1 /***************************************************************************
2 * Copyright (C) 2010 by Antonio Borneo <borneo.antonio@gmail.com> *
4 * This program is free software; you can redistribute it and/or modify *
5 * it under the terms of the GNU General Public License as published by *
6 * the Free Software Foundation; either version 2 of the License, or *
7 * (at your option) any later version. *
9 * This program is distributed in the hope that it will be useful, *
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
12 * GNU General Public License for more details. *
14 * You should have received a copy of the GNU General Public License *
15 * along with this program. If not, see <http://www.gnu.org/licenses/>. *
16 ***************************************************************************/
18 /* STM Serial Memory Interface (SMI) controller is a SPI bus controller
19 * specifically designed for SPI memories.
20 * Only SPI "mode 3" (CPOL=1 and CPHA=1) is supported.
21 * Two working modes are available:
22 * - SW mode: the SPI is controlled by SW. Any custom commands can be sent
24 * - HW mode: the SPI but is under SMI control. Memory content is directly
25 * accessible in CPU memory space. CPU can read, write and execute memory
29 * To have flash memory mapped in CPU memory space, the SMI controller
30 * have to be in "HW mode". This requires following constraints:
31 * 1) The command "reset init" have to initialize SMI controller and put
33 * 2) every command in this file have to return to prompt in HW mode. */
41 #include <jtag/jtag.h>
42 #include <helper/time_support.h>
44 #define SMI_READ_REG(a) (_SMI_READ_REG(a))
45 #define _SMI_READ_REG(a) \
50 __a = target_read_u32(target, io_base + (a), &__v); \
51 if (__a != ERROR_OK) \
56 #define SMI_WRITE_REG(a, v) \
60 __r = target_write_u32(target, io_base + (a), (v)); \
61 if (__r != ERROR_OK) \
65 #define SMI_POLL_TFF(timeout) \
69 __r = poll_tff(target, io_base, timeout); \
70 if (__r != ERROR_OK) \
74 #define SMI_SET_SW_MODE() SMI_WRITE_REG(SMI_CR1, \
75 SMI_READ_REG(SMI_CR1) | SMI_SW_MODE)
76 #define SMI_SET_HWWB_MODE() SMI_WRITE_REG(SMI_CR1, \
77 (SMI_READ_REG(SMI_CR1) | SMI_WB_MODE) & ~SMI_SW_MODE)
78 #define SMI_SET_HW_MODE() SMI_WRITE_REG(SMI_CR1, \
79 SMI_READ_REG(SMI_CR1) & ~(SMI_SW_MODE | SMI_WB_MODE))
80 #define SMI_CLEAR_TFF() SMI_WRITE_REG(SMI_SR, ~SMI_TFF)
82 #define SMI_BANK_SIZE (0x01000000)
84 #define SMI_CR1 (0x00) /* Control register 1 */
85 #define SMI_CR2 (0x04) /* Control register 2 */
86 #define SMI_SR (0x08) /* Status register */
87 #define SMI_TR (0x0c) /* TX */
88 #define SMI_RR (0x10) /* RX */
90 /* fields in SMI_CR1 */
91 #define SMI_SW_MODE 0x10000000 /* set to enable SW Mode */
92 #define SMI_WB_MODE 0x20000000 /* Write Burst Mode */
94 /* fields in SMI_CR2 */
95 #define SMI_TX_LEN_1 0x00000001 /* data length = 1 byte */
96 #define SMI_TX_LEN_4 0x00000004 /* data length = 4 byte */
97 #define SMI_RX_LEN_3 0x00000030 /* data length = 3 byte */
98 #define SMI_SEND 0x00000080 /* Send data */
99 #define SMI_RSR 0x00000400 /* reads status reg */
100 #define SMI_WE 0x00000800 /* Write Enable */
101 #define SMI_SEL_BANK0 0x00000000 /* Select Bank0 */
102 #define SMI_SEL_BANK1 0x00001000 /* Select Bank1 */
103 #define SMI_SEL_BANK2 0x00002000 /* Select Bank2 */
104 #define SMI_SEL_BANK3 0x00003000 /* Select Bank3 */
106 /* fields in SMI_SR */
107 #define SMI_TFF 0x00000100 /* Transfer Finished Flag */
110 #define SMI_READ_ID 0x0000009F /* Read Flash Identification */
113 #define SMI_CMD_TIMEOUT (100)
114 #define SMI_PROBE_TIMEOUT (100)
115 #define SMI_MAX_TIMEOUT (3000)
117 struct stmsmi_flash_bank {
121 const struct flash_device *dev;
124 struct stmsmi_target {
131 static const struct stmsmi_target target_devices[] = {
132 /* name, tap_idcode, smi_base, io_base */
133 { "SPEAr3xx/6xx", 0x07926041, 0xf8000000, 0xfc000000 },
134 { "STR75x", 0x4f1f0041, 0x80000000, 0x90000000 },
138 FLASH_BANK_COMMAND_HANDLER(stmsmi_flash_bank_command)
140 struct stmsmi_flash_bank *stmsmi_info;
142 LOG_DEBUG("%s", __func__);
145 return ERROR_COMMAND_SYNTAX_ERROR;
147 stmsmi_info = malloc(sizeof(struct stmsmi_flash_bank));
148 if (stmsmi_info == NULL) {
149 LOG_ERROR("not enough memory");
153 bank->driver_priv = stmsmi_info;
154 stmsmi_info->probed = 0;
159 /* Poll transmit finished flag */
161 static int poll_tff(struct target *target, uint32_t io_base, int timeout)
165 if (SMI_READ_REG(SMI_SR) & SMI_TFF)
168 endtime = timeval_ms() + timeout;
171 if (SMI_READ_REG(SMI_SR) & SMI_TFF)
173 } while (timeval_ms() < endtime);
175 LOG_ERROR("Timeout while polling TFF");
176 return ERROR_FLASH_OPERATION_FAILED;
179 /* Read the status register of the external SPI flash chip.
180 * The operation is triggered by setting SMI_RSR bit.
181 * SMI sends the proper SPI command (0x05) and returns value in SMI_SR */
182 static int read_status_reg(struct flash_bank *bank, uint32_t *status)
184 struct target *target = bank->target;
185 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
186 uint32_t io_base = stmsmi_info->io_base;
188 /* clear transmit finished flag */
192 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_RSR);
194 /* Poll transmit finished flag */
195 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
197 /* clear transmit finished flag */
200 *status = SMI_READ_REG(SMI_SR) & 0x0000ffff;
202 /* clean-up SMI_CR2 */
203 SMI_WRITE_REG(SMI_CR2, 0); /* AB: Required ? */
208 /* check for WIP (write in progress) bit in status register */
210 static int wait_till_ready(struct flash_bank *bank, int timeout)
216 endtime = timeval_ms() + timeout;
218 /* read flash status register */
219 retval = read_status_reg(bank, &status);
220 if (retval != ERROR_OK)
223 if ((status & SPIFLASH_BSY_BIT) == 0)
226 } while (timeval_ms() < endtime);
228 LOG_ERROR("timeout");
232 /* Send "write enable" command to SPI flash chip.
233 * The operation is triggered by setting SMI_WE bit, and SMI sends
234 * the proper SPI command (0x06) */
235 static int smi_write_enable(struct flash_bank *bank)
237 struct target *target = bank->target;
238 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
239 uint32_t io_base = stmsmi_info->io_base;
243 /* Enter in HW mode */
244 SMI_SET_HW_MODE(); /* AB: is this correct ?*/
246 /* clear transmit finished flag */
249 /* Send write enable command */
250 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_WE);
252 /* Poll transmit finished flag */
253 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
255 /* read flash status register */
256 retval = read_status_reg(bank, &status);
257 if (retval != ERROR_OK)
260 /* Check write enabled */
261 if ((status & SPIFLASH_WE_BIT) == 0) {
262 LOG_ERROR("Cannot enable write to flash. Status=0x%08" PRIx32, status);
269 static uint32_t erase_command(struct stmsmi_flash_bank *stmsmi_info,
272 uint8_t cmd_bytes[] = {
273 stmsmi_info->dev->erase_cmd,
279 return le_to_h_u32(cmd_bytes);
282 static int smi_erase_sector(struct flash_bank *bank, int sector)
284 struct target *target = bank->target;
285 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
286 uint32_t io_base = stmsmi_info->io_base;
290 retval = smi_write_enable(bank);
291 if (retval != ERROR_OK)
294 /* Switch to SW mode to send sector erase command */
297 /* clear transmit finished flag */
300 /* send SPI command "block erase" */
301 cmd = erase_command(stmsmi_info, bank->sectors[sector].offset);
302 SMI_WRITE_REG(SMI_TR, cmd);
303 SMI_WRITE_REG(SMI_CR2, stmsmi_info->bank_num | SMI_SEND | SMI_TX_LEN_4);
305 /* Poll transmit finished flag */
306 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
308 /* poll WIP for end of self timed Sector Erase cycle */
309 retval = wait_till_ready(bank, SMI_MAX_TIMEOUT);
310 if (retval != ERROR_OK)
316 static int stmsmi_erase(struct flash_bank *bank, int first, int last)
318 struct target *target = bank->target;
319 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
320 uint32_t io_base = stmsmi_info->io_base;
321 int retval = ERROR_OK;
324 LOG_DEBUG("%s: from sector %d to sector %d", __func__, first, last);
326 if (target->state != TARGET_HALTED) {
327 LOG_ERROR("Target not halted");
328 return ERROR_TARGET_NOT_HALTED;
331 if ((first < 0) || (last < first) || (last >= bank->num_sectors)) {
332 LOG_ERROR("Flash sector invalid");
333 return ERROR_FLASH_SECTOR_INVALID;
336 if (!(stmsmi_info->probed)) {
337 LOG_ERROR("Flash bank not probed");
338 return ERROR_FLASH_BANK_NOT_PROBED;
341 for (sector = first; sector <= last; sector++) {
342 if (bank->sectors[sector].is_protected) {
343 LOG_ERROR("Flash sector %d protected", sector);
348 if (stmsmi_info->dev->erase_cmd == 0x00)
349 return ERROR_FLASH_OPER_UNSUPPORTED;
351 for (sector = first; sector <= last; sector++) {
352 retval = smi_erase_sector(bank, sector);
353 if (retval != ERROR_OK)
358 /* Switch to HW mode before return to prompt */
363 static int stmsmi_protect(struct flash_bank *bank, int set,
368 for (sector = first; sector <= last; sector++)
369 bank->sectors[sector].is_protected = set;
373 static int smi_write_buffer(struct flash_bank *bank, const uint8_t *buffer,
374 uint32_t address, uint32_t len)
376 struct target *target = bank->target;
377 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
378 uint32_t io_base = stmsmi_info->io_base;
381 LOG_DEBUG("%s: address=0x%08" PRIx32 " len=0x%08" PRIx32,
382 __func__, address, len);
384 retval = smi_write_enable(bank);
385 if (retval != ERROR_OK)
388 /* HW mode, write burst mode */
391 retval = target_write_buffer(target, address, len, buffer);
392 if (retval != ERROR_OK)
398 static int stmsmi_write(struct flash_bank *bank, const uint8_t *buffer,
399 uint32_t offset, uint32_t count)
401 struct target *target = bank->target;
402 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
403 uint32_t io_base = stmsmi_info->io_base;
404 uint32_t cur_count, page_size, page_offset;
406 int retval = ERROR_OK;
408 LOG_DEBUG("%s: offset=0x%08" PRIx32 " count=0x%08" PRIx32,
409 __func__, offset, count);
411 if (target->state != TARGET_HALTED) {
412 LOG_ERROR("Target not halted");
413 return ERROR_TARGET_NOT_HALTED;
416 if (offset + count > stmsmi_info->dev->size_in_bytes) {
417 LOG_WARNING("Write pasts end of flash. Extra data discarded.");
418 count = stmsmi_info->dev->size_in_bytes - offset;
421 /* Check sector protection */
422 for (sector = 0; sector < bank->num_sectors; sector++) {
423 /* Start offset in or before this sector? */
424 /* End offset in or behind this sector? */
426 (bank->sectors[sector].offset + bank->sectors[sector].size))
427 && ((offset + count - 1) >= bank->sectors[sector].offset)
428 && bank->sectors[sector].is_protected) {
429 LOG_ERROR("Flash sector %d protected", sector);
434 /* if no valid page_size, use reasonable default */
435 page_size = stmsmi_info->dev->pagesize ?
436 stmsmi_info->dev->pagesize : SPIFLASH_DEF_PAGESIZE;
438 /* unaligned buffer head */
439 if (count > 0 && (offset & 3) != 0) {
440 cur_count = 4 - (offset & 3);
441 if (cur_count > count)
443 retval = smi_write_buffer(bank, buffer, bank->base + offset,
445 if (retval != ERROR_OK)
452 page_offset = offset % page_size;
453 /* central part, aligned words */
455 /* clip block at page boundary */
456 if (page_offset + count > page_size)
457 cur_count = page_size - page_offset;
459 cur_count = count & ~3;
461 retval = smi_write_buffer(bank, buffer, bank->base + offset,
463 if (retval != ERROR_OK)
476 retval = smi_write_buffer(bank, buffer, bank->base + offset, count);
479 /* Switch to HW mode before return to prompt */
484 /* Return ID of flash device */
485 /* On exit, SW mode is kept */
486 static int read_flash_id(struct flash_bank *bank, uint32_t *id)
488 struct target *target = bank->target;
489 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
490 uint32_t io_base = stmsmi_info->io_base;
493 if (target->state != TARGET_HALTED) {
494 LOG_ERROR("Target not halted");
495 return ERROR_TARGET_NOT_HALTED;
499 retval = wait_till_ready(bank, SMI_PROBE_TIMEOUT);
500 if (retval != ERROR_OK)
503 /* enter in SW mode */
506 /* clear transmit finished flag */
509 /* Send SPI command "read ID" */
510 SMI_WRITE_REG(SMI_TR, SMI_READ_ID);
511 SMI_WRITE_REG(SMI_CR2,
512 stmsmi_info->bank_num | SMI_SEND | SMI_RX_LEN_3 | SMI_TX_LEN_1);
514 /* Poll transmit finished flag */
515 SMI_POLL_TFF(SMI_CMD_TIMEOUT);
517 /* clear transmit finished flag */
520 /* read ID from Receive Register */
521 *id = SMI_READ_REG(SMI_RR) & 0x00ffffff;
525 static int stmsmi_probe(struct flash_bank *bank)
527 struct target *target = bank->target;
528 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
529 uint32_t io_base, sectorsize;
530 struct flash_sector *sectors;
531 uint32_t id = 0; /* silence uninitialized warning */
532 const struct stmsmi_target *target_device;
535 if (stmsmi_info->probed)
537 stmsmi_info->probed = 0;
539 for (target_device = target_devices ; target_device->name ; ++target_device)
540 if (target_device->tap_idcode == target->tap->idcode)
542 if (!target_device->name) {
543 LOG_ERROR("Device ID 0x%" PRIx32 " is not known as SMI capable",
544 target->tap->idcode);
548 switch (bank->base - target_device->smi_base) {
550 stmsmi_info->bank_num = SMI_SEL_BANK0;
553 stmsmi_info->bank_num = SMI_SEL_BANK1;
555 case 2*SMI_BANK_SIZE:
556 stmsmi_info->bank_num = SMI_SEL_BANK2;
558 case 3*SMI_BANK_SIZE:
559 stmsmi_info->bank_num = SMI_SEL_BANK3;
562 LOG_ERROR("Invalid SMI base address " TARGET_ADDR_FMT, bank->base);
565 io_base = target_device->io_base;
566 stmsmi_info->io_base = io_base;
568 LOG_DEBUG("Valid SMI on device %s at address " TARGET_ADDR_FMT,
569 target_device->name, bank->base);
571 /* read and decode flash ID; returns in SW mode */
572 retval = read_flash_id(bank, &id);
574 if (retval != ERROR_OK)
577 stmsmi_info->dev = NULL;
578 for (const struct flash_device *p = flash_devices; p->name ; p++)
579 if (p->device_id == id) {
580 stmsmi_info->dev = p;
584 if (!stmsmi_info->dev) {
585 LOG_ERROR("Unknown flash device (ID 0x%08" PRIx32 ")", id);
589 LOG_INFO("Found flash device \'%s\' (ID 0x%08" PRIx32 ")",
590 stmsmi_info->dev->name, stmsmi_info->dev->device_id);
592 /* Set correct size value */
593 bank->size = stmsmi_info->dev->size_in_bytes;
594 if (bank->size <= (1UL << 16))
595 LOG_WARNING("device needs 2-byte addresses - not implemented");
596 if (bank->size > (1UL << 24))
597 LOG_WARNING("device needs paging or 4-byte addresses - not implemented");
599 /* if no sectors, treat whole bank as single sector */
600 sectorsize = stmsmi_info->dev->sectorsize ?
601 stmsmi_info->dev->sectorsize : stmsmi_info->dev->size_in_bytes;
603 /* create and fill sectors array */
605 stmsmi_info->dev->size_in_bytes / sectorsize;
606 sectors = malloc(sizeof(struct flash_sector) * bank->num_sectors);
607 if (sectors == NULL) {
608 LOG_ERROR("not enough memory");
612 for (int sector = 0; sector < bank->num_sectors; sector++) {
613 sectors[sector].offset = sector * sectorsize;
614 sectors[sector].size = sectorsize;
615 sectors[sector].is_erased = -1;
616 sectors[sector].is_protected = 1;
619 bank->sectors = sectors;
620 stmsmi_info->probed = 1;
624 static int stmsmi_auto_probe(struct flash_bank *bank)
626 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
627 if (stmsmi_info->probed)
629 return stmsmi_probe(bank);
632 static int stmsmi_protect_check(struct flash_bank *bank)
634 /* Nothing to do. Protection is only handled in SW. */
638 static int get_stmsmi_info(struct flash_bank *bank, char *buf, int buf_size)
640 struct stmsmi_flash_bank *stmsmi_info = bank->driver_priv;
642 if (!(stmsmi_info->probed)) {
643 snprintf(buf, buf_size,
644 "\nSMI flash bank not probed yet\n");
648 snprintf(buf, buf_size, "\nSMI flash information:\n"
649 " Device \'%s\' (ID 0x%08" PRIx32 ")\n",
650 stmsmi_info->dev->name, stmsmi_info->dev->device_id);
655 const struct flash_driver stmsmi_flash = {
657 .flash_bank_command = stmsmi_flash_bank_command,
658 .erase = stmsmi_erase,
659 .protect = stmsmi_protect,
660 .write = stmsmi_write,
661 .read = default_flash_read,
662 .probe = stmsmi_probe,
663 .auto_probe = stmsmi_auto_probe,
664 .erase_check = default_flash_blank_check,
665 .protect_check = stmsmi_protect_check,
666 .info = get_stmsmi_info,
667 .free_driver_priv = default_flash_free_driver_priv,