NRF52840 Cryptocell register setting reading problem

[Barry]

I am trying to set the Lifecycle state of the cryptocell, but it seems like I am having an issue.

I do 

/** Enable crypto cell to configure it **/
NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Enabled << CRYPTOCELL_ENABLE_ENABLE_Pos;

/** Config cryptocell resgister so Device root key can only be set once per reset*/
NRF_CC_HOST_RGF->HOST_IOT_LCS = CC_HOST_RGF_HOST_IOT_LCS_LCS_Secure << CC_HOST_RGF_HOST_IOT_LCS_LCS_Pos;

/** Disable crypto cell until next use**/
NRF_CRYPTOCELL->ENABLE = CRYPTOCELL_ENABLE_ENABLE_Disabled << CRYPTOCELL_ENABLE_ENABLE_Pos;

But then later when I enable the cryptocell again and read the value of HOST_IOT_LCS,

LCS is 2 (like I expected) but LCS_IS_VALID is 0 which means invalid.

Any ideas?

I am using zephyr and I am doing this configuration post kernel with a priority after CONFIG_KERNEL_INIT_PRIORITY_DEFAULT. So the cryptocell is already being initialized by hw_cc310_init in file hw_cc310.c

[Barry]

I think maybe the issue is fixed. But I'm not sure. The behavior seems to depend how I debug.

First I changed one thing. I was doing this register setting before the flash device was initialized. So I changed it to happen after (not really related to this register setting but for something else I am doing in the same function).

Now when I set the register, it still goes fine LCS_IS_VALID is 1 and LCS is 2 (I see that after I set the register but before I disable). Then when I enable the cryptocell again if I step my debugger through the lines (shown in my original post) where I set the register I see LCS_IS_VALID is 1 and LCS is 2 in the register. But if I don't step my debugger though those lines and later I enable the cryptocell and look at the value of the register  in the debuger LCS_IS_VALID is 1 and LCS is 0.

So this is probably just a debugger issue at this point ( I am using nordic connect SES with a J-trace pro). But I'm not sure. I guess the only way to tell for sure will be to encrypt something with the root key then try to change the root key, and encrypt again, and see if the result is the same.