1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
|
/*
* This file is part of the flashrom project.
*
* Copyright (C) 2014 Google LLC.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
/*
* s25f.c - Helper functions for Spansion S25FL and S25FS SPI flash chips.
* Uses 24 bit addressing for the FS chips and 32 bit addressing for the FL
* chips (which is required by the overlaid sector size devices).
* TODO: Implement fancy hybrid sector architecture helpers.
*/
#include <stdlib.h>
#include <string.h>
#include "chipdrivers.h"
#include "spi.h"
/*
* RDAR and WRAR are supported on chips which have more than one set of status
* and control registers and take an address of the register to read/write.
* WRR, RDSR2, and RDCR are used on chips with a more limited set of control/
* status registers.
*
* WRR is somewhat peculiar. It shares the same opcode as JEDEC_WRSR, and if
* given one data byte (following the opcode) it acts the same way. If it's
* given two data bytes, the first data byte overwrites status register 1
* and the second data byte overwrites config register 1.
*/
#define CMD_WRR 0x01
#define CMD_WRDI 0x04
#define CMD_RDSR2 0x07 /* note: read SR1 with JEDEC RDSR opcode */
#define CMD_RDCR 0x35
#define CMD_RDAR 0x65
#define CMD_WRAR 0x71
/* TODO: For now, commands which use an address assume 24-bit addressing */
#define CMD_WRR_LEN 3
#define CMD_WRDI_LEN 1
#define CMD_RDAR_LEN 4
#define CMD_WRAR_LEN 5
#define CMD_RSTEN 0x66
#define CMD_RST 0x99
#define CR1NV_ADDR 0x000002
#define CR1_BPNV_O (1 << 3)
#define CR1_TBPROT_O (1 << 5)
#define CR3NV_ADDR 0x000004
#define CR3NV_20H_NV (1 << 3)
/* See "Embedded Algorithm Performance Tables for additional timing specs. */
#define T_W 145 * 1000 /* NV register write time (145ms) */
#define T_RPH 35 /* Reset pulse hold time (35us) */
#define S25FS_T_SE 145 * 1000 /* Sector Erase Time (145ms) */
#define S25FL_T_SE 130 * 1000 /* Sector Erase Time (130ms) */
static int s25f_legacy_software_reset(const struct flashctx *flash)
{
struct spi_command cmds[] = {
{
.writecnt = 1,
.writearr = (const uint8_t[]){ CMD_RSTEN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 1,
.writearr = (const uint8_t[]){ 0xf0 },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
int result = spi_send_multicommand(flash, cmds);
if (result) {
msg_cerr("%s failed during command execution\n", __func__);
return result;
}
/* Allow time for reset command to execute. The datasheet specifies
* Trph = 35us, double that to be safe. */
programmer_delay(flash, T_RPH * 2);
return 0;
}
/* "Legacy software reset" is disabled by default on S25FS, use this instead. */
static int s25fs_software_reset(struct flashctx *flash)
{
struct spi_command cmds[] = {
{
.writecnt = 1,
.writearr = (const uint8_t[]){ CMD_RSTEN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 1,
.writearr = (const uint8_t[]){ CMD_RST },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
int result = spi_send_multicommand(flash, cmds);
if (result) {
msg_cerr("%s failed during command execution\n", __func__);
return result;
}
/* Allow time for reset command to execute. Double tRPH to be safe. */
programmer_delay(flash, T_RPH * 2);
return 0;
}
static int s25f_poll_status(const struct flashctx *flash)
{
while (true) {
uint8_t tmp;
if (spi_read_register(flash, STATUS1, &tmp))
return -1;
if ((tmp & SPI_SR_WIP) == 0)
break;
/*
* The WIP bit on S25F chips remains set to 1 if erase or
* programming errors occur, so we must check for those
* errors here. If an error is encountered, do a software
* reset to clear WIP and other volatile bits, otherwise
* the chip will be unresponsive to further commands.
*/
if (tmp & SPI_SR_ERA_ERR) {
msg_cerr("Erase error occurred\n");
s25f_legacy_software_reset(flash);
return -1;
}
if (tmp & (1 << 6)) {
msg_cerr("Programming error occurred\n");
s25f_legacy_software_reset(flash);
return -1;
}
programmer_delay(flash, 1000 * 10);
}
return 0;
}
/* "Read Any Register" instruction only supported on S25FS */
static int s25fs_read_cr(const struct flashctx *flash, uint32_t addr)
{
uint8_t cfg;
/* By default, 8 dummy cycles are necessary for variable-latency
commands such as RDAR (see CR2NV[3:0]). */
uint8_t read_cr_cmd[] = {
CMD_RDAR,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff),
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
};
int result = spi_send_command(flash, sizeof(read_cr_cmd), 1, read_cr_cmd, &cfg);
if (result) {
msg_cerr("%s failed during command execution at address 0x%"PRIx32"\n",
__func__, addr);
return -1;
}
return cfg;
}
/* "Write Any Register" instruction only supported on S25FS */
static int s25fs_write_cr(const struct flashctx *flash,
uint32_t addr, uint8_t data)
{
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const uint8_t[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = CMD_WRAR_LEN,
.writearr = (const uint8_t[]){
CMD_WRAR,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff),
data
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
int result = spi_send_multicommand(flash, cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%"PRIx32"\n",
__func__, addr);
return -1;
}
programmer_delay(flash, T_W);
return s25f_poll_status(flash);
}
static int s25fs_restore_cr3nv(struct flashctx *flash, void *data)
{
int ret = 0;
uint8_t cfg = *(uint8_t *)data;
free(data);
msg_cdbg("Restoring CR3NV value to 0x%02x\n", cfg);
ret |= s25fs_write_cr(flash, CR3NV_ADDR, cfg);
ret |= s25fs_software_reset(flash);
return ret;
}
int s25fs_block_erase_d8(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
{
static int cr3nv_checked = 0;
struct spi_command erase_cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const uint8_t[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BE_D8_OUTSIZE,
.writearr = (const uint8_t[]){
JEDEC_BE_D8,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
/* Check if hybrid sector architecture is in use and, if so,
* switch to uniform sectors. */
if (!cr3nv_checked) {
uint8_t cfg = s25fs_read_cr(flash, CR3NV_ADDR);
if (!(cfg & CR3NV_20H_NV)) {
s25fs_write_cr(flash, CR3NV_ADDR, cfg | CR3NV_20H_NV);
s25fs_software_reset(flash);
cfg = s25fs_read_cr(flash, CR3NV_ADDR);
if (!(cfg & CR3NV_20H_NV)) {
msg_cerr("%s: Unable to enable uniform "
"block sizes.\n", __func__);
return 1;
}
msg_cdbg("\n%s: CR3NV updated (0x%02x -> 0x%02x)\n",
__func__, cfg,
s25fs_read_cr(flash, CR3NV_ADDR));
/* Restore CR3V when flashrom exits */
uint8_t *data = calloc(sizeof(uint8_t), 1);
if (!data) {
msg_cerr("Out of memory!\n");
return 1;
}
*data = cfg;
register_chip_restore(s25fs_restore_cr3nv, flash, data);
}
cr3nv_checked = 1;
}
int result = spi_send_multicommand(flash, erase_cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
programmer_delay(flash, S25FS_T_SE);
return s25f_poll_status(flash);
}
int s25fl_block_erase(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
{
struct spi_command erase_cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const uint8_t[]){
JEDEC_WREN
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BE_DC_OUTSIZE,
.writearr = (const uint8_t[]){
JEDEC_BE_DC,
(addr >> 24) & 0xff,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.readcnt = 0,
}
};
int result = spi_send_multicommand(flash, erase_cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
programmer_delay(flash, S25FL_T_SE);
return s25f_poll_status(flash);
}
int probe_spi_big_spansion(struct flashctx *flash)
{
uint8_t cmd = JEDEC_RDID;
uint8_t dev_id[6]; /* We care only about 6 first bytes */
if (spi_send_command(flash, sizeof(cmd), sizeof(dev_id), &cmd, dev_id))
return 0;
msg_gdbg("Read id bytes: ");
for (size_t i = 0; i < sizeof(dev_id); i++)
msg_gdbg(" 0x%02x", dev_id[i]);
msg_gdbg(".\n");
/*
* The structure of the RDID output is as follows:
*
* offset value meaning
* 00h 01h Manufacturer ID for Spansion
* 01h 20h 128 Mb capacity
* 01h 02h 256 Mb capacity
* 02h 18h 128 Mb capacity
* 02h 19h 256 Mb capacity
* 03h 4Dh Full size of the RDID output (ignored)
* 04h 00h FS: 256-kB physical sectors
* 04h 01h FS: 64-kB physical sectors
* 04h 00h FL: 256-kB physical sectors
* 04h 01h FL: Mix of 64-kB and 4KB overlaid sectors
* 05h 80h FL family
* 05h 81h FS family
*
* Need to use bytes 1, 2, 4, and 5 to properly identify one of eight
* possible chips:
*
* 2 types * 2 possible sizes * 2 possible sector layouts
*
*/
uint32_t model_id =
(uint32_t)dev_id[1] << 24 |
(uint32_t)dev_id[2] << 16 |
(uint32_t)dev_id[4] << 8 |
(uint32_t)dev_id[5] << 0;
if (dev_id[0] == flash->chip->manufacture_id && model_id == flash->chip->model_id)
return 1;
return 0;
}
|