SPI flash support (was: current limit)

Hello. I am using a very fresh build of the firmware, and selftest fails at the current limit test.

I noticed this after playing with spi memory chip and I have the habit of limiting current to 20mA just in case and then I noticed it won’t work anymore.

Enabling power output without current limit still works.
I am pretty certain I have not caused any electrical/physical damage to my bp5, and have not used any external power source, either. I had been using a smallish current limit exactly for the purpose of being cautious to not get any magic smoke escapes.

Also, trying to dump an spi flash to a file always creates an empty file.

My hardware is BP5 rev 10 batch 3 AFAIK.

Is there something specific I could look at?
I have a decently equipped electronics lab here…

Greetings from Finland,
-sjm

1 Like

Hello, thank you so much for the detailed bug report.

Would you please try the self test in the firmware I just pushed. I’m doing a huge rework on the code so it’s clean and tidy as Bus Pirates start to arrive. There were big changes to the power supply code and the self test code over the past 24-36 hours. It looks to me like the self-test was not yet updated to use the PSU’s new response codes.

For the flash: that command will be ported to the new system tomorrow. I have a few other fixes for it, and will check the dump to disk while I’m in there. One concern I have is that I don’t have any chips without SFDP tables that are also supported by SFUD. The library uses a table to get the chip capacity if it doesn’t find SFDP tables, and my guess is they store the capacity somewhere else and we’re not getting the right size to dump.

Yes, I will gladly test the latest firmware build and post results here.

I totally understand that the firmware is under heavy development and moving fast, and I really really appreciate your efforts and transparency!

Well, I have a small collection of various smallish random SPI flash chips that have been desoldered from decommissioned household machines like washing machines and such. I did that just to have some real world samples of flash, and also to have some flash dumps just to examine them with various reverse engineering tools for fun and learning. So… dumping the flash contents with bp5 will be just the first step in that path.

I should probably take pictures thru a magnifier and make a list of the exact part numbers after identification. Those chips may provide a more or less valuable sample of real world chips that will be encountered. :slight_smile:

BR, -sjm

1 Like

That is a really excellent resource to test with. I look forward to building out flash to support as many as possible.

Well for starters, I can confirm that selftest now succeeds on ci-buspirate5-main-407ff95.zip.

SELF TEST STARTING
DISABLE IRQ: OK
ADC SUBSYSTEM: VUSB  5.12V OK
FLASH STORAGE: OK
PSU ENABLE: OK
VREG==VOUT:  3404 = 3378 OK
BIO FLOAT TEST (SHOULD BE 0/<0.30V)
BIO0 FLOAT: 0/0.05V OK
BIO1 FLOAT: 0/0.05V OK
BIO2 FLOAT: 0/0.06V OK
BIO3 FLOAT: 0/0.05V OK
BIO4 FLOAT: 0/0.06V OK
BIO5 FLOAT: 0/0.06V OK
BIO6 FLOAT: 0/0.05V OK
BIO7 FLOAT: 0/0.06V OK
BIO HIGH TEST (SHOULD BE >3.00V)
BIO0 HIGH: 3.38V OK
BIO1 HIGH: 3.38V OK
BIO2 HIGH: 3.38V OK
BIO3 HIGH: 3.38V OK
BIO4 HIGH: 3.39V OK
BIO5 HIGH: 3.40V OK
BIO6 HIGH: 3.39V OK
BIO7 HIGH: 3.38V OK
BIO LOW TEST (SHOULD BE <0.30V)
BIO0 LOW: 0.04V OK
BIO1 LOW: 0.04V OK
BIO2 LOW: 0.05V OK
BIO3 LOW: 0.05V OK
BIO4 LOW: 0.05V OK
BIO5 LOW: 0.04V OK
BIO6 LOW: 0.05V OK
BIO7 LOW: 0.04V OK
BIO PULL-UP HIGH TEST (SHOULD BE 1/>3.00V)
BIO0 PU-HIGH: 1/3.38V OK
BIO1 PU-HIGH: 1/3.36V OK
BIO2 PU-HIGH: 1/3.35V OK
BIO3 PU-HIGH: 1/3.32V OK
BIO4 PU-HIGH: 1/3.36V OK
BIO5 PU-HIGH: 1/3.37V OK
BIO6 PU-HIGH: 1/3.33V OK
BIO7 PU-HIGH: 1/3.36V OK
BIO PULL-UP LOW TEST (SHOULD BE <0.30V)
BIO0 PU-LOW: 0.16V OK
BIO1 PU-LOW: 0.15V OK
BIO2 PU-LOW: 0.16V OK
BIO3 PU-LOW: 0.15V OK
BIO4 PU-LOW: 0.15V OK
BIO5 PU-LOW: 0.15V OK
BIO6 PU-LOW: 0.15V OK
BIO7 PU-LOW: 0.16V OK
CURRENT OVERRIDE: OK
CURRENT LIMIT TEST: OK
PUSH BUTTON TO COMPLETE: OK
1 Like

Ah, excellent! Thank you so much. I saw a similar error when I was debugging earlier, so I’m glad it’s something simple that was already fixed.

1 Like

But, the actual current limiting is not working, even that selftest is passing now.

SPI> W
Power supply
Volts (0.80V-5.00V)
x to exit (3.30) > 
Maximum current (0mA-500mA), <enter> for none
x to exit (none) > 20
Error: Current over limit, power supply disabled

SPI> W 3.3 100
Error: Current over limit, power supply disabled

SPI> W 3.3
3.30V requested, closest value: 3.30V
Current limit:Disabled

Power supply:Enabled
Vreg output: 3.3V, Vref/Vout pin: 3.3V, Current: 2.9mA

So the power supply seems to be working only with “unlimited” current.

Ok, thank you. I’m getting that too. I’m sure it’s a problem in the new startup sequence. I’ll push a fix ASAP.

Well haha, seems that my first spi flash is a Winbond 25Q40BW that must be operated at 1.8 volts.

ref. datasheet: https://datasheetspdf.com/pdf-down/2/5/Q/25Q40BW-Winbond.pdf

pic: https://photos.app.goo.gl/K84V4jPjHypJrXHF9

Now that I use 1.8V power supply instead of 3.3V I get this:

flash probe
Flash device manufacturer ID 0xEF, type ID 0x50, capacity ID 0x13
Error: SFDP signature error. It must be 0x50444653 'SFDP'
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Error: Flash device not found
Error: device not detected

Well, 0xEF, 0x50 and 0x13 is matching the datasheet info on page 16,
so for sure the spi bus is working at least now.

I was a bit worried because the datasheet gives quite tight timing requirements.
The clock+data signals should have 5 ns rise and fall times, and it sounds quite short…

No wonder it did not seem to work properly at 3.3V… the additional letters on the chip id do matter! TIL: W25Q40BW has different supply voltage than 25Q40CL. The latter is ok with 2.5 or 3.3 volts.

ref. W25Q40CL - Serial NOR Flash - Code Storage Flash Memory - Winbond

BR, -sjm

My second spi flash is another Winbond chip, this time 25X40:

Google Photos

datasheet: https://datasheetspdf.com/pdf-down/2/5/X/25X40_Winbond.pdf

This one gets identified by bp5:

SPI> flash probe
Flash device manufacturer ID 0xEF, type ID 0x30, capacity ID 0x13
Error: SFDP signature error. It must be 0x50444653 'SFDP'
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Found a Winbond W25X40CL flash chip (524288 bytes)
Flash device reset success
Probing:
		Device ID	Manuf ID	Type ID		Capacity ID
RESID (0xAB)	0x12
REMSID (0x90)	0x12		0xef
RDID (0x9F)			0xef		0x30		0x13

SFDP (0x5A): not found

BR, -sjm

1 Like

The next three chips I was bragging about are actually I2C serial eeproms from ST and Atmel. Oh well.

I can probably still find more different spi flash chips, though.
I have plenty of these handy smd-DIP adapter pcbs to make connecting the probes easy.

Google Photos

I made a solder bridge from VCC to /HOLD but not connecting /WP to keep it read only for now.

BR, -sjm

1 Like

Our next patient:

Google Photos

MX25L1606E from Macronix, datasheet:

This was rescued from an old ADSL modem. :slight_smile:

It gets partially identified by bp5:

SPI> flash probe
Flash device manufacturer ID 0xC2, type ID 0x20, capacity ID 0x15
SFDP V1.0, 2 parameter headers
Error: Parameter table length (2) error
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Error: Flash device not found
Error: device not detected

BR, -sjm

1 Like

OK, after cross checking my physical samples with datasheets and diving into a datasheet rabbit hole a bit, made a pull request to add support for more chips.

BR, -sjm

3 Likes

Good morning. That was a good deep dive! I’ll merge your update now, thank you.

The current limit should be working again, it was just an inverted flag causing all kinds of chaos.

2 Likes

Thank you again. Merged your request and it triggered an auto-build. Excellent! I’ll review the flash command for the dump size problem this afternoon.

2 Likes

Well now my first spi flash gets identified, more or less.
Some errors are shown, I have no idea if they are meaningful.

SPI> flash probe
Flash device manufacturer ID 0xC2, type ID 0x20, capacity ID 0x15
SFDP V1.0, 2 parameter headers
Error: Parameter table length (2) error
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Found a Macronix MX25L1606E flash chip (2097152 bytes)
Flash device reset success
Probing:
		Device ID	Manuf ID	Type ID		Capacity ID
RESID (0xAB)	0x14
REMSID (0x90)	0x29		0x84
RDID (0x9F)			0xc2		0x20		0x15

SFDP (0x5A): found 0x50444653 "PDFS"
 Version: 1.0
 Headers: 3

**Param Table 0**
		Type		Ver.	Length	Address
Table 0		JEDEC (0x00)	1.0	8	0x000020

MSB-LSB  3    2    1    0
[0001] 0xFF 0xC1 0x20 0xE5
[0002] 0x00 0xFF 0xFF 0xFF

Density: 2097152 bytes
Address bytes: 3
Write granularity:>=64B
Write Enable Volatile: 0
Write Enable instruction: 0x50
4K erase instruction: 0x20

Fast read:	1-1-2	1-1-4	1-2-2	1-4-4	2-2-2	4-4-4
Instruction:	0x00	0x20	--	--	--	--
Wait states:	0	4	0	4	0	0
Mode clocks:	0	0	0	11	0	0

Erase:		1	2	3	4
Instruction:	0x1c	0x20	0x00	0x00
Size:		4194303K	16B	2B	1B

**Param Table 1**
		Type		Ver.	Length	Address
Table 1		manuf (0x01)	1.0	252	0xffffff
 Error: record too long to fetch! Skipping...

**Param Table 2**
		Type		Ver.	Length	Address
Table 2		manuf (0x02)	1.0	8	0x000030

MSB-LSB  3    2    1    0
[0001] 0x27 0x00 0x36 0x00
[0002] 0xFF 0xFD 0x38 0xE0

VCC min: 2700mV
VCC max: 3600mV
/Reset pin: -
/Hold pin: -
Deep Power Down (DPDM): -
SW reset: - (instruction 0x8e)
Suspend/Resume program: Y
Suspend/Resume erase: Y
Wrap Read mode: - (instruction 0xfd, length 255)
Individual block lock: - (nonvolatile -, instruction 0x2d, default 1)
Secured OTP: Y
Read lock: Y
Permanent lock: -

BR, -sjm

2 Likes

And yes, the PSU current limit seems to work now.

SPI> W 3.3 20
3.30V requested, closest value: 3.30V
20.0mA requested, closest value: 20.0mA

Power supply:Enabled
Vreg output: 3.3V, Vref/Vout pin: 3.3V, Current: 3.1mA

Another spi flash:

SPI> flash probe
Flash device manufacturer ID 0xEF, type ID 0x30, capacity ID 0x13
Error: SFDP signature error. It must be 0x50444653 'SFDP'
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Found a Winbond W25X40CL flash chip (524288 bytes)
Flash device reset success
Probing:
		Device ID	Manuf ID	Type ID		Capacity ID
RESID (0xAB)	0x12
REMSID (0x90)	0x12		0xef
RDID (0x9F)			0xef		0x30		0x13

SFDP (0x5A): not found

And the last one with 1.8V power supply:

SPI> W 1.8 20
1.80V requested, closest value: 1.80V
20.0mA requested, closest value: 20.0mA

Power supply:Enabled
Vreg output: 1.8V, Vref/Vout pin: 1.8V, Current: 3.1mA

SPI> flash probe
Flash device manufacturer ID 0xEF, type ID 0x50, capacity ID 0x13
Error: SFDP signature error. It must be 0x50444653 'SFDP'
Warning: Read SFDP parameter header information failed. The SPI_FLASH does not support JEDEC SFDP.
Found a Winbond W25Q40BV flash chip (524288 bytes)
Flash device reset success
Probing:
		Device ID	Manuf ID	Type ID		Capacity ID
RESID (0xAB)	0x12
REMSID (0x90)	0x12		0xef
RDID (0x9F)			0xef		0x50		0x13

SFDP (0x5A): not found
2 Likes

Good stuff! I’m REALLY curious about that first chip from the post above this one. The library throws an error, but my probe finds …Something… I guess it’s an error and I need a sanity check.

I wonder what that 252 byte parameter table is about. If that’s an error or its really that long. If so, I can make the buffer bigger…

I studied the datasheet:

(hopefully that one is correct!)

A “word” here is two bytes, and datasheet referring to DWORD means 4 bytes.
On page 26 “Table c. Parameter Table (1): Macronix Flash Parameter Tables” we can find:

As per flash address 0x0B we have 0x09 DWORDs = 9*4 = 36 bytes of header data starting from address 0x0030 (as per pointer at address 0x0C).
The datasheet then elaborates on the header contents from address 0x0030 to 0x0053, so the length is indeed 0x24 (36) bytes.

As per length at 0x13 and pointer at address 0x14 we should have another 4*4 = 16 bytes of header data starting from address 0x0060. On page 29 indeed we have that header data listed from address 0x0060 to 0x006F.

Now rereading the output from detecting MX25L1606E chip and comparing that to what datasheet is saying.

Our actual JEDEC data is not starting from address 0x000020 but 0x000030, and its length is 36 bytes, not 8.

I don’t know what the label “Number of Parameter Headers” at address 0x06 means, given that the value is 1 and we have two headers, first JEDEC at 0x08 and then manufacturer specific at 0x10.

Sigh.

BR, -sjm

The code here looks like it should do the right thing:

everything looks exactly like what is shown on the datasheet.

Now I am suspecting that my spi flash is broken, somehow “special” or I should try identify it on different VCC voltage levels to see if anything changes. Because the rise and fall time requirements of SPI signals are so tight, the probe cable length might cause problems and we have bits flipped and unstable results coming from hardware.

For example, the 1.8V rated flash chip did “work” somehow with 3.3V but the probing results were completely off and basically BS. Even the manufacturer ID was not read right. Interestingly, the id data was consistent, not random, but still plain wrong.

I’ll give the MX25L1606E chip a bit more testing and see what results I get.

Certainly it looks like we are going to uncertain zone with 10cm probe cables and full VCC voltage. Another chip rated for 2.7V…3.6V did not get indentified correctly at 3.3V but behaved much better at 2.7V supply voltage.

Oh well.

Lesson learned: try identifying the chip from the physical markings if possible, and then find the datasheet and read it, and check the correct supply voltage! The chip may be specified to something as low as 1.8V supply, absolute maximum 1.95V.

1 Like