flash/nor: add support for NXP QN908x

This patch adds support for the NXP QN908x family of Bluetooth
microcontrollers, such as the QN9080. This chip features a Cortex-M4F
with 512 KiB of flash on all the available versions, although the
documentation suggests that there might be 256 kB versions as well.

The initial support allows to read, erase and write the whole user flash
area. Three new sub-commands under the new "qn908x" command are added
in this patch as well: disable_wdog to disabled the watchdog,
mass_erase to perform a mass erase and allow_brick to allow programming
images that disable the SWD interface.

Disabling the watchdog is required after a "reset halt" in order to run
the CRC algorithm from RAM when verifying the chip. However, this is not
done automatically on probing or other initialization since disabling
the watchdog might interfere with debugging real applications.

The "mass_erase" command allows to erase the whole flash without
probing it, since in some scenarios the chip can be locked such that no
flash or ram can be accessed from the SWD interface, allowing only to
run a mass_erase to be able to flash the program.

The flashing process allows to compute a checksum, similar to the
lpc2000 driver "calc_checksum" but done over a different region of the
memory. This checksum is required to be present for the QN908x
bootloader ROM to boot, and otherwise is useless. As with the lpc2000
design, verification when using "calc_checksum" is expected to fail if
the checksum was not valid in the image being verified.

This was manually tested on a QN9080, including the scan-view,
AddressSanitizer/UBSan and test coverage configurations.

Change-Id: Ibd6d8f3608654294795085fcaaffb448b77cc58b
Co-developed-by: Marian Buschsieweke <marian.buschsieweke@ovgu.de>
Signed-off-by: Marian Buschsieweke <marian.buschsieweke@ovgu.de>
Signed-off-by: iosabi <iosabi@protonmail.com>
Reviewed-on: https://review.openocd.org/c/openocd/+/5584
Tested-by: jenkins
Reviewed-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Tomas Vanek <vanekt@fbl.cz>

1 files changed, 38 insertions, 0 deletions

diff --git a/tcl/target/qn908x.cfg b/tcl/target/qn908x.cfg
new file mode 100644
index 0000000..ac3e06b
--- /dev/null
+++ b/tcl/target/qn908x.cfg
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# NXP QN908x Cortex-M4F with 128 KiB SRAM
+
+source [find target/swj-dp.tcl]
+
+set CHIPNAME qn908x
+set CHIPSERIES qn9080
+if { ![info exists WORKAREASIZE] } {
+  set WORKAREASIZE 0x20000
+}
+
+# SWD IDCODE (Cortex M4).
+set CPUTAPID 0x2ba01477
+
+swj_newdap $CHIPNAME cpu -irlen 4 -expected-id $CPUTAPID
+dap create $CHIPNAME.dap -chain-position $CHIPNAME.cpu
+
+set TARGETNAME $CHIPNAME.cpu
+target create $TARGETNAME cortex_m -dap $CHIPNAME.dap
+
+# SRAM is mapped at 0x04000000.
+$TARGETNAME configure -work-area-phys 0x04000000 -work-area-size $WORKAREASIZE
+
+# flash bank <name> qn908x <base> <size> 0 0 <target#> [calc_checksum]
+# The base must be set as 0x01000000, and the size parameter is unused.
+set FLASHNAME $CHIPNAME.flash
+flash bank $FLASHNAME qn908x 0x01000000 0 0 0 $TARGETNAME calc_checksum
+
+# We write directly to flash memory over this adapter interface. For debugging
+# this could in theory be faster (the Core clock on reset is normally at 32MHz),
+# but for flashing 1MHz is more reliable.
+adapter speed 1000
+
+# Delay on reset line.
+adapter srst delay 200
+
+cortex_m reset_config sysresetreq