tcl/target: add nRF53 and nRF91 config files

Both devices can be configured with or without SWD multidrop.

nRF53 network core is examined on demand to avoid problems
when the core is forced off.

Change-Id: I08f88ff48ff7ac592e9214b89ca8e5e9428573a5
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: https://review.openocd.org/c/openocd/+/8113
Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com>
Tested-by: jenkins

3 files changed, 295 insertions, 0 deletions

diff --git a/tcl/target/nrf53.cfg b/tcl/target/nrf53.cfg
new file mode 100644
index 0000000..307df90
--- /dev/null
+++ b/tcl/target/nrf53.cfg
@@ -0,0 +1,146 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#
+# Nordic nRF53 series: dual ARM Cortex-M33, multidrop SWD
+#
+
+source [find target/swj-dp.tcl]
+source [find mem_helper.tcl]
+
+if { [info exists CHIPNAME] } {
+	set _CHIPNAME $CHIPNAME
+} else {
+	set _CHIPNAME nrf53
+}
+
+# Work-area is a space in RAM used for flash programming
+# By default use 16kB
+if { [info exists WORKAREASIZE] } {
+   set _WORKAREASIZE $WORKAREASIZE
+} else {
+   set _WORKAREASIZE 0x4000
+}
+
+if { [info exists CPUTAPID] } {
+	set _CPUTAPID $CPUTAPID
+} else {
+	set _CPUTAPID 0x6ba02477
+}
+
+# Configurable instance ID resides in application UICR TINSTANCE
+if { [info exists SWD_INSTANCE_ID] } {
+	set _SWD_INSTANCE_ID $SWD_INSTANCE_ID
+} else {
+	set _SWD_INSTANCE_ID 0
+}
+
+swj_newdap $_CHIPNAME cpu -expected-id $_CPUTAPID
+
+if { [info exists SWD_MULTIDROP] } {
+	dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu -dp-id 0x0070289 -instance-id $_SWD_INSTANCE_ID
+} else {
+	dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
+}
+
+set _TARGETNAME_APP $_CHIPNAME.cpuapp
+target create $_TARGETNAME_APP cortex_m -dap $_CHIPNAME.dap
+
+$_TARGETNAME_APP configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
+
+# The network core is not accessible over HLA
+if { ![using_hla] } {
+	set _TARGETNAME_NET $_CHIPNAME.cpunet
+	target create $_TARGETNAME_NET cortex_m -dap $_CHIPNAME.dap -ap-num 1 -defer-examine
+
+	targets $_TARGETNAME_APP
+
+	$_TARGETNAME_NET configure -work-area-phys 0x21000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
+}
+
+# Keep adapter speed less or equal 2000 kHz or flash programming fails!
+adapter speed 1000
+
+source [find target/nrf_common.cfg]
+
+flash bank $_CHIPNAME.app.flash nrf5 0x00000000 0 0 0 $_TARGETNAME_APP
+flash bank $_CHIPNAME.app.uicr nrf5 0x00FF8000 0 0 0 $_TARGETNAME_APP
+
+if { ![using_hla] } {
+
+	flash bank $_CHIPNAME.net.flash nrf5 0x01000000 0 0 0 $_TARGETNAME_NET
+	flash bank $_CHIPNAME.net.uicr nrf5 0x01FF8000 0 0 0 $_TARGETNAME_NET
+
+	# System reset sets NETWORK.FORCEOFF which keeps the network core in reset
+	# Don't touch network core during reset
+	$_TARGETNAME_NET configure -event reset-assert {}
+	# and start it after application core reset is finished to make all flash accessible
+	$_TARGETNAME_APP configure -event reset-init "nrf53_cpunet_release $_CHIPNAME"
+
+	$_TARGETNAME_APP cortex_m reset_config sysresetreq
+	$_TARGETNAME_NET cortex_m reset_config sysresetreq
+
+	$_TARGETNAME_APP configure -event examine-fail { _nrf_check_ap_lock 2 3 }
+	$_TARGETNAME_NET configure -event examine-fail { _nrf_check_ap_lock 3 3 }
+
+	$_TARGETNAME_NET configure -event gdb-attach "_nrf53_cpunet_gdb_attach $_CHIPNAME"
+
+	proc _nrf53_cpunet_gdb_attach { _CHIPNAME } {
+		set _TARGETNAME_APP $_CHIPNAME.cpuapp
+		set _TARGETNAME_NET $_CHIPNAME.cpunet
+		set RESET_NETWORK_FORCEOFF 0x50005614
+
+		set is_off [$_TARGETNAME_APP read_memory $RESET_NETWORK_FORCEOFF 32 1]
+		if { $is_off } {
+			nrf53_cpunet_release $_CHIPNAME
+			$_TARGETNAME_NET arp_poll
+			$_TARGETNAME_NET arp_waitstate halted 100
+		} else {
+			if { ![$_TARGETNAME_NET was_examined] } {
+				$_TARGETNAME_NET arp_examine
+				$_TARGETNAME_NET arp_poll
+			}
+			set s [$_TARGETNAME_NET curstate]
+			if { ![string compare $s "halted"] } {
+				halt
+			}
+		}
+	}
+	lappend _telnet_autocomplete_skip _nrf53_cpunet_gdb_attach
+
+	# Release the network core
+	proc nrf53_cpunet_release { {_CHIPNAME nrf53} } {
+		set _TARGETNAME_APP $_CHIPNAME.cpuapp
+		set _TARGETNAME_NET $_CHIPNAME.cpunet
+		set RESET_NETWORK_FORCEOFF 0x50005614
+		set RESET_NETWORK_WORKAROUND 0x50005618
+		set CORTEX_M_DCB_DEMCR 0xE000EDFC
+
+		$_TARGETNAME_APP mww $RESET_NETWORK_WORKAROUND 1
+		$_TARGETNAME_APP mww $RESET_NETWORK_FORCEOFF 0
+		$_TARGETNAME_APP mww $RESET_NETWORK_FORCEOFF 1
+		set err [catch {$_TARGETNAME_NET arp_examine}]
+		if { $err } {
+			if { ![_nrf_check_ap_lock 3 3] } {
+				echo "Error: \[$_TARGETNAME_NET\] examination failed"
+			}
+			return
+		}
+		# set TRCENA | VC_HARDERR | VC_BUSERR | VC_CORERESET
+		$_TARGETNAME_NET mww $CORTEX_M_DCB_DEMCR 0x01000501
+		# Write DEMCR directly intead of permanetly setting by cortex_m vector_catch reset
+		# following cortex_m_endreset_event() restores the original DEMCR value
+		$_TARGETNAME_APP mww $RESET_NETWORK_FORCEOFF 0
+		$_TARGETNAME_APP mww $RESET_NETWORK_WORKAROUND 0
+	}
+
+	# Mass erase and unlock the device using proprietary nRF CTRL-AP (AP #2 or #3)
+	proc nrf53_cpuapp_recover {} {
+		_nrf_ctrl_ap_recover 2
+	}
+	add_help_text nrf53_cpuapp_recover "Mass erase flash and unlock nRF53 application CPU"
+
+	proc nrf53_recover {} {
+		_nrf_ctrl_ap_recover 3 1
+	}
+	add_help_text nrf53_recover "Mass erase all device flash and unlock nRF53"
+}
diff --git a/tcl/target/nrf91.cfg b/tcl/target/nrf91.cfg
new file mode 100644
index 0000000..e0ff4e5
--- /dev/null
+++ b/tcl/target/nrf91.cfg
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#
+# Nordic nRF91 series: ARM Cortex-M33, SWD only
+#
+
+source [find target/swj-dp.tcl]
+source [find mem_helper.tcl]
+
+if { [info exists CHIPNAME] } {
+	set _CHIPNAME $CHIPNAME
+} else {
+	set _CHIPNAME nrf91
+}
+
+# Work-area is a space in RAM used for flash programming
+# By default use 16kB
+if { [info exists WORKAREASIZE] } {
+   set _WORKAREASIZE $WORKAREASIZE
+} else {
+   set _WORKAREASIZE 0x4000
+}
+
+if { [info exists CPUTAPID] } {
+	set _CPUTAPID $CPUTAPID
+} else {
+	set _CPUTAPID 0x6ba02477
+}
+
+swj_newdap $_CHIPNAME cpu -expected-id $_CPUTAPID
+
+# Contrary to the product specification at least nRF9161 supports multidrop SWD.
+# The instance ID is fixed, no more than one nRF91 can be connected to one SWD bus.
+if { [info exists SWD_MULTIDROP] } {
+	dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu -dp-id 0x0090289 -instance-id 0
+} else {
+	dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu
+}
+
+set _TARGETNAME $_CHIPNAME.cpu
+target create $_TARGETNAME cortex_m -dap $_CHIPNAME.dap
+
+# Keep adapter speed less or equal 2000 kHz or flash programming fails!
+adapter speed 1000
+
+$_TARGETNAME configure -work-area-phys 0x20000000 -work-area-size $_WORKAREASIZE -work-area-backup 0
+
+source [find target/nrf_common.cfg]
+
+flash bank $_CHIPNAME.flash nrf5 0x00000000 0 0 0 $_TARGETNAME
+flash bank $_CHIPNAME.uicr nrf5 0x00FF8000 0 0 0 $_TARGETNAME
+
+if { ![using_hla] } {
+	$_TARGETNAME cortex_m reset_config sysresetreq
+
+	$_TARGETNAME configure -event examine-fail { _nrf_check_ap_lock 4 3 }
+}
+
+# Mass erase and unlock the device using proprietary nRF CTRL-AP (AP #4)
+proc nrf91_recover {} {
+	_nrf_ctrl_ap_recover 4
+}
+add_help_text nrf91_recover "Mass erase and unlock nRF91 device"
diff --git a/tcl/target/nrf_common.cfg b/tcl/target/nrf_common.cfg
new file mode 100644
index 0000000..2ae5011
--- /dev/null
+++ b/tcl/target/nrf_common.cfg
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#
+# Nordic nRF52, nRF53 and nRF91 CTRL-AP handling
+#
+
+if { [using_hla] } {
+	echo ""
+	echo "nRF device has a CTRL-AP dedicated to recover the device from AP lock."
+	echo "A high level adapter (like a ST-Link) you are currently using cannot access"
+	echo "the CTRL-AP so 'nrfxx_recover' command will not work."
+	echo "Do not enable UICR APPROTECT."
+	echo ""
+} else {
+
+	# Test if debug/MEM-AP is locked by UICR APPROTECT
+	proc _nrf_check_ap_lock { ctrl_ap_num unlocked_value } {
+		set target [target current]
+		set dap [$target cget -dap]
+		set err [catch {set APPROTECTSTATUS [$dap apreg $ctrl_ap_num 0xc]}]
+		if {$err == 0 && $APPROTECTSTATUS < $unlocked_value} {
+			echo ""
+			echo "****** WARNING ******"
+			echo "\[$target\] device has AP lock engaged (see UICR APPROTECT register)."
+			echo "Debug access is denied."
+			echo "Use 'nrfxx_recover' to erase and unlock the device."
+			echo ""
+			poll off
+			return 1
+		}
+		return 0
+	}
+
+	# Mass erase and unlock the device using proprietary nRF CTRL-AP
+	proc _nrf_ctrl_ap_recover { ctrl_ap_num {is_cpunet 0} } {
+		set target [target current]
+		set dap [$target cget -dap]
+
+		set IDR [$dap apreg $ctrl_ap_num 0xfc]
+		if {$IDR != 0x12880000} {
+			echo "Error: Cannot access nRF CTRL-AP!"
+			return
+		}
+
+		poll off
+
+		# Reset and trigger ERASEALL task
+		$dap apreg $ctrl_ap_num 4 0
+		$dap apreg $ctrl_ap_num 4 1
+
+		for {set i 0} {1} {incr i} {
+			set ERASEALLSTATUS [$dap apreg $ctrl_ap_num 8]
+			if {$ERASEALLSTATUS == 0} {
+				echo "\[$target\] device has been successfully erased and unlocked."
+				break
+			}
+			if {$i == 0} {
+				echo "Waiting for chip erase..."
+			}
+			if {$i >= 150} {
+				echo "Error: \[$target\] recovery failed."
+				break
+			}
+			sleep 100
+		}
+
+		# Assert reset
+		$dap apreg $ctrl_ap_num 0 1
+
+		# Deassert reset
+		$dap apreg $ctrl_ap_num 0 0
+
+		# Reset ERASEALL task
+		$dap apreg $ctrl_ap_num 4 0
+
+		if { $is_cpunet } {
+			reset init
+		} else {
+			sleep 100
+			$target arp_examine
+			poll on
+		}
+	}
+
+	lappend _telnet_autocomplete_skip _nrf_check_ap_lock _nrf_ctrl_ap_recover
+}