1 /***************************************************************************
2 * Copyright (C) 2010 by Antonio Borneo <borneo.antonio@gmail.com> *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program; if not, write to the *
16 * Free Software Foundation, Inc., *
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
18 ***************************************************************************/
20 /* STM Serial Memory Interface (SMI) controller is a SPI bus controller
21 * specifically designed for SPI memories.
22 * Only SPI "mode 3" (CPOL=1 and CPHA=1) is supported.
23 * Two working modes are available:
24 * - SW mode: the SPI is controlled by SW. Any custom commands can be sent
26 * - HW mode: the SPI but is under SMI control. Memory content is directly
27 * accessible in CPU memory space. CPU can read, write and execute memory
31 * To have flash memory mapped in CPU memory space, the SMI controller
32 * have to be in "HW mode". This requires following constraints:
33 * 1) The command "reset init" have to initialize SMI controller and put
35 * 2) every command in this file have to return to prompt in HW mode. */
43 #include <jtag/jtag.h>
44 #include <helper/time_support.h>
46 #define SMI_READ_REG(a) (_SMI_READ_REG(a))
47 #define _SMI_READ_REG(a) \
52 __a = target_read_u32(target, io_base + (a), &__v); \
53 if (__a != ERROR_OK) \
58 #define SMI_WRITE_REG(a, v) \
62 __r = target_write_u32(target, io_base + (a), (v)); \
63 if (__r != ERROR_OK) \
67 #define SMI_POLL_TFF(timeout) \
71 __r = poll_tff(target, io_base, timeout); \
72 if (__r != ERROR_OK) \
76 #define SMI_SET_SW_MODE() SMI_WRITE_REG(SMI_CR1, \
77 SMI_READ_REG(SMI_CR1) | SMI_SW_MODE)
78 #define SMI_SET_HWWB_MODE() SMI_WRITE_REG(SMI_CR1, \
79 (SMI_READ_REG(SMI_CR1) | SMI_WB_MODE) & ~SMI_SW_MODE)
80 #define SMI_SET_HW_MODE() SMI_WRITE_REG(SMI_CR1, \
81 SMI_READ_REG(SMI_CR1) & ~(SMI_SW_MODE | SMI_WB_MODE))
82 #define SMI_CLEAR_TFF() SMI_WRITE_REG(SMI_SR, ~SMI_TFF)
84 #define SMI_BANK_SIZE (0x01000000)
86 #define SMI_CR1 (0x00) /* Control register 1 */
87 #define SMI_CR2 (0x04) /* Control register 2 */
88 #define SMI_SR (0x08) /* Status register */
89 #define SMI_TR (0x0c) /* TX */
90 #define SMI_RR (0x10) /* RX */
92 /* fields in SMI_CR1 */
93 #define SMI_SW_MODE 0x10000000 /* set to enable SW Mode */
94 #define SMI_WB_MODE 0x20000000 /* Write Burst Mode */
96 /* fields in SMI_CR2 */
97 #define SMI_TX_LEN_1 0x00000001 /* data length = 1 byte */
98 #define SMI_TX_LEN_4 0x00000004 /* data length = 4 byte */
99 #define SMI_RX_LEN_3 0x00000030 /* data length = 3 byte */
100 #define SMI_SEND 0x00000080 /* Send data */
101 #define SMI_RSR 0x00000400 /* reads status reg */
102 #define SMI_WE 0x00000800 /* Write Enable */
103 #define SMI_SEL_BANK0 0x00000000 /* Select Bank0 */
104 #define SMI_SEL_BANK1 0x00001000 /* Select Bank1 */
105 #define SMI_SEL_BANK2 0x00002000 /* Select Bank2 */
106 #define SMI_SEL_BANK3 0x00003000 /* Select Bank3 */
108 /* fields in SMI_SR */
109 #define SMI_TFF 0x00000100 /* Transfer Finished Flag */
112 #define SMI_READ_ID 0x0000009F /* Read Flash Identification */
115 #define SMI_CMD_TIMEOUT (100)
116 #define SMI_PROBE_TIMEOUT (100)
117 #define SMI_MAX_TIMEOUT (3000)
119 struct stmsmi_flash_bank
{
123 struct flash_device
*dev
;
126 struct stmsmi_target
{
133 static struct stmsmi_target target_devices
[] = {
134 /* name, tap_idcode, smi_base, io_base */
135 { "SPEAr3xx/6xx", 0x07926041, 0xf8000000, 0xfc000000 },
136 { "STR75x", 0x4f1f0041, 0x80000000, 0x90000000 },
140 FLASH_BANK_COMMAND_HANDLER(stmsmi_flash_bank_command
)
142 struct stmsmi_flash_bank
*stmsmi_info
;
144 LOG_DEBUG("%s", __func__
);
147 return ERROR_COMMAND_SYNTAX_ERROR
;
149 stmsmi_info
= malloc(sizeof(struct stmsmi_flash_bank
));
150 if (stmsmi_info
== NULL
) {
151 LOG_ERROR("not enough memory");
155 bank
->driver_priv
= stmsmi_info
;
156 stmsmi_info
->probed
= 0;
161 /* Poll transmit finished flag */
163 static int poll_tff(struct target
*target
, uint32_t io_base
, int timeout
)
167 if (SMI_READ_REG(SMI_SR
) & SMI_TFF
)
170 endtime
= timeval_ms() + timeout
;
173 if (SMI_READ_REG(SMI_SR
) & SMI_TFF
)
175 } while (timeval_ms() < endtime
);
177 LOG_ERROR("Timeout while polling TFF");
178 return ERROR_FLASH_OPERATION_FAILED
;
181 /* Read the status register of the external SPI flash chip.
182 * The operation is triggered by setting SMI_RSR bit.
183 * SMI sends the proper SPI command (0x05) and returns value in SMI_SR */
184 static int read_status_reg(struct flash_bank
*bank
, uint32_t *status
)
186 struct target
*target
= bank
->target
;
187 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
188 uint32_t io_base
= stmsmi_info
->io_base
;
190 /* clear transmit finished flag */
194 SMI_WRITE_REG(SMI_CR2
, stmsmi_info
->bank_num
| SMI_RSR
);
196 /* Poll transmit finished flag */
197 SMI_POLL_TFF(SMI_CMD_TIMEOUT
);
199 /* clear transmit finished flag */
202 *status
= SMI_READ_REG(SMI_SR
) & 0x0000ffff;
204 /* clean-up SMI_CR2 */
205 SMI_WRITE_REG(SMI_CR2
, 0); /* AB: Required ? */
210 /* check for WIP (write in progress) bit in status register */
212 static int wait_till_ready(struct flash_bank
*bank
, int timeout
)
218 endtime
= timeval_ms() + timeout
;
220 /* read flash status register */
221 retval
= read_status_reg(bank
, &status
);
222 if (retval
!= ERROR_OK
)
225 if ((status
& SPIFLASH_BSY_BIT
) == 0)
228 } while (timeval_ms() < endtime
);
230 LOG_ERROR("timeout");
234 /* Send "write enable" command to SPI flash chip.
235 * The operation is triggered by setting SMI_WE bit, and SMI sends
236 * the proper SPI command (0x06) */
237 static int smi_write_enable(struct flash_bank
*bank
)
239 struct target
*target
= bank
->target
;
240 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
241 uint32_t io_base
= stmsmi_info
->io_base
;
245 /* Enter in HW mode */
246 SMI_SET_HW_MODE(); /* AB: is this correct ?*/
248 /* clear transmit finished flag */
251 /* Send write enable command */
252 SMI_WRITE_REG(SMI_CR2
, stmsmi_info
->bank_num
| SMI_WE
);
254 /* Poll transmit finished flag */
255 SMI_POLL_TFF(SMI_CMD_TIMEOUT
);
257 /* read flash status register */
258 retval
= read_status_reg(bank
, &status
);
259 if (retval
!= ERROR_OK
)
262 /* Check write enabled */
263 if ((status
& SPIFLASH_WE_BIT
) == 0) {
264 LOG_ERROR("Cannot enable write to flash. Status=0x%08" PRIx32
, status
);
271 static uint32_t erase_command(struct stmsmi_flash_bank
*stmsmi_info
,
279 cmd
.x
[0] = stmsmi_info
->dev
->erase_cmd
;
280 cmd
.x
[1] = offset
>> 16;
281 cmd
.x
[2] = offset
>> 8;
287 static int smi_erase_sector(struct flash_bank
*bank
, int sector
)
289 struct target
*target
= bank
->target
;
290 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
291 uint32_t io_base
= stmsmi_info
->io_base
;
295 retval
= smi_write_enable(bank
);
296 if (retval
!= ERROR_OK
)
299 /* Switch to SW mode to send sector erase command */
302 /* clear transmit finished flag */
305 /* send SPI command "block erase" */
306 cmd
= erase_command(stmsmi_info
, bank
->sectors
[sector
].offset
);
307 SMI_WRITE_REG(SMI_TR
, cmd
);
308 SMI_WRITE_REG(SMI_CR2
, stmsmi_info
->bank_num
| SMI_SEND
| SMI_TX_LEN_4
);
310 /* Poll transmit finished flag */
311 SMI_POLL_TFF(SMI_CMD_TIMEOUT
);
313 /* poll WIP for end of self timed Sector Erase cycle */
314 retval
= wait_till_ready(bank
, SMI_MAX_TIMEOUT
);
315 if (retval
!= ERROR_OK
)
321 static int stmsmi_erase(struct flash_bank
*bank
, int first
, int last
)
323 struct target
*target
= bank
->target
;
324 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
325 uint32_t io_base
= stmsmi_info
->io_base
;
326 int retval
= ERROR_OK
;
329 LOG_DEBUG("%s: from sector %d to sector %d", __func__
, first
, last
);
331 if (target
->state
!= TARGET_HALTED
) {
332 LOG_ERROR("Target not halted");
333 return ERROR_TARGET_NOT_HALTED
;
336 if ((first
< 0) || (last
< first
) || (last
>= bank
->num_sectors
)) {
337 LOG_ERROR("Flash sector invalid");
338 return ERROR_FLASH_SECTOR_INVALID
;
341 if (!(stmsmi_info
->probed
)) {
342 LOG_ERROR("Flash bank not probed");
343 return ERROR_FLASH_BANK_NOT_PROBED
;
346 for (sector
= first
; sector
<= last
; sector
++) {
347 if (bank
->sectors
[sector
].is_protected
) {
348 LOG_ERROR("Flash sector %d protected", sector
);
353 for (sector
= first
; sector
<= last
; sector
++) {
354 retval
= smi_erase_sector(bank
, sector
);
355 if (retval
!= ERROR_OK
)
360 /* Switch to HW mode before return to prompt */
365 static int stmsmi_protect(struct flash_bank
*bank
, int set
,
370 for (sector
= first
; sector
<= last
; sector
++)
371 bank
->sectors
[sector
].is_protected
= set
;
375 static int smi_write_buffer(struct flash_bank
*bank
, uint8_t *buffer
,
376 uint32_t address
, uint32_t len
)
378 struct target
*target
= bank
->target
;
379 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
380 uint32_t io_base
= stmsmi_info
->io_base
;
383 LOG_DEBUG("%s: address=0x%08" PRIx32
" len=0x%08" PRIx32
,
384 __func__
, address
, len
);
386 retval
= smi_write_enable(bank
);
387 if (retval
!= ERROR_OK
)
390 /* HW mode, write burst mode */
393 retval
= target_write_buffer(target
, address
, len
, buffer
);
394 if (retval
!= ERROR_OK
)
400 static int stmsmi_write(struct flash_bank
*bank
, uint8_t *buffer
,
401 uint32_t offset
, uint32_t count
)
403 struct target
*target
= bank
->target
;
404 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
405 uint32_t io_base
= stmsmi_info
->io_base
;
406 uint32_t cur_count
, page_size
, page_offset
;
408 int retval
= ERROR_OK
;
410 LOG_DEBUG("%s: offset=0x%08" PRIx32
" count=0x%08" PRIx32
,
411 __func__
, offset
, count
);
413 if (target
->state
!= TARGET_HALTED
) {
414 LOG_ERROR("Target not halted");
415 return ERROR_TARGET_NOT_HALTED
;
418 if (offset
+ count
> stmsmi_info
->dev
->size_in_bytes
) {
419 LOG_WARNING("Write pasts end of flash. Extra data discarded.");
420 count
= stmsmi_info
->dev
->size_in_bytes
- offset
;
423 /* Check sector protection */
424 for (sector
= 0; sector
< bank
->num_sectors
; sector
++) {
425 /* Start offset in or before this sector? */
426 /* End offset in or behind this sector? */
428 (bank
->sectors
[sector
].offset
+ bank
->sectors
[sector
].size
))
429 && ((offset
+ count
- 1) >= bank
->sectors
[sector
].offset
)
430 && bank
->sectors
[sector
].is_protected
) {
431 LOG_ERROR("Flash sector %d protected", sector
);
436 page_size
= stmsmi_info
->dev
->pagesize
;
438 /* unaligned buffer head */
439 if (count
> 0 && (offset
& 3) != 0) {
440 cur_count
= 4 - (offset
& 3);
441 if (cur_count
> count
)
443 retval
= smi_write_buffer(bank
, buffer
, bank
->base
+ offset
,
445 if (retval
!= ERROR_OK
)
452 page_offset
= offset
% page_size
;
453 /* central part, aligned words */
455 /* clip block at page boundary */
456 if (page_offset
+ count
> page_size
)
457 cur_count
= page_size
- page_offset
;
459 cur_count
= count
& ~3;
461 retval
= smi_write_buffer(bank
, buffer
, bank
->base
+ offset
,
463 if (retval
!= ERROR_OK
)
476 retval
= smi_write_buffer(bank
, buffer
, bank
->base
+ offset
, count
);
479 /* Switch to HW mode before return to prompt */
484 /* Return ID of flash device */
485 /* On exit, SW mode is kept */
486 static int read_flash_id(struct flash_bank
*bank
, uint32_t *id
)
488 struct target
*target
= bank
->target
;
489 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
490 uint32_t io_base
= stmsmi_info
->io_base
;
493 if (target
->state
!= TARGET_HALTED
) {
494 LOG_ERROR("Target not halted");
495 return ERROR_TARGET_NOT_HALTED
;
499 retval
= wait_till_ready(bank
, SMI_PROBE_TIMEOUT
);
500 if (retval
!= ERROR_OK
)
503 /* enter in SW mode */
506 /* clear transmit finished flag */
509 /* Send SPI command "read ID" */
510 SMI_WRITE_REG(SMI_TR
, SMI_READ_ID
);
511 SMI_WRITE_REG(SMI_CR2
,
512 stmsmi_info
->bank_num
| SMI_SEND
| SMI_RX_LEN_3
| SMI_TX_LEN_1
);
514 /* Poll transmit finished flag */
515 SMI_POLL_TFF(SMI_CMD_TIMEOUT
);
517 /* clear transmit finished flag */
520 /* read ID from Receive Register */
521 *id
= SMI_READ_REG(SMI_RR
) & 0x00ffffff;
525 static int stmsmi_probe(struct flash_bank
*bank
)
527 struct target
*target
= bank
->target
;
528 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
530 struct flash_sector
*sectors
;
531 uint32_t id
= 0; /* silence uninitialized warning */
532 struct stmsmi_target
*target_device
;
535 if (stmsmi_info
->probed
)
537 stmsmi_info
->probed
= 0;
539 for (target_device
= target_devices
; target_device
->name
; ++target_device
)
540 if (target_device
->tap_idcode
== target
->tap
->idcode
)
542 if (!target_device
->name
) {
543 LOG_ERROR("Device ID 0x%" PRIx32
" is not known as SMI capable",
544 target
->tap
->idcode
);
548 switch (bank
->base
- target_device
->smi_base
) {
550 stmsmi_info
->bank_num
= SMI_SEL_BANK0
;
553 stmsmi_info
->bank_num
= SMI_SEL_BANK1
;
555 case 2*SMI_BANK_SIZE
:
556 stmsmi_info
->bank_num
= SMI_SEL_BANK2
;
558 case 3*SMI_BANK_SIZE
:
559 stmsmi_info
->bank_num
= SMI_SEL_BANK3
;
562 LOG_ERROR("Invalid SMI base address 0x%" PRIx32
, bank
->base
);
565 io_base
= target_device
->io_base
;
566 stmsmi_info
->io_base
= io_base
;
568 LOG_DEBUG("Valid SMI on device %s at address 0x%" PRIx32
,
569 target_device
->name
, bank
->base
);
571 /* read and decode flash ID; returns in SW mode */
572 retval
= read_flash_id(bank
, &id
);
574 if (retval
!= ERROR_OK
)
577 stmsmi_info
->dev
= NULL
;
578 for (struct flash_device
*p
= flash_devices
; p
->name
; p
++)
579 if (p
->device_id
== id
) {
580 stmsmi_info
->dev
= p
;
584 if (!stmsmi_info
->dev
) {
585 LOG_ERROR("Unknown flash device (ID 0x%08" PRIx32
")", id
);
589 LOG_INFO("Found flash device \'%s\' (ID 0x%08" PRIx32
")",
590 stmsmi_info
->dev
->name
, stmsmi_info
->dev
->device_id
);
592 /* Set correct size value */
593 bank
->size
= stmsmi_info
->dev
->size_in_bytes
;
595 /* create and fill sectors array */
597 stmsmi_info
->dev
->size_in_bytes
/ stmsmi_info
->dev
->sectorsize
;
598 sectors
= malloc(sizeof(struct flash_sector
) * bank
->num_sectors
);
599 if (sectors
== NULL
) {
600 LOG_ERROR("not enough memory");
604 for (int sector
= 0; sector
< bank
->num_sectors
; sector
++) {
605 sectors
[sector
].offset
= sector
* stmsmi_info
->dev
->sectorsize
;
606 sectors
[sector
].size
= stmsmi_info
->dev
->sectorsize
;
607 sectors
[sector
].is_erased
= -1;
608 sectors
[sector
].is_protected
= 1;
611 bank
->sectors
= sectors
;
612 stmsmi_info
->probed
= 1;
616 static int stmsmi_auto_probe(struct flash_bank
*bank
)
618 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
619 if (stmsmi_info
->probed
)
621 return stmsmi_probe(bank
);
624 static int stmsmi_protect_check(struct flash_bank
*bank
)
626 /* Nothing to do. Protection is only handled in SW. */
630 static int get_stmsmi_info(struct flash_bank
*bank
, char *buf
, int buf_size
)
632 struct stmsmi_flash_bank
*stmsmi_info
= bank
->driver_priv
;
634 if (!(stmsmi_info
->probed
)) {
635 snprintf(buf
, buf_size
,
636 "\nSMI flash bank not probed yet\n");
640 snprintf(buf
, buf_size
, "\nSMI flash information:\n"
641 " Device \'%s\' (ID 0x%08x)\n",
642 stmsmi_info
->dev
->name
, stmsmi_info
->dev
->device_id
);
647 struct flash_driver stmsmi_flash
= {
649 .flash_bank_command
= stmsmi_flash_bank_command
,
650 .erase
= stmsmi_erase
,
651 .protect
= stmsmi_protect
,
652 .write
= stmsmi_write
,
653 .read
= default_flash_read
,
654 .probe
= stmsmi_probe
,
655 .auto_probe
= stmsmi_auto_probe
,
656 .erase_check
= default_flash_blank_check
,
657 .protect_check
= stmsmi_protect_check
,
658 .info
= get_stmsmi_info
,