nRF5340 - Cannot read UICR.OTP in relase mode

RE: nRF5340 - Cannot read UICR.OTP in relase mode

Gabriele — Fri, 05 Jul 2024 09:07:40 GMT

yes I do. Thank you so much

RE: nRF5340 - Cannot read UICR.OTP in relase mode

Hieu — Fri, 05 Jul 2024 07:58:59 GMT

I'm not sure what you mean by hacking the UICR lock. I assume you disable the lock altogether. Please just be aware that it is locked for security reasons, and by disabling the lock, you compromise that security measure.

RE: nRF5340 - Cannot read UICR.OTP in relase mode

Gabriele — Fri, 05 Jul 2024 06:55:28 GMT

I've hacked the UICR lock. This ticket can be closed

RE: nRF5340 - Cannot read UICR.OTP in relase mode

Gabriele — Thu, 04 Jul 2024 06:54:37 GMT

It seems very complicated stuff. Can you guide me with some concrete coding sample ? Alternatively, can I remove the access restriction to UICR ? Or, is there a non-protected register where I can copy the bluetooth address, in such a way I can read it at runtime without any restriction ?

I have a bash script on host, used for the first device programming.
It does the following

1) Retrieve and save in a local variable the factory MAC from device, using
    uicrotp="$(nrfjprog -f nrf53 --memrd 0x00FF8100 --n 8)"
2) Erase and program device with application
3) Restore the original bluetooth address into device from the local variable, using
    nrfjprog -f nrf53 --memwr 0x00FF8104 --${uicrotp:21:8} 0x
    nrfjprog -f nrf53 --memwr 0x00FF8100 --${uicrotp:12:8} 0x

Is there any 8-bytes flash area, other than 0x00FF8100, where I can copy the MAC address, which is easily readable at runtime, without any restriction ? Maybe a different UICR register ?

RE: nRF5340 - Cannot read UICR.OTP in relase mode

Hieu — Mon, 01 Jul 2024 13:07:17 GMT

Hi Gabriele,

The Nordic Secure Immutable Bootloader uses the Hardware unique key library, which in turn uses the nRF5340's KMU — Key management unit to limit the access to a part of the UICR. The OTP registers that you want to use is one of the registers with access restricted.

To read the OTP, you need to use the Hardware Unique Key library's API. You can refer to its sample: https://docs.nordicsemi.com/bundle/ncs-2.6.1/page/nrf/samples/keys/hw_unique_key/README.html.

Hieu