1 /***************************************************************************
2 * Copyright (C) 2013 Synapse Product Development *
3 * Andrey Smirnov <andrew.smironv@gmail.com> *
4 * Angus Gratton <gus@projectgus.com> *
5 * Erdem U. Altunyurt <spamjunkeater@gmail.com> *
7 * This program is free software; you can redistribute it and/or modify *
8 * it under the terms of the GNU General Public License as published by *
9 * the Free Software Foundation; either version 2 of the License, or *
10 * (at your option) any later version. *
12 * This program is distributed in the hope that it will be useful, *
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
15 * GNU General Public License for more details. *
17 * You should have received a copy of the GNU General Public License *
18 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
19 ***************************************************************************/
26 #include <target/algorithm.h>
27 #include <target/armv7m.h>
28 #include <helper/types.h>
29 #include <helper/time_support.h>
32 NRF5_FLASH_BASE = 0x00000000,
35 enum nrf5_ficr_registers {
36 NRF5_FICR_BASE = 0x10000000, /* Factory Information Configuration Registers */
38 #define NRF5_FICR_REG(offset) (NRF5_FICR_BASE + offset)
40 NRF5_FICR_CODEPAGESIZE = NRF5_FICR_REG(0x010),
41 NRF5_FICR_CODESIZE = NRF5_FICR_REG(0x014),
42 NRF5_FICR_CLENR0 = NRF5_FICR_REG(0x028),
43 NRF5_FICR_PPFC = NRF5_FICR_REG(0x02C),
44 NRF5_FICR_NUMRAMBLOCK = NRF5_FICR_REG(0x034),
45 NRF5_FICR_SIZERAMBLOCK0 = NRF5_FICR_REG(0x038),
46 NRF5_FICR_SIZERAMBLOCK1 = NRF5_FICR_REG(0x03C),
47 NRF5_FICR_SIZERAMBLOCK2 = NRF5_FICR_REG(0x040),
48 NRF5_FICR_SIZERAMBLOCK3 = NRF5_FICR_REG(0x044),
49 NRF5_FICR_CONFIGID = NRF5_FICR_REG(0x05C),
50 NRF5_FICR_DEVICEID0 = NRF5_FICR_REG(0x060),
51 NRF5_FICR_DEVICEID1 = NRF5_FICR_REG(0x064),
52 NRF5_FICR_ER0 = NRF5_FICR_REG(0x080),
53 NRF5_FICR_ER1 = NRF5_FICR_REG(0x084),
54 NRF5_FICR_ER2 = NRF5_FICR_REG(0x088),
55 NRF5_FICR_ER3 = NRF5_FICR_REG(0x08C),
56 NRF5_FICR_IR0 = NRF5_FICR_REG(0x090),
57 NRF5_FICR_IR1 = NRF5_FICR_REG(0x094),
58 NRF5_FICR_IR2 = NRF5_FICR_REG(0x098),
59 NRF5_FICR_IR3 = NRF5_FICR_REG(0x09C),
60 NRF5_FICR_DEVICEADDRTYPE = NRF5_FICR_REG(0x0A0),
61 NRF5_FICR_DEVICEADDR0 = NRF5_FICR_REG(0x0A4),
62 NRF5_FICR_DEVICEADDR1 = NRF5_FICR_REG(0x0A8),
63 NRF5_FICR_OVERRIDEN = NRF5_FICR_REG(0x0AC),
64 NRF5_FICR_NRF_1MBIT0 = NRF5_FICR_REG(0x0B0),
65 NRF5_FICR_NRF_1MBIT1 = NRF5_FICR_REG(0x0B4),
66 NRF5_FICR_NRF_1MBIT2 = NRF5_FICR_REG(0x0B8),
67 NRF5_FICR_NRF_1MBIT3 = NRF5_FICR_REG(0x0BC),
68 NRF5_FICR_NRF_1MBIT4 = NRF5_FICR_REG(0x0C0),
69 NRF5_FICR_BLE_1MBIT0 = NRF5_FICR_REG(0x0EC),
70 NRF5_FICR_BLE_1MBIT1 = NRF5_FICR_REG(0x0F0),
71 NRF5_FICR_BLE_1MBIT2 = NRF5_FICR_REG(0x0F4),
72 NRF5_FICR_BLE_1MBIT3 = NRF5_FICR_REG(0x0F8),
73 NRF5_FICR_BLE_1MBIT4 = NRF5_FICR_REG(0x0FC),
75 /* Following registers are available on nRF52 and on nRF51 since rev 3 */
76 NRF5_FICR_INFO_PART = NRF5_FICR_REG(0x100),
77 NRF5_FICR_INFO_VARIANT = NRF5_FICR_REG(0x104),
78 NRF5_FICR_INFO_PACKAGE = NRF5_FICR_REG(0x108),
79 NRF5_FICR_INFO_RAM = NRF5_FICR_REG(0x10C),
80 NRF5_FICR_INFO_FLASH = NRF5_FICR_REG(0x110),
83 enum nrf5_uicr_registers {
84 NRF5_UICR_BASE = 0x10001000, /* User Information
85 * Configuration Regsters */
87 #define NRF5_UICR_REG(offset) (NRF5_UICR_BASE + offset)
89 NRF5_UICR_CLENR0 = NRF5_UICR_REG(0x000),
90 NRF5_UICR_RBPCONF = NRF5_UICR_REG(0x004),
91 NRF5_UICR_XTALFREQ = NRF5_UICR_REG(0x008),
92 NRF5_UICR_FWID = NRF5_UICR_REG(0x010),
95 enum nrf5_nvmc_registers {
96 NRF5_NVMC_BASE = 0x4001E000, /* Non-Volatile Memory
97 * Controller Registers */
99 #define NRF5_NVMC_REG(offset) (NRF5_NVMC_BASE + offset)
101 NRF5_NVMC_READY = NRF5_NVMC_REG(0x400),
102 NRF5_NVMC_CONFIG = NRF5_NVMC_REG(0x504),
103 NRF5_NVMC_ERASEPAGE = NRF5_NVMC_REG(0x508),
104 NRF5_NVMC_ERASEALL = NRF5_NVMC_REG(0x50C),
105 NRF5_NVMC_ERASEUICR = NRF5_NVMC_REG(0x514),
108 enum nrf5_nvmc_config_bits {
109 NRF5_NVMC_CONFIG_REN = 0x00,
110 NRF5_NVMC_CONFIG_WEN = 0x01,
111 NRF5_NVMC_CONFIG_EEN = 0x02,
115 struct nrf52_ficr_info {
123 struct nrf5_device_spec {
127 const char *build_code;
128 unsigned int flash_size_kb;
135 struct nrf5_info *chip;
138 struct target *target;
140 /* chip identification stored in nrf5_probe() for use in nrf5_info() */
141 bool ficr_info_valid;
142 struct nrf52_ficr_info ficr_info;
143 const struct nrf5_device_spec *spec;
145 unsigned int flash_size_kb;
148 #define NRF5_DEVICE_DEF(id, pt, var, bcode, fsize) \
153 .build_code = bcode, \
154 .flash_size_kb = (fsize), \
157 /* The known devices table below is derived from the "nRF5x series
158 * compatibility matrix" documents, which can be found in the "DocLib" of
161 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF51/latest/COMP/nrf51/nRF51422_ic_revision_overview
162 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF51/latest/COMP/nrf51/nRF51822_ic_revision_overview
163 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF51/latest/COMP/nrf51/nRF51824_ic_revision_overview
164 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF52810/latest/COMP/nrf52810/nRF52810_ic_revision_overview
165 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF52832/latest/COMP/nrf52832/ic_revision_overview
166 * https://www.nordicsemi.com/DocLib/Content/Comp_Matrix/nRF52840/latest/COMP/nrf52840/nRF52840_ic_revision_overview
168 * Up to date with Matrix v2.0, plus some additional HWIDs.
170 * The additional HWIDs apply where the build code in the matrix is
171 * shown as Gx0, Bx0, etc. In these cases the HWID in the matrix is
172 * for x==0, x!=0 means different (unspecified) HWIDs.
174 static const struct nrf5_device_spec nrf5_known_devices_table[] = {
175 /* nRF51822 Devices (IC rev 1). */
176 NRF5_DEVICE_DEF(0x001D, "51822", "QFAA", "CA/C0", 256),
177 NRF5_DEVICE_DEF(0x0026, "51822", "QFAB", "AA", 128),
178 NRF5_DEVICE_DEF(0x0027, "51822", "QFAB", "A0", 128),
179 NRF5_DEVICE_DEF(0x0020, "51822", "CEAA", "BA", 256),
180 NRF5_DEVICE_DEF(0x002F, "51822", "CEAA", "B0", 256),
182 /* Some early nRF51-DK (PCA10028) & nRF51-Dongle (PCA10031) boards
183 with built-in jlink seem to use engineering samples not listed
184 in the nRF51 Series Compatibility Matrix V1.0. */
185 NRF5_DEVICE_DEF(0x0071, "51822", "QFAC", "AB", 256),
187 /* nRF51822 Devices (IC rev 2). */
188 NRF5_DEVICE_DEF(0x002A, "51822", "QFAA", "FA0", 256),
189 NRF5_DEVICE_DEF(0x0044, "51822", "QFAA", "GC0", 256),
190 NRF5_DEVICE_DEF(0x003C, "51822", "QFAA", "G0", 256),
191 NRF5_DEVICE_DEF(0x0057, "51822", "QFAA", "G2", 256),
192 NRF5_DEVICE_DEF(0x0058, "51822", "QFAA", "G3", 256),
193 NRF5_DEVICE_DEF(0x004C, "51822", "QFAB", "B0", 128),
194 NRF5_DEVICE_DEF(0x0040, "51822", "CEAA", "CA0", 256),
195 NRF5_DEVICE_DEF(0x0047, "51822", "CEAA", "DA0", 256),
196 NRF5_DEVICE_DEF(0x004D, "51822", "CEAA", "D00", 256),
198 /* nRF51822 Devices (IC rev 3). */
199 NRF5_DEVICE_DEF(0x0072, "51822", "QFAA", "H0", 256),
200 NRF5_DEVICE_DEF(0x00D1, "51822", "QFAA", "H2", 256),
201 NRF5_DEVICE_DEF(0x007B, "51822", "QFAB", "C0", 128),
202 NRF5_DEVICE_DEF(0x0083, "51822", "QFAC", "A0", 256),
203 NRF5_DEVICE_DEF(0x0084, "51822", "QFAC", "A1", 256),
204 NRF5_DEVICE_DEF(0x007D, "51822", "CDAB", "A0", 128),
205 NRF5_DEVICE_DEF(0x0079, "51822", "CEAA", "E0", 256),
206 NRF5_DEVICE_DEF(0x0087, "51822", "CFAC", "A0", 256),
207 NRF5_DEVICE_DEF(0x008F, "51822", "QFAA", "H1", 256),
209 /* nRF51422 Devices (IC rev 1). */
210 NRF5_DEVICE_DEF(0x001E, "51422", "QFAA", "CA", 256),
211 NRF5_DEVICE_DEF(0x0024, "51422", "QFAA", "C0", 256),
212 NRF5_DEVICE_DEF(0x0031, "51422", "CEAA", "A0A", 256),
214 /* nRF51422 Devices (IC rev 2). */
215 NRF5_DEVICE_DEF(0x002D, "51422", "QFAA", "DAA", 256),
216 NRF5_DEVICE_DEF(0x002E, "51422", "QFAA", "E0", 256),
217 NRF5_DEVICE_DEF(0x0061, "51422", "QFAB", "A00", 128),
218 NRF5_DEVICE_DEF(0x0050, "51422", "CEAA", "B0", 256),
220 /* nRF51422 Devices (IC rev 3). */
221 NRF5_DEVICE_DEF(0x0073, "51422", "QFAA", "F0", 256),
222 NRF5_DEVICE_DEF(0x007C, "51422", "QFAB", "B0", 128),
223 NRF5_DEVICE_DEF(0x0085, "51422", "QFAC", "A0", 256),
224 NRF5_DEVICE_DEF(0x0086, "51422", "QFAC", "A1", 256),
225 NRF5_DEVICE_DEF(0x007E, "51422", "CDAB", "A0", 128),
226 NRF5_DEVICE_DEF(0x007A, "51422", "CEAA", "C0", 256),
227 NRF5_DEVICE_DEF(0x0088, "51422", "CFAC", "A0", 256),
229 /* The driver fully autodects nRF52 series devices by FICR INFO,
230 * no need for nRF52xxx HWIDs in this table */
232 /* nRF52810 Devices */
233 NRF5_DEVICE_DEF(0x0142, "52810", "QFAA", "B0", 192),
234 NRF5_DEVICE_DEF(0x0143, "52810", "QCAA", "C0", 192),
236 /* nRF52832 Devices */
237 NRF5_DEVICE_DEF(0x00C7, "52832", "QFAA", "B0", 512),
238 NRF5_DEVICE_DEF(0x0139, "52832", "QFAA", "E0", 512),
239 NRF5_DEVICE_DEF(0x00E3, "52832", "CIAA", "B0", 512),
241 /* nRF52840 Devices */
242 NRF5_DEVICE_DEF(0x0150, "52840", "QIAA", "C0", 1024),
246 struct nrf5_device_package {
251 /* Newer devices have FICR INFO.PACKAGE.
252 * This table converts its value to two character code */
253 static const struct nrf5_device_package nrf5_packages_table[] = {
260 static int nrf5_bank_is_probed(struct flash_bank *bank)
262 struct nrf5_bank *nbank = bank->driver_priv;
264 assert(nbank != NULL);
266 return nbank->probed;
268 static int nrf5_probe(struct flash_bank *bank);
270 static int nrf5_get_probed_chip_if_halted(struct flash_bank *bank, struct nrf5_info **chip)
272 if (bank->target->state != TARGET_HALTED) {
273 LOG_ERROR("Target not halted");
274 return ERROR_TARGET_NOT_HALTED;
277 struct nrf5_bank *nbank = bank->driver_priv;
280 int probed = nrf5_bank_is_probed(bank);
284 return nrf5_probe(bank);
289 static int nrf5_wait_for_nvmc(struct nrf5_info *chip)
293 int timeout_ms = 340;
294 int64_t ts_start = timeval_ms();
297 res = target_read_u32(chip->target, NRF5_NVMC_READY, &ready);
298 if (res != ERROR_OK) {
299 LOG_ERROR("Couldn't read NVMC_READY register");
303 if (ready == 0x00000001)
308 } while ((timeval_ms()-ts_start) < timeout_ms);
310 LOG_DEBUG("Timed out waiting for NVMC_READY");
311 return ERROR_FLASH_BUSY;
314 static int nrf5_nvmc_erase_enable(struct nrf5_info *chip)
317 res = target_write_u32(chip->target,
319 NRF5_NVMC_CONFIG_EEN);
321 if (res != ERROR_OK) {
322 LOG_ERROR("Failed to enable erase operation");
327 According to NVMC examples in Nordic SDK busy status must be
328 checked after writing to NVMC_CONFIG
330 res = nrf5_wait_for_nvmc(chip);
332 LOG_ERROR("Erase enable did not complete");
337 static int nrf5_nvmc_write_enable(struct nrf5_info *chip)
340 res = target_write_u32(chip->target,
342 NRF5_NVMC_CONFIG_WEN);
344 if (res != ERROR_OK) {
345 LOG_ERROR("Failed to enable write operation");
350 According to NVMC examples in Nordic SDK busy status must be
351 checked after writing to NVMC_CONFIG
353 res = nrf5_wait_for_nvmc(chip);
355 LOG_ERROR("Write enable did not complete");
360 static int nrf5_nvmc_read_only(struct nrf5_info *chip)
363 res = target_write_u32(chip->target,
365 NRF5_NVMC_CONFIG_REN);
367 if (res != ERROR_OK) {
368 LOG_ERROR("Failed to enable read-only operation");
372 According to NVMC examples in Nordic SDK busy status must be
373 checked after writing to NVMC_CONFIG
375 res = nrf5_wait_for_nvmc(chip);
377 LOG_ERROR("Read only enable did not complete");
382 static int nrf5_nvmc_generic_erase(struct nrf5_info *chip,
383 uint32_t erase_register, uint32_t erase_value)
387 res = nrf5_nvmc_erase_enable(chip);
391 res = target_write_u32(chip->target,
397 res = nrf5_wait_for_nvmc(chip);
401 return nrf5_nvmc_read_only(chip);
404 nrf5_nvmc_read_only(chip);
406 LOG_ERROR("Failed to erase reg: 0x%08"PRIx32" val: 0x%08"PRIx32,
407 erase_register, erase_value);
411 static int nrf5_protect_check(struct flash_bank *bank)
416 /* UICR cannot be write protected so just return early */
417 if (bank->base == NRF5_UICR_BASE)
420 struct nrf5_bank *nbank = bank->driver_priv;
421 struct nrf5_info *chip = nbank->chip;
423 assert(chip != NULL);
425 res = target_read_u32(chip->target, NRF5_FICR_CLENR0,
427 if (res != ERROR_OK) {
428 LOG_ERROR("Couldn't read code region 0 size[FICR]");
432 if (clenr0 == 0xFFFFFFFF) {
433 res = target_read_u32(chip->target, NRF5_UICR_CLENR0,
435 if (res != ERROR_OK) {
436 LOG_ERROR("Couldn't read code region 0 size[UICR]");
441 for (int i = 0; i < bank->num_sectors; i++)
442 bank->sectors[i].is_protected =
443 clenr0 != 0xFFFFFFFF && bank->sectors[i].offset < clenr0;
448 static int nrf5_protect(struct flash_bank *bank, int set, int first, int last)
451 uint32_t clenr0, ppfc;
452 struct nrf5_info *chip;
454 /* UICR cannot be write protected so just bail out early */
455 if (bank->base == NRF5_UICR_BASE)
458 res = nrf5_get_probed_chip_if_halted(bank, &chip);
463 LOG_ERROR("Code region 0 must start at the begining of the bank");
467 res = target_read_u32(chip->target, NRF5_FICR_PPFC,
469 if (res != ERROR_OK) {
470 LOG_ERROR("Couldn't read PPFC register");
474 if ((ppfc & 0xFF) == 0x00) {
475 LOG_ERROR("Code region 0 size was pre-programmed at the factory, can't change flash protection settings");
479 res = target_read_u32(chip->target, NRF5_UICR_CLENR0,
481 if (res != ERROR_OK) {
482 LOG_ERROR("Couldn't read code region 0 size[UICR]");
486 if (clenr0 == 0xFFFFFFFF) {
487 res = target_write_u32(chip->target, NRF5_UICR_CLENR0,
489 if (res != ERROR_OK) {
490 LOG_ERROR("Couldn't write code region 0 size[UICR]");
495 LOG_ERROR("You need to perform chip erase before changing the protection settings");
498 nrf5_protect_check(bank);
503 static bool nrf5_info_variant_to_str(uint32_t variant, char *bf)
505 h_u32_to_be((uint8_t *)bf, variant);
507 if (isalnum(bf[0]) && isalnum(bf[1]) && isalnum(bf[2]) && isalnum(bf[3]))
514 static const char *nrf5_decode_info_package(uint32_t package)
516 for (size_t i = 0; i < ARRAY_SIZE(nrf5_packages_table); i++) {
517 if (nrf5_packages_table[i].package == package)
518 return nrf5_packages_table[i].code;
523 static int nrf5_info(struct flash_bank *bank, char *buf, int buf_size)
525 struct nrf5_bank *nbank = bank->driver_priv;
526 struct nrf5_info *chip = nbank->chip;
529 snprintf(buf, buf_size,
530 "nRF%s-%s(build code: %s) %ukB Flash",
531 chip->spec->part, chip->spec->variant, chip->spec->build_code,
532 chip->flash_size_kb);
534 } else if (chip->ficr_info_valid) {
536 nrf5_info_variant_to_str(chip->ficr_info.variant, variant);
537 snprintf(buf, buf_size,
538 "nRF%" PRIx32 "-%s%.2s(build code: %s) %" PRIu32
539 "kB Flash, %" PRIu32 "kB RAM",
540 chip->ficr_info.part,
541 nrf5_decode_info_package(chip->ficr_info.package),
542 variant, &variant[2],
544 chip->ficr_info.ram);
547 snprintf(buf, buf_size, "nRF51xxx (HWID 0x%04" PRIx16 ") %ukB Flash",
548 chip->hwid, chip->flash_size_kb);
553 static int nrf5_read_ficr_info(struct nrf5_info *chip)
556 struct target *target = chip->target;
558 chip->ficr_info_valid = false;
560 res = target_read_u32(target, NRF5_FICR_INFO_PART, &chip->ficr_info.part);
561 if (res != ERROR_OK) {
562 LOG_DEBUG("Couldn't read FICR INFO.PART register");
566 uint32_t series = chip->ficr_info.part & 0xfffff000;
567 if (!(series == 0x51000 || series == 0x52000)) {
568 LOG_DEBUG("FICR INFO likely not implemented. Invalid PART value 0x%08"
569 PRIx32, chip->ficr_info.part);
570 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
573 /* Now we know the device has FICR INFO filled by something relevant:
574 * Although it is not documented, the tested nRF51 rev 3 devices
575 * have FICR INFO.PART, RAM and FLASH of the same format as nRF52.
576 * VARIANT and PACKAGE coding is unknown for a nRF51 device.
577 * nRF52 devices have FICR INFO documented and always filled. */
579 res = target_read_u32(target, NRF5_FICR_INFO_VARIANT, &chip->ficr_info.variant);
583 res = target_read_u32(target, NRF5_FICR_INFO_PACKAGE, &chip->ficr_info.package);
587 res = target_read_u32(target, NRF5_FICR_INFO_RAM, &chip->ficr_info.ram);
591 res = target_read_u32(target, NRF5_FICR_INFO_FLASH, &chip->ficr_info.flash);
595 chip->ficr_info_valid = true;
599 static int nrf5_probe(struct flash_bank *bank)
602 struct nrf5_bank *nbank = bank->driver_priv;
603 struct nrf5_info *chip = nbank->chip;
604 struct target *target = chip->target;
606 res = target_read_u32(target, NRF5_FICR_CONFIGID, &chip->hwid);
607 if (res != ERROR_OK) {
608 LOG_ERROR("Couldn't read CONFIGID register");
612 chip->hwid &= 0xFFFF; /* HWID is stored in the lower two
613 * bytes of the CONFIGID register */
616 for (size_t i = 0; i < ARRAY_SIZE(nrf5_known_devices_table); i++) {
617 if (chip->hwid == nrf5_known_devices_table[i].hwid) {
618 chip->spec = &nrf5_known_devices_table[i];
623 /* Don't bail out on error for the case that some old engineering
624 * sample has FICR INFO registers unreadable. We can proceed anyway. */
625 (void)nrf5_read_ficr_info(chip);
627 if (chip->spec && chip->ficr_info_valid) {
628 /* check if HWID table gives the same part as FICR INFO */
629 if (chip->ficr_info.part != strtoul(chip->spec->part, NULL, 16))
630 LOG_WARNING("HWID 0x%04" PRIx32 " mismatch: FICR INFO.PART %"
631 PRIx32, chip->hwid, chip->ficr_info.part);
634 /* The value stored in NRF5_FICR_CODEPAGESIZE is the number of bytes in one page of FLASH. */
635 uint32_t flash_page_size;
636 res = target_read_u32(chip->target, NRF5_FICR_CODEPAGESIZE,
638 if (res != ERROR_OK) {
639 LOG_ERROR("Couldn't read code page size");
643 /* Note the register name is misleading,
644 * NRF5_FICR_CODESIZE is the number of pages in flash memory, not the number of bytes! */
645 uint32_t num_sectors;
646 res = target_read_u32(chip->target, NRF5_FICR_CODESIZE, &num_sectors);
647 if (res != ERROR_OK) {
648 LOG_ERROR("Couldn't read code memory size");
652 chip->flash_size_kb = num_sectors * flash_page_size / 1024;
654 if (!chip->bank[0].probed && !chip->bank[1].probed) {
656 nrf5_info(bank, buf, sizeof(buf));
657 if (!chip->spec && !chip->ficr_info_valid) {
658 LOG_INFO("Unknown device: %s", buf);
665 if (bank->base == NRF5_FLASH_BASE) {
666 bank->num_sectors = num_sectors;
667 bank->size = num_sectors * flash_page_size;
670 if (chip->spec && chip->flash_size_kb != chip->spec->flash_size_kb)
671 LOG_WARNING("Chip's reported Flash capacity does not match expected one");
672 if (chip->ficr_info_valid && chip->flash_size_kb != chip->ficr_info.flash)
673 LOG_WARNING("Chip's reported Flash capacity does not match FICR INFO.FLASH");
675 bank->sectors = calloc(bank->num_sectors,
676 sizeof((bank->sectors)[0]));
678 return ERROR_FLASH_BANK_NOT_PROBED;
680 /* Fill out the sector information: all NRF5 sectors are the same size and
681 * there is always a fixed number of them. */
682 for (int i = 0; i < bank->num_sectors; i++) {
683 bank->sectors[i].size = flash_page_size;
684 bank->sectors[i].offset = i * flash_page_size;
686 /* mark as unknown */
687 bank->sectors[i].is_erased = -1;
688 bank->sectors[i].is_protected = -1;
691 nrf5_protect_check(bank);
693 chip->bank[0].probed = true;
695 bank->size = flash_page_size;
696 bank->num_sectors = 1;
697 bank->sectors = calloc(bank->num_sectors,
698 sizeof((bank->sectors)[0]));
700 return ERROR_FLASH_BANK_NOT_PROBED;
702 bank->sectors[0].size = bank->size;
703 bank->sectors[0].offset = 0;
705 bank->sectors[0].is_erased = 0;
706 bank->sectors[0].is_protected = 0;
708 chip->bank[1].probed = true;
714 static int nrf5_auto_probe(struct flash_bank *bank)
716 int probed = nrf5_bank_is_probed(bank);
723 return nrf5_probe(bank);
726 static int nrf5_erase_all(struct nrf5_info *chip)
728 LOG_DEBUG("Erasing all non-volatile memory");
729 return nrf5_nvmc_generic_erase(chip,
734 static int nrf5_erase_page(struct flash_bank *bank,
735 struct nrf5_info *chip,
736 struct flash_sector *sector)
740 LOG_DEBUG("Erasing page at 0x%"PRIx32, sector->offset);
741 if (sector->is_protected) {
742 LOG_ERROR("Cannot erase protected sector at 0x%" PRIx32, sector->offset);
746 if (bank->base == NRF5_UICR_BASE) {
748 res = target_read_u32(chip->target, NRF5_FICR_PPFC,
750 if (res != ERROR_OK) {
751 LOG_ERROR("Couldn't read PPFC register");
755 if ((ppfc & 0xFF) == 0xFF) {
756 /* We can't erase the UICR. Double-check to
757 see if it's already erased before complaining. */
758 default_flash_blank_check(bank);
759 if (sector->is_erased == 1)
762 LOG_ERROR("The chip was not pre-programmed with SoftDevice stack and UICR cannot be erased separately. Please issue mass erase before trying to write to this region");
766 res = nrf5_nvmc_generic_erase(chip,
772 res = nrf5_nvmc_generic_erase(chip,
780 static const uint8_t nrf5_flash_write_code[] = {
781 /* See contrib/loaders/flash/cortex-m0.S */
783 0x0d, 0x68, /* ldr r5, [r1, #0] */
784 0x00, 0x2d, /* cmp r5, #0 */
785 0x0b, 0xd0, /* beq.n 1e <exit> */
786 0x4c, 0x68, /* ldr r4, [r1, #4] */
787 0xac, 0x42, /* cmp r4, r5 */
788 0xf9, 0xd0, /* beq.n 0 <wait_fifo> */
789 0x20, 0xcc, /* ldmia r4!, {r5} */
790 0x20, 0xc3, /* stmia r3!, {r5} */
791 0x94, 0x42, /* cmp r4, r2 */
792 0x01, 0xd3, /* bcc.n 18 <no_wrap> */
793 0x0c, 0x46, /* mov r4, r1 */
794 0x08, 0x34, /* adds r4, #8 */
796 0x4c, 0x60, /* str r4, [r1, #4] */
797 0x04, 0x38, /* subs r0, #4 */
798 0xf0, 0xd1, /* bne.n 0 <wait_fifo> */
800 0x00, 0xbe /* bkpt 0x0000 */
804 /* Start a low level flash write for the specified region */
805 static int nrf5_ll_flash_write(struct nrf5_info *chip, uint32_t address, const uint8_t *buffer, uint32_t bytes)
807 struct target *target = chip->target;
808 uint32_t buffer_size = 8192;
809 struct working_area *write_algorithm;
810 struct working_area *source;
811 struct reg_param reg_params[4];
812 struct armv7m_algorithm armv7m_info;
813 int retval = ERROR_OK;
815 LOG_DEBUG("Writing buffer to flash address=0x%"PRIx32" bytes=0x%"PRIx32, address, bytes);
816 assert(bytes % 4 == 0);
818 /* allocate working area with flash programming code */
819 if (target_alloc_working_area(target, sizeof(nrf5_flash_write_code),
820 &write_algorithm) != ERROR_OK) {
821 LOG_WARNING("no working area available, falling back to slow memory writes");
823 for (; bytes > 0; bytes -= 4) {
824 retval = target_write_memory(target, address, 4, 1, buffer);
825 if (retval != ERROR_OK)
828 retval = nrf5_wait_for_nvmc(chip);
829 if (retval != ERROR_OK)
839 retval = target_write_buffer(target, write_algorithm->address,
840 sizeof(nrf5_flash_write_code),
841 nrf5_flash_write_code);
842 if (retval != ERROR_OK)
846 while (target_alloc_working_area(target, buffer_size, &source) != ERROR_OK) {
848 buffer_size &= ~3UL; /* Make sure it's 4 byte aligned */
849 if (buffer_size <= 256) {
850 /* free working area, write algorithm already allocated */
851 target_free_working_area(target, write_algorithm);
853 LOG_WARNING("No large enough working area available, can't do block memory writes");
854 return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
858 armv7m_info.common_magic = ARMV7M_COMMON_MAGIC;
859 armv7m_info.core_mode = ARM_MODE_THREAD;
861 init_reg_param(®_params[0], "r0", 32, PARAM_IN_OUT); /* byte count */
862 init_reg_param(®_params[1], "r1", 32, PARAM_OUT); /* buffer start */
863 init_reg_param(®_params[2], "r2", 32, PARAM_OUT); /* buffer end */
864 init_reg_param(®_params[3], "r3", 32, PARAM_IN_OUT); /* target address */
866 buf_set_u32(reg_params[0].value, 0, 32, bytes);
867 buf_set_u32(reg_params[1].value, 0, 32, source->address);
868 buf_set_u32(reg_params[2].value, 0, 32, source->address + source->size);
869 buf_set_u32(reg_params[3].value, 0, 32, address);
871 retval = target_run_flash_async_algorithm(target, buffer, bytes/4, 4,
874 source->address, source->size,
875 write_algorithm->address, 0,
878 target_free_working_area(target, source);
879 target_free_working_area(target, write_algorithm);
881 destroy_reg_param(®_params[0]);
882 destroy_reg_param(®_params[1]);
883 destroy_reg_param(®_params[2]);
884 destroy_reg_param(®_params[3]);
889 static int nrf5_write(struct flash_bank *bank, const uint8_t *buffer,
890 uint32_t offset, uint32_t count)
892 struct nrf5_info *chip;
894 int res = nrf5_get_probed_chip_if_halted(bank, &chip);
898 assert(offset % 4 == 0);
899 assert(count % 4 == 0);
901 res = nrf5_nvmc_write_enable(chip);
905 res = nrf5_ll_flash_write(chip, bank->base + offset, buffer, count);
909 return nrf5_nvmc_read_only(chip);
912 nrf5_nvmc_read_only(chip);
913 LOG_ERROR("Failed to write to nrf5 flash");
917 static int nrf5_erase(struct flash_bank *bank, int first, int last)
920 struct nrf5_info *chip;
922 res = nrf5_get_probed_chip_if_halted(bank, &chip);
926 /* For each sector to be erased */
927 for (int s = first; s <= last && res == ERROR_OK; s++)
928 res = nrf5_erase_page(bank, chip, &bank->sectors[s]);
933 static void nrf5_free_driver_priv(struct flash_bank *bank)
935 struct nrf5_bank *nbank = bank->driver_priv;
936 struct nrf5_info *chip = nbank->chip;
941 if (chip->refcount == 0) {
943 bank->driver_priv = NULL;
947 FLASH_BANK_COMMAND_HANDLER(nrf5_flash_bank_command)
949 static struct nrf5_info *chip;
950 struct nrf5_bank *nbank = NULL;
952 switch (bank->base) {
953 case NRF5_FLASH_BASE:
957 LOG_ERROR("Invalid bank address " TARGET_ADDR_FMT, bank->base);
962 /* Create a new chip */
963 chip = calloc(1, sizeof(*chip));
967 chip->target = bank->target;
970 switch (bank->base) {
971 case NRF5_FLASH_BASE:
972 nbank = &chip->bank[0];
975 nbank = &chip->bank[1];
978 assert(nbank != NULL);
982 nbank->probed = false;
983 bank->driver_priv = nbank;
984 bank->write_start_alignment = bank->write_end_alignment = 4;
989 COMMAND_HANDLER(nrf5_handle_mass_erase_command)
992 struct flash_bank *bank = NULL;
993 struct target *target = get_current_target(CMD_CTX);
995 res = get_flash_bank_by_addr(target, NRF5_FLASH_BASE, true, &bank);
999 assert(bank != NULL);
1001 struct nrf5_info *chip;
1003 res = nrf5_get_probed_chip_if_halted(bank, &chip);
1004 if (res != ERROR_OK)
1009 res = target_read_u32(target, NRF5_FICR_PPFC,
1011 if (res != ERROR_OK) {
1012 LOG_ERROR("Couldn't read PPFC register");
1016 if ((ppfc & 0xFF) == 0x00) {
1017 LOG_ERROR("Code region 0 size was pre-programmed at the factory, "
1018 "mass erase command won't work.");
1022 res = nrf5_erase_all(chip);
1023 if (res != ERROR_OK) {
1024 LOG_ERROR("Failed to erase the chip");
1025 nrf5_protect_check(bank);
1029 res = nrf5_protect_check(bank);
1030 if (res != ERROR_OK) {
1031 LOG_ERROR("Failed to check chip's write protection");
1035 res = get_flash_bank_by_addr(target, NRF5_UICR_BASE, true, &bank);
1036 if (res != ERROR_OK)
1042 COMMAND_HANDLER(nrf5_handle_info_command)
1045 struct flash_bank *bank = NULL;
1046 struct target *target = get_current_target(CMD_CTX);
1048 res = get_flash_bank_by_addr(target, NRF5_FLASH_BASE, true, &bank);
1049 if (res != ERROR_OK)
1052 assert(bank != NULL);
1054 struct nrf5_info *chip;
1056 res = nrf5_get_probed_chip_if_halted(bank, &chip);
1057 if (res != ERROR_OK)
1061 const uint32_t address;
1064 { .address = NRF5_FICR_CODEPAGESIZE },
1065 { .address = NRF5_FICR_CODESIZE },
1066 { .address = NRF5_FICR_CLENR0 },
1067 { .address = NRF5_FICR_PPFC },
1068 { .address = NRF5_FICR_NUMRAMBLOCK },
1069 { .address = NRF5_FICR_SIZERAMBLOCK0 },
1070 { .address = NRF5_FICR_SIZERAMBLOCK1 },
1071 { .address = NRF5_FICR_SIZERAMBLOCK2 },
1072 { .address = NRF5_FICR_SIZERAMBLOCK3 },
1073 { .address = NRF5_FICR_CONFIGID },
1074 { .address = NRF5_FICR_DEVICEID0 },
1075 { .address = NRF5_FICR_DEVICEID1 },
1076 { .address = NRF5_FICR_ER0 },
1077 { .address = NRF5_FICR_ER1 },
1078 { .address = NRF5_FICR_ER2 },
1079 { .address = NRF5_FICR_ER3 },
1080 { .address = NRF5_FICR_IR0 },
1081 { .address = NRF5_FICR_IR1 },
1082 { .address = NRF5_FICR_IR2 },
1083 { .address = NRF5_FICR_IR3 },
1084 { .address = NRF5_FICR_DEVICEADDRTYPE },
1085 { .address = NRF5_FICR_DEVICEADDR0 },
1086 { .address = NRF5_FICR_DEVICEADDR1 },
1087 { .address = NRF5_FICR_OVERRIDEN },
1088 { .address = NRF5_FICR_NRF_1MBIT0 },
1089 { .address = NRF5_FICR_NRF_1MBIT1 },
1090 { .address = NRF5_FICR_NRF_1MBIT2 },
1091 { .address = NRF5_FICR_NRF_1MBIT3 },
1092 { .address = NRF5_FICR_NRF_1MBIT4 },
1093 { .address = NRF5_FICR_BLE_1MBIT0 },
1094 { .address = NRF5_FICR_BLE_1MBIT1 },
1095 { .address = NRF5_FICR_BLE_1MBIT2 },
1096 { .address = NRF5_FICR_BLE_1MBIT3 },
1097 { .address = NRF5_FICR_BLE_1MBIT4 },
1099 { .address = NRF5_UICR_CLENR0, },
1100 { .address = NRF5_UICR_RBPCONF },
1101 { .address = NRF5_UICR_XTALFREQ },
1102 { .address = NRF5_UICR_FWID },
1105 for (size_t i = 0; i < ARRAY_SIZE(ficr); i++) {
1106 res = target_read_u32(chip->target, ficr[i].address,
1108 if (res != ERROR_OK) {
1109 LOG_ERROR("Couldn't read %" PRIx32, ficr[i].address);
1114 for (size_t i = 0; i < ARRAY_SIZE(uicr); i++) {
1115 res = target_read_u32(chip->target, uicr[i].address,
1117 if (res != ERROR_OK) {
1118 LOG_ERROR("Couldn't read %" PRIx32, uicr[i].address);
1124 "\n[factory information control block]\n\n"
1125 "code page size: %"PRIu32"B\n"
1126 "code memory size: %"PRIu32"kB\n"
1127 "code region 0 size: %"PRIu32"kB\n"
1128 "pre-programmed code: %s\n"
1129 "number of ram blocks: %"PRIu32"\n"
1130 "ram block 0 size: %"PRIu32"B\n"
1131 "ram block 1 size: %"PRIu32"B\n"
1132 "ram block 2 size: %"PRIu32"B\n"
1133 "ram block 3 size: %"PRIu32 "B\n"
1134 "config id: %" PRIx32 "\n"
1135 "device id: 0x%"PRIx32"%08"PRIx32"\n"
1136 "encryption root: 0x%08"PRIx32"%08"PRIx32"%08"PRIx32"%08"PRIx32"\n"
1137 "identity root: 0x%08"PRIx32"%08"PRIx32"%08"PRIx32"%08"PRIx32"\n"
1138 "device address type: 0x%"PRIx32"\n"
1139 "device address: 0x%"PRIx32"%08"PRIx32"\n"
1140 "override enable: %"PRIx32"\n"
1141 "NRF_1MBIT values: %"PRIx32" %"PRIx32" %"PRIx32" %"PRIx32" %"PRIx32"\n"
1142 "BLE_1MBIT values: %"PRIx32" %"PRIx32" %"PRIx32" %"PRIx32" %"PRIx32"\n"
1143 "\n[user information control block]\n\n"
1144 "code region 0 size: %"PRIu32"kB\n"
1145 "read back protection configuration: %"PRIx32"\n"
1146 "reset value for XTALFREQ: %"PRIx32"\n"
1147 "firmware id: 0x%04"PRIx32,
1149 (ficr[1].value * ficr[0].value) / 1024,
1150 (ficr[2].value == 0xFFFFFFFF) ? 0 : ficr[2].value / 1024,
1151 ((ficr[3].value & 0xFF) == 0x00) ? "present" : "not present",
1154 (ficr[6].value == 0xFFFFFFFF) ? 0 : ficr[6].value,
1155 (ficr[7].value == 0xFFFFFFFF) ? 0 : ficr[7].value,
1156 (ficr[8].value == 0xFFFFFFFF) ? 0 : ficr[8].value,
1158 ficr[10].value, ficr[11].value,
1159 ficr[12].value, ficr[13].value, ficr[14].value, ficr[15].value,
1160 ficr[16].value, ficr[17].value, ficr[18].value, ficr[19].value,
1162 ficr[21].value, ficr[22].value,
1164 ficr[24].value, ficr[25].value, ficr[26].value, ficr[27].value, ficr[28].value,
1165 ficr[29].value, ficr[30].value, ficr[31].value, ficr[32].value, ficr[33].value,
1166 (uicr[0].value == 0xFFFFFFFF) ? 0 : uicr[0].value / 1024,
1167 uicr[1].value & 0xFFFF,
1168 uicr[2].value & 0xFF,
1169 uicr[3].value & 0xFFFF);
1174 static const struct command_registration nrf5_exec_command_handlers[] = {
1176 .name = "mass_erase",
1177 .handler = nrf5_handle_mass_erase_command,
1178 .mode = COMMAND_EXEC,
1179 .help = "Erase all flash contents of the chip.",
1184 .handler = nrf5_handle_info_command,
1185 .mode = COMMAND_EXEC,
1186 .help = "Show FICR and UICR info.",
1189 COMMAND_REGISTRATION_DONE
1192 static const struct command_registration nrf5_command_handlers[] = {
1195 .mode = COMMAND_ANY,
1196 .help = "nrf5 flash command group",
1198 .chain = nrf5_exec_command_handlers,
1202 .mode = COMMAND_ANY,
1203 .help = "nrf51 flash command group",
1205 .chain = nrf5_exec_command_handlers,
1207 COMMAND_REGISTRATION_DONE
1210 const struct flash_driver nrf5_flash = {
1212 .commands = nrf5_command_handlers,
1213 .flash_bank_command = nrf5_flash_bank_command,
1215 .erase = nrf5_erase,
1216 .protect = nrf5_protect,
1217 .write = nrf5_write,
1218 .read = default_flash_read,
1219 .probe = nrf5_probe,
1220 .auto_probe = nrf5_auto_probe,
1221 .erase_check = default_flash_blank_check,
1222 .protect_check = nrf5_protect_check,
1223 .free_driver_priv = nrf5_free_driver_priv,
1226 /* We need to retain the flash-driver name as well as the commands
1227 * for backwards compatability */
1228 const struct flash_driver nrf51_flash = {
1230 .commands = nrf5_command_handlers,
1231 .flash_bank_command = nrf5_flash_bank_command,
1233 .erase = nrf5_erase,
1234 .protect = nrf5_protect,
1235 .write = nrf5_write,
1236 .read = default_flash_read,
1237 .probe = nrf5_probe,
1238 .auto_probe = nrf5_auto_probe,
1239 .erase_check = default_flash_blank_check,
1240 .protect_check = nrf5_protect_check,
1241 .free_driver_priv = nrf5_free_driver_priv,