Thanks, due to certain NDA on our side I need to get the necessary permission before continuing.

The other avenue I have tried exploring is directly inspecting the registers by running a debug session with the `flash_programmer`.

I can confirm that both with the Dev Kit board and the Target PCB I have been able to see the same values:

I looked at the `TARGET_MEMORY` location (as defined in the code, 0x07FC4000) and it appears to read something.

Additionally I looked at 0x07F87FC8 - which according to the SmartSnippets toolbox is where the OTP memory is stored for the Boot config, as we also get a value (that matches the dev kit).

Interestingly if I use the DA14531-01 config (in the GUI) I actually am able to "Connect" but when I hit the "Read" button it waits for 10s before failing

[INFO     General@23-03-23 11:37:07] Found SW-DP with ID 0x0BC11477
[INFO     General@23-03-23 11:37:07] Scanning AP map to find all available APs
[INFO     General@23-03-23 11:37:07] AP[1]: Stopped AP scan as end of AP map has been reached
[INFO     General@23-03-23 11:37:07] AP[0]: AHB-AP (IDR: 0x04770031)
[INFO     General@23-03-23 11:37:07] Iterating through AP map to find AHB-AP to use
[INFO     General@23-03-23 11:37:07] AP[0]: Core found
[INFO     General@23-03-23 11:37:07] AP[0]: AHB-AP ROM base: 0xE00FF000
[INFO     General@23-03-23 11:37:07] CPUID register: 0x410CC601. Implementer code: 0x41 (ARM)
[INFO     General@23-03-23 11:37:07] Found Cortex-M0 r0p1, Little endian.
[INFO     General@23-03-23 11:37:07] FPUnit: 4 code (BP) slots and 0 literal slots
[INFO     General@23-03-23 11:37:07] CoreSight components:
[INFO     General@23-03-23 11:37:07] ROMTbl[0] @ E00FF000
[INFO     General@23-03-23 11:37:07] ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB008 SCS
[INFO     General@23-03-23 11:37:07] ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 000BB00A DWT
[INFO     General@23-03-23 11:37:07] ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 000BB00B FPB
[INFO     General@23-03-23 11:37:07] BTLE device selected.
[INFO     OTP@23-03-23 11:37:09] Found SW-DP with ID 0x0BC11477
[INFO     OTP@23-03-23 11:37:09] AP map detection skipped. Manually configured AP map found.
[INFO     OTP@23-03-23 11:37:09] AP[0]: AHB-AP (IDR: Not set)
[INFO     OTP@23-03-23 11:37:09] AP[0]: Core found
[INFO     OTP@23-03-23 11:37:09] AP[0]: AHB-AP ROM base: 0xE00FF000
[INFO     OTP@23-03-23 11:37:09] CPUID register: 0x410CC601. Implementer code: 0x41 (ARM)
[INFO     OTP@23-03-23 11:37:09] Found Cortex-M0 r0p1, Little endian.
[INFO     OTP@23-03-23 11:37:09] FPUnit: 4 code (BP) slots and 0 literal slots
[INFO     OTP@23-03-23 11:37:09] CoreSight components:
[INFO     OTP@23-03-23 11:37:09] ROMTbl[0] @ E00FF000
[INFO     OTP@23-03-23 11:37:09] ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 000BB008 SCS
[INFO     OTP@23-03-23 11:37:09] ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 000BB00A DWT
[INFO     OTP@23-03-23 11:37:09] ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 000BB00B FPB
[INFO     OTP@23-03-23 11:37:09] Reset: Halt core after reset via DEMCR.VC_CORERESET.
[INFO     OTP@23-03-23 11:37:09] Reset: Reset device via AIRCR.SYSRESETREQ.
[INFO     OTP@23-03-23 11:37:10] Firmware File C:\Program Files\SmartSnippetsToolbox\SmartSnippetsToolbox5.0.22\common_resources\SupportPackages\DA1453x\toolbox_resources/common/jtag_programmer_531_01.bin has been selected for downloading.
[INFO     OTP@23-03-23 11:37:10] Reset: Halt core after reset via DEMCR.VC_CORERESET.
[INFO     OTP@23-03-23 11:37:10] Reset: Reset device via AIRCR.SYSRESETREQ.
[INFO     OTP@23-03-23 11:37:10] Reset: Halt core after reset via DEMCR.VC_CORERESET.
[INFO     OTP@23-03-23 11:37:10] Reset: Reset device via AIRCR.SYSRESETREQ.
[INFO     OTP@23-03-23 11:37:10] Successfully downloaded firmware file to the board.
[INFO     OTP@23-03-23 11:37:17] Started reading 64 bytes from memory.
[INFO     OTP@23-03-23 11:37:17] Started reading 64 bytes from OTP memory address 0x7F87FC0.
[ERROR    OTP@23-03-23 11:37:27] OTP memory reading has failed.
[ERROR    OTP@23-03-23 11:37:27] Failed reading memory.
[INFO     OTP@23-03-23 11:37:42] Started reading 64 bytes from memory.
[INFO     OTP@23-03-23 11:37:42] Started reading 64 bytes from OTP memory address 0x7F87FC0.
[ERROR    OTP@23-03-23 11:37:53] OTP memory reading has failed.
[ERROR    OTP@23-03-23 11:37:53] Failed reading memory.

Hi There,

I have responded directly on the private ticket you created (#367309).
Let's continue the ticket from there.

Kind Regards,
OV_Renesas

Extremely grateful for your help OV_Renesas. 

I wanted to share a summary of the ticket resolution here for any future readers.

Fixing OTP memory read

The issue regarding reading OTP memory was fixed by using the dev-board as a J-Link

We followed the instructions here:

http://lpccs-docs.renesas.com/Tutorial_SDK6/debug_probe.html#da14531-pro-development-kit

Then we observed that we could read the SPI flash (without any special changes)!

But had some trouble writing the flash.

We are seeing the following error (messages for burning and then erasing):

[INFO  Flash Code@23-03-27 13:26:29] Started burning memory with 21396 bytes of data at address 0x00.
[ERROR SPI Flash Programmer@23-03-27 13:26:29] Adddittional error info at JTAG address 0x7FC3C0C. (MSB first): FF FF FF F8.
[ERROR Flash Code@23-03-27 13:26:29] Fail write 16384 bytes at offset 0x00
[ERROR Flash Code@23-03-27 13:26:29] Failed burning memory.
[INFO  Flash Code@23-03-27 13:27:33] Started erasing from 0x00 to 0x5394 (6 sectors)
[ERROR Flash Code@23-03-27 13:27:33] Memory erasing failed.

At this point we had disabled the HW_RESET in the flash_programmer and therefore we re-enabled this. We then made more progress.

When we read the SPI Flash this way we actually see that it is partially flashed correctly. ie some of the bits match, but the whole image we want burned does not seem to have been sent across.

When we try and Burn the SPI flash using this method, we get the following error:

[INFO  Flash Code@23-03-27 13:32:57] Started burning memory with 21396 bytes of data at address 0x00.
[ERROR SPI Flash Programmer@23-03-27 13:32:57] Failed reading memory at address 0x7FC3C08.
[ERROR Flash Code@23-03-27 13:32:57] Fail write 16384 bytes at offset 0x00
[ERROR Flash Code@23-03-27 13:32:57] Failed burning memory.

Fixing the SPI Read & Burn Issue

This was our process for Burning & Erasing the SPI using with the SmartSnippets toolbox:

1. Hit "Connect" in GUI
2. Use the command line to read OTP and pass a custom `-firmare` flag, so we provide our custom build
   

   & 'C:\Program Files\SmartSnippetsToolbox\SmartSnippetsToolbox5.0.22\SmartSnippetsToolbox.exe' -type otp -chip DA14531 -jtag 480072116 -baudrate 57600 -cmd read_header -file "$env:USERPROFILE\Downloads\header.hex" -firmware "C:\Projects\Aramis\e4-da14531-sdk\utilities\flash_programmer\out_DA14531_JTAG\Objects\jtag_programmer_531.bin" -y

   
   
3. Use the GUI to "Read" and "Flash Code" and then also try "Burn" and "Erase"

As mentioned by OV_Renesas above: https://community.renesas.com/wireles-connectivity/f/bluetooth-low-energy/30177/da14531-wlcsp17-cannot-flash-external-spi-or-read-otp---failed-clearing-memory-address-7fc3c08-failed-configuring-spi-ports-and-pins/104499#104499 

We needed to modify the flash_programmer image to include the additional SPI wait time.

We simply changed the #undef to a #define

/* Enable extra wait time after release from Ultra Deep Power-Down (UDPD). Mainly required for the              */
/* Adesto/Dialog SPI flash memories which support the UDPD command.                                             */
/****************************************************************************************************************/
-#undef CFG_SPI_FLASH_ADESTO_UDPD
+#define CFG_SPI_FLASH_ADESTO_UDPD

The summary of the flash_programmer build:

1. #define CFG_SPI_FLASH_ADESTO_UDPD
2. Ensure that #define CFG_HW_RESET_P00 is used (default behaviour, but I mentioned earlier in this question I disabled it, that was not required)

The summary of our custom firmware build:

1. We kept the HW_RESET enabled & with a state where the SWD pins were enabled for debug (DA14531 cannot reuse JTAG SWDIO or SCLK pins as GPIO with pull-up/pull-down ? (blinky demo) - Bluetooth Low Energy - Wireless Connectivity - Renesas Community). This allowed us to reprogram the board with a RAM program, so we could reflash the flash_programmer and then reprogram the SPI Flash .

Additional Notes

For our purposes we didn't need to access the SPI flash in our custom firmware (only for booting), so we didn't need to make some of the changes the flash_programmer in our custom firmware too.

For this SPI chip we were lucky and didn't need to flash the secondary bootloader.

As OV_Renesas provided in the support ticker:

In order to be able to read/write/erase the SPI Flash via SW as well in your FW you will have to update the spi_flash.h file as well.
For instance, for P25Q11U which is the integrated SPI Flash on the DA14531MOD:

// P25Q11U
#define P25Q11U_MAN_DEV_ID                      0x8510
#define P25Q11U_JEDEC_ID                        0x854011
#define P25Q11U_CHIP_SIZE                       0x20000
#define P25Q11U_MEM_PROT_UPPER_HALF             4
#define P25Q11U_MEM_PROT_LOWER_HALF             36
#define P25Q11U_MEM_PROT_ALL                    8
/// Device index of supported SPI flash memories
typedef enum
{
    /// W25x10CL device index
    W25X10CL_DEV_INDEX = 1,

    /// W25x20CL device index
    W25X20CL_DEV_INDEX,

    /// AT25DN011/AT25DF011 device index
    AT25DX011_DEV_INDEX,

    /// MX25V1006E device index
    MX25V1006E_DEV_INDEX,

    /// MX25R1035F device index
    MX25R1035F_DEV_INDEX,

    /// MX25R2035F device index
    MX25R2035F_DEV_INDEX,

    /// MX25R4035F device index
    MX25R4035F_DEV_INDEX,

    /// MX25R8035F device index
    MX25R8035F_DEV_INDEX,

    /// MX25R1635F device index
    MX25R1635F_DEV_INDEX,

    /// MX25V1035F device index
    MX25V1035F_DEV_INDEX,

    /// MX25V2035F device index
    MX25V2035F_DEV_INDEX,

    /// MX25V4035F device index
    MX25V4035F_DEV_INDEX,

    /// MX25V8035F device index
    MX25V8035F_DEV_INDEX,

    /// MX25V1635F device index
    MX25V1635F_DEV_INDEX,

    /// P25Q10U device index
    P25Q10U_DEV_INDEX,

    P25Q11U_DEV_INDEX,

    /// P25Q40U device index
    P25Q40U_DEV_INDEX,

    /// GD25WD10 device index
    GD25WD10_DEV_INDEX,

    /// GD25WD20 device index
    GD25WD20_DEV_INDEX,

    /// AT25DF021A device index
    AT25DF021A_DEV_INDEX,

    /// AT25EU0021A device index
    AT25EU0021A_DEV_INDEX,

    /// AT25XE041D device index
    AT25XE041D_DEV_INDEX,

    /// AT45DB081E device index
    AT45DB081E_DEV_INDEX,
} spi_flash_dev_index_t;

And on spi_flash.c file:

int8_t spi_flash_auto_detect(uint8_t *dev_id)
{
    int8_t status;
    // List of known SPI Flash devices
    const spi_flash_cfg_t known_spi_devs_list[] =
    {
        {W25X10CL_DEV_INDEX,    W25X10CL_JEDEC_ID,    W25X10CL_CHIP_SIZE},
        {W25X20CL_DEV_INDEX,    W25X20CL_JEDEC_ID,    W25X20CL_CHIP_SIZE},
        {AT25DX011_DEV_INDEX,   AT25DX011_JEDEC_ID,   AT25DX011_CHIP_SIZE},
        {MX25V1006E_DEV_INDEX,  MX25V1006E_JEDEC_ID,  MX25V1006E_CHIP_SIZE},
        {MX25R1035F_DEV_INDEX,  MX25R1035F_JEDEC_ID,  MX25R1035F_CHIP_SIZE},
        {MX25R2035F_DEV_INDEX,  MX25R2035F_JEDEC_ID,  MX25R2035F_CHIP_SIZE},
        {P25Q10U_DEV_INDEX,     P25Q10U_JEDEC_ID,     P25Q10U_CHIP_SIZE},
        {P25Q11U_DEV_INDEX,     P25Q11U_JEDEC_ID,       P25Q11U_CHIP_SIZE},
        {GD25WD20_DEV_INDEX,    GD25WD20_JEDEC_ID,    GD25WD20_CHIP_SIZE},
        {AT25DF021A_DEV_INDEX,  AT25DF021A_JEDEC_ID,  AT25DF021A_CHIP_SIZE},
        {AT25EU0021A_DEV_INDEX, AT25EU0021A_JEDEC_ID, AT25EU0021A_CHIP_SIZE},
        {AT25XE041D_DEV_INDEX,  AT25XE041D_JEDEC_ID,  AT25XE041D_CHIP_SIZE},
#if defined (__FPGA__)
        {MX25R8035F_DEV_INDEX,  MX25R8035F_JEDEC_ID,  MX25R8035F_CHIP_SIZE},
        {AT45DB081E_DEV_INDEX,  AT45DB081E_JEDEC_ID,  AT45DB081E_CHIP_SIZE},
#endif
    };
.
.
.

So, you should define the appropriate macros according to the AT25DF041B datasheet, insert your device on the spi_flash_dev_index_t and save it on the known_spi_devs_list as well.
According to the AT25DF041B datasheet: