SUPPLEMENT
S25FL128S
S25FL256S
128 Mbit (16 Mbyte) and
256 Mbit (32 Mbyte), 3 V, MirrorBit
®
Flash
This supplementary document provides information on a device designed for limited distribution. It describes how the features,
operation, and ordering options of this device have been enhanced or changed from the standard device on which it is based. The
information contained in this document modifies any information on the same topics established by the data sheets listed in the
Affected Documents/Related Documents table and should be used in conjunction with those documents. This document may also
contain information that was not previously covered by the S25FL128S and S25FL256S data sheets. It is intended for hardware
system designers and software developers of applications, operating systems, or tools.
General Description
Affected Documents/Related Documents
Title
S25FL128S and S25FL256S Data Sheet
Spansion Publication Number
S25FL128S_256S_00
Cypress Document Number
001-98283
Cypress Semiconductor Corporation
Document Number: 002-00627 Rev. *D
•
198 Champion Court
•
San Jose
,
CA 95134-1709
•
408-943-2600
Revised June 09, 2017
SUPPLEMENT
S25FL128S
S25FL256S
1.
1.1
Device Description
Permanent Lock Description
The Secure Model devices offer a unique Permanent Lock feature that allows the host system to permanently secure data in the
memory array. Initiating this locking feature makes the selected block protection scheme permanent, thereby disabling both program
and erase operations in the protected region of the array.
1.2
Advanced Sector Protection Description
The secure model devices modify the Advanced Sector Protection (ASP) features:
All Dynamic Protection Bits (DYB) are modified to be in the protected state following power-up
All Persistent Protection Bits (PPB) are modified to be One Time Programmable (OTP). After a PPB bit is programmed, the
related sector is permanently protected. PPB bits are not erasable. PPB bits may be programmed while the PPBLOCK Bit = 0.
2. Registers
2.1
Configuration Register 1 (CR1)
Bit 4 called LOCK is added to CR1. When set to 1, the Block Protection configuration is permanent.
Configuration Register (CR1)
Bits
7
6
5
4
3
Field Name
LC1
LC0
TBPROT
LOCK
BPNV
Latency Code
Configures Start of Block Protection and selects readable
boot sector in Read Password Mode
Permanently locks BP2-0 and TBPROT bits in their state
when LOCK is set to 1
Configures BP2-0 in Status Register
Function
Default
State
0
0
0
0
0
Description
Selects number of initial read latency cycles. See Latency
Code Tables.
1 = BP starts at bottom (Low address)
0 = BP starts at top (High address)
1 = Locked
0 = Un-locked
1 = Volatile
0 = Non-Volatile
1 = 4 kB physical sectors at top (High address)
0 = 4 kB physical sectors at bottom
(Low address)
RFU in uniform sector devices.
1 = Quad
0 = Dual or Serial
1 = Block Protection and OTP locked
0 = Block Protection and OTP un-locked
2
TBPARM
Configures Parameter Sectors location
0
1
QUAD
Puts the device into Quad I/O operation
Lock current state of BP2-0 bits in Status Register,
TBPROT, and TBPARM in Configuration Register, and OTP
regions
0
0
FREEZE
0
Document Number: 002-00627 Rev. *D
Page 2 of 8
SUPPLEMENT
S25FL128S
S25FL256S
2.2
ASP Register (ASPR)
Bits 3 and 4 are added to make PPB bits OTP and DYB bits default to protected state following power-up.
ASP Register (ASPR)
Bits
15 to 9
8
7
6
5
4
3
2
1
0
Field Name
RFU
RFU
RFU
RFU
RFU
DYBLBB
PPBOTP
PWDMLB
PSTMLB
RFU
Function
Reserved
Reserved
Reserved
Reserved
Reserved
DYB Lock Boot Bit
PPB OTP Bit
Password Protection Mode Lock Bit
Persistent Protection Mode Lock Bit
Reserved
Default
State
1
0
0
1
1
0
0
1
1
1
Reserved for Future Use
Reserved for Future Use
Reserved for Future Use
Reserved for Future Use
Reserved for Future Use
0 = All DYB power-up in the protected state (0)
0 = PPB bits are OTP
0 = Password Protection Mode permanently enabled.
1 = Password Protection Mode not permanently enabled.
0 = Persistent Protection Mode permanently enabled.
1 = Persistent Protection Mode not permanently enabled.
Reserved for Future Use
Description
3. Block Protection
3.1
Lock Bit
Bit 4 of the Configuration Register is the LOCK bit. When the LOCK bit is programmed to a 1 the BP2-0 bits in the Status Register
and the TBPROT bit in the Configuration Register are permanently locked to their nonvolatile values, they cannot be erased or
programmed; thereby permanently locking the selected portion of the memory array from change by programming or erasure. The
FREEZE bit and BPNV bits in the Configuration Register no longer affect the BP2-0 bits, because the LOCK bit has permanently
frozen the BP2-0 bits in their non-volatile state. Any attempt to change the BP bits with the WRR command while
LOCK = 1 is ignored and no error status is set. The LOCK bit is a one-time programmable value, so once set it cannot be changed
back.
4.
4.1
Advanced Sector Protection
ASP Register
The ASP register is used to permanently configure the behavior of Advanced Sector Protection (ASP) features.
The ASPR[4] DYB Lock Boot Bit is shipped from the factory as 0, which means all the DYB are powered up in the Protected State.
The ASPR[3] PPB OTP Bit is shipped from the factory as 0, which means all the PPB bits are One Time Programmable. Once a
PPB bit is programmed to 0, the related sector is permanently protected.
The PPBLOCK bit controls when PPB bits are programmable or protected as described in the standard device models data sheet.
The Persistent and Password protection modes control the PPBLOCK bit state as described in the standard device models data
sheet.
4.2
Read Password Protection Mode
If enabled the Read Password Method is a security option that will replace the default PPB Password Protection Mode. The Read
Password Protection Mode enables protecting the main Flash array from read, program and erase. Only the lowest or highest
address range, selected by the configuration register TBPROT bit, remains readable until a successful Password Unlock command
is completed.
In this mode the PPB Lock bit is used to control the high order bits of address. When the PPB Lock bit is 1, the address bits operate
normally. When the PPB Lock bit is 0, the address bits that select a main array sector address range are forced either to Zeros
Document Number: 002-00627 Rev. *D
Page 3 of 8
SUPPLEMENT
S25FL128S
S25FL256S
(TBPROT = 0) or to Ones (TBPROT = 1) to select the lowest or highest address main Flash array address range per the table below.
When TBPROT is cleared to a 0, the bottom (zero address) 64 kB or 256 kB of the array is readable. When TBPROT is set to a 1,
the top (maximum address) 64 kB or 256 kB of the array is readable. The selection of 64 kB or 256 kB depends on the OPN
selection for size of the sector erase command.
Sector size option
64 kB (Hybrid)
256 kB (Uniform)
TBPARM is ignored
TBPARM = 0 (bottom of the chip)
TBPROT = 0
User is confined to the lowest
address sixteen 4 kB sectors.
User is confined to the lowest
address sector
TBPROT = 1
User is confined to the highest
address 64 kB sector
User is confined to highest
address sector
TBPARM = 1 (top of the chip)
TBPROT = 0
User is confined to the lowest
address 64 kB sector
User is confined to the lowest
address sector
TBPROT = 1
User is confined to the highest
address sixteen 4 kB sectors
User is confined to highest
address sector
This address range selection is independent of the bank address register. The Bank Address Register remains at the default value
of zero. The BRWR command does not work during read password mode so the user must be aware to set the BAR to the desired
address immediately after the password unlock to normal read mode.
The PPB bits are protected from program and erase when PPB Lock is 0 and may be programmed or erased when PPB Lock is 1.
The PPB Lock bit is set to 0 by power-on reset or hardware reset — same as in PPB Password Protection Mode.
Read Password Protection Notes:
1. The user can program the ASPR[5] bit to 0 and use read password, or not, as desired.
2. The command sequence for programming, reading, and locking of the Password for Read Password Method is the same
as the default for the PPB Password Method.
3. When the Read Password Mode and Password Protection Mode are enabled (i.e. ASPR[2] and ASPR[5] are
programmed to 0), then all addresses are redirected to the Boot Sector until the password unlocking sequence is properly
entered, with the correct password. At which time, the Read Password Mode is disabled and all addressing will select the
proper location.
4. If a system hardware reset occurs, then the Read Password Mode is re-enabled.
5. ASPR[5] is used to select between Read Password vs. PPB Password options. If ASPR[5]=0 then the device is ready for
Read Password. However, Read Password is not enabled until ASPR[2]=0. At which point, all addresses select only
within the top or bottom sectors, until the device is unlocked with the proper unlocking sequence and Password. When
ASPR[2] is not = 1 the addresses select normally. This allows users to program in code, test it, provide a password, and
then lock it by programming ASPR[2]= 0.
6. The PLBWR command has undefined results if sent when Read Password Protection is in use. The PPB Lock bit may
only be returned to 0 by a hardware reset or power-on reset.
7. Only the read commands and the Password Unlock command are valid during Read Password Mode while the PPB Lock
bit = 1. Other commands are disabled until the password is supplied to enable reading of the entire device and normal
command operation.
8. When Read Password Protection mode is active (ASPR[5]=0, ASPR[2]=0, PPB Lock = 0), reading of the main array is
allowed but forced to have only the boot sector visible via the forcing of memory sector address to zero or ones. Reading
the OTP, DYB, and PPB address space returns undefined data.
9. Programming memory spaces or writing registers is not allowed when Read Password Protection mode is active. The
WRR, WRDI, WREN, ABWR, BRWR, ASPP, CLSR, OTPP, PNVDLR, WVDLR, PLBWR, DYBWR, PPBP, PPBE and
PASSP commands do not change memory or register state when Read Password Protection mode is active. RESET
operates normally, and bus protocol may be modified by resetting mode bits.
10. AutoBoot is disabled when the Read Password feature is enabled, as part of the ASP. This removes any conflicts when
the AutoBoot address is within the Protected Area. The user won’t be able to AutoBoot since a password is required prior
to addressing the “boot” code. Cypress recommends that the ABE Bit 0 should be cleared to 0 when the Read Password
feature is enabled.
11. All ID Read commands - ABh, 90h, 9Fh, and 5Ah (FL512S only) - are enabled and can be used when the device is in
Read Password Protection mode.
Document Number: 002-00627 Rev. *D
Page 4 of 8
SUPPLEMENT
S25FL128S
S25FL256S
12. The BRAC and WRR combined command sequence is illegal when Read Password mode is active, prior to the password
being provided.
5.
5.1
Commands
Reset Commands
Software Reset Command (RESET F0h)
5.1.1
The Software Reset command (RESET) restores the device to its initial power up state, except for the volatile FREEZE bit in the
Configuration register CR1[1] and the volatile PPB Lock bit in the PPB Lock Register. The Freeze bit and the PPB Lock bit will
remain set at their last value prior to the software reset. To clear the FREEZE bit and set the PPB Lock bit to its protection mode
selected power on state, a full power-on reset sequence or hardware reset must be done. Note that all bits in the configuration
register retain their previous state after a Software Reset. The Block Protection bits BP2, BP1, and BP0, in the status register will
only be reset if they are configured as volatile via the BPNV bit in the Configuration Register (CR1[3]) and FREEZE (CR1[0]) is
cleared to zero and LOCK (CR1[4]) is cleared to zero. The software reset cannot be used to circumvent the FREEZE or PPBLOCK
bit protection mechanisms for security configuration bits (SR1[4:2], CR1[5:2], and PPB bits). The reset command is executed when
CS# is brought to high state and requires t
RPH
time to execute.
In case of power-up failure, if the user applies a RESET command, a full power up sequence is triggered. Meanwhile program and
erase commands are ignored.
6. Software Interface Reference
6.1
Device ID and Common Flash Interface (ID-CFI) Address Map
CFI Alternate Vendor-Specific Extended Query Parameter 88h Data Protection
Parameter Relative Byte
Address Offset
00h
01h
02h
03h
04h
05h
Data
88h
04h
0Ah
01h
02h
03h
Parameter ID (Data Protection)
Parameter Length (The number of following bytes in this parameter. Adding this value to the current location value +1 = the
first byte of the next parameter)
OTP size 2
N
bytes, FFh = not supported
OTP address map format, 01h = FL-S format, FFh = not supported
Block Protect Type, model dependent
00h = FL-P, FL-S, FFh = not supported, 02h = FL-S Lock Bit Enabled
Advanced Sector Protection type, model dependent
01h = FL-S ASP, 03h = FL-S ASP with DYB Lock Boot and PPBOTP
Description
Document Number: 002-00627 Rev. *D
Page 5 of 8
