How can I read the UICR register of 9160?

[xinjiang]

The current project needs to save the ID in the programmable register and use the ID in the application image.

So I save the ID number in the URCI->OTP[0] register. When I read the ID in URCI->OTP[0] in the main function of the application image, a fatal error occurred.

uint32_t get_id_from_uicr(){
        uint32_t id;
        id = (NRF_UICR_S->OTP[0]);
        return id;
}

As far as I know, UICR can only be read in secure code.

So I execute this code in the main function of spm and get the ID normally. How can I pass the ID to the application image(not via flash)?

Or is there any other better way to store this ID?

spm.c:

uint32_t get_id_from_uicr(){
        uint32_t id;
        id = (NRF_UICR_S->OTP[0]);
        return id;
}

void main(void)
{
    uint32_t id;
    id = get_imei_from_uicr();
	spm_config();
	spm_jump();
}

[Sigurd]

Hi,

How can I pass the ID to the application image(not via flash)?

If you want to read the UICR (or FICR) from the application, you need to use secure services.

See this sample:

https://github.com/nrfconnect/sdk-nrf/blob/master/samples/nrf9160/secure_services/src/main.c

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.7.0/nrf/samples/nrf9160/secure_services/README.html

[xinjiang]

I imitated the method of reading the FICR register in secure services to read the UICR register. The spm_request_read() function returns error code -1. How can I solve this problem?

static int read_uicr_word(uint32_t *result, const volatile uint32_t *addr)
{
	printk("Read UICR (address 0x%08x):\n", (uint32_t)addr);
	int ret = spm_request_read(result, (uint32_t)addr, sizeof(uint32_t));

	if (ret != 0) {
		printk("Could not read UICR (err: %d)\n", ret);
	}
	return ret;
}
void main(void)
{
    uint32_t uicr_info;
    if(read_uicr_word(&ficr_info, &NRF_UICR_S->OTP[0]) == 0) {
	    printk("UICR = 0x%08X\n\n", uicr_info);        
    }
    
	printk("Reboot in %d seconds.\n", sleep_time_s);
	k_sleep(K_SECONDS(5));

	sys_reboot(0); /* Argument is ignored. */    
}

Log:

Read UICR (address 0x00ff8108):
Could not read UICR (err: -1)
Reboot in 5 seconds.

[Sigurd]

xinjiang said:

How can I solve this problem?

I see now that UICR is not in the allowed read range:

https://github.com/nrfconnect/sdk-nrf/blob/v1.7.0/subsys/spm/secure_services.c#L73

So you need to append some this like this to the ranges array, so it looks something like this:

	static const struct read_range ranges[] = {
#ifdef PM_MCUBOOT_ADDRESS
		/* Allow reads of mcuboot metadata */
		{.start = PM_MCUBOOT_PAD_ADDRESS,
		 .size = PM_MCUBOOT_PAD_SIZE},
#endif
		{.start = FICR_PUBLIC_ADDR,
		 .size = FICR_PUBLIC_SIZE},
		{.start = FICR_RESTRICTED_ADDR,
		 .size = FICR_RESTRICTED_SIZE},
		{.start = NRF_UICR_S_BASE+0x108, //OTP[0] address
		 .size = 0x4},
	};

[xinjiang]

I did not find secure_services.c under the secure_services demo. According to the macro configuration, the file should be imported, but the actual situation is the opposite.

secure_services demo:

nrf/subsys/spm/Kconfig:

nrf/subsys/spm/CMakeLists.txt:

When I tried to add CONFIG_SPM to spm, a fatal error occurred: CONFIG_SPM and CONFIG_IS_SPM conflict. Do I modify secure_services.c in spm image or modify it in app image?

[Sigurd]

Just modify the file in found in subsys/spm/secure_services.c

[xinjiang]

Thank you very much for your method, I can already read the UICR register, but getting the value of UICR->OTP[0] is wrong. I write 0x12345678 to UICR->OTP[0], but it reads 0xDEADDEAD. The specification says that the register is readable. What is the problem?

[Sigurd]

xinjiang said:

0xDEADDEAD

This indicates that you don't have permission to read it.

See these links:

https://infocenter.nordicsemi.com/topic/ps_nrf9160/uicr.html#register.KEYSLOT.CONFIG.PERM

infocenter.nordicsemi.com/.../kmu.html

[xinjiang]

Today I read the link you gave, and I didn't find a way to access OTP. After writing 0x01 to NRF_KMU_NS->TASKS_PUSH_KEYSLOT, the operation NRF_KMU_NS->SELECTKEYSLOT is also invalid. Do you have access to the OTP demo?

[Sigurd]

xinjiang said:

Do you have access to the OTP demo?

No.

xinjiang said:

I didn't find a way to access OTP.

But this code shows you how our bootloader writes to OTP:

https://github.com/nrfconnect/sdk-nrf/blob/v1.7.1/subsys/bootloader/bl_storage/bl_storage.c#L205

[xinjiang]

This does not tell me how to read the OTP in the app image.

[Sigurd]

There was a read function in the code I linked to as well.

The current project needs to save the ID in the programmable register and use the ID in the application image.

I'm not sure what kind of use-case this ID has, but a potential alterative would be to use the IMEI number instead. You can read it from the modem using a AT command: https://infocenter.nordicsemi.com/topic/ref_at_commands/REF/at_commands/general/cgsn_set.html