freecalypso-tools: doc/Flash-write-protection annotate

annotate doc/Flash-write-protection @ 1012:11391cb6bdc0

patch from fixeria: doc change from SE K2x0 to K2xx Since their discovery in late 2022, Sony Ericsson K200 and K220 phones were collectively referred to as SE K2x0 in FreeCalypso documentation. However, now that SE K205 has been discovered as yet another member of the same family (same PCBA in different case), it makes more sense to refer to the whole family as SE K2xx.

author	Mychaela Falconia <falcon@freecalypso.org>
date	Mon, 23 Sep 2024 12:23:20 +0000
parents	30fad2b3afd2
children

rev	line source
997 67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	1 Some Calypso-based GSM MS designs (phones, modems, development boards) use
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	2 AMD-style (Spansion or Samsung) flash chips, while others use Intel flash.
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	3 In the case of Calypso devices that use Spansion or Samsung flash chips, all of
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	4 those chips support a rarely used feature: an ability to write-protect selected
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	5 flash sectors, disallowing erase and program operations in those areas. With
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	6 earlier AMD-style flash chips (actual AMD-branded ones prior to introduction of
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	7 Spansion brand, as well as Samsung K5A32xx used in Openmoko devices) this
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	8 sector-level write protection can only be applied or lifted by way of external
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	9 programming equipment, executing special commands with a high voltage applied
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	10 to one of the pins - hence when the chip resides on a product board, no new
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	11 sector locks can be applied. (We are not aware of any Calypso GSM device manuf
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	12 who locked some flash sectors and then populated the chip onto the board in
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	13 that state.)
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	14
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	15 With newer Spansion and Samsung flash families, however, sector locks became
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	16 more easily accessible: they have Persistent Protection Bits (PPBs) which can
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	17 be programmed (locking a sector or a group of sectors) and erased (removing all
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	18 such locks) in-system under normal operating conditions, using only special
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	19 software commands. These flash chips also have "hard" locking modes: a Password
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	20 Sector Protection mode in which PPBs can only be modified after feeding a
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	21 matching 64-bit key to the chip, and an OTP "master lock" mode in which the
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	22 ability to erase PPBs is irreversibly disabled, locking all write-protected
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	23 sectors forever - but so far we (FreeCalypso community) have not yet encountered
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	24 any devices in which any of these "hard" locks have been activated. There is,
1012 11391cb6bdc0 patch from fixeria: doc change from SE K2x0 to K2xx Mychaela Falconia <falcon@freecalypso.org> parents: 999 diff changeset	25 however, at least one Calypso-based phone out there (Sony Ericsson K2xx family)
997 67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	26 in which the shipping state of the device includes some flash sector locks -
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	27 but these locks are of the "soft" kind, removable by performing a PPB erase
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	28 operation which is not further blocked.
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	29
999 30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	30 fc-loadtool support for sector write-protection
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	31 ===============================================
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	32
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	33 As of fc-host-tools-r21, fc-loadtool provides the following facilities in
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	34 relation to sector write-protection features on AMD-style flash chips:
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	35
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	36 * flash lock-state command is available when operating on those flash chips for
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	37 which we've implemented the necessary table, listing how sectors are grouped
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	38 for the purpose of write protection, how they are grouped for the purpose of
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	39 lock status retrieval via Autoselect read mode, and what additional lock
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	40 status words should be checked. We have implemented the necessary knowledge
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	41 tables for all chips on which we support PPB manipulation (see below), but
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	42 also for some chips on which sector lock state can be modified only by high-
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	43 voltage methods - on the latter chips we can examine the lock state, but not
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	44 modify it.
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	45
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	46 * flash ppb-* commands actively alter sector write protection state by
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	47 programming and erasing PPBs on those Spansion and Samsung flash chips that
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	48 allow these PPB alterations by software commands alone (without high-voltage
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	49 circuits) and for which we have implemented the necessary knowledge tables.
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	50 The set of flash chips for which we have implemented these active commands is
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	51 a proper subset of those for which we have implemented flash lock-state
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	52 retrieval.
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	53
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	54 These commands are primarily aimed at unlocking flash regions that have been
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	55 write-protected by previous parties. It is very helpful, however, to understand
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	56 some theory before using these commands, which the present document aims to
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	57 explain.
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	58
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	59 How PPBs work
30fad2b3afd2 doc/Flash-write-protection: document flash lock-state retrieval Mychaela Falconia <falcon@freecalypso.org> parents: 997 diff changeset	60 =============
997 67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	61
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	62 Spansion and Samsung flash chips that feature PPBs have one PPB per sector or
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	63 per sector group - some sectors are aggregated into groups (of 4 sectors max)
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	64 for the purpose of write protection control. All of these PPBs are contained
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	65 in one special-purpose non-volatile memory element inside the flash chip, and
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	66 this NV memory element behaves like a little flash sector of its own: it has a
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	67 program operation, affecting each PPB individually, and an erase operation that
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	68 affects all PPBs across the chip at once. (See How-flash-really-works article
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	69 for an explanation of program and erase operations.) The programmed state of a
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	70 PPB corresponds to the associated flash sector or sector group being locked
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	71 (write-protected), and the erased state of a PPB corresponds to the flash
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	72 location being unlocked (free to erase and program at will).
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	73
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	74 fc-loadtool commands for manipulating PPBs are flash ppb-program and flash
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	75 ppb-erase-all; they are named in this manner (as opposed to a naming scheme
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	76 based on "lock/unlock" or "protect/unprotect") to emphasize the physical nature
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	77 of what they actually do in the flash chip. flash ppb-program command (or
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	78 flash2 ppb-program for the second bank of 16 MiB flash chips) addresses a
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	79 specific sector and programs that sector's PPB, causing the sector to become
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	80 write-protected; flash ppb-erase-all erases all PPBs across the flash chip,
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	81 causing the entire main flash array to become unlocked for write operations.
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	82
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	83 The internal implementation of these PPB manipulation commands is very different
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	84 between PL-J and PL-N flash types, as required by the respective flash chip
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	85 families presenting a very different type of command interface for PPB
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	86 operations. The command interface implemented on Spansion PL-J family and at
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	87 least some Samsung flash chips (K5L29xx in particular) exposes the raw physics
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	88 of the flash (see How-flash-really-works article) to the user for PPB
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	89 operations, requiring flashing software tool developers to understand all of
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	90 that theory and implement it in practice. OTOH, the command interface for PPB
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	91 program and erase operations implemented on Spansion PL-N family (of which only
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	92 PL129N is usable with Calypso) brings these special operations into harmony with
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	93 ordinary flash programming and erasure procedures. We don't know (and may never
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	94 know) if Spansion aimed to simplify life for flash low-level driver implementors
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	95 or if internal advancements from PL-J to PL-N flash necessitated some changes
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	96 in physics-level program/erase algorithms and Spansion didn't feel like exposing
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	97 the internal details of their newer flash - but the practical implication for us
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	98 is that we had to implement two different code paths to support both ways of
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	99 performing these operations, as we need to support all flash chip types that are
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	100 found in Calypso GSM devices of different ages.
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	101
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	102 It also needs to be noted that at least in Spansion PL-J and Samsung flash chips
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	103 the special non-volatile memory element that holds PPBs has a very limited
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	104 number of program-erase cycles: the datasheets we were able to find give a limit
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	105 of 100 (1e2) cycles for this special NV memory element, compared to 1e5 cycles
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	106 promised by the same datasheets for the main flash array. So please beware,
67513b9446da doc/Flash-write-protection: new article Mychaela Falconia <falcon@freecalypso.org> parents: diff changeset	107 and avoid needlessly cycling these write protection bits.

FreeCalypso > hg > freecalypso-tools

annotate doc/Flash-write-protection @ 1012:11391cb6bdc0