How can I read the UICR register of 9160?

RE: How can I read the UICR register of 9160?

flaik-wayne — Mon, 25 Jul 2022 10:59:56 GMT

Hi xinjiang - the problem is that OTP memory must be read in 32 bit words. Simply adding the OTP memory to the `ranges` in spm_request_read_nse isn't enough - I used code like this:

__TZ_NONSECURE_ENTRY_FUNC
int spm_request_read_nse(void *destination, uint32_t addr, size_t len)
{
	static const struct read_range ranges[] = {

#ifdef PM_MCUBOOT_ADDRESS
		/* Allow reads of mcuboot metadata */
		{.start = PM_MCUBOOT_PAD_ADDRESS,
		 .size = PM_MCUBOOT_PAD_SIZE},
#endif
		{.start = FICR_INFO_ADDR,
		 .size = FICR_INFO_SIZE},
#if defined(FICR_NFC_TAGHEADER0_MFGID_Msk)
		{.start = FICR_NFC_ADDR,
		 .size = FICR_NFC_SIZE},
#endif
		{.start = FICR_RESTRICTED_ADDR,
		 .size = FICR_RESTRICTED_SIZE},

        // Allow reading UICR
        {.start = NRF_UICR_S_BASE,
         .size = 4096},
	};

	if (destination == NULL || len <= 0) {
		return -EINVAL;
	}

	if (ptr_in_secure_area((intptr_t)destination)) {
		return -EINVAL;
	}

	for (size_t i = 0; i < ARRAY_SIZE(ranges); i++) {
		uint32_t start = ranges[i].start;
		uint32_t size = ranges[i].size;

		if (addr >= start && addr + len <= start + size)
        {
            if ((addr & 3) == 0 && (len & 3) == 0)
            {
                // use 32 bit copy
                uint32_t *d = destination;
                uint32_t *s = (uint32_t)addr;
                while (len)
                {
                    *d++ = *s++;
                    len -= 4;
                }
            }
            else
            {
			    memcpy(destination, (const void *)addr, len);
            }
			return 0;
		}
	}

	return -EPERM;
}

RE: How can I read the UICR register of 9160?

Sigurd — Fri, 26 Nov 2021 09:45:12 GMT

There was a read function in the code I linked to as well.

[quote user=""]The current project needs to save the ID in the programmable register and use the ID in the application image.[/quote]

I'm not sure what kind of use-case this ID has, but a potential alterative would be to use the IMEI number instead. You can read it from the modem using a AT command: https://infocenter.nordicsemi.com/topic/ref_at_commands/REF/at_commands/general/cgsn_set.html

RE: How can I read the UICR register of 9160?

xinjiang — Tue, 23 Nov 2021 02:19:23 GMT

This does not tell me how to read the OTP in the app image.

RE: How can I read the UICR register of 9160?

Sigurd — Mon, 22 Nov 2021 16:00:52 GMT

[quote user="xinjiang"] Do you have access to the OTP demo?[/quote]

No.

[quote user="xinjiang"]I didn't find a way to access OTP.[/quote]

But this code shows you how our bootloader writes to OTP:

https://github.com/nrfconnect/sdk-nrf/blob/v1.7.1/subsys/bootloader/bl_storage/bl_storage.c#L205

RE: How can I read the UICR register of 9160?

xinjiang — Mon, 15 Nov 2021 11:53:24 GMT

Today I read the link you gave, and I didn't find a way to access OTP. After writing 0x01 to NRF_KMU_NS->TASKS_PUSH_KEYSLOT, the operation NRF_KMU_NS->SELECTKEYSLOT is also invalid. Do you have access to the OTP demo?

RE: How can I read the UICR register of 9160?

Sigurd — Fri, 22 Oct 2021 09:14:52 GMT

[quote user="xinjiang"]0xDEADDEAD[/quote]

This indicates that you don't have permission to read it.

See these links:

https://infocenter.nordicsemi.com/topic/ps_nrf9160/uicr.html#register.KEYSLOT.CONFIG.PERM

infocenter.nordicsemi.com/.../kmu.html

RE: How can I read the UICR register of 9160?

xinjiang — Fri, 22 Oct 2021 02:12:11 GMT

Thank you very much for your method, I can already read the UICR register, but getting the value of UICR->OTP[0] is wrong. I write 0x12345678 to UICR->OTP[0], but it reads 0xDEADDEAD. The specification says that the register is readable. What is the problem?

RE: How can I read the UICR register of 9160?

Sigurd — Thu, 21 Oct 2021 12:05:14 GMT

Just modify the file in found in subsys/spm/secure_services.c

RE: How can I read the UICR register of 9160?

xinjiang — Thu, 21 Oct 2021 02:19:14 GMT

I did not find secure_services.c under the secure_services demo. According to the macro configuration, the file should be imported, but the actual situation is the opposite.

secure_services demo:

nrf/subsys/spm/Kconfig:

nrf/subsys/spm/CMakeLists.txt:

When I tried to add CONFIG_SPM to spm, a fatal error occurred: CONFIG_SPM and CONFIG_IS_SPM conflict. Do I modify secure_services.c in spm image or modify it in app image?

RE: How can I read the UICR register of 9160?

Sigurd — Wed, 20 Oct 2021 11:53:04 GMT

[quote user="xinjiang"]How can I solve this problem?[/quote]

I see now that UICR is not in the allowed read range:

https://github.com/nrfconnect/sdk-nrf/blob/v1.7.0/subsys/spm/secure_services.c#L73

So you need to append some this like this to the ranges array, so it looks something like this:

	static const struct read_range ranges[] = {
#ifdef PM_MCUBOOT_ADDRESS
		/* Allow reads of mcuboot metadata */
		{.start = PM_MCUBOOT_PAD_ADDRESS,
		 .size = PM_MCUBOOT_PAD_SIZE},
#endif
		{.start = FICR_PUBLIC_ADDR,
		 .size = FICR_PUBLIC_SIZE},
		{.start = FICR_RESTRICTED_ADDR,
		 .size = FICR_RESTRICTED_SIZE},
		{.start = NRF_UICR_S_BASE+0x108, //OTP[0] address
		 .size = 0x4},
	};

RE: How can I read the UICR register of 9160?

xinjiang — Wed, 20 Oct 2021 02:19:18 GMT

I imitated the method of reading the FICR register in secure services to read the UICR register. The spm_request_read() function returns error code -1. How can I solve this problem?

static int read_uicr_word(uint32_t *result, const volatile uint32_t *addr)
{
	printk("Read UICR (address 0x%08x):\n", (uint32_t)addr);
	int ret = spm_request_read(result, (uint32_t)addr, sizeof(uint32_t));

	if (ret != 0) {
		printk("Could not read UICR (err: %d)\n", ret);
	}
	return ret;
}
void main(void)
{
    uint32_t uicr_info;
    if(read_uicr_word(&ficr_info, &NRF_UICR_S->OTP[0]) == 0) {
	    printk("UICR = 0x%08X\n\n", uicr_info);        
    }
    
	printk("Reboot in %d seconds.\n", sleep_time_s);
	k_sleep(K_SECONDS(5));

	sys_reboot(0); /* Argument is ignored. */    
}

Log:

Read UICR (address 0x00ff8108):
Could not read UICR (err: -1)
Reboot in 5 seconds.

RE: How can I read the UICR register of 9160?

Sigurd — Tue, 19 Oct 2021 17:21:56 GMT

Hi,

[quote user=""]How can I pass the ID to the application image(not via flash)?[/quote]

If you want to read the UICR (or FICR) from the application, you need to use secure services.

See this sample:

https://github.com/nrfconnect/sdk-nrf/blob/master/samples/nrf9160/secure_services/src/main.c

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.7.0/nrf/samples/nrf9160/secure_services/README.html