->DISABLE = APPROTECT_DISABLE_DISABLE_SwDisable;

Afterwards I've implemented a check to determine if the UICR setting has stuck;

if((NRF_UICR->APPROTECT & UICR_APPROTECT_PALL_Msk) == (UICR_APPROTECT_PALL_HwDisabled << UICR_APPROTECT_PALL_Pos)){

Which tells me that it has worked, as in the UICR register is indeed set to disabled

While this has caused some progress, this creates a weird behavior, where instead of counting up, it will oscillate between 0x00000000 and 0x00000001 on restarts.
So for some reason it seems to only reset the last bit changed?

To be more specific;

The first value returned is 0xFFFFFFFF, then it adds 1 and writes + NVIC_SystemReset();

The second value is 0x00000000, then adds 1 again, write and reset

The third value is 0x00000000, then adds 1 again, write and reset

The third value is 0x00000001, then adds 1, writes and reset

The fifth value is 0x00000000 again. It adds 1, writes and reset

The sixth value is 0x00000001 again. Then add, write and reset.

The values after that will oscillate between 0 and 1.

If I tell it to add 2 instead, it will output nearly the same;

First 0xFFFFFFFF,

Second 0x00000001,

Third 0x00000001,

Fourth 0x000000003,

Fifth 0x00000001

Sixth 0x00000003.

And then oscillate between 1 and 3.

RE: ERASEUICR not erasing UICR

Sigurd Hellesvik — Mon, 11 Mar 2024 15:36:24 GMT

We had an fix to approtect a while ago, so approtect behaves differently for different nRF52840 revisions. See Working with the nRF52 Series' improved APPROTECT for a list.

We can see the difference between the old and new at Enabling access port protection mechanism:

As you can see, The new one (Hardware and software) is automatically enabled on reset.

You can not erase UICR with approtect enabled.

You say that you have disabled approtect in the post here, but I suspect you might have missed part of it. Did you verify that approtect was indeed disabled by flashing the device without --recover?

[quote user="DaRu"]However, I've looked up the possible return values of the nrfx_nvmc_uicr_erase() function (e.g. NRFX_SUCCESS)[/quote]

I checked, and looks like this function will return NRFX_SUCCESS if approtect is locked, so that unfortunately does not give us the info we are looking for.

RE: ERASEUICR not erasing UICR

DaRu — Mon, 11 Mar 2024 15:23:42 GMT

Sort of nice to hear that I'm not the only one with this problem.

My NRF_FICR->INFO.VARIANT is 0x41414630 / AAF0. But the datasheet lists AAF0 as 0x41414530, which is weird as 0x45 is an 'E'.

However, I've looked up the possible return values of the nrfx_nvmc_uicr_erase() function (e.g. NRFX_SUCCESS) and those are actually 0x0BAD0000 + the error indicator.

This is in nrfx_errors.h;

#define NRFX_ERROR_BASE_NUM         0x0BAD0000
typedef enum {
    NRFX_SUCCESS                    = (NRFX_ERROR_BASE_NUM + 0),  ///< Operation performed successfully.
    NRFX_ERROR_INTERNAL             = (NRFX_ERROR_BASE_NUM + 1),  ///< Internal error.
    NRFX_ERROR_NO_MEM               = (NRFX_ERROR_BASE_NUM + 2),  ///< No memory for operation.
    NRFX_ERROR_NOT_SUPPORTED        = (NRFX_ERROR_BASE_NUM + 3),  ///< Not supported.
    NRFX_ERROR_INVALID_PARAM        = (NRFX_ERROR_BASE_NUM + 4),  ///< Invalid parameter.
    NRFX_ERROR_INVALID_STATE        = (NRFX_ERROR_BASE_NUM + 5),  ///< Invalid state, operation disallowed in this state.
    NRFX_ERROR_INVALID_LENGTH       = (NRFX_ERROR_BASE_NUM + 6),  ///< Invalid length.
    NRFX_ERROR_TIMEOUT              = (NRFX_ERROR_BASE_NUM + 7),  ///< Operation timed out.
    NRFX_ERROR_FORBIDDEN            = (NRFX_ERROR_BASE_NUM + 8),  ///< Operation is forbidden.
    NRFX_ERROR_NULL                 = (NRFX_ERROR_BASE_NUM + 9),  ///< Null pointer.
    NRFX_ERROR_INVALID_ADDR         = (NRFX_ERROR_BASE_NUM + 10), ///< Bad memory address.
    NRFX_ERROR_BUSY                 = (NRFX_ERROR_BASE_NUM + 11), ///< Busy.
    NRFX_ERROR_ALREADY_INITIALIZED  = (NRFX_ERROR_BASE_NUM + 12), ///< Module already initialized.

    NRFX_ERROR_DRV_TWI_ERR_OVERRUN  = (NRFX_ERROR_DRIVERS_BASE_NUM + 0), ///< TWI error: Overrun.
    NRFX_ERROR_DRV_TWI_ERR_ANACK    = (NRFX_ERROR_DRIVERS_BASE_NUM + 1), ///< TWI error: Address not acknowledged.
    NRFX_ERROR_DRV_TWI_ERR_DNACK    = (NRFX_ERROR_DRIVERS_BASE_NUM + 2)  ///< TWI error: Data not acknowledged.
} nrfx_err_t;

RE: ERASEUICR not erasing UICR

andreasd — Mon, 11 Mar 2024 13:58:15 GMT

nrfx_nvmc_uicr_erase should actually not be able to return the value you mentioned (at least not the one in the nRF5 SDK version 17). It always returns NRFX_SUCCESS.

Anyway, I have a similar problem (which is why I stumbled upon this), but apparently only with a specific chip revision. I'm calling nrfx_nvmc_uicr_erase, but when I check NRF_UICR->CUSTOMER directly afterwards, it's not 0xFFFFFFFF (I can only "debug via buzzer", since I have ready products w/o debug connectors on my desk. Would need to do some tinkering to get the Chip revision out).

Edit: NRF_FICR->INFO.VARIANT is 0x41414430 / AAD0

RE: ERASEUICR not erasing UICR

DaRu — Fri, 08 Mar 2024 16:31:38 GMT

I have written a few debug lines, such that upon startup the first customer register is read and send to my serial terminal. Then that value from the customer register is incremented by one and inserted as the first uint32 of a dummy serial number, then given to the write function to be written.

The write function will perform a NVIC_SystemReset() to update the UICR configuration, this will then reset the nrf and begin the cycle anew.

The result in the nrf52832 is a nicely incrementing output in the terminal on every boot.

But in the nrf52840 the message in the terminal is always the same; 0x00, 0x00, 0x00, 0x00 followed by the rest of the dummy serial.

As for the output of the nrfx_nvmc_uicr_erase(), it was 0x0BAD0000.

RE: ERASEUICR not erasing UICR

Sigurd Hellesvik — Fri, 08 Mar 2024 13:19:12 GMT

In that case:

Could you explain how you see that it does not work?

What does nrfx_nvmc_uicr_erase() return?

RE: ERASEUICR not erasing UICR

DaRu — Fri, 08 Mar 2024 11:04:22 GMT

Hello,

I've tried the nrfx_nvmc_uicr_erase(), but it doesn't help, the nrf52840 isn't able to erase the UICR.

I've also tried this on the nrf52832, where it does work, but there it was already working in the first place.

RE: ERASEUICR not erasing UICR

Sigurd Hellesvik — Fri, 08 Mar 2024 10:20:58 GMT

Hi,

Try nrfx_nvmc_uicr_erase().

Regards,
Sigurd Hellesvik