1 /***************************************************************************
2 * Copyright (C) 2010 by Antonio Borneo <borneo.antonio@gmail.com> *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program; if not, write to the *
16 * Free Software Foundation, Inc., *
17 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
18 ***************************************************************************/
20 /* STM Serial Memory Interface (SMI) controller is a SPI bus controller
21 * specifically designed for SPI memories.
22 * Only SPI "mode 3" (CPOL=1 and CPHA=1) is supported.
23 * Two working modes are available:
24 * - SW mode: the SPI is controlled by SW. Any custom commands can be sent
26 * - HW mode: the SPI but is under SMI control. Memory content is directly
27 * accessible in CPU memory space. CPU can read, write and execute memory
31 * To have flash memory mapped in CPU memory space, the SMI controller
32 * have to be in "HW mode". This requires following constraints:
33 * 1) The command "reset init" have to initialize SMI controller and put
35 * 2) every command in this file have to return to prompt in HW mode. */
42 #include <jtag/jtag.h>
43 #include <helper/time_support.h>
45 #define SMI_READ_REG(a) (_SMI_READ_REG(a))
46 #define _SMI_READ_REG(a) \
51 __a = target_read_u32(target, io_base + (a), &__v); \
52 if (__a != ERROR_OK) \
57 #define SMI_WRITE_REG(a,v) \
61 __r = target_write_u32(target, io_base + (a), (v)); \
62 if (__r != ERROR_OK) \
66 #define SMI_POLL_TFF(timeout) \
70 __r = poll_tff(target, io_base, timeout); \
71 if (__r != ERROR_OK) \
75 #define SMI_SET_SW_MODE() SMI_WRITE_REG(SMI_CR1, \
76 SMI_READ_REG(SMI_CR1) | SMI_SW_MODE)
77 #define SMI_SET_HWWB_MODE() SMI_WRITE_REG(SMI_CR1, \
78 (SMI_READ_REG(SMI_CR1) | SMI_WB_MODE) & ~SMI_SW_MODE)
79 #define SMI_SET_HW_MODE() SMI_WRITE_REG(SMI_CR1, \
80 SMI_READ_REG(SMI_CR1) & ~(SMI_SW_MODE | SMI_WB_MODE))
81 #define SMI_CLEAR_TFF() SMI_WRITE_REG(SMI_SR, ~SMI_TFF)
83 #define SMI_BANK_SIZE (0x01000000)
85 #define SMI_CR1 (0x00) /* Control register 1 */
86 #define SMI_CR2 (0x04) /* Control register 2 */
87 #define SMI_SR (0x08) /* Status register */
88 #define SMI_TR (0x0c) /* TX */
89 #define SMI_RR (0x10) /* RX */
91 /* fields in SMI_CR1 */
92 #define SMI_SW_MODE 0x10000000 /* set to enable SW Mode */
93 #define SMI_WB_MODE 0x20000000 /* Write Burst Mode */
95 /* fields in SMI_CR2 */
96 #define SMI_TX_LEN_1 0x00000001 /* data length = 1 byte */
97 #define SMI_TX_LEN_4 0x00000004 /* data length = 4 byte */
98 #define SMI_RX_LEN_3 0x00000030 /* data length = 3 byte */
99 #define SMI_SEND 0x00000080 /* Send data */
100 #define SMI_RSR 0x00000400 /* reads status reg */
101 #define SMI_WE 0x00000800 /* Write Enable */
102 #define SMI_SEL_BANK0 0x00000000 /* Select Bank0 */
103 #define SMI_SEL_BANK1 0x00001000 /* Select Bank1 */
104 #define SMI_SEL_BANK2 0x00002000 /* Select Bank2 */
105 #define SMI_SEL_BANK3 0x00003000 /* Select Bank3 */
107 /* fields in SMI_SR */
108 #define SMI_WIP_BIT 0x00000001 /* WIP Bit of SPI SR on SMI SR */
109 #define SMI_WEL_BIT 0x00000002 /* WEL Bit of SPI SR on SMI SR */
110 #define SMI_TFF 0x00000100 /* Transfer Finished Flag */
113 #define SMI_READ_ID 0x0000009F /* Read Flash Identification */
116 #define SMI_CMD_TIMEOUT (100)
117 #define SMI_PROBE_TIMEOUT (100)
118 #define SMI_MAX_TIMEOUT (3000)
120 struct stmsmi_flash_bank
125 struct flash_device *dev;
128 /* data structure to maintain flash ids from different vendors */
129 struct flash_device {
134 unsigned long sectorsize;
135 unsigned long size_in_bytes;
138 #define FLASH_ID(n, es, id, psize, ssize, size) \
144 .sectorsize = ssize, \
145 .size_in_bytes = size \
148 /* List below is taken from Linux driver. It is not exhaustive of all the
149 * possible SPI memories, nor exclusive for SMI. Could be shared with
150 * other SPI drivers. */
151 static struct flash_device flash_devices[] = {
152 /* name, erase_cmd, device_id, pagesize, sectorsize, size_in_bytes */
153 FLASH_ID("st m25p05", 0xd8, 0x00102020, 0x80, 0x8000, 0x10000),
154 FLASH_ID("st m25p10", 0xd8, 0x00112020, 0x80, 0x8000, 0x20000),
155 FLASH_ID("st m25p20", 0xd8, 0x00122020, 0x100, 0x10000, 0x40000),
156 FLASH_ID("st m25p40", 0xd8, 0x00132020, 0x100, 0x10000, 0x80000),
157 FLASH_ID("st m25p80", 0xd8, 0x00142020, 0x100, 0x10000, 0x100000),
158 FLASH_ID("st m25p16", 0xd8, 0x00152020, 0x100, 0x10000, 0x200000),
159 FLASH_ID("st m25p32", 0xd8, 0x00162020, 0x100, 0x10000, 0x400000),
160 FLASH_ID("st m25p64", 0xd8, 0x00172020, 0x100, 0x10000, 0x800000),
161 FLASH_ID("st m25p128", 0xd8, 0x00182020, 0x100, 0x40000, 0x1000000),
162 FLASH_ID("st m45pe10", 0xd8, 0x00114020, 0x100, 0x10000, 0x20000),
163 FLASH_ID("st m45pe20", 0xd8, 0x00124020, 0x100, 0x10000, 0x40000),
164 FLASH_ID("st m45pe40", 0xd8, 0x00134020, 0x100, 0x10000, 0x80000),
165 FLASH_ID("st m45pe80", 0xd8, 0x00144020, 0x100, 0x10000, 0x100000),
166 FLASH_ID("sp s25fl004", 0xd8, 0x00120201, 0x100, 0x10000, 0x80000),
167 FLASH_ID("sp s25fl008", 0xd8, 0x00130201, 0x100, 0x10000, 0x100000),
168 FLASH_ID("sp s25fl016", 0xd8, 0x00140201, 0x100, 0x10000, 0x200000),
169 FLASH_ID("sp s25fl032", 0xd8, 0x00150201, 0x100, 0x10000, 0x400000),
170 FLASH_ID("sp s25fl064", 0xd8, 0x00160201, 0x100, 0x10000, 0x800000),
171 FLASH_ID("atmel 25f512", 0x52, 0x0065001f, 0x80, 0x8000, 0x10000),
172 FLASH_ID("atmel 25f1024", 0x52, 0x0060001f, 0x100, 0x8000, 0x20000),
173 FLASH_ID("atmel 25f2048", 0x52, 0x0063001f, 0x100, 0x10000, 0x40000),
174 FLASH_ID("atmel 25f4096", 0x52, 0x0064001f, 0x100, 0x10000, 0x80000),
175 FLASH_ID("atmel 25fs040", 0xd7, 0x0004661f, 0x100, 0x10000, 0x80000),
176 FLASH_ID("mac 25l512", 0xd8, 0x001020c2, 0x010, 0x10000, 0x10000),
177 FLASH_ID("mac 25l1005", 0xd8, 0x001120c2, 0x010, 0x10000, 0x20000),
178 FLASH_ID("mac 25l2005", 0xd8, 0x001220c2, 0x010, 0x10000, 0x40000),
179 FLASH_ID("mac 25l4005", 0xd8, 0x001320c2, 0x010, 0x10000, 0x80000),
180 FLASH_ID("mac 25l8005", 0xd8, 0x001420c2, 0x010, 0x10000, 0x100000),
181 FLASH_ID("mac 25l1605", 0xd8, 0x001520c2, 0x100, 0x10000, 0x200000),
182 FLASH_ID("mac 25l3205", 0xd8, 0x001620c2, 0x100, 0x10000, 0x400000),
183 FLASH_ID("mac 25l6405", 0xd8, 0x001720c2, 0x100, 0x10000, 0x800000),
184 FLASH_ID(NULL, 0, 0, 0, 0, 0)
187 struct stmsmi_target {
194 static struct stmsmi_target target_devices[] = {
195 /* name, tap_idcode, smi_base, io_base */
196 { "SPEAr3xx/6xx", 0x07926041, 0xf8000000, 0xfc000000 },
197 { "STR75x", 0x4f1f0041, 0x80000000, 0x90000000 },
201 FLASH_BANK_COMMAND_HANDLER(stmsmi_flash_bank_command)
203 struct stmsmi_flash_bank *stmsmi_info;
205 LOG_DEBUG("%s", __FUNCTION__);
209 LOG_WARNING("incomplete flash_bank stmsmi configuration");
210 return ERROR_FLASH_BANK_INVALID;
213 stmsmi_info = malloc(sizeof(struct stmsmi_flash_bank));
214 if (stmsmi_info == NULL)
216 LOG_ERROR("not enough memory");
220 bank->driver_priv = stmsmi_info;
221 stmsmi_info->probed = 0;
226 /* Poll transmit finished flag */
228 static int poll_tff(struct target *target, uint32_t io_base, int timeout)
232 if (SMI_READ_REG(SMI_SR) & SMI_TFF)
235 endtime = timeval_ms() + timeout;
238 if (SMI_READ_REG(SMI_SR) & SMI_TFF)
240 } while (timeval_ms() < endtime);
242 LOG_ERROR("Timeout while polling TFF");
243 return ERROR_FLASH_OPERATION_FAILED;
246 /* Read the status register of the external SPI flash chip.
247 * The operation is triggered by setting SMI_RSR bit.
248 * SMI sends the proper SPI command (0x05) and returns value in SMI_SR */
249 static int read_status_reg(struct flash_bank *bank, uint32_t *status)
251 struct target *target = bank->target;
252 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
253 uint32_t io_base = stmsmi_info->io_base;
255 /* clear transmit finished flag */
259 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_RSR);
261 /* Poll transmit finished flag */
262 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
264 /* clear transmit finished flag */
267 *status = SMI_READ_REG(SMI_SR) & 0x0000ffff;
269 /* clean-up SMI_CR2 */
270 SMI_WRITE_REG(SMI_CR2, 0); /* AB: Required ? */
275 /* check for WIP (write in progress) bit in status register */
277 static int wait_till_ready(struct flash_bank *bank, int timeout)
283 endtime = timeval_ms() + timeout;
285 /* read flash status register */
286 retval = read_status_reg(bank, &status);
287 if (retval != ERROR_OK)
290 if ((status & SMI_WIP_BIT) == 0)
293 } while (timeval_ms() < endtime);
295 LOG_ERROR("timeout");
299 /* Send "write enable" command to SPI flash chip.
300 * The operation is triggered by setting SMI_WE bit, and SMI sends
301 * the proper SPI command (0x06) */
302 static int smi_write_enable(struct flash_bank *bank)
304 struct target *target = bank->target;
305 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
306 uint32_t io_base = stmsmi_info->io_base;
310 /* Enter in HW mode */
311 SMI_SET_HW_MODE(); /* AB: is this correct ?*/
313 /* clear transmit finished flag */
316 /* Send write enable command */
317 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_WE);
319 /* Poll transmit finished flag */
320 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
322 /* read flash status register */
323 retval = read_status_reg(bank, &status);
324 if (retval != ERROR_OK)
327 /* Check write enabled */
328 if ((status & SMI_WEL_BIT) == 0)
330 LOG_ERROR("Cannot enable write to flash. Status=0x%08" PRIx32, status);
337 static uint32_t erase_command(struct stmsmi_flash_bank *stmsmi_info,
345 cmd.x[0] = stmsmi_info->dev->erase_cmd;
346 cmd.x[1] = offset >> 16;
347 cmd.x[2] = offset >> 8;
353 static int smi_erase_sector(struct flash_bank *bank, int sector)
355 struct target *target = bank->target;
356 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
357 uint32_t io_base = stmsmi_info->io_base;
361 retval = smi_write_enable(bank);
362 if (retval != ERROR_OK)
365 /* Switch to SW mode to send sector erase command */
368 /* clear transmit finished flag */
371 /* send SPI command "block erase" */
372 cmd = erase_command(stmsmi_info, bank->sectors[sector].offset);
373 SMI_WRITE_REG(SMI_TR, cmd);
374 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_SEND | SMI_TX_LEN_4);
376 /* Poll transmit finished flag */
377 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
379 /* poll WIP for end of self timed Sector Erase cycle */
380 retval = wait_till_ready(bank, SMI_MAX_TIMEOUT);
381 if (retval != ERROR_OK)
387 static int stmsmi_erase(struct flash_bank *bank, int first, int last)
389 struct target *target = bank->target;
390 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
391 uint32_t io_base = stmsmi_info->io_base;
392 int retval = ERROR_OK;
395 LOG_DEBUG("%s: from sector %d to sector %d", __FUNCTION__, first, last);
397 if (target->state != TARGET_HALTED)
399 LOG_ERROR("Target not halted");
400 return ERROR_TARGET_NOT_HALTED;
403 if ((first < 0) || (last < first) || (last >= bank->num_sectors))
405 LOG_ERROR("Flash sector invalid");
406 return ERROR_FLASH_SECTOR_INVALID;
409 if (!(stmsmi_info->probed))
411 LOG_ERROR("Flash bank not probed");
412 return ERROR_FLASH_BANK_NOT_PROBED;
415 for (sector = first; sector <= last; sector++)
417 if (bank->sectors[sector].is_protected)
419 LOG_ERROR("Flash sector %d protected", sector);
424 for (sector = first; sector <= last; sector++)
426 retval = smi_erase_sector(bank, sector);
427 if (retval != ERROR_OK)
432 /* Switch to HW mode before return to prompt */
437 static int stmsmi_protect(struct flash_bank *bank, int set,
442 for (sector = first; sector <= last; sector++)
443 bank->sectors[sector].is_protected = set;
447 static int smi_write_buffer(struct flash_bank *bank, uint8_t *buffer,
448 uint32_t address, uint32_t len)
450 struct target *target = bank->target;
451 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
452 uint32_t io_base = stmsmi_info->io_base;
455 LOG_DEBUG("%s: address=0x%08" PRIx32 " len=0x%08" PRIx32,
456 __FUNCTION__, address, len);
458 retval = smi_write_enable(bank);
459 if (retval != ERROR_OK)
462 /* HW mode, write burst mode */
465 retval = target_write_buffer(target, address, len, buffer);
466 if (retval != ERROR_OK)
472 static int stmsmi_write(struct flash_bank *bank, uint8_t *buffer,
473 uint32_t offset, uint32_t count)
475 struct target *target = bank->target;
476 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
477 uint32_t io_base = stmsmi_info->io_base;
478 uint32_t cur_count, page_size, page_offset;
480 int retval = ERROR_OK;
482 LOG_DEBUG("%s: offset=0x%08" PRIx32 " count=0x%08" PRIx32,
483 __FUNCTION__, offset, count);
485 if (target->state != TARGET_HALTED)
487 LOG_ERROR("Target not halted");
488 return ERROR_TARGET_NOT_HALTED;
491 if (offset + count > stmsmi_info->dev->size_in_bytes)
493 LOG_WARNING("Write pasts end of flash. Extra data discarded.");
494 count = stmsmi_info->dev->size_in_bytes - offset;
497 /* Check sector protection */
498 for (sector = 0; sector < bank->num_sectors; sector++)
500 /* Start offset in or before this sector? */
501 /* End offset in or behind this sector? */
503 (bank->sectors[sector].offset + bank->sectors[sector].size))
504 && ((offset + count - 1) >= bank->sectors[sector].offset)
505 && bank->sectors[sector].is_protected )
507 LOG_ERROR("Flash sector %d protected", sector);
512 page_size = stmsmi_info->dev->pagesize;
514 /* unaligned buffer head */
515 if (count > 0 && (offset & 3) != 0)
517 cur_count = 4 - (offset & 3);
518 if (cur_count > count)
520 retval = smi_write_buffer(bank, buffer, bank->base + offset,
522 if (retval != ERROR_OK)
529 page_offset = offset % page_size;
530 /* central part, aligned words */
533 /* clip block at page boundary */
534 if (page_offset + count > page_size)
535 cur_count = page_size - page_offset;
537 cur_count = count & ~3;
539 retval = smi_write_buffer(bank, buffer, bank->base + offset,
541 if (retval != ERROR_OK)
554 retval = smi_write_buffer(bank, buffer, bank->base + offset, count);
557 /* Switch to HW mode before return to prompt */
562 /* Return ID of flash device */
563 /* On exit, SW mode is kept */
564 static int read_flash_id(struct flash_bank *bank, uint32_t *id)
566 struct target *target = bank->target;
567 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
568 uint32_t io_base = stmsmi_info->io_base;
571 if (target->state != TARGET_HALTED)
573 LOG_ERROR("Target not halted");
574 return ERROR_TARGET_NOT_HALTED;
578 retval = wait_till_ready(bank, SMI_PROBE_TIMEOUT);
579 if (retval != ERROR_OK)
582 /* enter in SW mode */
585 /* clear transmit finished flag */
588 /* Send SPI command "read ID" */
589 SMI_WRITE_REG(SMI_TR, SMI_READ_ID);
590 SMI_WRITE_REG(SMI_CR2,
591 stmsmi_info->bank_num | SMI_SEND | SMI_RX_LEN_3 | SMI_TX_LEN_1);
593 /* Poll transmit finished flag */
594 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
596 /* clear transmit finished flag */
599 /* read ID from Receive Register */
600 *id = SMI_READ_REG(SMI_RR) & 0x00ffffff;
604 static int stmsmi_probe(struct flash_bank *bank)
606 struct target *target = bank->target;
607 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
609 struct flash_sector *sectors;
610 uint32_t id = 0; /* silence uninitialized warning */
611 struct stmsmi_target *target_device;
614 if (stmsmi_info->probed)
616 stmsmi_info->probed = 0;
618 for (target_device=target_devices ; target_device->name ; ++target_device)
619 if (target_device->tap_idcode == target->tap->idcode)
621 if (!target_device->name)
623 LOG_ERROR("Device ID 0x%" PRIx32 " is not known as SMI capable",
624 target->tap->idcode);
628 switch (bank->base - target_device->smi_base)
631 stmsmi_info->bank_num = SMI_SEL_BANK0;
634 stmsmi_info->bank_num = SMI_SEL_BANK1;
636 case 2*SMI_BANK_SIZE:
637 stmsmi_info->bank_num = SMI_SEL_BANK2;
639 case 3*SMI_BANK_SIZE:
640 stmsmi_info->bank_num = SMI_SEL_BANK3;
643 LOG_ERROR("Invalid SMI base address 0x%" PRIx32, bank->base);
646 io_base = target_device->io_base;
647 stmsmi_info->io_base = io_base;
649 LOG_DEBUG("Valid SMI on device %s at address 0x%" PRIx32,
650 target_device->name, bank->base);
652 /* read and decode flash ID; returns in SW mode */
653 retval = read_flash_id(bank, &id);
655 if (retval != ERROR_OK)
658 stmsmi_info->dev = NULL;
659 for (struct flash_device *p = flash_devices; p->name ; p++)
660 if (p->device_id == id) {
661 stmsmi_info->dev = p;
665 if (!stmsmi_info->dev)
667 LOG_ERROR("Unknown flash device (ID 0x%08" PRIx32 ")", id);
671 LOG_INFO("Found flash device \'%s\' (ID 0x%08" PRIx32 ")",
672 stmsmi_info->dev->name, stmsmi_info->dev->device_id);
674 /* Set correct size value */
675 bank->size = stmsmi_info->dev->size_in_bytes;
677 /* create and fill sectors array */
679 stmsmi_info->dev->size_in_bytes / stmsmi_info->dev->sectorsize;
680 sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
683 LOG_ERROR("not enough memory");
687 for (int sector = 0; sector < bank->num_sectors; sector++)
689 sectors[sector].offset = sector * stmsmi_info->dev->sectorsize;
690 sectors[sector].size = stmsmi_info->dev->sectorsize;
691 sectors[sector].is_erased = -1;
692 sectors[sector].is_protected = 1;
695 bank->sectors = sectors;
696 stmsmi_info->probed = 1;
700 static int stmsmi_auto_probe(struct flash_bank *bank)
702 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
703 if (stmsmi_info->probed)
705 return stmsmi_probe(bank);
708 static int stmsmi_protect_check(struct flash_bank *bank)
710 /* Nothing to do. Protection is only handled in SW. */
714 static int get_stmsmi_info(struct flash_bank *bank, char *buf, int buf_size)
716 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
719 if (!(stmsmi_info->probed))
721 printed = snprintf(buf, buf_size,
722 "\nSMI flash bank not probed yet\n");
726 printed = snprintf(buf, buf_size, "\nSMI flash information:\n"
727 " Device \'%s\' (ID 0x%08x)\n",
728 stmsmi_info->dev->name, stmsmi_info->dev->device_id);
735 struct flash_driver stmsmi_flash = {
737 .flash_bank_command = stmsmi_flash_bank_command,
738 .erase = stmsmi_erase,
739 .protect = stmsmi_protect,
740 .write = stmsmi_write,
741 .read = default_flash_read,
742 .probe = stmsmi_probe,
743 .auto_probe = stmsmi_auto_probe,
744 .erase_check = default_flash_blank_check,
745 .protect_check = stmsmi_protect_check,
746 .info = get_stmsmi_info,