FreeCalypso > hg > freecalypso-tools
annotate doc/Flash-write-protection @ 1014:961efadd530a default tip
fc-shell TCH DL handler: add support for CSD modes
TCH DL capture mechanism in FC Tourmaline firmware has been extended
to support CSD modes in addition to speech - add the necessary support
on the host tools side.
It needs to be noted that this mechanism in its present state does NOT
provide the debug utility value that was sought: as we learned only
after the code was implemented, TI's DSP has a misfeature in that the
buffer we are reading (a_dd_0[]) is zeroed out when the IDS block
is enabled, i.e., we are reading all zeros and not the real DL bits
we were after. But since the code has already been written, we are
keeping it - perhaps we can do some tests with IDS disabled.
author | Mychaela Falconia <falcon@freecalypso.org> |
---|---|
date | Tue, 26 Nov 2024 06:27:43 +0000 |
parents | 11391cb6bdc0 |
children |
rev | line source |
---|---|
997
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
1 Some Calypso-based GSM MS designs (phones, modems, development boards) use |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
2 AMD-style (Spansion or Samsung) flash chips, while others use Intel flash. |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
3 In the case of Calypso devices that use Spansion or Samsung flash chips, all of |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
4 those chips support a rarely used feature: an ability to write-protect selected |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
5 flash sectors, disallowing erase and program operations in those areas. With |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
6 earlier AMD-style flash chips (actual AMD-branded ones prior to introduction of |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
7 Spansion brand, as well as Samsung K5A32xx used in Openmoko devices) this |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
8 sector-level write protection can only be applied or lifted by way of external |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
9 programming equipment, executing special commands with a high voltage applied |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
10 to one of the pins - hence when the chip resides on a product board, no new |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
11 sector locks can be applied. (We are not aware of any Calypso GSM device manuf |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
12 who locked some flash sectors and then populated the chip onto the board in |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
13 that state.) |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
14 |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
15 With newer Spansion and Samsung flash families, however, sector locks became |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
16 more easily accessible: they have Persistent Protection Bits (PPBs) which can |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
17 be programmed (locking a sector or a group of sectors) and erased (removing all |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
18 such locks) in-system under normal operating conditions, using only special |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
19 software commands. These flash chips also have "hard" locking modes: a Password |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
20 Sector Protection mode in which PPBs can only be modified after feeding a |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
21 matching 64-bit key to the chip, and an OTP "master lock" mode in which the |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
22 ability to erase PPBs is irreversibly disabled, locking all write-protected |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
23 sectors forever - but so far we (FreeCalypso community) have not yet encountered |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
24 any devices in which any of these "hard" locks have been activated. There is, |
1012
11391cb6bdc0
patch from fixeria: doc change from SE K2x0 to K2xx
Mychaela Falconia <falcon@freecalypso.org>
parents:
999
diff
changeset
|
25 however, at least one Calypso-based phone out there (Sony Ericsson K2xx family) |
997
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
26 in which the shipping state of the device includes some flash sector locks - |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
27 but these locks are of the "soft" kind, removable by performing a PPB erase |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
28 operation which is not further blocked. |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
29 |
999
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
30 fc-loadtool support for sector write-protection |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
31 =============================================== |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
32 |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
33 As of fc-host-tools-r21, fc-loadtool provides the following facilities in |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
34 relation to sector write-protection features on AMD-style flash chips: |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
35 |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
36 * flash lock-state command is available when operating on those flash chips for |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
37 which we've implemented the necessary table, listing how sectors are grouped |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
38 for the purpose of write protection, how they are grouped for the purpose of |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
39 lock status retrieval via Autoselect read mode, and what additional lock |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
40 status words should be checked. We have implemented the necessary knowledge |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
41 tables for all chips on which we support PPB manipulation (see below), but |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
42 also for some chips on which sector lock state can be modified only by high- |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
43 voltage methods - on the latter chips we can examine the lock state, but not |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
44 modify it. |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
45 |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
46 * flash ppb-* commands actively alter sector write protection state by |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
47 programming and erasing PPBs on those Spansion and Samsung flash chips that |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
48 allow these PPB alterations by software commands alone (without high-voltage |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
49 circuits) and for which we have implemented the necessary knowledge tables. |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
50 The set of flash chips for which we have implemented these active commands is |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
51 a proper subset of those for which we have implemented flash lock-state |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
52 retrieval. |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
53 |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
54 These commands are primarily aimed at unlocking flash regions that have been |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
55 write-protected by previous parties. It is very helpful, however, to understand |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
56 some theory before using these commands, which the present document aims to |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
57 explain. |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
58 |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
59 How PPBs work |
30fad2b3afd2
doc/Flash-write-protection: document flash lock-state retrieval
Mychaela Falconia <falcon@freecalypso.org>
parents:
997
diff
changeset
|
60 ============= |
997
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
61 |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
62 Spansion and Samsung flash chips that feature PPBs have one PPB per sector or |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
63 per sector group - some sectors are aggregated into groups (of 4 sectors max) |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
64 for the purpose of write protection control. All of these PPBs are contained |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
65 in one special-purpose non-volatile memory element inside the flash chip, and |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
66 this NV memory element behaves like a little flash sector of its own: it has a |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
67 program operation, affecting each PPB individually, and an erase operation that |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
68 affects all PPBs across the chip at once. (See How-flash-really-works article |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
69 for an explanation of program and erase operations.) The programmed state of a |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
70 PPB corresponds to the associated flash sector or sector group being locked |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
71 (write-protected), and the erased state of a PPB corresponds to the flash |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
72 location being unlocked (free to erase and program at will). |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
73 |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
74 fc-loadtool commands for manipulating PPBs are flash ppb-program and flash |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
75 ppb-erase-all; they are named in this manner (as opposed to a naming scheme |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
76 based on "lock/unlock" or "protect/unprotect") to emphasize the physical nature |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
77 of what they actually do in the flash chip. flash ppb-program command (or |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
78 flash2 ppb-program for the second bank of 16 MiB flash chips) addresses a |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
79 specific sector and programs that sector's PPB, causing the sector to become |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
80 write-protected; flash ppb-erase-all erases all PPBs across the flash chip, |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
81 causing the entire main flash array to become unlocked for write operations. |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
82 |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
83 The internal implementation of these PPB manipulation commands is very different |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
84 between PL-J and PL-N flash types, as required by the respective flash chip |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
85 families presenting a very different type of command interface for PPB |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
86 operations. The command interface implemented on Spansion PL-J family and at |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
87 least some Samsung flash chips (K5L29xx in particular) exposes the raw physics |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
88 of the flash (see How-flash-really-works article) to the user for PPB |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
89 operations, requiring flashing software tool developers to understand all of |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
90 that theory and implement it in practice. OTOH, the command interface for PPB |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
91 program and erase operations implemented on Spansion PL-N family (of which only |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
92 PL129N is usable with Calypso) brings these special operations into harmony with |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
93 ordinary flash programming and erasure procedures. We don't know (and may never |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
94 know) if Spansion aimed to simplify life for flash low-level driver implementors |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
95 or if internal advancements from PL-J to PL-N flash necessitated some changes |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
96 in physics-level program/erase algorithms and Spansion didn't feel like exposing |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
97 the internal details of their newer flash - but the practical implication for us |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
98 is that we had to implement two different code paths to support both ways of |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
99 performing these operations, as we need to support all flash chip types that are |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
100 found in Calypso GSM devices of different ages. |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
101 |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
102 It also needs to be noted that at least in Spansion PL-J and Samsung flash chips |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
103 the special non-volatile memory element that holds PPBs has a *very* limited |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
104 number of program-erase cycles: the datasheets we were able to find give a limit |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
105 of 100 (1e2) cycles for this special NV memory element, compared to 1e5 cycles |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
106 promised by the same datasheets for the main flash array. So please beware, |
67513b9446da
doc/Flash-write-protection: new article
Mychaela Falconia <falcon@freecalypso.org>
parents:
diff
changeset
|
107 and avoid needlessly cycling these write protection bits. |