S25FL256L,128L Datasheet

Cypress Semiconductor Corp

View All Related Products | Download PDF Datasheet

Datasheet

Cypress Semiconductor Corporation 198 Champion Court San Jose,CA 95134-1709 408-943-2600
Document Number: 002-00124 Rev. *G Revised April 03, 2018
S25FL256L/S25FL128L
256-Mb (32-MB)/128-Mb (16-MB),
3.0 V FL-L Flash Memory
General Description
The Cypress FL-L Family devices are Flash non-volatile memory products using:
Floating Gate technology
65 nm process lithography
The FL-L family connects to a host system via a Serial Peripheral Interface (SPI). Traditional SPI single bit serial input and output
(Single I/O or SIO) is supported as well as optional two bit (Dual I/O or DIO) and four bit wide Quad I/O (QIO) and Quad Peripheral
Interface (QPI) commands. In addition, there are Double Data Rate (DDR) read commands for QIO and QPI that transfer address
and read data on both edges of the clock.
The architecture features a Page Programming Buffer that allows up to 256-bytes to be programmed in one operation and provides
individual 4KB sector, 32KB half block, 64KB block, or entire chip erase.
By using FL-L family devices at the higher clock rates supported, with Quad commands, the instruction read transfer rate can match
or exceed traditional parallel interface, asynchronous, NOR Flash memories, while reducing signal count dramatically.
The FL-L family products offer high densities coupled with the flexibility and fast performance required by a variety of mobile or
embedded applications. Provides an ideal storage solution for systems with limited space, signal connections, and power. These
memories offer flexibility and performance well beyond ordinary serial flash devices. They are ideal for code shadowing to RAM,
executing code directly (XIP), and storing re-programmable data.
Features
Serial Peripheral Interface (SPI) with Multi-I/O
Clock polarity and phase modes 0 and 3
Double Data Rate (DDR) option
Quad peripheral Interface (QPI) option
Extended Addressing: 24- or 32-bit address options
Serial Command subset and footprint compatible with
S25FL-A, S25FL1-K, S25FL-P, S25FL-S and S25FS-S SPI
families
Multi I/O Command subset and footprint compatible with
S25FL-P, S25FL-S and S25FS-S SPI families
Read
Commands: Normal, Fast, Dual I/O, Quad I/O, DualO,
QuadO, DDR Quad I/O.
Modes: Burst Wrap, Continuous (XIP), QPI
Serial Flash Discoverable Parameters (SFDP) for configura-
tion information.
Program Architecture
256 Bytes Page Programming buffer
3.0 V FL-L Flash Memory
Program suspend and resume
Erase Architecture
Uniform 4 KB Sector Erase
Uniform 32 KB Half Block Erase
Uniform 64 KB Block Erase
Chip erase
Erase suspend and resume
100,000 Program/Erase Cycles, minimum
20 Year Data Retention, minimum
Security features
Status and Configuration Register Protection
Four Security Regions of 256 bytes each outside the main
Flash array
Legacy Block Protection: Block range
Individual and Region Protection
Individual Block Lock: Volatile individual Sector/Block
Pointer Region: Non-Volatile Sector/Block range
Power Supply Lock-down, Password, or Permanent pro-
tection of Security Regions 2 and 3 and Pointer Region
Technology
65 nm Floating Gate Technology
Single Supply Voltage with CMOS I/O
2.7 V to 3.6 V
Temperature Range / Grade
Industrial (–40 °C to +85 °C)
Industrial Plus (–40 °C to +105 °C)
Automotive, AEC-Q100 Grade 3 (–40 °C to +85 °C)
Automotive, AEC-Q100 Grade 2 (–40 °C to +105 °C)
Automotive, AEC-Q100 Grade 1 (–40 °C to +125 °C)
Packages (all Pb-free)
8-pin SOIC 208 mil (SOC008) — S25FL128L only
WSON 5 6 mm (WND008) — S25FL128L only
WSON 6 8 mm (WNG008) — S25FL256L only
16-pin SOIC 300 mil (SO3016)
BGA-24 6 8 mm
•5 5 ball (FAB024) footprint
•4 6 ball (FAC024) footprint
Document Number: 002-00124 Rev. *G Page 2 of 160
S25FL256L/S25FL128L
Performance Summary
Maximum Read Rates SDR
Command Clock Rate (MHz) MBps
Read 50 6.25
Fast Read 133 16.5
Dual Read 133 33
Quad Read 133 66
Maximum Read Rates DDR
Command Clock Rate (MHz) MBps
DDR Quad Read 66 66
Typical Program and Erase Rates
Operation KBps
Page Programming 854
4 KB Sector Erase 80
32 KB Half Block Erase 168
64 KB Block Erase 237
Typical Current Consumption, 40 °C to +85 °C
Operation Typical Current Unit
Fast Read 5 MHz 10
mA
Fast Read 10 MHz 10
Fast Read 20 MHz 10
Fast Read 50 MHz 15
Fast Read 108 MHz 25
Fast Read 133 MHz 30
Quad I/O / QPI Read 108 MHz 25
Quad I/O / QPI Read 133 MHz 30
Quad I/O / QPI DDR Read 33 MHz 15
Quad I/O / QPI DDR Read 66 MHz 30
Program 40
Erase 40
Standby SPI 20
µAStandby QPI 60
Deep Power Down 2
Document Number: 002-00124 Rev. *G Page 3 of 160
S25FL256L/S25FL128L
Contents
1. Product Overview ........................................................ 4
1.1 Migration Notes.............................................................. 4
2. Connection Diagrams.................................................. 5
2.1 SOIC 16-Lead................................................................ 5
2.2 8 Connector Packages................................................... 5
2.3 BGA Ball Footprint ......................................................... 6
2.4 Special Handling Instructions for FBGA Packages........ 6
3. Signal Descriptions ..................................................... 7
3.1 Input/Output Summary................................................... 7
3.2 Multiple Input / Output (MIO).......................................... 8
3.3 Serial Clock (SCK)......................................................... 8
3.4 Chip Select (CS#) .......................................................... 8
3.5 Serial Input (SI) / IO0 ..................................................... 8
3.6 Serial Output (SO) / IO1................................................. 8
3.7 Write Protect (WP#) / IO2 .............................................. 8
3.8 IO3 / RESET# ................................................................ 9
3.9 RESET# ......................................................................... 9
3.10 Voltage Supply (VCC)..................................................... 9
3.11 Supply and Signal Ground (VSS) ................................... 9
3.12 Not Connected (NC) ...................................................... 9
3.13 Reserved for Future Use (RFU)................................... 10
3.14 Do Not Use (DNU) ....................................................... 10
4. Block Diagram............................................................ 11
4.1 System Block Diagrams............................................... 11
5. Signal Protocols......................................................... 13
5.1 SPI Clock Modes ......................................................... 13
5.2 Command Protocol ...................................................... 14
5.3 Interface States............................................................ 18
5.4 Data Protection ............................................................ 22
6. Address Space Maps................................................. 23
6.1 Overview ...................................................................... 23
6.2 Flash Memory Array..................................................... 23
6.3 ID Address Space ........................................................ 24
6.4 JEDEC JESD216 Serial Flash
Discoverable Parameters (SFDP) Space .................... 24
6.5 Security Regions Address Space ................................ 24
6.6 Registers...................................................................... 25
7. Data Protection .......................................................... 43
7.1 Security Regions.......................................................... 43
7.2 Deep Power Down....................................................... 43
7.3 Write Enable Commands............................................. 44
7.4 Write Protect Signal ..................................................... 44
7.5 Status Register Protect (SRP1, SRP0)........................ 45
7.6 Array Protection ........................................................... 46
7.7 Individual and Region Protection ................................. 53
8. Commands ................................................................. 58
8.1 Command Set Summary.............................................. 58
8.2 Identification Commands ............................................. 64
8.3 Register Access Commands........................................ 68
8.4 Read Memory Array Commands ................................. 82
8.5 Program Flash Array Commands ................................ 90
8.6 Erase Flash Array Commands...................................... 92
8.7 Security Regions Array Commands............................ 100
8.8 Individual Block Lock Commands ............................... 102
8.9 Pointer Region Command........................................... 107
8.10 Individual and Region Protection
(IRP) Commands ........................................................ 108
8.11 Reset Commands ....................................................... 115
8.12 Deep Power Down Commands................................... 116
9. Data Integrity ............................................................. 119
9.1 Erase Endurance ........................................................ 119
9.2 Data Retention............................................................ 119
10. Software Interface Reference .................................. 120
10.1 JEDEC JESD216B Serial Flash
Discoverable Parameters............................................ 120
10.2 Device ID Address Map .............................................. 129
10.3 Initial Delivery State .................................................... 129
11. Electrical Specifications........................................... 130
11.1 Absolute Maximum Ratings ........................................ 130
11.2 Latchup Characteristics .............................................. 130
11.3 Thermal Resistance.................................................... 130
11.4 Operating Ranges....................................................... 131
11.5 Power-Up and Power-Down ....................................... 132
11.6 DC Characteristics ...................................................... 134
12. Timing Specifications............................................... 137
12.1 Key to Switching Waveforms ...................................... 137
12.2 AC Test Conditions..................................................... 137
12.3 Reset .......................................................................... 138
12.4 SDR AC Characteristics ............................................. 141
12.5 DDR AC Characteristics ............................................. 144
12.6 Embedded Algorithm Performance Tables................. 146
13. Ordering Information................................................ 147
13.1 Ordering Part Number................................................. 147
14. Physical Diagrams.................................................... 150
14.1 SOIC 16-Lead, 300-mil Body Width (SO3016) ........... 150
14.2 SOIC 8-Lead, 208 mil Body Width (SOC008)............. 151
14.3 WSON 8-Contact 5 x 6 mm Leadless (WND008)....... 152
14.4 WSON 8-Contact 6 x 8 mm Leadless (WNG008)....... 153
14.5 Ball Grid Array 24-ball 6 x 8 mm (FAB024)................. 154
14.6 Ball Grid Array 24-ball 6 x 8 mm (FAC024) ................ 155
15. Other Resources....................................................... 156
15.1 Glossary...................................................................... 156
15.2 Link to Cypress Flash Roadmap................................. 157
15.3 Link to Software .......................................................... 157
15.4 Link to Application Notes ............................................ 157
16. Document History..................................................... 158
Sales, Solutions, and Legal Information ......................... 160
Worldwide Sales and Design Support .......................... 160
Products ....................................................................... 160
PSoC® Solutions ......................................................... 160
Cypress Developer Community .................................... 160
Technical Support ........................................................ 160
Document Number: 002-00124 Rev. *G Page 4 of 160
S25FL256L/S25FL128L
1. Product Overview
1.1 Migration Notes
1.1.1 Features Comparison
The FL-L family is command subset and footprint compatible with prior generation FL-S, FL1-K and FL-P families.
Note
1. Refer to individual datasheets for further details.
Table 1. Cypress SPI Families Comparison
Parameter FL-L FL-S FL1-K FL-P
Technology Node 65 nm 65 nm 90 nm 90 nm
Architecture Floating Gate MirrorBit® Eclipse™ Floating Gate MirrorBit®
Release Date In Production In Production In Production In Production
Density 256 Mb 128 Mb - 1 Gb 4 Mb - 64 Mb 32 Mb - 256 Mb
Bus Width x1, x2, x4 x1, x2, x4 x1, x2, x4 x1, x2, x4
Supply Voltage 2.7 V - 3.6 V 2.7 V - 3.6 V /
1.65 V - 3.6 V VIO 2.7 V - 3.6 V 2.7 V - 3.6 V
Normal Read Speed 6 MBps (50 MHz) 6 MBps (50 MHz) 6 MBps (50 MHz) 5 MBps (40 MHz)
Fast Read Speed 16.5 MBps (133 MHz) 17 MBps (133 MHz) 13 MBps (108 MHz) 13 MBps (104 MHz)
Dual Read Speed 33 MBps (133 MHz) 26 MBps (104 MHz) 26 MBps (108 MHz) 20 MBps (80 MHz)
Quad Read Speed 66 MBps (133 MHz) 52 MBps (104 MHz) 52 MBps (108 MHz) 40 MBps (80 MHz)
Quad Read Speed (DDR) 66 MBps (66 MHz) 80 MBps (80 MHz)
Program Buffer Size 256B 256B / 512B 256B 256B
Erase Sector/Block Size 4 KB / 32 KB / 64 KB 64 KB / 256 KB 4 KB / 64 KB 64 KB / 256 KB
Parameter Sector Size - 4 KB (option) 4 KB
Sector / Block Erase Rate (typ.)
80 KBps (4 KB)
168 KBps (32 KB
237 KBps (64 KB)
500 KBps 136 KBps (4 KB)
437 KBps (64 KB) 130 KBps
Page Programming Rate (typ.) 854 KBps (256B) 1.2 MBps (256B)
1.5 MBps (512B) 365 KBps 170 KBps
Security Region / OTP 1024B 1024B 768B (3 256B) 506B
Individual and Region Protection
or Advanced Sector Protection
Yes Yes
No
No
Erase Suspend/Resume Yes
Program Suspend/Resume
Operating Temperature
–40 °C to +85 °C
–40 °C to +105 °C
–40 °C to +125 °C
–40 °C to +85 °C
–40 °C to +105 °C –40 °C to +85 °C –40 °C to +85 °C
–40 °C to +105 °C
Document Number: 002-00124 Rev. *G Page 5 of 160
S25FL256L/S25FL128L
2. Connection Diagrams
2.1 SOIC 16-Lead
Figure 1. 16-Lead SOIC Package (SO3016), Top View
Note
2. The RESET# and IO3 / RESET# inputs have an internal pull-up and may be left unconnected in the system if quad mode, mode and hardware reset are not in use.
2.2 8 Connector Packages
Figure 2. 8-Pin Plastic Small Outline Package (SOIC8)
Figure 3. 8-Connector Package (WSON 6 x 8) (WSON 5 x 6), Top View
Note
3. The RESET# input has an internal pull-up and may be left unconnected in the system if quad mode and hardware reset are not in use.
SOIC16
NC
IO3/RESET# SCK
SI/IO0
1
2
3
1
413
14
15
16
CS#
SO/IO1 WP#/IO2
VSS
5
6
7
8
VCC
RESET#
9
10
11
12
NC
RFU DNU
RFU
DNU
DNU
SOIC
CS#
SO/IO1
WP#/IO2
VSS
VCC
IO3/RESET#
SCK
SI/IO0
1
2
3
1
45
6
7
8
WSON
CS#
SO/IO1
WP#/IO2
VSS
VCC
IO3/RESET#
SCK
SI/IO0
2
3
1
4 5
6
7
8
Document Number: 002-00124 Rev. *G Page 6 of 160
S25FL256L/S25FL128L
2.3 BGA Ball Footprint
Figure 4. 24-Ball BGA, 5 x 5 Ball Footprint (FAB024), Top View
Notes
4. Signal connections are in the same relative positions as FAC024 BGA, allowing a single PCB footprint to use either package.
5. The RESET# input has an internal pull-up and may be left unconnected in the system if quad mode and hardware reset are not in use.
Figure 5. 24-Ball BGA, 4 x 6 Ball Footprint (FAC024), Top View
Note
6. The RESET# input has an internal pull-up and may be left unconnected in the system if quad mode and hardware reset are not in use.
2.4 Special Handling Instructions for FBGA Packages
Flash memory devices in BGA packages may be damaged if exposed to ultrasonic cleaning methods. The package and/or data
integrity may be compromised if the package body is exposed to temperatures above 150°C for prolonged periods of time.
12345
AA
B
C
D
C
E
NC NC NC
NC
NC
NC
NCNC NC NC
RESET#
RFU
DNU
DNU
DNU
SCK VSS VCC
CS# RFU WP#/IO2
SO/IO1 SI/IO0 IO3/RESET#
Document Number: 002-00124 Rev. *G Page 7 of 160
S25FL256L/S25FL128L
3. Signal Descriptions
Serial Peripheral Interface with Multiple Input / Output (SPI-MIO)
Many memory devices connect to their host system with separate parallel control, address, and data signals that require a large
number of signal connections and larger package size. The large number of connections increase power consumption due to so
many signals switching and the larger package increases cost.
The FL-L family reduces the number of signals for connection to the host system by serially transferring all control, address, and
data information over 6 signals. This reduces the cost of the memory package, reduces signal switching power, and either reduces
the host connection count or frees host connectors for use in providing other features.
The FL-L family uses the industry standard single bit SPI and also supports optional extension commands for two bit (Dual) and four
bit (Quad) wide serial transfers. This multiple width interface is called SPI Multi-I/O or SPI-MIO.
3.1 Input/Output Summary
Note
7. Inputs with internal pull-ups or pull-downs drive less than 2 A. Only during power-up is the current larger at 150 A for 4 S. Resistance of pull-ups or pull-down
resistors with the typical process at Vcc = 3.3 V at –40°C is ~4.5 M and at 90°C is ~6.6 M.
Table 2. Signal List
Signal Name Type Description
RESET# Input Hardware Reset: Low = device resets and returns to standby state, ready to receive a command. The signal has an
internal pull-up resistor and may be left unconnected in the host system if not used.
SCK Input Serial Clock.
CS# Input Chip Select.
SI / IO0 I/O Serial Input for single bit data commands or IO0 for Dual or Quad commands.
SO / IO1 I/O Serial Output for single bit data commands. IO1 for Dual or Quad commands.
WP# / IO2 I/O
Write Protect when not in Quad mode (CR1V[1] = 0 and SR1NV[7] = 1).
IO2 when in Quad mode (CR1V[1] = 1).
The signal has an internal pull-up resistor and may be left unconnected in the host system if not used for Quad
commands or write protection. If write protection is enabled by SR1NV[7] = 1 and CR1V[1] = 0, the host system is
required to drive WP# high or low during a WRR or WRAR command.
IO3 / RESET# I/O
IO3 in Quad-I/O mode, when Configuration Register 1 QUAD bit, CR1V[1] =1, or in QPI mode, when Configuration
Register 2 QPI bit, CR2V[3] =1 and CS# is low.
RESET# when enabled by CR2V[7]=1 and not in Quad-I/O mode, CR1V[1] = 0, or when enabled in quad mode,
CR1V[1] = 1 and CS# is high.
The signal has an internal pull-up resistor and may be left unconnected in the host system if not used for Quad
commands or RESET#.
VCC Supply Power Supply.
VSS Supply Ground.
NC Unused
Not Connected. No device internal signal is connected to the package connector nor is there any future plan to use
the connector for a signal. The connection may safely be used for routing space for a signal on a Printed Circuit Board
(PCB). However, any signal connected to an NC must not have voltage levels higher than VCC.
RFU Reserved
Reserved for Future Use. No device internal signal is currently connected to the package connector but there is
potential future use of the connector for a signal. It is recommended to not use RFU connectors for PCB routing
channels so that the PCB may take advantage of future enhanced features in compatible footprint devices.
DNU Reserved
Do Not Use. A device internal signal may be connected to the package connector. The connection may be used by
Cypress for test or other purposes and is not intended for connection to any host system signal. Any DNU signal
related function will be inactive when the signal is at VIL. The signal has an internal pull-down resistor and may be left
unconnected in the host system or may be tied to VSS. Do not use these connections for PCB signal routing channels.
Do not connect any host system signal to this connection.
Document Number: 002-00124 Rev. *G Page 8 of 160
S25FL256L/S25FL128L
3.2 Multiple Input / Output (MIO)
Traditional SPI single bit wide commands (Single or SIO) send information from the host to the memory only on the Serial Input (SI)
signal. Data may be sent back to the host serially on the Serial Output (SO) signal.
Dual or Quad Input / Output (I/O) commands send instructions to the memory only on the SI/IO0 signal. Address or data is sent from
the host to the memory as bit pairs on IO0 and IO1 or four bit (nibble) groups on IO0, IO1, IO2, and IO3. Data is returned to the host
similarly as bit pairs on IO0 and IO1 or four bit (nibble) groups on IO0, IO1, IO2, and IO3.
QPI mode transfers all instructions, addresses, and data from the host to the memory as four bit (nibble) groups on IO0, IO1, IO2,
and IO3. Data is returned to the host similarly as four bit (nibble) groups on IO0, IO1, IO2, and IO3.
3.3 Serial Clock (SCK)
This input signal provides the synchronization reference for the SPI interface. Instructions, addresses, or data input are latched on
the rising edge of the SCK signal. Data output changes after the falling edge of SCK, in SDR commands.
3.4 Chip Select (CS#)
The chip select signal indicates when a command is transferring information to or from the device and the other signals are relevant
for the memory device.
When the CS# signal is at the logic high state, the device is not selected and all input signals are ignored and all output signals are
high impedance. The device will be in the Standby Power mode, unless an internal embedded operation is in progress. An
embedded operation is indicated by the Status Register 1 Write-In-Progress bit (SR1V[0]) set to 1, until the operation is completed.
Some example embedded operations are: Program, Erase, or Write Registers (WRR) operations.
Driving the CS# input to the logic low state enables the device, placing it in the Active Power mode. After Power-up, a falling edge on
CS# is required prior to the start of any command.
3.5 Serial Input (SI) / IO0
This input signals used to transfer data serially into the device. It receives instructions, addresses, and data to be programmed.
Values are latched on the rising edge of serial SCK clock signal. SI becomes IO0 - an input and output during Dual and Quad
commands for receiving instructions, addresses, and data to be programmed (values latched on rising edge of serial SCK clock
signal) as well as shifting out data (on the falling edge of SCK, in SDR commands, and on every edge of SCK, in DDR commands).
3.6 Serial Output (SO) / IO1
This output signals used to transfer data serially out of the device. Data is shifted out on the falling edge of the serial SCK clock
signal. SO becomes IO1 - an input and output during Dual and Quad commands for receiving addresses, and data to be
programmed (values latched on rising edge of serial SCK clock signal) as well as shifting out data (on the falling edge of SCK in
SDR commands, and on every edge of SCK, in DDR commands).
3.7 Write Protect (WP#) / IO2
When WP# is driven Low (VIL), when the Status Register Protect 0 (SRP0_NV) or (SRP0) bit of Status Register 1 (SR1NV[7]) or
(SR1V[7]) is set to a 1, it is not possible to write to Status Registers, Configuration Registers or DLR registers. In this situation, the
command selecting SR1NV, SR1V, CR1NV,CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV is ignored, and no error is set.
This prevents any alteration of the Legacy Block Protection settings. As a consequence, all the data bytes in the memory area that
are protected by the Legacy Block Protection feature are also hardware protected against data modification if WP# is Low during
commands changing Status Registers, Configuration Registers or DLR registers, with SRP0_NV set to 1. Similarly, the Security
Region Lock Bits (LB3-LB0) are protected against programming.
The WP# function is not available when the Quad mode is enabled (CR1V[1]=1) or QPI mode is enabled (CR2V[3]=1). The WP#
function is replaced by IO2 for input and output during Quad mode or QPI mode is enabled (CR2V[3]=1) for receiving addresses,
and data to be programmed (values are latched on rising edge of the SCK signal) as well as shifting out data on the falling edge of
SCK, in SDR commands, and on every edge of SCK, in DDR commands).
WP# has an internal pull-up resistance; when unconnected, WP# is at VIH and may be left unconnected in the host system if not
used for Quad mode or QPI mode or protection.
Document Number: 002-00124 Rev. *G Page 9 of 160
S25FL256L/S25FL128L
3.8 IO3 / RESET#
IO3 is used for input and output during Quad mode (CR1V[1]=1) or QPI mode is enabled (CR2V[3]=1) for receiving addresses, and
data to be programmed (values are latched on rising edge of the SCK signal) as well as shifting out data (on the falling edge of SCK,
in SDR commands, and on every edge of SCK, in DDR commands).
The IO3 / RESET# input may also be used to initiate the hardware reset function when the IO3 / RESET# feature is enabled by
writing Configuration Register 2 non-volatile bit 7 (CR2NV[7]=1). The input is only treated as RESET# when the device is not in
Quad modes (114,144,444), CR1V[1] = 0, or when CS# is high. When Quad modes are in use, CR1V[1]=1or QPI mode is enabled
(CR2V[3]=1), and the device is selected with CS# low, the IO3 / RESET# is used only as IO3 for information transfer. When CS# is
high, the IO3 / RESET# is not in use for information transfer and is used as the reset input. By conditioning the reset operation on
CS# high during Quad modes (114,144,444), the reset function remains available during Quad modes (114,144,444).
When the system enters a reset condition, the CS# signal must be driven high as part of the reset process and the IO3 / RESET#
signal is driven low. When CS# goes high the IO3 / RESET# input transitions from being IO3 to being the reset input. The reset
condition is then detected when CS# remains high and the IO3 / RESET# signal remains low for tRP. If a reset is not intended, the
system is required to actively drive IO3 / RESET# to high along with CS# being driven high at the end of a transfer of data to the
memory. Following transfers of data to the host system, the memory will drive IO3 high during tCS. This will ensure that IO3 /
RESET# is not left floating or being pulled slowly to high by the internal or an external passive pull-up. Thus, an unintended reset is
not triggered by the IO3 / RESET# not being recognized as high before the end of tRP.
The IO3 / RESET# input reset feature is disabled when (CR2V[7]=0).
The IO3 / RESET# input has an internal pull-up resistor and may be left unconnected in the host system if not used for Quad mode
or the reset function. The internal pull-up will hold IO3 / RESET# high after the host system has actively driven the signal high and
then stops driving the signal.
Note that IO3 / RESET# input cannot be shared by more than one SPI-MIO memory if any of them are operating in Quad I/O mode
as IO3 being driven to or from one selected memory may look like a reset signal to a second non-selected memory sharing the same
IO3 / RESET# signal.
3.9 RESET#
The RESET# input provides a hardware method of resetting the device to standby state, ready for receiving a command. When
RESET# is driven to logic low (VIL) for at least a period of tRP, the device starts the hardware reset process.
RESET# causes the same initialization process as is performed when power comes up and requires tPU time.
RESET# may be asserted low at any time. To ensure data integrity any operation that was interrupted by a hardware reset should
be reinitiated once the device is ready to accept a command sequence.
RESET# has an internal pull-up resistor and may be left unconnected in the host system if not used. The internal pull-up will hold
Reset high after the host system has actively driven the signal high and then stops driving the signal.
The RESET# input is not available on all packages options. When not available the RESET# input of the device is tied to the inactive
state.
3.10 Voltage Supply (VCC)
VCC is the voltage source for all device internal logic. It is the single voltage used for all device internal functions including read,
program, and erase.
3.11 Supply and Signal Ground (VSS)
VSS is the common voltage drain and ground reference for the device core, input signal receivers, and output drivers.
3.12 Not Connected (NC)
No device internal signal is connected to the package connector nor is there any future plan to use the connector for a signal. The
connection may safely be used for routing space for a signal on a Printed Circuit Board (PCB).
Document Number: 002-00124 Rev. *G Page 10 of 160
S25FL256L/S25FL128L
3.13 Reserved for Future Use (RFU)
No device internal signal is currently connected to the package connector but there is potential future use of the connector. It is
recommended to not use RFU connectors for PCB routing channels so that the PCB may take advantage of future enhanced
features in compatible footprint devices.
3.14 Do Not Use (DNU)
A device internal signal may be connected to the package connector. The connection may be used by Cypress for test or other
purposes and is not intended for connection to any host system signal. Any DNU signal related function will be inactive when the
signal is at VIL. The signal has an internal pull-down resistor and may be left unconnected in the host system or may be tied to VSS.
Do not use these connections for PCB signal routing channels. Do not connect any host system signal to these connections.
Document Number: 002-00124 Rev. *G Page 11 of 160
S25FL256L/S25FL128L
4. Block Diagram
Figure 6. Logic Block Diagram
4.1 System Block Diagrams
Figure 7. Bus Master and Memory Devices on the SPI Bus — Single Bit Data Path
Figure 8. Bus Master and Memory Devices on the SPI Bus — Dual Bit Data Path
Memory Array
Control
Logic
Data Path
X Decoders
CS#
SCK
SI/IO0
SO/IO1
RESET#/IO3
WP#/IO2
RESET#
I/O Y Decoders
Data Latch
RESET#
WP#
SI
SCK
CS#
CS#
WP#
SI
SCK
CS2#
CS1#
SPI
Bus Master
SO
SPI Flash SPI Flash
RESET#
SO
RESET#
WP#
IO1
SCK
CS#
CS#
WP#
IO1
SCK
CS2#
CS1#
SPI
Bus Master
IO0
SPI Flash SPI Flash
RESET#
IO0
Document Number: 002-00124 Rev. *G Page 12 of 160
S25FL256L/S25FL128L
Figure 9. Bus Master and Memory Devices on the SPI Bus — Quad Bit Data Path — Separate RESET#
Figure 10. Bus Master and Memory Devices on the SPI Bus — Quad Bit Data Path — I/O3 / RESET#
RESET#
IO3
IO2
IO1
SCK
CS#
CS#
IO3
IO2
IO1
SCK
CS2#
CS1#
SPI
Bus Master
IO0
SPI Flash SPI Flash
RESET#
IO0
IO3 / RESET#
IO2
IO1
SCK
CS#
IO3 / RESET#
IO2
IO1
SCK
CS#
SPI
Bus Master
IO0
SPI Flash
IO0
Document Number: 002-00124 Rev. *G Page 13 of 160
S25FL256L/S25FL128L
5. Signal Protocols
5.1 SPI Clock Modes
5.1.1 Single Data Rate (SDR)
The FL-L family can be driven by an embedded micro-controller (bus master) in either of the two following clocking modes.
Mode 0 with Clock Polarity (CPOL) = 0 and, Clock Phase (CPHA) = 0
Mode 3 with CPOL = 1 and, CPHA = 1
For these two modes, input data into the device is always latched in on the rising edge of the SCK signal and the output data is
always available from the falling edge of the SCK clock signal.
The difference between the two modes is the clock polarity when the bus master is in standby mode and not transferring any data.
SCK will stay at logic low state with CPOL = 0, CPHA = 0
SCK will stay at logic high state with CPOL = 1, CPHA = 1
Figure 11. SPI SDR Modes Supported
Timing diagrams throughout the remainder of the document are generally shown as both mode 0 and 3 by showing SCK as both
high and low at the fall of CS#. In some cases a timing diagram may show only mode 0 with SCK low at the fall of CS#. In such a
case, mode 3 timing simply means clock is high at the fall of CS# so no SCK rising edge set up or hold time to the falling edge of
CS# is needed for mode 3.
SCK cycles are measured (counted) from one falling edge of SCK to the next falling edge of SCK. In mode 0 the beginning of the
first SCK cycle in a command is measured from the falling edge of CS# to the first falling edge of SCK because SCK is already low
at the beginning of a command.
5.1.2 Double Data Rate (DDR)
Mode 0 and Mode 3 are also supported for DDR commands. In DDR commands, the instruction bits are always latched on the rising
edge of clock, the same as in SDR commands. However, the address and input data that follow the instruction are latched on both
the rising and falling edges of SCK. The first address bit is latched on the first rising edge of SCK following the falling edge at the end
of the last instruction bit. The first bit of output data is driven on the falling edge at the end of the last access latency (dummy) cycle.
SCK cycles are measured (counted) in the same way as in SDR commands, from one falling edge of SCK to the next falling edge of
SCK. In mode 0 the beginning of the first SCK cycle in a command is measured from the falling edge of CS# to the first falling edge
of SCK because SCK is already low at the beginning of a command.
Figure 12. SPI DDR Modes Supported
CPOL=0_CPHA=0_SCLK
CPOL=1_CPHA=1_SCLK
CS#
SI_IO0
SO_IO1
MSB
MSB
CPOL=0_CPHA=0_SCLK
CPOL=1_CPHA=1_SCLK
CS#
Transfer_Phase
IO0
IO1
IO2
IO3
Inst. 7 Inst. 0 A28 A24 A0 M4 M0
DL
P
.
DL
P
.D0 D1
A29 A25 A1 M5 M1
DL
P
.
DL
P
.D0 D1
A30 A26 A2 M6 M2
DL
P
.
DL
P
.D0 D1
A31 A27 A3 M7 M3
DL
P
.
DL
P
.D0 D1
Dummy / DLPAddress ModeInstruction
Document Number: 002-00124 Rev. *G Page 14 of 160
S25FL256L/S25FL128L
5.2 Command Protocol
All communication between the host system and FL-L family memory devices is in the form of units called commands. See
Section 8. Commands on page 58 for definition and details for all commands.
All commands begin with an 8-bit instruction that selects the type of information transfer or device operation to be performed.
Commands may also have an address, instruction modifier, latency period, data transfer to the memory, or data transfer from the
memory. All instruction, address, and data information is transferred sequentially between the host system and memory device.
Command protocols are also classified by a numerical nomenclature using three numbers to reference the transfer width of three
command phases:
instruction;
address and instruction modifier (continuous read mode bits);
data.
Single bit wide commands start with an instruction and may provide an address or data, all sent only on the SI signal. Data may be
sent back to the host serially on the SO signal. This is referenced as a 1-1-1 command protocol for single bit width instruction, single
bit width address and modifier, single bit data.
Dual-O or Quad-O commands provide an address sent from the host as serial on SI (IO0) then followed by dummy cycles. Data is
returned to the host as bit pairs on IO0 and IO1 or, four bit (nibble) groups on IO0, IO1, IO2, and IO3. This is referenced as 1-1-2 for
Dual-O and 1-1-4 for Quad-O command protocols.
Dual or Quad Input / Output (I/O) commands provide an address sent from the host as bit pairs on IO0 and IO1 or, four bit (nibble)
groups on IO0, IO1, IO2, and IO3 then followed by dummy cycles. Data is returned to the host similarly as bit pairs on IO0 and IO1
or, four bit (nibble) groups on IO0, IO1, IO2, and IO3. This is referenced as 1-2-2 for Dual I/O and 1-4-4 for Quad I/O command
protocols.
The FL-L family also supports a QPI mode in which all information is transferred in 4-bit width, including the instruction, address,
modifier, and data. This is referenced as a 4-4-4 command protocol.
Commands are structured as follows:
Each command begins with CS# going low and ends with CS# returning high. The memory device is selected by the host driving
the Chip Select (CS#) signal low throughout a command.
The serial clock (SCK) marks the transfer of each bit or group of bits between the host and memory.
Each command begins with an eight bit (byte) instruction. The instruction selects the type of information transfer or device operation
to be performed. The instruction transfers occur on SCK rising edges. However, some read commands are modified by a prior read
command, such that the instruction is implied from the earlier command. This is called Continuous Read Mode. When the device
is in continuous read mode, the instruction bits are not transmitted at the beginning of the command because the instruction is the
same as the read command that initiated the Continuous Read Mode. In Continuous Read mode the command will begin with the
read address. Thus, Continuous Read Mode removes eight instruction bits from each read command in a series of same type read
commands.
The instruction may be stand alone or may be followed by address bits to select a location within one of several address spaces in
the device. The instruction determines the address space used. The address may be either a 24-bit or a 32-bit, byte boundary,
address. The address transfers occur on SCK rising edge, in SDR commands, or on every SCK edge, in DDR commands.
In legacy SPI mode, the width of all transfers following the instruction are determined by the instruction sent. Following transfers
may continue to be single bit serial on only the SI or Serial Output (SO) signals, they may be done in two bit groups per (dual)
transfer on the IO0 and IO1 signals, or they may be done in 4-bit groups per (quad) transfer on the IO0-IO3 signals. Within the dual
or quad groups the LSb is on IO0. More significant bits are placed in significance order on each higher numbered IO signal. Single
bits or parallel bit groups are transferred in most to LSb order.
In QPI mode, the width of all transfers is a 4-bit wide (quad) transfer on the IO0-IO3 signals.
Dual and Quad I/O read instructions send an instruction modifier called Continuous Read mode bits, following the address, to indicate
whether the next command will be of the same type with an implied, rather than an explicit, instruction. These mode bits initiate or
end the continuous read mode. In continuous read mode, the next command thus does not provide an instruction byte, only a new
address and mode bits. This reduces the time needed to send each command when the same command type is repeated in a
sequence of commands. The mode bit transfers occur on SCK rising edge, in SDR commands, or on every SCK edge, in DDR
commands.
Document Number: 002-00124 Rev. *G Page 15 of 160
S25FL256L/S25FL128L
The address or mode bits may be followed by write data to be stored in the memory device or by a read latency period before read
data is returned to the host.
Write data bit transfers occur on SCK rising edge, in SDR commands, or on every SCK edge, in DDR commands.
SCK continues to toggle during any read access latency period. The latency may be zero to several SCK cycles (also referred to
as dummy cycles). At the end of the read latency cycles, the first read data bits are driven from the outputs on SCK falling edge at
the end of the last read latency cycle. The first read data bits are considered transferred to the host on the following SCK rising
edge. Each following transfer occurs on the next SCK rising edge, in SDR commands, or on every SCK edge, in DDR commands.
If the command returns read data to the host, the device continues sending data transfers until the host takes the CS# signal high.
The CS# signal can be driven high after any transfer in the read data sequence. This will terminate the command.
At the end of a command that does not return data, the host drives the CS# input high. The CS# signal must go high after the eighth
bit, of a stand alone instruction or, of the last write data byte that is transferred. That is, the CS# signal must be driven high when
the number of bits after the CS# signal was driven low is an exact multiple of eight bits. If the CS# signal does not go high exactly
at the eight bit boundary of the instruction or write data, the command is rejected and not executed.
All instruction, address, and mode bits are shifted into the device with the MSb first. The data bits are shifted in and out of the device
MSb first. All data is transferred in byte units with the lowest address byte sent first. Following bytes of data are sent in lowest to
highest byte address order i.e. the byte address increments.
All attempts to read the flash memory array during a program, erase, or a write cycle (embedded operations) are ignored. The
embedded operation will continue to execute without any affect. A very limited set of commands are accepted during an embedded
operation. These are discussed in the individual command descriptions.
Depending on the command, the time for execution varies. A command to read status information from an executing command is
available to determine when the command completes execution and whether the command was successful.
5.2.1 Command Sequence Examples
Figure 13. Stand Alone Instruction Command
Figure 14. Single Bit Wide Input Command
Figure 15. Single Bit Wide Output Command without Latency
CS#
SCK
SI_IO0
SO_IO1-IO3
Phase
76543210
Instruction
CS#
SCLK
SO_IO1-IO3
SO
Phase
7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
Instruction Input Data
CS#
SCLK
SI
SO
Phase
76543210
7654321076543210
Instruction Data 1 Data 2
Document Number: 002-00124 Rev. *G Page 16 of 160
S25FL256L/S25FL128L
Figure 16. Single Bit Wide I/O Command with Latency
Figure 17. Dual Output Read Command
Figure 18. Quad Output Read Command
Figure 19. Dual I/O Command
Figure 20. Quad I/O Command
Note
8. The gray bits are optional, the host does not have to drive bits during that cycle.
CS#
SCLK
SI
SO
Phase
7 6 5 4 3 2 1 0 31 1 0
7 6 5 4 3 2 1 0
Instruction Address Dummy Cycles Data 1
CS#
SCK
IO0
IO1
Phase
7 6 5 4 3 2 1 0 31 1 0 6 4 2 0 6 4 2 0
7 5 3 1 7 5 3 1
Instruction Address Dummy Cycles Data 1 Data 2
CS#
SCK
IO0
IO1
IO2
IO3
Phase
7 6 5 4 3 2 1 0 31 1 0 4 0 4 0 4 0 4 0 4 0 4
5 1 5 1 5 1 5 1 5 1 5
6 2 6 2 6 2 6 2 6 2 6
7 3 7 3 7 3 7 3 7 3 7
Instruction Address Dummy D1 D2 D3 D4 D5
CS#
SCK
IO0
IO1
Phase
7 6 5 4 3 2 1 0 30 2 0 6 4 2 0 6 4 2 0 6 4 2 0
31 3 1 7 5 3 1 7 5 3 1 7 5 3 1
Instruction Address Mode Dum Data 1 Data 2
CS#
SCLK
IO0
IO1
IO2
IO3
Phase
7 6 5 4 3 2 1 0 28 4 0 4 0 4 0 4 0 4 0 4 0
29 5 1 5 1 5 1 5 1 5 1 5 1
30 6 2 6 2 6 2 6 2 6 2 6 2
31 7 3 7 3 7 3 7 3 7 3 7 3
Instruction Address Mode Dummy D1 D2 D3 D4
Document Number: 002-00124 Rev. *G Page 17 of 160
S25FL256L/S25FL128L
Figure 21. Quad I/O Read Command in QPI Mode
Note
9. The gray bits are optional, the host does not have to drive bits during that cycle.
Figure 22. DDR Quad I/O Read Command
Figure 23. DDR Quad I/O Read Command QPI Mode
Additional sequence diagrams, specific to each command, are provided in Section 8. Commands on page 58.
CS#
SCLK
IO0
IO1
IO2
IO3
Phase
4 0 28 4 0 4 0 4 0 4 0 4 0 4 0
5 1 29 5 1 5 1 5 1 5 1 5 1 5 1
6 2 30 6 2 6 2 6 2 6 2 6 2 6 2
7 3 31 7 3 7 3 7 3 7 3 7 3 7 3
Instruct. Address Mode Dummy D1 D2 D3 D4
CS#
SCK
IO0
IO1
IO2
IO3
Phase
7 6 5 4 3 2 1 0 A-3 8 4 0 4 0 7 6 5 4 3 2 1 0 4 0 4 0
A-2 9 5 1 5 1 7 6 5 4 3 2 1 0 5 1 5 1
A-1 2 6 2 6 2 7 6 5 4 3 2 1 0 6 2 6 2
A 3 7 3 7 3 7 6 5 4 3 2 1 0 7 3 7 3
Instruction Address Mode Dummy DLP D1 D2
CS#
SCLK
IO0
IO1
IO2
IO3
Phase
4 0 A-3 8 4 0 4 0 7 6 5 4 3 2 1 0 4 0 4 0
5 1 A-2 9 5 1 5 1 7 6 5 4 3 2 1 0 5 1 5 1
6 2 A-1 2 6 2 6 2 7 6 5 4 3 2 1 0 6 2 6 2
7 3 A 3 7 3 7 3 7 6 5 4 3 2 1 0 7 3 7 3
Instruct. Address Mode Dummy DLP D1 D2
Document Number: 002-00124 Rev. *G Page 18 of 160
S25FL256L/S25FL128L
5.3 Interface States
This section describes the input and output signal levels as related to the SPI interface behavior.
Legend
Z = no driver - floating signal
HL = Host driving VIL
–HH = Host driving V
IH
HV = either HL or HH
X = HL or HH or Z
HT = toggling between HL and HH
ML = Memory driving VIL
MH = Memory driving VIH
MV = either ML or MH
Table 3. Interface States Summary
Interface State VCC SCK CS# RESET# IO3 /
RESET#
WP# /
IO2
SO /
IO1 SI / IO0
Power-Off <VCC (low) X X X X X Z X
Low Power
Hardware Data Protection <VCC (cut-off) X X X X X Z X
Power-On (Cold) Reset ≥VCC (min) X HH X X X Z X
Hardware (Warm) Reset
Non-Quad Mode ≥VCC (min) X X HL HL X Z X
Hardware (Warm) Reset Quad
Mode ≥VCC (min) X HH HL HL X Z X
Interface Standby ≥VCC (min) X HH HH HH X Z X
Instruction Cycle
(Legacy SPI) ≥VCC (min) HT HL HH HH HV Z HV
Single Input Cycle
Host to Memory Transfer ≥VCC (min) HT HL HH HH X Z HV
Single Latency (Dummy) Cycle ≥VCC (min) HT HL HH HH X Z X
Single Output Cycle
Memory to Host Transfer ≥VCC (min) HT HL HH HH X MV X
Dual Input Cycle
Host to Memory Transfer ≥VCC (min) HT HL HH HH X HV HV
Dual Latency (Dummy) Cycle ≥VCC (min) HT HL HH HH X X X
Dual Output Cycle
Memory to Host Transfer ≥VCC (min) HT HL HH HH X MV MV
Quad Input Cycle
Host to Memory Transfer ≥VCC (min) HT HL HH HV HV HV HV
Quad Latency (Dummy) Cycle ≥VCC (min) HT HL HH X X X X
Quad Output Cycle
Memory to Host Transfer ≥VCC (min) HT HL HH MV MV MV MV
DDR Quad Input Cycle
Host to Memory Transfer ≥VCC (min) HT HL HH HV HV HV HV
DDR Latency (Dummy) Cycle ≥VCC (min) HT HL HH X X X X
DDR Quad Output Cycle
Memory to Host Transfer ≥VCC (min) HT HL HH MV MV MV MV
Document Number: 002-00124 Rev. *G Page 19 of 160
S25FL256L/S25FL128L
5.3.1 Power-Off
When the core supply voltage is at or below the VCC (Low) voltage, the device is considered to be powered off. The device does not
react to external signals, and is prevented from performing any program or erase operation.
5.3.2 Low Power Hardware Data Protection
When VCC is less than VCC (Cut-off) the memory device will ignore commands to ensure that program and erase operations can not
start when the core supply voltage is out of the operating range. When the core voltage supply remains at or below the VCC (Low)
voltage for tPD time, then rises to VCC (Minimum) the device will begin its Power On Reset (POR) process. POR continues until the
end of tPU. During tPU the device does not react to external input signals nor drive any outputs. Following the end of tPU the device
transitions to the Interface Standby state and can accept commands. For additional information on POR see Section 12.3.1 Power-
On (Cold) Reset on page 138.
5.3.3 Hardware (Warm) Reset
A configuration option is provided to allow IO3 / RESET# to be used as a hardware reset input when the device is not in any Quad or
QPI mode or when it is in any Quad mode or QPI mode and CS# is high. In Quad or QPI mode on some packages a separate reset
input is provided (RESET #). When IO3 / RESET# or RESET# is driven low for tRP time the device starts the hardware reset
process. The process continues for tRPH time. Following the end of both tRPH and the reset hold time following the rise of RESET#
(tRH) the device transitions to the Interface Standby state and can accept commands. For additional information on hardware reset
see Section 12.3 Reset on page 138.
5.3.4 Interface Standby
When CS# is high the SPI interface is in standby state. Inputs other than RESET# are ignored. The interface waits for the beginning
of a new command. The next interface state is Instruction Cycle when CS# goes low to begin a new command.
While in interface standby state the memory device draws standby current (ISB) if no embedded algorithm is in progress. If an
embedded algorithm is in progress, the related current is drawn until the end of the algorithm when the entire device returns to
standby current draw.
5.3.5 Instruction Cycle (Legacy SPI Mode)
When the host drives the MSb of an instruction and CS# goes low, on the next rising edge of SCK the device captures the MSb of
the instruction that begins the new command. On each following rising edge of SCK the device captures the next lower significance
bit of the 8-bit instruction. The host keeps CS# low, and drives the Write Protect (WP#) and IO3 / RESET# signals as needed for the
instruction. However, WP# is only relevant during instruction cycles of a WRR or WRAR command or any other commands which
affect Status registers, Configuration registers and DLR registers, and is other wise ignored. IO3 / RESET# is driven high when the
device is not in Quad Mode (CR1V[1]=0) or QPI Mode (CR2V[3]=0) and hardware reset is not required.
Each instruction selects the address space that is operated on and the transfer format used during the remainder of the command.
The transfer format may be Single, Dual O, Quad O, Dual I/O, or Quad I/O, or DDR Quad I/O. The expected next interface state
depends on the instruction received.
Some commands are stand alone, needing no address or data transfer to or from the memory. The host returns CS# high after the
rising edge of SCK for the eighth bit of the instruction in such commands. The next interface state in this case is Interface Standby.
5.3.6 Instruction Cycle (QPI Mode)
In QPI mode, when CR2V[3]=1, instructions are transferred 4 bits per cycle. In this mode instruction cycles are the same as a Quad
Input Cycle. See Section 5.3.13 QPP or QOR Address Input Cycle on page 20.
5.3.7 Single Input Cycle — Host to Memory Transfer
Several commands transfer information after the instruction on the single serial input (SI) signal from host to the memory device. The
host keeps RESET# high, CS# low, and drives SI as needed for the command. The memory does not drive the Serial Output (SO)
signal.
The expected next interface state depends on the instruction. Some instructions continue sending address or data to the memory
using additional Single Input Cycles. Others may transition to Single Latency, or directly to Single, Dual, or Quad Output cycle
states.
Document Number: 002-00124 Rev. *G Page 20 of 160
S25FL256L/S25FL128L
5.3.8 Single Latency (Dummy) Cycle
Read commands may have zero to several latency cycles during which read data is read from the main Flash memory array before
transfer to the host. The number of latency cycles are determined by the Latency Code in the configuration register (CR3V[3:0]).
During the latency cycles, the host keeps RESET# and IO3 / RESET# high, CS# low and SCK toggles. The Write Protect (WP#)
signal is ignored. The host may drive the SI signal during these cycles or the host may leave SI floating. The memory does not use
any data driven on SO or other I/O signals during the latency cycles. The memory does not drive the Serial Output (SO) or I/O
signals during the latency cycles.
The next interface state depends on the command structure i.e. the number of latency cycles, and whether the read is single, dual,
or quad width.
5.3.9 Single Output Cycle — Memory to Host Transfer
Several commands transfer information back to the host on the single Serial Output (SO) signal. The host keeps RESET# and IO3 /
RESET# high, CS# low. The Write Protect (WP#) signal is ignored. The memory ignores the Serial Input (SI) signal. The memory
drives SO with data.
The next interface state continues to be Single Output Cycle until the host returns CS# to high ending the command.
5.3.10 Dual Input Cycle — Host to Memory Transfer
The Read Dual I/O command transfers two address or mode bits to the memory in each cycle. The host keeps RESET# and IO3 /
RESET# high, CS# low. The Write Protect (WP#) signal is ignored. The host drives address on SI / IO0 and SO / IO1.
The next interface state following the delivery of address and mode bits is a Dual Latency Cycle if there are latency cycles needed or
Dual Output Cycle if no latency is required.
5.3.11 Dual Latency (Dummy) Cycle
Read commands may have zero to several latency cycles during which read data is read from the main Flash memory array before
transfer to the host. The number of latency cycles are determined by the Latency Code in the configuration register (CR3V[3:0]).
During the latency cycles, the host keeps RESET# and IO3 / RESET# high, CS# low, and SCK continues to toggle. The Write
Protect (WP#) signal is ignored. The host may drive the SI / IO0 and SO / IO1 signals during these cycles or the host may leave SI /
IO0 and SO / IO1 floating. The memory does not use any data driven on SI / IO0 and SO / IO1 during the latency cycles. The host
must stop driving SI / IO0 and SO / IO1 on the falling edge of SCK at the end of the last latency cycle. It is recommended that the
host stop driving them during all latency cycles so that there is sufficient time for the host drivers to turn off before the memory
begins to drive at the end of the latency cycles. This prevents driver conflict between host and memory when the signal direction
changes. The memory does not drive the SI / IO0 and SO / IO1 signals during the latency cycles.
The next interface state following the last latency cycle is a Dual Output Cycle.
5.3.12 Dual Output Cycle — Memory to Host Transfer
The Read Dual Output and Read Dual I/O return data to the host two bits in each cycle. The host keeps RESET# and IO3 / RESET#
high, CS# low. The Write Protect (WP#) signal is ignored. The memory drives data on the SI / IO0 and SO / IO1 signals during the
dual output cycles on the falling edge of SCK.
The next interface state continues to be Dual Output Cycle until the host returns CS# to high ending the command.
5.3.13 QPP or QOR Address Input Cycle
The Quad Page Program and Quad Output Read commands send address to the memory only on IO0. The other IO signals are
ignored. The host keeps RESET# and IO3 / RESET# high, CS# low, and drives IO0.
For QPP the next interface state following the delivery of address is the Quad Input Cycle. For QOR the next interface state following
address is a Quad Latency Cycle if there are latency cycles needed or Quad Output Cycle if no latency is required.
Document Number: 002-00124 Rev. *G Page 21 of 160
S25FL256L/S25FL128L
5.3.14 Quad Input Cycle — Host to Memory Transfer
The Quad I/O Read command transfers four address or mode bits to the memory in each cycle. In QPI mode, the Quad I/O Read
and Page Program commands transfer four data bits to the memory in each cycle, including the instruction cycles. The host keeps
CS# low, and drives the IO signals.
For Quad I/O Read the next interface state following the delivery of address and mode bits is a Quad Latency Cycle if there are
latency cycles needed or Quad Output Cycle if no latency is required. For QPI mode Page Program, the host returns CS# high
following the delivery of data to be programmed and the interface returns to standby state.
5.3.15 Quad Latency (Dummy) Cycle
Read commands may have zero to several latency cycles during which read data is read from the main Flash memory array before
transfer to the host. The number of latency cycles are determined by the Latency Code in the configuration register (CR3V[3:0]).
During the latency cycles, the host keeps CS# low and continues to toggle SCK. The host may drive the IO signals during these
cycles or the host may leave the IO floating. The memory does not use any data driven on IO during the latency cycles. The host
must stop driving the IO signals on the falling edge at the end of the last latency cycle. It is recommended that the host stop driving
them during all latency cycles so that there is sufficient time for the host drivers to turn off before the memory begins to drive at the
end of the latency cycles. This prevents driver conflict between host and memory when the signal direction changes. The memory
does not drive the IO signals during the latency cycles.
The next interface state following the last latency cycle is a Quad Output Cycle.
5.3.16 Quad Output Cycle — Memory to Host Transfer
The Quad-O and Quad I/O Read returns data to the host four bits in each cycle. The host keeps CS# low. The memory drives data
on IO0-IO3 signals during the Quad output cycles.
The next interface state continues to be Quad Output Cycle until the host returns CS# to high ending the command.
5.3.17 DDR Quad Input Cycle — Host to Memory Transfer
The DDR Quad I/O Read command sends address, and mode bits to the memory on all the IO signals. Four bits are transferred on
the rising edge of SCK and four bits on the falling edge in each cycle. The host keeps CS# low.
The next interface state following the delivery of address and mode bits is a DDR Latency Cycle.
5.3.18 DDR Latency Cycle
DDR Read commands may have one to several latency cycles during which read data is read from the main Flash memory array
before transfer to the host. The number of latency cycles are determined by the Latency Code in the configuration register
(CR3V[3:0]). During the latency cycles, the host keeps CS# low. The host may not drive the IO signals during these cycles. So that
there is sufficient time for the host drivers to turn off before the memory begins to drive. This prevents driver conflict between host
and memory when the signal direction changes. The memory has an option to drive all the IO signals with a Data Learning Pattern
(DLP) during the last 4 latency cycles. The DLP option should not be enabled when there are fewer than five latency cycles so that
there is at least one cycle of high impedance for turn around of the IO signals before the memory begins driving the DLP. When
there are more than 4 cycles of latency the memory does not drive the IO signals until the last four cycles of latency.
The next interface state following the last latency cycle is a DDR Quad Output Cycle, depending on the instruction.
5.3.19 DDR Quad Output Cycle — Memory to Host Transfer
The DDR Quad I/O Read command returns bits to the host on all the IO signals. Four bits are transferred on the rising edge of SCK
and four bits on the falling edge in each cycle. The host keeps CS# low.
The next interface state continues to be DDR Quad Output Cycle until the host returns CS# to high ending the command.
Document Number: 002-00124 Rev. *G Page 22 of 160
S25FL256L/S25FL128L
5.4 Data Protection
Some basic protection against unintended changes to stored data are provided and controlled purely by the hardware design. These
are described below. Other software managed protection methods are discussed in the software section of this document.
5.4.1 Power-Up
The device must not be selected at power-up (that is, CS# must follow the voltage applied on VCC) until VCC reaches the correct
value as follows:
VCC (min) at power-up, and then for a further delay of tPU
User is not allowed to enter any command until a valid delay of tPU has elapsed after the moment that VCC rises above the minimum
VCC threshold. See Figure 131. However, correct operation of the device is not guaranteed if VCC returns below VCC (min) during
tPU. No command should be sent to the device until the end of tPU.
5.4.2 Low Power
When VCC is less than VCC (Cut-off) the memory device will ignore commands to ensure that program and erase operations can not
start when the core supply voltage is out of the operating range.
5.4.3 Clock Pulse Count
The device verifies that all non-volatile memory and register data modifying commands consist of a clock pulse count that is a
multiple of eight bit transfers (byte boundary) before executing them. A command not ending on an 8-bit (byte) boundary is ignored
and no error status is set for the command.
5.4.4 Deep Power Down (DPD)
In DPD mode the device responds only to the Resume from DPD command (RES ABh). All other commands are ignored during
DPD mode, thereby protecting the memory from program and erase operations. If the IO3 / RESET# function has been enabled
(CR2V[7]=1) or if RESET# is active, IO3 / RESET# or RESET# going low will start a hardware reset and release the device from
DPD mode.
Document Number: 002-00124 Rev. *G Page 23 of 160
S25FL256L/S25FL128L
6. Address Space Maps
6.1 Overview
6.1.1 Extended Address
The FL-L family supports 32-bit (4 Byte) addresses to enable higher density devices than allowed by previous generation (legacy)
SPI devices that supported only 24-bit (3 Byte) addresses. A 24-bit, byte resolution, address can access only 16 MB (128 Mb)
maximum density. A 32-bit, byte resolution, address allows direct addressing of up to a 4 GB (32 Gb) address space.
Legacy commands continue to support 24-bit addresses for backward software compatibility. Extended 32-bit addresses are
enabled in two ways:
Extended address mode a volatile configuration register bit that changes all legacy commands to expect 32 bits of address
supplied from the host system.
4 Byte address commands — that perform both legacy and new functions, which always expect 32-bit address.
The default condition for extended address mode, after power-up or reset, is controlled by a non-volatile configuration bit. The
default extended address mode may be set for 24- or 32-bit addresses. This enables legacy software compatible access to the first
128 Mb of a device or for the device to start directly in 32-bit address mode.
6.1.2 Multiple Address Spaces
Many commands operate on the main Flash memory array. Some commands operate on address spaces separate from the main
Flash array. Each separate address space uses the full 24- or 32-bit address but may only define a small portion of the available
address space.
6.2 Flash Memory Array
The main Flash array is divided into uniform erase units called physical Blocks (64 KB), Half Blocks (32 KB) and Sectors (4 KB).
Table 4. S25FL256L Sector Address Map
Table 5. S25FL128L Sector Address Map
Block Size
(KB)
Block
Count
Block
Range
Half Block
Size (KB)
Half Block
Count
Half Block
Range
Sector
Size (KB)
Sector
Count
Sector
Range
Address Range
(Byte Address) Notes
64 1 BA00
32 1 HBA00 4 1 SA00 0000000h-0000FFFh
Sector Starting
Address
Sector Ending
Address
: : : :
32 2 HBA01 4 16 SA15 000F000h-
000FFFFh
::: : : : ::: :
64 512 BA511
32 1023 HBA1022 4 8176 SA8175 1FF0000h-
1FF0FFFh
::: :
32 1024 HBA1023 4 8192 SA8191 1FFF000h-
1FFFFFFh
Block
Size (KB)
Block
Count
Block
Range
Half
Block
Size (KB)
Half
Block
Count
Half
Block
Range
Sector
Size (KB)
Sector
Count
Sector
Range
Address Range
(Byte Address) Notes
64 1 BA00
32 1 HBA00 4 1 SA00 000000h-000FFFh
Sector Starting
Address
Sector Ending
Address
: : : :
32 2 HBA01 4 16 SA15 00F000h-00FFFFh
::::::::: :
64 256 BA255
32 511 HBA510 4 4080 SA4079 FF0000h-FF0FFFh
::: :
32 512 HBA511 4 4096 SA4095 FFF000h-FFFFFFh
Document Number: 002-00124 Rev. *G Page 24 of 160
S25FL256L/S25FL128L
6.3 ID Address Space
The RDID command (9Fh) reads information from a separate Flash memory address space for device identification (ID). See
Section 10.2 Device ID Address Map on page 129 for the tables defining the contents of the ID address space. The ID address
space is programmed by Cypress and read-only for the host system.
6.3.1 Device Unique ID
A 64-bit unique number is located in 8 bytes of the Unique Device ID address space, see Table 52 on page 129. This Unique ID may
be used as a software readable serial number that is unique for each device.
6.4 JEDEC JESD216 Serial Flash Discoverable Parameters (SFDP) Space
The RSFDP command (5Ah) reads information from a separate Flash memory address space for device identification, feature, and
configuration information, in accord with the JEDEC JESD216 standard for Serial Flash Discoverable Parameters. The ID address
space is incorporated as one of the SFDP parameters. See Section 10.1 JEDEC JESD216B Serial Flash Discoverable Parameters
on page 120 for the tables defining the contents of the SFDP address space. The SFDP address space is programmed by Cypress
and read-only for the host system.
6.5 Security Regions Address Space
Each FL-L family memory device has a 1024-byte Security Regions address space that is separate from the main Flash array. The
Security Regions area is divided into 4, individually lockable 256-byte regions. The Security Regions memory space is intended to
hold information that can be temporarily protected or permanently locked from further program or erase.
The regions data bytes are erased to FFh when shipped from Cypress. The regions may be programmed and erased like any other
Flash memory address space when not protected or locked. Each region can be individually erased. The Security Region Lock Bits
(CR1NV[5:2]) are located in the Configuration Register 1. The Security Region Lock Bits are One Time Programmable (OTP) and
after being programmed (set to 1) a Lock Bit permanently protects the related region from further erase or programming.
Regions 2 and 3 also have temporary protection from program or erase by the Protection Register (PR) NVLock bit. The NVLock bit
is volatile and set or cleared by the IRP logic and commands. See Section 6.6.8 Protection Register (PR) on page 40.
The Security Region Password Protection Bit in the IRP Register (IRP[2]) allows Regions 2 and 3 to be protected from Program and
Erase operations until a password is provided. The Security Region Read Protection Bit in the IRP Register (IRP[6]) allows Region 3
to also be protected from Read operations until a password is provided. Attempting to read in a region, that is protected from read,
returns invalid and undefined data. See Section 6.6.6 Individual and Region Protection Register (IRP) on page 38.
Attempting to erase or program in a region that is locked or protected will fail with the P_ERR or E_ERR bit in SR2V[6:5] set to “1”.
(see Section 6.6.2 Status Register 2 Volatile (SR2V) on page 29 for detail descriptions).
Table 6. Security Region Address Map
Region Byte Address Range (Hex) Initial Delivery State (Hex)
Region 0 000 to 0FF All Bytes = FF
Region 1 100 to 1FF All Bytes = FF
Region 2 200 to 2FF All Bytes = FF
Region 3 300 to 3FF All Bytes = FF
Document Number: 002-00124 Rev. *G Page 25 of 160
S25FL256L/S25FL128L
6.6 Registers
Registers are small groups of memory cells used to configure how the FL-L family memory device operates or to report the status of
device operations. The registers are accessed by specific commands. The commands (and hexadecimal instruction codes) used for
each register are noted in each register description.
In legacy SPI memory devices the individual register bits could be a mixture of volatile, non-volatile, or One Time Programmable
(OTP) bits within the same register. In some configuration options the type of a register bit could change e.g. from non-volatile to
volatile.
The FL-L family uses separate non-volatile or volatile memory cell groups (areas) to implement the different register bit types.
However, the legacy registers and commands continue to appear and behave as they always have for legacy software compatibility.
There is a non-volatile and a volatile version of each legacy register when that legacy register has volatile bits or when the command
to read the legacy register has zero read latency. When such a register is read the volatile version of the register is delivered. During
Power-On Reset (POR), hardware reset, or software reset, the non-volatile version of a register is copied to the volatile version to
provide the default state of the volatile register. When non-volatile register bits are written the non-volatile version of the register is
erased and programmed with the new bit values and the volatile version of the register is updated with the new contents of the non-
volatile version. When OTP bits are programmed the non-volatile version of the register is programmed and the appropriate bits are
updated in the volatile version of the register. When volatile register bits are written, only the volatile version of the register has the
appropriate bits updated.
The type for each bit is noted in each register description. The default state shown for each bit refers to the state after power-on
reset, hardware reset, or software reset if the bit is volatile. If the bit is non-volatile or OTP, the default state is the value of the bit
when the device is shipped from Cypress.
6.6.1 Status Register 1
6.6.1.1 Status Register 1 Non-Volatile (SR1NV) S25FL256L
Related Commands: Non-volatile Write Enable (WREN 06h), Write Disable (WRDI 04h), Write Registers (WRR 01h), Read Any
Register (RDAR 65h), Write Any Register (WRAR 71h).
Status Register Protect Non-volatile (SRP0_NV) SR1NV[7]: Provides the default state for SRP0. See Section 7.5 Status Register
Protect (SRP1, SRP0) on page 45.
Top or Bottom Protection (TBPROT_NV) SR1NV[6]: Provides the default state for TBPROT.
Legacy Block Protection (BP_NV3, BP_NV2, BP_NV1, BP_NV0) SR1NV[5:2]: Provides the default state for BP_3 to BP_0 bits.
Write Enable Latch Default (WEL_D) SR1NV[1]: Provides the default state for the WEL Status in SR1V[1]. This bit is programmed
by Cypress and is not user programmable.
Write In Progress Default (WIP_D) SR1NV[0]: Provides the default state for the WIP Status in SR1V[0]. This bit is programmed by
Cypress and is not user programmable.
Table 7. Status Register 1 Non-Volatile (SR1NV)
Bits Field Name Function Type Default State Description
7 SRP0_NV
Status Register
Protect 0
Default
Non-Volatile 0 Provides the default state for SRP0.
6 TBPROT_NV TBPROT
Default Non-Volatile 0 Provides the default state for TBPROT
5 BP_NV3
Legacy Block
Protection
Default
Non-Volatile 0000b Provides the default state for BP bits.
4 BP_NV2
3 BP_NV1
2 BP_NV0
1 WEL_D WEL Default Non-Volatile
Read Only 0 Provides the default state for the WEL Status. Not
user programmable.
0 WIP_D WIP Default Non-Volatile
Read Only 0 Provides the default state for the WIP Status. Not
user programmable.
Document Number: 002-00124 Rev. *G Page 26 of 160
S25FL256L/S25FL128L
6.6.1.2 Status Register 1 Volatile (SR1V) S25FL256L
Related Commands: Read Status Register 1 (RDSR1 05h), Write Enable for Volatile (WRENV 50h), Write Registers (WRR 01h),
Clear Status Register (CLSR 30h), Read Any Register (RDAR 65h), Write Any Register (WRAR 71h). This is the register displayed
by the RDSR1 command
Status Register Protect 0 (SRP0) SR1V[7]: Places the device in the Hardware Protected mode when this bit is set to 1 and the
WP# input is driven low. In this mode, any commands that change status registers or configuration registers are ignored and not
accepted for execution, effectively locking the state of the Status Registers and Configuration Registers SR1NV, SR1V, CR1NV,
CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV bits, by making the registers read-only. If WP# is high, Status Registers and
Configuration Registers SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV may be changed. If SRP0 is 0,
WP# has no effect, the Status Registers and Configuration Registers SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV,
DLRNV and DLRV may be changed. WP# has no effect on the writing of any other registers. SRP0 tracks any changes to the non-
volatile version of this bit (SRP0_NV). When QPI or QIO mode is enabled (CR2V[3] or CR1V[1] = “1”) the internal WP# signal level
is = 1 because the WP# external input is used as IO2 when either mode is active. This effectively turns off hardware protection. The
Register SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV are unlocked and can be written. See
Section 7.5 Status Register Protect (SRP1, SRP0) on page 45.
TBPROT SR1V[6]: This bit defines the reference point of the Legacy Block Protection bits BP3, BP2, BP1, and BP0 in the Status
Register. As described in the status register section, the BP3-0 bits allow the user to optionally protect a portion of the array, ranging
from 1/64, ¼, ½, etc., up to the entire array. When TBPROT is set to a “0” the Legacy Block Protection is defined to start from the top
(maximum address) of the array. When TBPROT is set to a “1” the Legacy Block Protection is defined to start from the bottom (zero
address) of the array. TBPROT tracks any changes to the non-volatile version of this bit (TBPROT_NV).
Legacy Block Protection (BP3, BP2, BP1, BP0) SR1V[5:2]: These bits define the main Flash array area to be protected against
program and erase commands. See Section 7.6.1 Legacy Block Protection on page 46 for a description of how the BP bit values
select the memory array area protected.
Table 8. S25FL256L Status Register 1 Volatile (SR1V)
Bits Field
Name Function Type Default
State Description
7 SRP0 Status Register
Protect 0 Volatile
SR1NV
1 = Locks state of SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V,
CR3NV, DLRNV and DLRV when WP# is low, by not executing any
command that would affect SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV
0 = No register protection, even when WP# is low.
6 TBPROT
Top or Bottom
Relative
Protection
Volatile 1 = BP starts at bottom (Low address)
0 = BP starts at top (High address)
5 BP3
Legacy Block
Protection
Volatile
Volatile Protects the selected range of sectors (Blocks) from Program or
Erase.
4 BP2
3 BP1
2 BP0
1 WEL Write Enable
Latch
Volatile
Read
Only
0 = Not write enabled, no embedded operation can start, 1= Write
Enable, embedded operation can start
This bit is not affected by WRR or WRAR, only WREN, WRENV,
WRDI and CLSR commands affect this bit.
0 WIP Write in
Progress
Volatile
Read
Only
1 = Device Busy, an embedded operation is in progress such as
program or erase
0 = Ready Device is in standby mode and can accept commands
This bit is not affected by WRR or WRAR, it only provides WIP status.
Document Number: 002-00124 Rev. *G Page 27 of 160
S25FL256L/S25FL128L
Write Enable Latch (WEL) SR1V[1]: The WEL bit must be set to 1 to enable program, write, or erase operations as a means to
provide protection against inadvertent changes to memory or register values. The Write Enable (WREN) command execution sets
the Write Enable Latch to a “1” to allow any program, erase, or write commands to execute afterwards. The Write Disable (WRDI)
command can be used to set the Write Enable Latch to a “0 to prevent all program, erase, and write commands from execution. The
WEL bit is cleared to 0 at the end of any successful program, write, or erase operation. Following a failed operation the WEL bit may
remain set and should be cleared with a CLSR command. After a power down / power up sequence, hardware reset, or software
reset, the Write Enable Latch is set to a WEL_D. The WRR or WRAR command does not affect this bit.
Write In Progress (WIP) SR1V[0]: Indicates whether the device is performing a program, write, erase operation, or any other
operation, during which a new operation command will be ignored. When the bit is set to a “1” the device is busy performing an
operation. While WIP is “1”, only Read Status Registers (RDSR1, RDSR2), Read Any Register (RDAR), Erase / Program Suspend
(EPS), Clear Status Register (CLSR), Read Configuration Registers (RDCR1, RDCR2, RDCR3) and Software Reset (RSTEN 66h
followed by RST 99h) commands are accepted. EPS command will only be accepted if memory array erase or program operations
are in progress. The status register E_ERR and P_ERR bits are updated while WIP =1. When P_ERR or E_ERR bits are set to one,
the WIP bit will remain set to one indicating the device remains busy and unable to receive new operation commands. A Clear Status
Register (CLSR) command must be received to return the device to standby mode. When the WIP bit is cleared to 0 no operation is
in progress. This is a read-only bit.
6.6.1.3 Status Register 1 Non-Volatile (SR1NV) S25FL128L
Related Commands: Non-volatile Write Enable (WREN 06h), Write Disable (WRDI 04h), Write Registers (WRR 01h), Read Any
Register (RDAR 65h), Write Any Register (WRAR 71h)
Status Register Protect Non-volatile (SRP0_NV) SR1NV[7]: Provides the default state for SRP0. See Section 7.5 Status Register
Protect (SRP1, SRP0) on page 45.
Sector / Block Protect (SEC_NV) SR1NV[6]: Provides the default state for SEC.
Top or Bottom Protection (TBPROT_NV) SR1NV[5]: Provides the default state for TBPROT.
Legacy Block Protection (BP_NV3, BP_NV2, BP_NV1, BP_NV0) SR1NV[4:2]: Provides the default state for BP_2 to BP_0 bits.
Write Enable Latch Default (WEL_D) SR1NV[1]: Provides the default state for the WEL Status in SR1V[1]. This bit is programmed
by Cypress and is not user programmable.
Write In Progress Default (WIP_D) SR1NV[0]: Provides the default state for the WIP Status in SR1V[0]. This bit is programmed by
Cypress and is not user programmable.
Table 9. S25FL128LStatus Register 1 Non-Volatile (SR1NV)
Bits Field Name Function Type Default State Description
7 SRP0_NV Status Register
Protect 0 Default Non-Volatile 0 Provides the default state for SRP0.
6 SEC_NV Sector / Block
Protect Non-Volatile 0 Provides the defaults state for SEC
5 TBPROT_
NV TBPROT Default Non-Volatile 0 Provides the default state for TBPROT
4 BP_NV2 Legacy Block
Protection
Default
Non-Volatile 000b Provides the default state for BP bits. 3 BP_NV1
2 BP_NV0
1 WEL_D WEL Default Non-Volatile
Read Only 0 Provides the default state for the WEL Status. Not user
programmable.
0 WIP_D WIP Default Non-Volatile
Read Only 0 Provides the default state for the WIP Status. Not user
programmable.
Document Number: 002-00124 Rev. *G Page 28 of 160
S25FL256L/S25FL128L
6.6.1.4 Status Register 1 Volatile (SR1V) S25FL128L
Related Commands: Read Status Register 1(RDSR1 05h), Write Enable for Volatile (WRENV 50h), Write Registers (WRR 01h),
Clear Status Register (CLSR 30h), Read Any Register (RDAR 65h), Write Any Register (WRAR 71h). This is the register displayed
by the RDSR1 command.
Status Register Protect 0 (SRP0) SR1V[7]: Places the device in the Hardware Protected mode when this bit is set to 1 and the
WP# input is driven low. In this mode, any command that change status registers or configuration registers are ignored and not
accepted for execution, effectively locking the state of the Status Registers and Configuration Registers SR1NV, SR1V, CR1NV,
CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV bits, by making the registers read-only. If WP# is high, Status Registers and
Configuration Registers SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV may be changed and
Configuration Registers SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV may be changed. WP# has no
effect on the writing of any other registers. SRP0 tracks any changes to the non-volatile version of this bit (SRP0_NV). When QPI or
QIO mode is enabled (CR2V[3] or CR1V[1] = “1”) the internal WP# signal level is = 1 because the WP# external input is used as IO2
when either mode is active. This effectively turns off hardware protection. The Register SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV are unlocked and can be written. See Section 7.5 Status Register Protect (SRP1, SRP0)
on page 45.
Sector / Block Protect (SEC) SR1V[6]: This bit controls if the Block Protect Bits (BP2, BP1, BP0) protect either 4kB Sectors (SEC
= “1”) or 64kB Blocks (SEC = “0”). See Section 7.6.1 Legacy Block Protection on page 46 for a description of how the SEC bit value
select the memory array area protected.
TBPROT SR1V[5]: This bit defines the reference point of the Legacy Block Protection bits BP2, BP1, and BP0 in the Status
Register. As described in the status register section, the BP2-0 bits allow the user to optionally protect a portion of the array, ranging
from 1/64, ¼, ½, etc., up to the entire array. When TBPROT is set to a “0” the Legacy Block Protection is defined to start from the top
(maximum address) of the array. When TBPROT is set to a “1” the Legacy Block Protection is defined to start from the bottom (zero
address) of the array. TBPROT tracks any changes to the non-volatile version of this bit (TBPROT_NV).
Table 10. S25FL128L Status Register 1 Volatile (SR1V)
Bits Field
Name Function Type Default
State Description
7 SRP0 Status Register
Protect 0 Volatile
SR1NV
1 = Locks state of SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV
when WP# is low, by not executing any commands that would
affect SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV,
DLRNV and DLRV
0 = No register protection, even when WP# is low.
6 SEC Sector / Block
Protect Volatile 0 = BP2-BP0 protect 64kB blocks
1 = BP2-BP0 protect 4kB sectors
5 TBPROT
Top or Bottom
Relative
Protection
Volatile 1 = BP starts at bottom (Low address)
0 = BP starts at top (High address)
4 BP2 Legacy Block
Protection
Volatile
Volatile Protects the selected range of sectors (Blocks) from Program
or Erase.
3 BP1
2 BP0
1 WEL Write Enable
Latch
Volatile
Read Only
0 = Not write enabled, no embedded operation can start, 1=
Write Enable, embedded operation can start
This bit is not affected by WRR or WRAR, only WREN
WRENV, WRDI and CLSR commands affect this bit.
0 WIP Write in
Progress
Volatile
Read Only
1 = Device Busy, an embedded operation is in progress such
as program or erase
0 = Ready Device is in standby mode and can accept
commands
This bit is not affected by WRR or WRAR, it only provides
WIP status.
Document Number: 002-00124 Rev. *G Page 29 of 160
S25FL256L/S25FL128L
Legacy Block Protection (BP2, BP1, BP0) SR1V[4:2]: These bits define the main Flash array area to be protected against
program and erase commands. See Section 7.6.1 Legacy Block Protection on page 46 for a description of how the BP bit values
select the memory array area protected.
Write Enable Latch (WEL) SR1V[1]: The WEL bit must be set to 1 to enable program, write, or erase operations as a means to
provide protection against inadvertent changes to memory or register values. The Write Enable (WREN) command execution sets
the Write Enable Latch to a “1” to allow any program, erase, or write commands to execute afterwards. The Write Disable (WRDI)
command can be used to set the Write Enable Latch to a “0 to prevent all program, erase, and write commands from execution. The
WEL bit is cleared to 0 at the end of any successful program, write, or erase operation. Following a failed operation the WEL bit may
remain set and should be cleared with a CLSR command. After a power down / power up sequence, hardware reset, or software
reset, the Write Enable Latch is set to a WEL_D. The WRR or WRAR command does not affect this bit.
Write In Progress (WIP) SR1V[0]: Indicates whether the device is performing a program, write, erase operation, or any other
operation, during which a new operation command will be ignored. When the bit is set to a “1” the device is busy performing an
operation. While WIP is “1”, only Read Status (RDSR1 or RDSR2), Read Any Register (RDAR), Erase / Program Suspend (EPS),
Clear Status Register (CLSR), and Software Reset (RSTEN 66h followed by RST 99h) commands are accepted. EPS command will
only be accepted if memory array erase or program operations are in progress. The status register E_ERR and P_ERR bits are
updated while WIP =1. When P_ERR or E_ERR bits are set to one, the WIP bit will remain set to one indicating the device remains
busy and unable to receive new operation commands. A Clear Status Register (CLSR) command must be received to return the
device to standby mode. When the WIP bit is cleared to 0 no operation is in progress. This is a read-only bit.
6.6.2 Status Register 2 Volatile (SR2V)
Related Commands: Read Status Register 2 (RDSR2 07h), Read Any Register (RDAR 65h). Status Register 2 does not have user
programmable non-volatile bits, all defined bits are volatile read only status. The default state of these bits are set by hardware.
Erase Error (E_ERR) SR2V[6]: The Erase Error Bit is used as an Erase operation success or failure indication. When the Erase
Error bit is set to a “1” it indicates that there was an error in the last erase operation. This bit will also be set when the user attempts
to erase an individual protected main memory sector or erase a locked Security Region. The Chip Erase command will set E_ERR if
a protected sector is found during the command execution. When the Erase Error bit is set to a “1” this bit can be cleared to zero with
the Clear Status Register (CLSR) command. This is a read-only bit and is not affected by the WRR or WRAR commands.
Program Error (P_ERR) SR2V[5]: The Program Error Bit is used as a program operation success or failure indication. When the
Program Error bit is set to a “1” it indicates that there was an error in the last program operation. This bit will also be set when the
user attempts to program within a protected main memory sector, or program within a locked Security Region. When the Program
Error bit is set to a “1” this bit can be cleared to zero with the Clear Status Register (CLSR) command. This is a read-only bit and is
not affected by the WRR or WRAR commands.
Erase Suspend (ES) SR2V[1]: The Erase Suspend bit is used to determine when the device is in Erase Suspend mode. This is a
status bit that cannot be written by the user. When Erase Suspend bit is set to “1”, the device is in erase suspend mode. When Erase
Suspend bit is cleared to “0”, the device is not in erase suspend mode. Refer to Section 8.6.5 Program or Erase Suspend (PES 75h)
on page 96 for details about the Erase Suspend/Resume commands.
Table 11. Status Register 2 Volatile (SR2V)
Bits Field Name Function Type Default State Description
7 RFU Reserved 0 Reserved for Future Use
6 E_ERR Erase Error
Occurred
Volatile
Read Only 01 = Error occurred
0 = No Error
5 P_ERR Programming
Error Occurred
Volatile
Read Only 01 = Error occurred
0 = No Error
4 RFU Reserved 0 Reserved for Future Use
3 RFU Reserved 0 Reserved for Future Use
2 RFU Reserved 0 Reserved for Future Use
1 ES Erase Suspend Volatile Read Only 0 1 = In erase suspend mode.
0 = Not in erase suspend mode.
0 PS Program
Suspend Volatile Read Only 0 1 = In program suspend mode.
0 = Not in program suspend mode.
Document Number: 002-00124 Rev. *G Page 30 of 160
S25FL256L/S25FL128L
Program Suspend (PS) SR2V[0]: The Program Suspend bit is used to determine when the device is in Program Suspend mode.
This is a status bit that cannot be written by the user. When Program Suspend bit is set to1, the device is in program suspend
mode. When the Program Suspend bit is cleared to “0”, the device is not in program suspend mode. Refer to Section 8.6.5 Program
or Erase Suspend (PES 75h) on page 96 for details.
6.6.3 Configuration Register 1
Configuration Register 1 controls certain interface and data protection functions. The register bits can be changed using the WRR
command with sixteen input cycles or with the WRAR command.
6.6.3.1 Configuration Register 1 Non-Volatile (CR1NV)
Related Commands: Non-volatile Write Enable (WREN 06h), Write Registers (WRR 01h), Read Any Register (RDAR 65h), Write
Any Register (WRAR 71h).
Suspend Erase/Program Status (SUS_D) CR1NV[7]: Provides the default state for the SUS bit in CR1V[7]. This bit is not user
programmable.
Complement Protect (CMP_NV) CR1NV[6]: Provides the default state for the CMP bit in CR1V[6].
Security Region Lock Bits (LB3, LB2, LB1, LB0) CR1NV[5:2]: Provide the OTP write protection control of the Security Regions.
When an LB bit is set to 1 the related Security Region can no longer be programmed or erased.
Quad Data Width Non-volatile (QUAD_NV) CR1NV[1]: Provides the default state for the QUAD bit in CR1V[1]. The WRR or
WRAR command affects this bit. Programming CR1NV[1] =1 will default operation to allow Quad-data-width commands at Power-on
or Reset. Status Register Protect 1 Default (SRP1_D) CR1NV[0]: Provides the default state for the SRP1 bit in CR1V[0]. When
IRP[2:0]= “111” the SRP1_D OTP bit is user programmable. When SRP1_D =”1” Registers SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV are permanently locked. See Section 7.5 Status Register Protect (SRP1, SRP0) on page 45.
Table 12. Configuration Register 1 Non-Volatile (CR1NV)
Bits Field Name Function Type Default State Description
7 SUS_D Suspend Status Default Non-Volatile
Read Only 0 Provides the default state for the Suspend Status.
Not user programmable.
6 CMP_NV Complement Protection
Default Non-Volatile 0 Provides the default state for CMP.
5 LB3
Security Region Lock
Bits OTP
0
OTP lock Bits 3:0 for Security Regions 3:0
0 = Security Region not locked
1 = Security Region permanently locked
4 LB2 0
3 LB1 0
2 LB0 0
1 QUAD_NV Quad Default Non-Volatile 0 Provides the default state for QUAD.
0 SRP1_D Status Register Protect
1 Default OTP 0
When IRP[2:0] = “111” SRP1_D bit is
programmable.
Lock current state of SR1NV, SR1V, CR1NV,
CR1V, CR2NV, CR2V, CR3NV, DLRNV and
DLRV
1 = Registers permanently locked
0 = Registers not protected by SRP1 after POR
Document Number: 002-00124 Rev. *G Page 31 of 160
S25FL256L/S25FL128L
6.6.3.2 Configuration Register 1 Volatile (CR1V)
Related Commands: Read Configuration Register 1 (RDCR1 35h), Write Enable for Volatile (WRENV 50h), Write Registers (WRR
01h), Read Any Register (RDAR 65h), Write Any Register (WRAR 71h). This is the register displayed by the RDCR1 command.
Suspend Status (SUS) CR1V[7]: The Suspend Status bit is used to determine when the device is in Erase or Program suspend
mode. This is a status bit that cannot be written by the user. When Suspend Status bit is set to “1”, the device is in erase or program
suspend mode. When Suspend Status bit is cleared to “0”, the device is not in erase or program suspend mode. Refer to
Section 8.6.5 Program or Erase Suspend (PES 75h) on page 96 for details about the Erase/Program Suspend/Resume commands.
Complement Protection (CMP) CR1V[6]: CMP is used in conjunction with TBPROT, BP3, BP2, BP1 and BP0 bits to provide more
flexibility for the array protection map, to protect from 1/2 to all of the array.
LB[3:0] CR1V[5:2]: These bits are volatile copies of the related OTP bits of CR1NV. These bits track any changes to the related
OTP version of these bits.
Quad Data Width (QUAD) CR1V[1]: When set to 1, this bit switches the data width of the device to 4-bit - Quad mode. That is, WP#
becomes IO2 and IO3 / RESET# becomes an active I/O signal when CS# is low or the RESET# input when CS# is high. The WP#
input is not monitored for its normal function and is internally set to high (inactive). The commands for Serial, and Dual I/O Read still
function normally but, there is no need to drive the WP# input for those commands when switching between commands using
different data path widths. Similarly, there is no requirement to drive the IO3 / RESET# during those commands (while CS# is low).
The QUAD bit must be set to one when using the Quad Output Read, Quad I/O Read, DDR Quad I/O Read. The volatile register
write for QIO mode has a short and well defined time (tQEN) to switch the device interface into QIO mode and (tQEX) to switch the
device back to SPI mode. Following commands can then be immediately sent in QIO protocol. While QPI mode is entered or exited
by the QPIEN and QPIEX commands, or by setting the CR2V[3] bit to 1, the Quad data width mode is in use whether the QUAD bit
is set or not.
Status Register Protect 1(SRP1) CR1V[0]: The SRP1 Bit, when set to 1, protects the current state of the SR1NV, SR1V, CR1NV,
CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV registers by preventing any write of these registers.
See Section 7.5 Status Register Protect (SRP1, SRP0) on page 45.
As long as the SRP1 bit remains cleared to logic 0 the SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV, and DLRV
registers are not protected by SRP1. However, these registers may be protected by SRP0 (SR1V[7]) and the WP# input.
Once the SRP1 bit has been written to a logic 1 it can only be cleared to a logic 0 by a power-off to power-on cycle or a hardware
reset. Software reset will not affect the state of the SRP1 bit.
The CR1V[0] SRP1 bit is volatile and the default state of SRP1 after power-on comes from SRP1_D in CR1NV[0]. The SRP1 bit can
be set in parallel with updating other values in CR1V by a single WRR or WRAR command.
Table 13. Configuration Register 1 Volatile (CR1V)
Bits Field Name Function Type Default
State Description
7 SUS Suspend Status Volatile
Read Only
CR1NV
1 = Erase / Program suspended
0 = Erase / Program not suspended
6 CMP Complement
Protection Volatile 0 = Normal Protection Map
1 = Inverted Protection Map
5 LB3
Volatile copy of
Security Region
Lock Bits
Volatile
Read Only
Not user writable
See CR1NV[5:2]
OTP lock Bits 3:0 for Security Regions 3:0
0 = Security Region not locked
1 = Security Region permanently locked
4 LB2
3 LB1
2 LB0
1 QUAD Quad I/O mode Volatile 1 = Quad
0 = Dual or Serial
0 SRP1 Status register
Protect 1 Volatile
Lock current state of SR1NV, SR1V, CR1NV, CR1V,
CR2NV, CR2V, CR3NV, DLRNV and DLRV
1 = Registers locked
0 = Registers un-locked
Document Number: 002-00124 Rev. *G Page 32 of 160
S25FL256L/S25FL128L
6.6.4 Configuration Register 2
Configuration Register 2 controls certain interface functions. The register bits can be read and changed using the Read Any Register
and Write Any Register commands. The non-volatile version of the register provides the ability to set the POR, hardware reset, or
software reset state of the controls. The volatile version of the register controls the feature behavior during normal operation.
6.6.4.1 Configuration Register 2 Non-Volatile (CR2NV)
Related Commands: Non-volatile Write Enable (WREN 06h), Write Registers (WRR 01h), Read Any Register (RDAR 65h), Write
Any Register (WRAR 71h).
IO3 _Reset Non-volatile CR2NV[7]: This bit controls the POR, hardware reset, or software reset state of the IO3 signal behavior.
Most legacy SPI devices do not have a hardware reset input signal due to the limited signal count and connections available in
traditional SPI device packages. The FL-L family provides the option to use the IO3 signal as a hardware reset input when the IO3
signal is not in use for transferring information between the host system and the memory. This non-volatile IO3_Reset configuration
bit enables the device to start immediately (boot) with IO3 enabled for use as a RESET# signal.
Output Impedance Non-volatile CR2NV[6:5]: These bits control the POR, hardware reset, or software reset state of the IO signal
output impedance (drive strength). Multiple drive strength are available to help match the output impedance with the system printed
circuit board environment to minimize overshoot and ringing. These non-volatile output impedance configuration bits enable the
device to start immediately (boot) with the appropriate drive strength.
Table 15. Output Impedance Control
Table 14. Configuration Register 2 Non-Volatile (CR2NV)
Bits Field Name Function Type Default
State Description
7 IO3R_NV IO3_Reset
Non-volatile
0
1 = Enabled -- IO3_RESET is used as IO3 / RESET# input
when CS# is high or Quad Mode is disabled CR1V[1]=0 or
QPI is disabled (CR3V[3] = 0)
0 = Disabled -- IO3 has no alternate function, hardware reset
is disabled.Provides the default state for the IO3 / RESET#
function enable.
6 OI_NV Output Impedance 1Provides the default output impedance state.
See Table 15 on page 32.
5 1
4 RFU Reserved 0 Reserved for Future Use
3 QPI_NV QPI 0
1 = Enabled -- QPI (4-4-4) protocol in use
0 = Disabled -- Legacy SPI protocols in use, instruction is
always serial on SI
Provides the default state for QPI mode.
2WPS_NV
Write Protect
Selection 0
Provides the default state for WPS
0 = Legacy Protection
1 = Individual Block Lock
1ADP_NV
Address Length at
Power-up 0
Provides the default state for Address Length
1 = 4 byte address
0 = 3 byte address
0 RFU Reserved 0 Reserved for Future Use
CR2NV[6:5]
Impedance Selection Typical Impedance to VSS ()Typical Impedance to VCC ()Notes
00 18 21
01 26 28
10 47 45
11 71 64 Factory Default
Document Number: 002-00124 Rev. *G Page 33 of 160
S25FL256L/S25FL128L
QPI Non-volatile CR2NV[3]: This bit controls the POR, hardware reset, or software reset state of the expected instruction width for
all commands. Legacy SPI commands always send the instruction one bit wide (serial I/O) on the SI (IO0) signal. The FL-L family
also supports the QPI mode in which all transfers between the host system and memory are 4 bits wide on IO0 to IO3, including all
instructions. This non-volatile QPI configuration bit enables the device to start immediately (boot) in QPI mode rather than the legacy
serial instruction mode. The recommended procedure for moving to QPI mode is to first use the QPIEN (38h) command, the WRR or
WRAR command can also set CR2V[3]=1, QPI mode. The volatile register write for QPI mode has a short and well defined time
(tQEN) to switch the device interface into QPI mode and (tQEX) to switch the device back to SPI mode Following commands can then
be immediately sent in QPI protocol. The WRAR command can be used to program CR2NV[3]=1, followed by polling of SR1V[0] to
know when the programming operation is completed. Similarly, to exit QPI mode use the QPIEX (F5h) command. The WRR or
WRAR command can also be used to clear CR2V[3]=0.
Write Protect Selection Non-volatile CR2NV[2]: This bit controls the POR, hardware reset, or software reset state of the Write
Protect Method. This non-volatile configuration bit enables the device to start immediately (boot) with Individual Block Lock
protection rather than Legacy Block protection.
Address Length at Power-up Non-volatile CR2NV[1]: This bit controls the POR, hardware reset, or software reset state of the
expected address length for all commands that require address and are not fixed 3 Byte or 4 Byte only address. Most commands
that need an address are legacy SPI commands that traditionally used 3 byte (24 bit) address. For device densities greater than
128 Mb a 4 Byte (32 bit) address is required to access the entire memory array. The address length configuration bit is used to
change all 3 Byte address commands to expect 4 Byte address. See Table 41 on page 60 for command address length. This non-
volatile Address Length configuration bit enables the device to start immediately (boot) in 4 Byte address mode rather than the
legacy 3 Byte address mode.
6.6.4.2 Configuration Register 2 Volatile (CR2V)
Related Commands: Read Configuration Register 2 (RDCR2 15h), Read Any Register (RDAR 65h), Write Enable for Volatile
(WRENV 50h), Write Register (WRR 01h), Write Any Register (WRAR 71h), Enter 4 Byte address mode (4BEN B7h), Exit 4 Byte
address mode (4BEX E9h), Enter QPI (38h), Exit QPI (F5h). This is the register displayed by the RDCR2 command.
IO3 Reset CR2V[7]: This bit controls the IO3 / RESET# signal behavior. This volatile IO3 Reset configuration bit enables the use of
IO3 as a RESET# input during normal operation when CS# is high or Quad Mode is disabled (CR1V[1] = 0) or QPI is disabled
(CR3V[3] = 0).
Table 16. Configuration Register 2 Volatile (CR2V)
Bits Field Name Function Type Default
State Description
7 IO3R IO3_Reset
Volatile
CR2NV
1 = Enabled -- IO3 is used as RESET# input when CS# is high
or Quad Mode is disabled CR1V[1]=0 or QPI is disabled
(CR3V[3] = 0).
0 = Disabled -- IO3 has no alternate function, hardware reset
through IO3 / RESET# input is disabled.
6 OI Output
Impedance See Table 15 on page 32.
5
4 RFU Reserved Reserved for Future Use
3 QPI QPI
1 = Enabled -- QPI (4-4-4) protocol in use
0 = Disabled -- Legacy SPI protocols in use, instruction is
always serial on SI
2 WPS Write Protect
Selection
0 = Legacy Block Protection
1 = Individual Block Lock
1ADP
Address Length
at Power-up
Volatile
Read Only
Read Status Only Bit
1 = 4 byte address
0 = 3 byte address
0 ADS Address Length
Status Volatile CR2NV[1]
Current Address Mode
1 = 4 byte address
0 = 3 byte address
Document Number: 002-00124 Rev. *G Page 34 of 160
S25FL256L/S25FL128L
Output Impedance CR2V[6:5]: These bits control the IO signal output impedance (drive strength). This volatile output impedance
configuration bit enables the user to adjust the drive strength during normal operation.
QPI CR2V[3]: This bit controls the expected instruction width for all commands. This volatile QPI configuration bit enables the
device to enter and exit QPI mode during normal operation. When this bit is set to QPI mode, the QUAD mode is active, independent
of the setting of QIO mode (CR1V[1]). When this bit is cleared to legacy SPI mode, the QUAD bit is not affected. The QPI CR2V[3]
bit can also be set to “1” by the QPIEN (38h) command and set to “0” by the QPIEX (F5h) command.
Write Protect Selection CR2V[2]: This bit selects which Array protection method is used; see Section 7.6.1 Legacy Block
Protection on page 46) or Section 7.6.2 Individual Block Lock (IBL) Protection on page 51. These volatile configuration bits enable
the user to change Protection method during normal operation.
Address Length at Power-on (ADP) CR2V[1]: This bit is read only and shows what the address length will be after power-on reset,
hardware reset, or software reset for all commands that require address and are not fixed 3 Byte or 4 Byte address.
Address Length Status (ADS) CR2V[0]: This bit controls the expected address length for all commands that require address and
are not fixed 3 Byte or 4 Byte address. See Table 41 on page 60 for command address length. This volatile Address Length
configuration bit enables the address length to be changed during normal operation. The four byte address mode (4BEN) command
directly sets this bit into 4 byte address mode and the (4BEX) command exits sets this bit back into 3 byte address mode. This bit is
also updated when the Address Length Non-volatile CR2NV[1] bit is updated.
6.6.5 Configuration Register 3
Configuration Register 3 controls the main Flash array read commands burst wrap behavior and read latency. The burst wrap
configuration does not affect commands reading from areas other than the main Flash array e.g. read commands for registers or
Security Regions. The non-volatile version of the register provides the ability to set the start up (boot) state of the controls as the
contents are copied to the volatile version of the register during the POR, hardware reset, or software reset. The volatile version of
the register controls the feature behavior during normal operation.
The register bits can be read and changed using the, Read Configuration 3 (RDCR3 33h), Write Registers (WRR 01h), Read Any
Register (RDAR 65h), Write Any Register (WRAR 71h). The volatile version of the register can also be written by the Set Burst
Length (77h) command.
6.6.5.1 Configuration Register 3 Non-Volatile (CR3NV)
Related Commands: Non-volatile Write Enable (WREN 06h), Write Registers (WRR 01h), Read Any Register (RDAR 65h), Write
Any Register (WRAR 71h).
Table 17. QPI and QIO Mode Control Bits
QPI
CR2V[3] QUAD CR1V[1] Description
00
SIO mode: Single and Dual Read, WP#/IO2 input is in use as WP# pin and IO3 / RESET# input is in
use as RESET# pin
01
QIO mode: Single, Dual, and Quad Read, WP#/IO2 input is in use as IO2 and IO3 / RESET# input is in
use as IO3 or RESET# pin
1X
QPI mode: Quad Read, WP#/IO2 input is in use as IO2 and IO3 / RESET# input is in use as IO3 or
RESET# pin
Document Number: 002-00124 Rev. *G Page 35 of 160
S25FL256L/S25FL128L
Wrap Length Non-volatile CR3NV[6:5]: These bits controls the POR, hardware reset, or software reset state of the wrapped read
length and alignment.
Wrap Enable Non-volatile CR3NV[4]: This bit controls the POR, hardware reset, or software reset state of the wrap enable. The
commands affected by Wrap Enable are: Quad I/O Read, QPI Read, DDR Quad I/O Read and DDR QPI Read. This configuration bit
enables the device to start immediately (boot) in wrapped burst read mode rather than the legacy sequential read mode.
Read Latency Non-volatile CR3NV[3:0]: These bits control the POR, hardware reset, or software reset state of the read latency
(dummy cycle) delay in all variable latency read commands. The following read commands have a variable latency period between
the end of address or mode and the beginning of read data returning to the host:
The latency delay per clock frequency for the following commands are: One dummy cycle for all clock frequency's. The default
latency code of “0” is one dummy cycle.
Data Learning pattern Read DLPRD (1-1-1) or (4-4-4)
IRP Read IRPRD (1-1-1) or (4-4-4))
Protect Register Read PRRD (1-1-1) or (4-4-4)
Password Read PASSRD (1-1-1) or (4-4-4)
The latency delay per clock frequency for the following commands are shown in Table 20 and Table 21. The default latency code
of “0” is 8 dummy cycles.
Fast Read FAST_READ (1-1-1)
Quad-O Read QOR, 4QOR (1-1-4)
Dual-O Read DOR, 4DOR (1-1-2)
Dual I/O Read DIOR, 4DIOR (1-2-2)
Quad I/O Read QIOR, 4QIOR (1-4-4) or (4-4-4)
DDR Quad I/O Read DDRQIOR, 4DDRQIOR(1-4-4)
Security Regions Read SECRR (1-1-1) or (4-4-4)
Read Any Register RDAR (1-1-1) or (4-4-4)
Read Serial Flash Discoverable Parameters RSFDP (1-1-1) or (4-4-4)
The non-volatile read latency configuration bits set the number of read latency (dummy cycles) in use so the device can start
immediately (boot) with an appropriate read latency for the host system.
Table 19. Configuration Register 3 Non-Volatile (CR3NV)
Bits Field Name Function Type Default
State Description
7 RFU Reserved
Non-volatile
0 Reserved for Future Use
6
WL_NV Wrap Length Default
1 00 = 8-byte wrap
01 = 16 byte wrap
10 = 32 byte wrap
11 = 64 byte wrap
5 1
4 WE_NV Wrap Enable Default 1 0 = Wrap Enabled
1 = Wrap Disabled
3
RL_NV Read Latency
Default
1
0 to 15 latency (dummy) cycles following read
address or continuous mode bits.
20
10
00
Document Number: 002-00124 Rev. *G Page 36 of 160
S25FL256L/S25FL128L
.
Table 20. Latency Code (Cycles) Versus Frequency
Latency
Code
0
Read Command Maximum Frequency (MHz)
Fast Read
(1-1-1)
Dual-O Read
(1-1-2)
Dual I/O Read
(1-2-2)
Quad-O Read
(1-1-4)
Quad I/O Read
(1-4-4)
Quad I/O Read
QPI (4-4-4)
DDR
Quad I/O
(1-4-4)
QPI (4-4-4)
Mode Cycles =
0
Mode Cycles =
0
Mode Cycles =
4
Mode Cycles =
0
Mode Cycles =
2
Mode Cycles =
2
Mode Cycles =
1
Dummy
Cycles = 8
Dummy
Cycles = 8
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy
Cycles = 8
Dummy
Cycles = 8
150 50 75 35 35 35 20
265 65 85 45 45 45 25
375 75 95 55 55 55 35
4 85 85 108 65 65 65 45
5 95 95 108 75 75 75 55
6 108 105 108 85 85 85 60
7 108 108 133 95 95 95 66
8108 108 133 108 108 108 66
9 133 133 133 115 115 115 66
10 133 133 133 115 115 115 66
11 133 133 133 120 120 120 66
12 133 133 133 120 120 120 66
13 133 133 133 133 133 133 66
14 133 133 133 133 133 133 66
15 133 133 133 133 133 133 66
Document Number: 002-00124 Rev. *G Page 37 of 160
S25FL256L/S25FL128L
Notes:
1. SCK frequency > 133 MHz SDR, or 66MHz DDR is not supported by this family of devices.
2. The Dual I/O, Quad I/O, QPI, DDR Quad I/O, and DDR QPI command protocols include Continuous Read Mode bits following the address. The clock cycles for these
bits are not counted as part of the latency cycles shown in the table. Example: the legacy Quad I/O command has 2 Continuous Read Mode cycles following the
address. Therefore, the legacy Quad I/O command without additional read latency is supported only up to the frequency shown in the table for a read latency of 0
cycles. By increasing the variable read latency the frequency of the Quad I/O command can be increased to allow operation up to the maximum supported 133 MHz
frequency and QPI maximum supported 133 MHz.
3. Other commands have fixed latency, e.g. Read always has zero read latency, Read Unique ID has 32 dummy cycles and release from Deep Power-Down has 24
dummy cycles.
Table 21. Latency Code (Cycles) Versus Frequency
Latency Code 0
Read Command Maximum Frequency (MHz)
Read Any
Register
(1-1-1)
Read Any
Register
QPI
(4-4-4)
Security Region
Read (1-1-1)
Security Region
Read QPI (4-4-4)
Read SFDP
RSFDP (1-1-1)
Read SFDP
RSFDP QPI
(4-4-4)
Mode Cycles = 0 Mode Cycles = 0 Mode Cycles = 0 Mode Cycles = 0 Mode Cycles = 0 Mode Cycles = 0
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy Cycles
= 8
Dummy Cycles
= 8
1 501550155015
2 652565256525
3 753575357535
4 854585458545
5 955595559555
6 108 65 108 65 108 65
7 108 75 108 75 108 75
8108 85 108 85 108 85
9 133 95 133 95 133 95
10 133 108 133 108 133 108
11 133 115 133 115 133 115
12 133 115 133 115 133 115
13 133 120 133 120 133 120
14 133 120 133 120 133 120
15 133 133 133 133 133 133
Document Number: 002-00124 Rev. *G Page 38 of 160
S25FL256L/S25FL128L
6.6.5.2 Configuration Register 3 Volatile (CR3V)
Related Commands: Read Configuration 3 (RDCR3 33h), Write Enable for Volatile (WRENV 50h), Write Registers (WRR 01h),
Read Any Register (RDAR 65h), Write Any Register (WRAR 71h), Set Burst Length (SBL 77h). This is the register displayed by the
RDCR3 command.
Wrap Length CR3V[6:5]: These bits controls the wrapped read length and alignment during normal operation. These volatile
configuration bits enable the user to adjust the burst wrapped read length during normal operation.
Wrap Enable CR3V[4]: This bit controls the burst wrap feature. This volatile configuration bit enables the device to enter and exit
burst wrapped read mode during normal operation.
When CR3V[4]=1, the wrap mode is not enabled and unlimited length sequential read is performed.
When CR3V[4]=0, the wrap mode is enabled and a fixed length and aligned group of 8, 16, 32, or 64 bytes is read starting at the
byte address provided by the read command and wrapping around at the group alignment boundary.
Read Latency CR3V[3:0]: These bits set the read latency (dummy cycle) delay in variable latency read commands. These volatile
configuration bits enable the user to adjust the read latency during normal operation to optimize the latency for different commands
or, at different operating frequencies, as needed.
6.6.6 Individual and Region Protection Register (IRP)
Related Commands: IRP Read (IRPRD 2Bh) and IRP Program (IRPP 2Fh), Read Any Register (RDAR 65h), Write Any Register
(WRAR 71h).
The IRP register is a 16 bit OTP memory location used to permanently configure the behavior of Individual and Region Protection
(IRP) features. IRP does not have user programmable volatile bits, all defined bits are OTP.
Table 22. Configuration Register 3 Volatile (CR3V)
Bits Field Name Function Type Default
State Description
7 RFU Reserved
Volatile CR3NV
Reserved for Future Use
6
WL Wrap Length
00 = 8-byte wrap
01 = 16 byte wrap
10 = 32 byte wrap
11 = 64 byte wrap
5
4 WE Wrap Enable 0 = Wrap Enabled
1 = Wrap Disabled
3
RL Read Latency 0 to 15 latency (dummy) cycles following read
address or continuous mode bits.
2
1
0
Document Number: 002-00124 Rev. *G Page 39 of 160
S25FL256L/S25FL128L
The default state of the IRP bits are programmed by Cypress.
Security Regions Read Password Mode Enable (SECRRP) IRP[6]: When programmed to “0”, SECRRP enables the Security
Region 3 read password mode when PWDMLB bit IRP[2] is program at same time or later. The SECRRP bit can only be
programmed when IRP[2:0] = “111”, if not programming will fail with P_ERR set to 1. See Section 7.7.4 Security Region Read
Password Protection on page 57.
IBL Lock Boot Bit (IBLLBB) IRP[4]: The default state is 1, all individual IBL bits are set to “0” in the protected state, following
power-up, hardware reset, or software reset. In order to Program or Erase the Array the Global IBL Unlock or the Sector / Block IBL
Unlock command must be given before the Program or Erase commands. When programmed to 0, all the individual IBL bits are in
the un-protected state following power-up, hardware reset, or software reset. The IBLLBB bit can only be programmed when
IRP[2:0] = “111”, if not programming will fail with P_ERR set to “1”. See Section 7.6.2 Individual Block Lock (IBL) Protection
on page 51.
Password Protection Mode Lock Bit (PWDMLB) IRP[2]: When programmed to “0”, the Password Protection Mode is permanently
selected to protect the Security Regions 2 and 3 and Pointer Region. The PWDMLB bit can only be programmed when IRP[2:0] =
“111”, if not programming will fail with P_ERR set to 1. See Section 7.7.3 Password Protection Mode on page 56.
After the Password protection mode is selected by programming IRP[2] = “0”, the state of all IRP bits are locked and permanently
protected from further programming. Attempting to program any IRP bits will result in a programming error with P_ERR set to 1.
The Password must be programmed and verified, before the Password Mode (IRP[2]=0) is set.
Power Supply Lock-down protection Mode Lock Bit (PSLMLB) IRP[1]: When programmed to 0, the Power Supply Lock-down
protection Mode is permanently selected. The PSLMLB bit can only be programmed when IRP[2:0] = “111”, if not programming will
fail with P_ERR set to “1”.
Table 23. IRP Register (IRP)
Bits Field Name Function Type Default
State Description
15 to 7 RFU Reserved OTP All bits are
1Reserved for Future Use
6 SECRRP
Security Region
3 Read
Password Mode
Enable Bit
OTP 1
0 = Security Region 3 Read password mode selected
1 = Security Region 3 Read Password not selected
IRP[6] is programmable if IRP[2:0]= “111”
5 RFU Reserved OTP 1 Reserved for Future Use
4 IBLLBB IBL Lock Boot Bit OTP 1
0 = All individual IBL bits are set to “1” at power-up in the
unprotected state
1 = All individual IBL bits are set to “0” at power-up in the
protected state
IRP[4] is programmable if IRP[2:0]= “111”
3 RFU Reserved OTP 1 Reserved for Future Use
2
PWDMLB Password
Protection Mode
Lock Bit OTP 1
0 = Password Protection Mode permanently enabled.
1 = Password Protection Mode not permanently enabled.
IRP[2] is programmable if IRP[2:0]= “111”
1 PSLMLB
Power Supply
Lock-down
protection Mode
Lock Bit
OTP 1
0 = Power Supply Lock-down protection Mode permanently
enabled.
1 = Power Supply Lock-down protection Mode not
permanently enabled.
IRP[1] is programmable if this is enabled by IRP[2:0]= “111”
0 PERMLB
Permanent
Protection Lock OTP 1
0 = Permanent Protection Mode permanently enabled.
1 = Permanent Protection Mode not permanently enabled.
IRP[0] is programmable if IRP[2:0]= “111”
Document Number: 002-00124 Rev. *G Page 40 of 160
S25FL256L/S25FL128L
After the Power Supply Lock-down protection mode is selected by programming IRP[1] = 0”, the state of all IRP bits are locked and
permanently protected from further programming. Attempting to program any IRP bits will result in a programming error with P_ERR
set to “1”. See Section 7.7.1 IRP Register on page 55.
Permanent Protection Lock Bit (PERMLB) IRP[0]: When programmed to 0, the Permanent Protection Lock Bit permanently
protects the Pointer Region and Security Regions 2 and 3, This bit provides a simple way to permanently protect the Pointer Region
and Security Regions 2 and 3 without the use of a password or the PRL command. See Section 7.7.1 IRP Register on page 55.
PWDMLB (IRP[2]), PSLMLB (IRP[1]) and PERMLB(IRP[0]) are mutually exclusive, only one may be programmed to zero. IRP bits
may only be programmed while IRP[2:0] = “111”. Attempting to program IRP bits when IRP[2:0] is not = “111” will result in a
programming error with P_ERR set to “1”. The IRP protection mode should be selected during system configuration to ensure that a
malicious program does not select an undesired protection mode at a later time. By locking all the protection configuration via the
IRP mode selection, later alteration of the protection methods by malicious programs is prevented.
6.6.7 Password Register (PASS)
Related Commands: Password Read (PASSRD E7h) and Password Program (PASSP E8h), Read Any Register (RDAR 65h), Write
Any Register (WRAR 71h). The PASS register is a 64-bit OTP memory location used to permanently define a password for the
Individual and Region Protection (IRP) feature. PASS does not have user programmable volatile bits, all defined bits are OTP. A
volatile copy of PASS is used to satisfy read latency requirements but the volatile register is not user writable or further described.
The Password can not be read or programmed after IRP[2] is programmed to “0”. See Table 23 on page 39.
6.6.8 Protection Register (PR)
Related Commands: Protection Register Read (PRRD A7h) Protection Register Lock (PRL A6h), Read Any Register (RDAR 65h).
PR does not have separate user programmable non-volatile bits, all defined bits are volatile read only status. The default state of the
RFU bits is set by hardware. There is no non-volatile version of the PR register.
The NVLOCK bit is used to protect the Security Regions 2 and 3 and Pointer Region Protection. When NVLOCK[0] = 0, the Security
Regions 2 and 3 and Pointer Region Protection can not be changed.
Note
10. The Command Protection Register Lock (PRL), sets the NVLOCK =”1”.
Table 24. Password Register (PASS)
Bits Field
Name Function Type Default State Description
63 to 0 PWD Hidden
Password OTP FFFFFFFF-
FFFFFFFFh
Non-volatile OTP storage of 64-bit password. The password is no longer
readable after the password protection mode is selected by
programming IRP register bit 2 to zero.
Table 25. Protection Status Register (PR)
Bits Field Name Function Type Default State Description
7 RFU Reserved
Volatile
Read
Only
00h Reserved for Future Use
6 SECRRP Security Regions
Read Password IRP[6]
0 = Security Region 3 password protected from read
when NVLOCK = 0
1 = Security Region 3 not password protected from read
5 RFU Reserved 0 Reserved for Future Use
4 RFU Reserved 0 Reserved for Future Use
3 RFU Reserved 0 Reserved for Future Use
2 RFU Reserved 0 Reserved for Future Use
1 RFU Reserved 0 Reserved for Future Use
0 NVLOCK
Protect Non-
volatile
configuration
IRP[2] and IRP[0]
0 = Security Regions 2 and 3 and Pointer Region write
protected
1 = Security Regions 2 and 3 and Pointer Region may
be written[10].
Document Number: 002-00124 Rev. *G Page 41 of 160
S25FL256L/S25FL128L
6.6.9 Individual Block Lock Access Register (IBLAR)
Related Commands: IBL Read (IBLRD 3Dh or 4IBLRD E0h), IBL Lock (IBL 36h or 4IBL E1h), IBL Unlock (IBLUL 39h or 4IBUL E2h),
Global IBL lock (GBL 7Eh), Global IBL unlock (GBUL 98h).
IBLAR does not have user programmable non-volatile bits, all bits are a representation of the volatile bits in the IBL array. The
default state of the IBL array bits is set by hardware. There is no non-volatile version of the IBLAR register.
Notes
11. See Figure 25, Individual Block Lock / Pointer Region Protection Control on page 51.
12. The IBL bits maybe read by the IBLRD and 4IBLRD commands.
6.6.10 Pointer Region Protection Register (PRPR)
Related Commands: Set Pointer Region (SPRP FBh or 4SPRP E3h), Read Any Register (RDAR 65h), Write Any Register (WRAR
71h).
PRPR contains user programmable non-volatile bits. The default state of the PRPR bits is set by hardware. There is no volatile
version of the PRPR register. See Section 7.6.3 Pointer Region Protection (PRP) on page 52 for additional details.
Table 26. IBL Access Register (IBLAR)
Bits Field Name Function Type Default State Description
7 to 0 IBL
Read or write
IBL for
individual
sectors / blocks
Volatile
IRP[4]=1 then
00h
else FFh
00h = IBL for the sector / block addressed is set to “0” by the IBL,
4IBL and GBL commands protecting that sector from program or
erase operations.
FFh = IBL for the sector / block addressed is cleared to “1” by the
IBUL, 4IBUL and GBUL commands not protecting that sector
from program or erase operations.
Table 27. PRP Register (PRPR)
Bits Field
Name Function Type Default
State Description
A31 to A25 RFU Reserved
Non-
volatile
11111111b Reserved for Future Use
A24 PRPAD PRP Address 1
Pointer Address
A24 in S25FL256L
RFU in S25FL128L,
A23 to A16 FFh Pointer Address A23 to A16
A15 to A12 Fh Pointer Address A15 to A12
A11 PRPALL PRP Protect
All 10 = Protect Pointer Region selected sectors
1 = Protect All sectors
A10 PRPEN PRP Enable 1 0 = Enable Pointer Region Protection
1 = Disable Pointer Region Protection
A9 PRPTB PRP Top/
Bottom 1
0 = Pointer Region Protection starts from the top (high
address)
1 = Pointer Region Protection starts from the bottom (low
address)
A8 RFU Reserved 1 Reserved for Future Use
A7 to A0 RFU Reserved FFh Reserved for Future Use
Document Number: 002-00124 Rev. *G Page 42 of 160
S25FL256L/S25FL128L
6.6.11 DDR Data Learning Registers
Related Commands: Program DLRNV (PDLRNV 43h), Write DLRV (WDLRV 4Ah), Data Learning Pattern Read (DLPRD 41h), Read
Any Register (RDAR 65h), Write Any Register (WRAR 71h).
The Data Learning Pattern (DLP) resides in an 8-bit Non-Volatile Data Learning Register (DLRNV) as well as an 8-bit Volatile Data
Learning Register (DLRV). When shipped from Cypress, the DLRNV value is 00h. Once programmed, the DLRNV cannot be
reprogrammed or erased; a copy of the data pattern in the DLRNV will also be written to the DLRV. The DLRV can be written to at
any time, but on hardware and software reset or power cycles the data pattern will revert back to what is in the DLRNV. During the
learning phase described in the SPI DDR modes, the DLP will come from the DLRV. Each IO will output the same DLP value for
every clock edge. For example, if the DLP is 34h (or binary 00110100) then during the first clock edge all IO’s will output 0;
subsequently, the 2nd clock edge all I/O’s will output 0, the 3rd will output 1, etc.
When the DLRV value is 00h, no preamble data pattern is presented during the dummy phase in the DDR commands.
Table 28. Non-Volatile Data Learning Register (DLRNV)
Bits Field
Name Function Type Default
State Description
7 to 0 NVDLP
Non-Volatile
Data Learning
Pattern
OTP 00h
OTP value that may be transferred to the host during DDR read com-
mand latency (dummy) cycles to provide a training pattern to help the
host more accurately center the data capture point in the received data
bits.
Table 29. Volatile Data Learning Register (DLRV)
Bits Field
Name Function Type Default State Description
7 to 0 VDLP
Volatile Data
Learning Pat-
tern
Volatile
Takes the value
of DLRNV
during POR or
Reset
Volatile copy of the NVDLP used to enable and deliver the Data Learn-
ing Pattern (DLP) to the outputs. The VDLP may be changed by the
host during system operation.
Document Number: 002-00124 Rev. *G Page 43 of 160
S25FL256L/S25FL128L
7. Data Protection
7.1 Security Regions
The device has a 1024 byte address space that is separate from the main Flash array. This area is divided into 4, individually
lockable, 256 byte length regions. See Section 6.5 Security Regions Address Space on page 24.
The Security Region memory space is intended for increased system security. The data values can “mate” a flash component with
the system CPU/ASIC to prevent device substitution. The Security Region address space is protected by the Security Region Lock
bits or the Protection Register NVLOCK bit (PR[0]). See Section 7.1.4 Security Region Lock Bits (LB3, LB2, LB1, LB0) on page 43.
7.1.1 Reading Security Region Memory Regions
The Security Region Read command (SECRR) uses the same protocol as Fast Read. Read operations outside the valid 1024 byte
Security Region address range will yield indeterminate data. See Section 8.7.3 Security Regions Read (SECRR 48h) on page 101.
Security Region 3 may be password protected from read by setting the PWDMLB bit IRP[2] = 0 and SECRRP bit IRP[6] = 0 when
NVLOCK = 0.
7.1.2 Programming the Security Regions
The protocol of the Security Region programming command (SECRP) is the same as Page Program. See Section 8.7.2 Security
Region Program (SECRP 42h) on page 100.
The valid address range for Security Region Program is depicted in Table 6 on page 24. Security Region Program operations
outside the valid Security Region address range will be ignored, without P_ERR in SR2V[5] set to “1”.
Security Regions 2 and 3 may be password protected from programming by setting the PWDMLB bit IRP[2] = 0.
7.1.3 Erasing the Security Regions
The protocol of the Security Region erasing command (SECRE) is the same as Sector erase. See Section 8.7.1 Security Region
Erase (SECRE 44h) on page 100.
The valid address range for Security Region Erase is depicted in Table 6 on page 24. Security Region Erase operations outside the
valid Security Region address range will be ignored, without E_ERR in SR2V set to “1”.
Security Regions 2 and 3 may be password protected from erasing by setting the PWDMLB bit IRP[2] = 0.
7.1.4 Security Region Lock Bits (LB3, LB2, LB1, LB0)
The Security Region Lock Bits (LB3, LB2, LB1, LB0) are non-volatile One Time Program (OTP) bits in Configuration Register
1(CR1NV[5:2]) that provide the write protect control and status to the Security Regions. The default state of Security Regions 0 to 3
are unlocked. LB[3:0] can be set to 1 individually using the Write Status Registers or Write Any Register command. LB[3:0] are One
Time Programmable (OTP), once it’s set to 1, the corresponding 256 Byte Security Region will become read-only permanently.
7.2 Deep Power Down
The Deep Power Down (DPD) command offers an alternative means of data protection as all commands are ignored during the DPD
state, except for the Release from Deep Power Down (RES ABh) command and hardware reset. Thus, preventing any program or
erase during the DPD state.
Document Number: 002-00124 Rev. *G Page 44 of 160
S25FL256L/S25FL128L
7.3 Write Enable Commands
7.3.1 Write Enable (WREN)
The Write Enable (WREN) command must be written prior to any command that modifies non-volatile data. The WREN command
sets the Write Enable Latch (WEL) bit. The WEL bit is cleared to 0 (disables writes) during power-up, hardware and software reset,
or after the device completes the following commands:
Reset
Page Program (PP or 4PP)
Quad Page Program (QPP or 4QPP)
Sector Erase (SE or 4SE)
Half Block Erase (HBE or 4HBE)
Block Erase (BE or 4BE)
Chip Erase (CE)
Write Disable (WRDI)
Write Registers (WRR)
Write Any Register (WRAR)
Security Region Erase (SECRE)
Security Region Byte Programming (SECRP)
Individual and Region Protection Register Program (IRPP)
Password Program (PASSP)
Clear Status Register (CLSR)
Set Pointer Region Protection (SPRP or 4SPRP)
Program Non-Volatile Data Learning Register (PDLRNV)
Write Volatile Data Learning Register (WDLRV)
Write Enable for Volatile Registers (WRENV)
The Write Enable Volatile (WRENV) command must be written prior to Write Register (WRR) command that modifies volatile
registers data.
7.4 Write Protect Signal
When not in Quad mode (CR1V[1] = 0) or QPI mode (CR2V[3] = 0), the Write Protect (WP#) input in combination with the Status
Register Protect 0 (SRP0) bit (SR1NV[7]) provide hardware input signal controlled protection. When WP# is Low and SRP0 is set to
“1” Status Register 1 (SR1NV and SR1V), Configuration register (CR1NV, CR1V, CR2NV, CR2V, CR2NV and CR3NV) and DDR
Data Learning Registers (DLRNV and DLRV) are protected from alteration. This prevents disabling or changing the protection
defined by the Legacy Block Protect bits or Security Region Lock Bits. See Section 6.6.1 Status Register 1 on page 25.
Document Number: 002-00124 Rev. *G Page 45 of 160
S25FL256L/S25FL128L
7.5 Status Register Protect (SRP1, SRP0)
The Status Register Protect bits (SRP1 and SRP0) are volatile bits in the configuration and status registers (CR1V[0] and SR1V[7]).
The SRP bits control the method of write protection for SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and DLRV: software
protection, hardware protection, or power supply lock-down
Notes
13. SRP0 is reloaded from SRP0_NV (SR1NV[7]) default state after a power-down, power-up cycle, software or hardware reset. To enable hardware protection mode by
the WP# pin at power-up set the SRP0_NV bit to “1”.
14. When SRP1 = 1, a power-down, power-up cycle, or hardware reset, will change SRP1 to 0 as SRP1 is reloaded from SRP1_D.
15. SRP1_D can be written only when IRP[2:0] =”111”. When SRP1_D CR1NV[0]=”1” a power-down, power-up cycle, or hardware reset, will reload SRP1 from SRP1_D
= ”1” the volatile bit SRP1 is not writable, thus providing OTP protection. When SRP1_D is programmed to 1, Recommended that SRP0_NV should also be programmed
to 1 as an indication that OTP protection is in use.
16. When QPI or QIO mode is enabled (CR2V[3] or CR1V[1] = “1”) the internal WP# signal level is = 1 because the WP# external input is used as IO2 when either mode
is active. This effectively turns off hardware protection when SRP1-SRP0 = 01b. The Register SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV and
DLRV are unlocked and can be written.
17. WIP, WEL, and SUS (SR1[1:0] and CR1[7]) are volatile read only status bits that are never affected by the Write Status Registers command.
18. The non-volatile version of SR1NV, CR1NV, CR2NV and CR3NV are not writable when protected by the SRP bits and WP# as shown in the table. The non-volatile
version of these status register bits are selected for writing when the Write Enable (06h) command precedes the Write Status Registers (01h) command or the Write
Any Register (71h) command.
19. The volatile version of registers SR1V, CR1V and CR2V are not writable when protected by the SRP bits and WP# as shown in the table. The volatile version of these
status register bits are selected for writing when the Write Enable for volatile Status Register (50h) command precedes the Write Status Registers (01h) commandor
the Write Enable (06h) command precedes the Write Any Register (71h) command.
20. The volatile CR3V bits are not protected by the SRP bits and may be written at any time by volatile (50h) Write Enable command preceding the Write Status Registers
(01h) command. The WRAR (71h) and SBL (77h) commands are alternative ways to write bits in the CR3V register.
21. During system power up and boot code execution: Trusted boot code can determine whether there is any need to change SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV values. If no changes are needed the SRP1 bit (CR1V[0]) can be set to 1 to protect the SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV registers from changes during the remainder of normal system operation while power remains on.
Table 31. Status Register Protection Bits (High Security)
SRP1_D
CR1NV[0]
SRP1
CR1V[0]
SRP0
SR1V[7] WP# Status Register Description
0 0 0 X Software Protection
WP# pin has no control. SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV can be written. [Factory
Default]
0 0 1 0 Hardware Protected
When WP# pin is low SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV are locked and can not be
written[13, 16].
0 0 1 1 Hardware Unprotected
When WP# pin is high SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV are unlocked and can be
written[13].
01XX
Power Supply Lock-
Down
SR1NV, SR1V, CR1NV, CR1V, CR2NV, CR2V, CR3NV, DLRNV
and DLRV are protected and can not be written to again until the
next power-down, power-up cycle[14].
1 1 X X One Time Program
SRP1_D CR1NV[0]= 1 SR1NV, SR1V, CR1NV, CR1V, CR2NV,
CR2V, CR3NV, DLRNV and DLRV are permanently protected
and can not be written[15].
Document Number: 002-00124 Rev. *G Page 46 of 160
S25FL256L/S25FL128L
7.6 Array Protection
There are three types of memory array protection: Legacy Block (LBP), Individual Block Lock (IBL) and Pointer Region (PRP). The
Write Protect Selection (WPS) bit is used by the user to enable one of two protection mechanisms: Legacy Block (LBP) protection
(WPS CR2V[2]=0)or Individual Block Lock (IBL) protection (WPS CR2V[2]=1). See Section 6.6.4.2 Configuration Register 2 Volatile
(CR2V) on page 33. Only one protection mechanism can be enabled at one time. The Legacy Block Protection is the default
protection and is mutually exclusive with the IBL protection scheme. The Pointer Region Protection is enabled by the Set Pointer
Region Protection command or the WRAR command by the value of A10 = 0. See Section 8.9 Pointer Region Command
on page 107. When the Pointer Region Protection is enabled it is logically ORed with the Legacy Block Protection or Individual Block
Lock protection.
Figure 24. WPS Selection of LBP or IBL and PRP Array Protection
7.6.1 Legacy Block Protection
The Legacy Block Protect bits (S25FL256L)Status Register bits BP3, BP2, BP1, BP0 -- SR1V[5:2]) (S25FL128L,) Status Register
bits BP2, BP1, BP0 -- SR1V[4:2]) in combination with the Configuration Register TBPROT (SR1V[6] S25FL256L) (SR1V[5]
S25FL128L)bit, CMP (CR1V[6] bit and SEC (SR1V[5] S25FL128L) can be used to protect an address range of the main Flash array
from program and erase operations. The size of the range is determined by the value of the BP bits and the upper or lower starting
point of the range is selected by the TBPROT bit of the configuration register (SR1V[6] S25FL256L ) (SR1V[5] S25FL128L,). The
protection is complemented when the CMP bit (CR1V[6]) is set to 1.
If the Pointer Region Protection is enabled this region protection is logically ORed with the Legacy Block protection region
Legacy Block
Protection Logic
(Address Range
Compare)
Individual Block
Protection Logic
(IBL Bit Array)
Mux
OR
Command
Address
BP Bits
WPS
Pointer Region
Protection Logic
(Address range
compare)
NVLOCK
Array
Location
Protected
WPS = 1
IBLBOOT
WPS = 0
Document Number: 002-00124 Rev. *G Page 47 of 160
S25FL256L/S25FL128L
Table 32. S25FL128L Block Protection (CMP = 0)
Note
22. X = don’t care.
Status Register 128L (128 Mb) Block Protection (CMP = 0)
SEC TBPROT BP2 BP1 BP0 Protected Block(s) Protected Addresses Protected
Density Protected Portion
X X 0 0 0 None None None None
0 0 0 0 1 252 thru 255 FC0000h – FFFFFFh 256 kB Upper 1/64
0 0 0 1 0 248 thru 255 F80000h – FFFFFFh 512 kB Upper 1/32
0 0 0 1 1 240 thru 255 F00000h – FFFFFFh 1 MB Upper 1/16
0 0 1 0 0 224 thru 255 E00000h – FFFFFFh 2 MB Upper 1/8
0 0 1 0 1 192 thru 255 C00000h – FFFFFFh 4 MB Upper 1/4
0 0 1 1 0 128 thru 255 800000h – FFFFFFh 8 MB Upper 1/2
0 1 0 0 1 0 thru 3 000000h – 03FFFFh 256 kB Lower 1/64
0 1 0 1 0 0 thru 7 000000h – 07FFFFh 512 kB Lower 1/32
0 1 0 1 1 0 thru 15 000000h – 0FFFFFh 1 MB Lower 1/16
0 1 1 0 0 0 thru 31 000000h – 1FFFFFh 2 MB Lower 1/8
0 1 1 0 1 0 thru 63 000000h – 3FFFFFh 4 MB Lower 1/4
0 1 1 1 0 0 thru 127 000000h – 7FFFFFh 8 MB Lower 1/2
X X 1 1 1 0 thru 255 000000h – FFFFFFh 16 MB ALL
1 0 0 0 1 255 FFF000h – FFFFFFh 4 kB Upper 1/4096
1 0 0 1 0 255 FFE000h – FFFFFFh 8 kB Upper 1/2048
1 0 0 1 1 255 FFC000h – FFFFFFh 16 kB Upper 1/1024
1 0 1 0 X 255 FF8000h – FFFFFFh 32 kB Upper 1/512
1 0 1 1 0
1 1 0 0 1 0 000000h – 000FFFh 4 kB Lower 1/4096
1 1 0 1 0 0 000000h – 001FFFh 8 kB Lower 1/2048
1 1 0 1 1 0 000000h – 003FFFh 16 kB Lower 1/1024
1 1 1 0 X 0 000000h – 007FFFh 32 kB Lower 1/512
1 1 1 1 0
Document Number: 002-00124 Rev. *G Page 48 of 160
S25FL256L/S25FL128L
Table 33. S25FL128L (128Mb) Block Protection (CMP = 1)
Note
23. X = don’t care.
Status Register 128L Legacy Block Protection (CMP = 1)
SEC TBPORT BP2 BP1 BP0 Protected Block(s) Protected Addresses Protected
Density Protected Portion
X X 0 0 0 0 thru 255 000000h – FFFFFFh 16 MB ALL
0 0 0 0 1 0 thru 251 000000h – FBFFFFh 16,128 kB Lower 63/64
0 0 0 1 0 0 thru 247 000000h – F7FFFFh 15,872 kB Lower 31/32
0 0 0 1 1 0 thru 239 000000h – EFFFFFh 15 MB Lower 15/16
0 0 1 0 0 0 thru 223 000000h – DFFFFFh 14 MB Lower 7/8
0 0 1 0 1 0 thru 191 000000h – BFFFFFh 12 MB Lower 3/4
0 0 1 1 0 0 thru 127 000000h – 7FFFFFh 8 MB Lower 1/2
0 1 0 0 1 4 thru 255 040000h – FFFFFFh 16,128 kB Upper 63/64
0 1 0 1 0 8 thru 255 080000h – FFFFFFh 15,872 kB Upper 31/32
0 1 0 1 1 16 thru 255 100000h – FFFFFFh 15 MB Upper 15/16
0 1 1 0 0 32 thru 255 200000h – FFFFFFh 14 MB Upper 7/8
0 1 1 0 1 64 thru 255 400000h – FFFFFFh 12 MB Upper 3/4
0 1 1 1 0 128 thru 255 800000h – FFFFFFh 8 MB Upper 1/2
X X 1 1 1 None None None None
1 0 0 0 1 0 thru 255 000000h – FFEFFFh 16,380 kB Lower 4095/4096
1 0 0 1 0 0 thru 255 000000h – FFDFFFh 16,376 kB Lower 2047/2048
1 0 0 1 1 0 thru 255 000000h – FFBFFFh 16,368 kB Lower 1023/1024
1 0 1 0 X 0 thru 255 000000h – FF7FFFh 16,352 Lower 511/512
1 0 1 1 0
1 1 0 0 1 0 thru 255 001000h – FFFFFFh 16,380 kB Upper 4095/4096
1 1 0 1 0 0 thru 255 002000h – FFFFFFh 16,376 kB Upper 2047/2048
1 1 0 1 1 0 thru 255 004000h – FFFFFFh 16,368 kB Upper 1023/1024
1 1 1 0 X 0 thru 255 008000h – FFFFFFh 16,352 kB Upper 511/512
1 1 1 1 0
Document Number: 002-00124 Rev. *G Page 49 of 160
S25FL256L/S25FL128L
Table 34. S25FL256L (256Mb) Upper Array Complement Legacy Block Protection (TBPROT = 0, CMP = 1)
Status Register Content S25FL256L Legacy Block Protection (TBPROT = 0, CMP = 1)
BP3 BP2 BP1 BP0 Number
Protected Blocks Protected Blocks Protected
Density (KB)
Protected
Portion
0 0 0 0 512 0-511 32768 All
0 0 0 1 511 0-510 32704 Lower 511/512
0 0 1 0 510 0-509 32640 Lower 255/256
0 0 1 1 508 0-507 32512 Lower 127/128
0 1 0 0 504 0-503 32256 Lower 63/64
0 1 0 1 496 0-495 31744 Lower 31/32
0 1 1 0 480 0-479 30720 Lower 15/16
0 1 1 1 448 0-447 28672 Lower 7/8
1 0 0 0 384 0-383 24576 Lower 3/4
1 0 0 1 256 0-255 16384 Lower 1/2
1010 0 None 0 None
1011 0 None 0 None
1100 0 None 0 None
1101 0 None 0 None
1110 0 None 0 None
1111 0 None 0 None
Table 35. S25FL256L (256Mb) Lower Array Complement Legacy Block Protection (TBPROT = 1, CMP = 1)
Status Register Content S25FL256L Legacy Block Protection (TBPROT = 1, CMP = 1)
BP3 BP2 BP1 BP0 Number
Protected Blocks Protected Blocks Protected
Density (KB)
Protected
Portion
0 0 0 0 512 0-511 32768 All
0 0 0 1 511 1-511 32704 Upper 511/512
0 0 1 0 510 2-511 32640 Upper 255/256
0 0 1 1 508 4-511 32512 Upper 127/128
0 1 0 0 504 8-511 32256 Upper 63/64
0 1 0 1 496 16-511 31744 Upper 31/32
0 1 1 0 480 32-511 30720 Upper 15/16
0 1 1 1 448 64-511 28672 Upper 7/8
1 0 0 0 384 128-511 24576 Upper 3/4
1 0 0 1 256 256-511 16384 Upper 1/2
1010 0 None 0 None
1011 0 None 0 None
1100 0 None 0 None
1101 0 None 0 None
1110 0 None 0 None
1111 0 None 0 None
Document Number: 002-00124 Rev. *G Page 50 of 160
S25FL256L/S25FL128L
Table 37. S25FL256L (256Mb) Lower Array Legacy Block Protection (TBPROT = 1, CMP = 0)
Table 36. S25FL256L (256Mb) Upper Array Legacy Block Protection (TBPROT = 0, CMP = 0)
Status Register Content S25FL256L Legacy Block Protection (TBPROT =0, CMP =0)
BP3 BP2 BP1 BP0 Number
Protected Blocks Protected Blocks Protected
Density (KB)
Protected
Portion
0000 0 None 0 None
0 0 0 1 1 511 64 Upper 1/512
0 0 1 0 2 510-511 128 Upper 1/256
0 0 1 1 4 508-511 256 Upper 1/128
0 1 0 0 8 504-511 512 Upper 1/64
0 1 0 1 16 496-511 1024 Upper 1/32
0 1 1 0 32 480-511 2048 Upper 1/16
0 1 1 1 64 448-511 4096 Upper 1/8
1 0 0 0 128 384-511 8192 Upper 1/4
1 0 0 1 256 256-511 16384 Upper 1/2
1 0 1 0 512 0-511 32768 ALL
1 0 1 1 512 0-511 32768 ALL
1 1 0 0 512 0-511 32768 ALL
1 1 0 1 512 0-511 32768 ALL
1 1 1 0 512 0-511 32768 ALL
1 1 1 1 512 0-511 32768 ALL
Status Register Content S25FL256L Legacy Block Protection (TBPROT =0, CMP =0)
BP3 BP2 BP1 BP0 Number
Protected Blocks Protected Blocks Protected
Density (KB)
Protected
Portion
0000 0 None 0 None
0 0 0 1 1 0 64 Lower 1/512
0 0 1 0 2 0-1 128 Lower 1/256
0 0 1 1 4 0-3 256 Lower 1/128
0 1 0 0 8 0-7 512 Lower 1/64
0 1 0 1 16 0-15 1024 Lower 1/32
0 1 1 0 32 0-31 2048 Lower 1/16
0 1 1 1 64 0-63 4096 Lower 1/8
1 0 0 0 128 0-127 8192 Lower 1/4
1 0 0 1 256 0-255 16384 Lower 1/2
1 0 1 0 512 0-511 32768 ALL
1 0 1 1 512 0-511 32768 ALL
1 1 0 0 512 0-511 32768 ALL
1 1 0 1 512 0-511 32768 ALL
1 1 1 0 512 0-511 32768 ALL
1 1 1 1 512 0-511 32768 ALL
Document Number: 002-00124 Rev. *G Page 51 of 160
S25FL256L/S25FL128L
7.6.2 Individual Block Lock (IBL) Protection
Individual Block Lock Bits (IBL) are volatile, with one bit for each sector / block, and each bit can be individually modified. By issuing
the IBL or GBL commands, a IBL bit is set to “0” protecting each related sector / block. By issuing the IBUL or GUL commands, a IBL
bit is cleared to “1” unprotecting each related sector or block. By issuing the IBLRD command the state of each IBL bit can be read.
This feature allows software to easily protect individual sectors / blocks against inadvertent changes, yet does not prevent the easy
removal of protection when changes are needed. The IBL’s can be set or cleared as often as needed as they are volatile bits.
Every main 64KB Block and the 4KB Sectors in bottom and top blocks has a volatile Individual Block Lock Bit (IBL) associated with
it. When a sector / block IBL bit is “0”, the related sector/block is protected from program and erase operations.
If the Pointer Region Protection is enabled this protected region is logically ORed with the IBL bits.
Following power-up, hardware reset, or software reset the default state [IBLLBB = 1] (see Table 23 on page 39) all individual IBL bits
are set to “0” in the protected state. In order to Program or Erase the Array the Global IBL Unlock or the Sector / Block IBL Unlock
command must be given before the Program or Erase commands. When [IBLLBB = 0], all the individual IBL bits are set to “1” in the
un-protected state following power-up, hardware reset, or software reset.
Figure 25. Individual Block Lock / Pointer Region Protection Control
Notes
24. The “M” is the top 64KB Block.
25. The “N is the top 4KB Sector.
Pointer Region
Protection
Enabled
A10 = 0”
Individual Block
Lock Bits (IBL) Array
WPS = 1”
Sector N
Logical OR
Flash
Memory
Array
Sector N
Sector N-15
Sector N-15
Logical OR
Block M
Block M-1
...
...
...
Block M-1
Logical OR
Block 1
Block 1
Logical OR
...
...
...
Sector 15
Sector 0
Block 0
...
Sector 15
Logical OR
Sector 0
Logical OR ...
...
...
...
......
...
Document Number: 002-00124 Rev. *G Page 52 of 160
S25FL256L/S25FL128L
7.6.3 Pointer Region Protection (PRP)
The Pointer Region Protection is defined by a non-volatile address pointer that selects any 4KB sector as the boundary between
protected and unprotected regions in the memory. This provides a protection scheme with individual sector granularity that remains
in effect across power cycles and reset operations. PRP settings can also be protected from modification until the next power cycle,
until a password is supplied, or can be permanently locked. PRP can be used in combination with either the Legacy Block Protection
or Individual Block Lock protection methods. When enabled, PRP protection is logically ORed with the protection method selected
by the WPS bit (CR2V[2])
The Set Pointer Region Protection (SPRP FBh or 4SPRP E3h) command (see Section8.9 onpage107) or Write Any Register
(WRAR 71h) command to write the PRPR register (see Section 8.3.15 on page 78) is used to enable or disable PRP, and set the
pointer value.
The S25FL256L device must have 4 Byte addressing enabled (CR2V[0] = 1) to set the Pointer Region Protection register PRPR
(see Section 6.6.10 on page 41) this insures that A24 and A25 are set correctly.
After the Set Block/Pointer Protection command is given or Write Any Register (WRAR 71h) command to write the PRPR register,
the value of A10 enables or disables the pointer protection mechanism. If A10 = 1, then the pointer protection region is disabled.
This is the default state, and the rest of pointer values are don’t care. If A10=0, then the pointer protection region is enabled. The
value of A10 is written in the non-volatile pointer bit in the PRPR. The pointer address values for RFU bits are don’t care but these bit
locations will read back as ones. See Section 6.6.10 on page 41 for additional information on the PRPR.
If the pointer protection mechanism is enabled, the pointer value determines the block boundary between the protected and the
unprotected regions in the memory. The pointer boundary is set by the three (A23-A12) or four (A31-A12) address bytes written to
the non-volatile pointer value in the PRPR. The area that is unprotected will be inclusive of the 4KB sector selected by the pointer
value.
The value of A9 is used to determine whether the region that is unprotected will start from the top (highest address) or bottom
(lowest address) of the memory array to the location of the pointer. If A9=0 when the SPRP or 4SPRP command is issued followed
by a the address, then the 4-kB sector which includes that address and all the sectors from the bottom up (zero to higher address)
will be unprotected. If A9=1 when the SPRP or 4SPRPcommand is issued followed by address then the 4-kB sector which includes
that address and all the sectors from the Top down (max to lower address) will be unprotected. The value of A9 is in the non-volatile
pointer value in the PRPR.
The A11 bit can be used to protect all sectors. If A11=1, then all sectors are protected. If A11=0, then the unprotected range will be
determined by Amax-A12. The value of A11 is in the non-volatile pointer value in the PRPR.
The SPRP or 4SPRP command is ignored during a suspend operation because the pointer value cannot be erased and re-
programmed during a suspend.
The SPRP or 4SPRP command is ignored if NVLOCK PR[0]=0.
The Read Any Register 65h command (see Section 8.3.14 on page 76) reads the contents of PRP access register. This allows the
contents of the pointer to be read out for test and verification.
Table 38. PRP Table
A11 A10 A9
Protect
Address
Range
Unprotect
Address
Range
Comment
x1 x None All A10 = 1 is PRP disabled (this is the default state and the rest of pointer value is
don't care).
00 01FFFFFF to
(A[31:12]+1)
A[31:12]
to 0000000
The 4-kB sector which includes that address and all the sectors from the bottom up
(zero to higher address) will be unprotected.
00 1(A[31;12]-1)
to 0000000
1FFFFFF
to A[31:12]
The 4-kB sector which includes that address and all the sectors from the Top down
(max to lower address) will be unprotected.
10 x1FFFFFF to
000000
Not
Applicable A10=0 and A11 =1 means protect all sectors and Amax-A12 are don't care.
Document Number: 002-00124 Rev. *G Page 53 of 160
S25FL256L/S25FL128L
If the pointer protect scheme is active (A10=0), and the pointer protects any portion of the address space to which an erase
command is applied, the erase command fails. For example, if the pointer protection is protecting 4KB of the array that would be
affected by a Block erase command, that erase command fails. Chip Erase CEh command is ignored if PRP is enabled (A10=0) and
this will set the E_ERR status bit.
If the Pointer Region Protection is enabled this protection is logically ORed with either the Legacy Block protection region if WPS
CR2V[2]=0 or Individual Block Lock protection if WPS CR2V[2]=1 (See Figure 24 on page 46).
7.7 Individual and Region Protection
Individual and Region Protection (IRP) is the name used for a set of independent hardware and software methods used to disable or
enable programming or erase operations on Security Regions 2 and 3 and the Pointer Region Protection Register.
Each method manages the state of the NVLOCK bit (PR[0]). When NVLOCK =1, the Security Regions 2 and 3 and the Pointer
Region Protection Register (PRPR) may be programmed and erased. When NVLOCK =0, the Security Regions 2 and 3 and PRPR
can not be programmed or erased. Note, the Security Regions 2 and 3 are also protected respectively by LB2 or LB3=1
(CR1NV[4:5]).
Power Supply Lock-down protection is the default method. This method sets the NVLOCK bit to “1” during POR or Hardware Reset
so that the NVLOCK related areas and registers are unprotected by a device reset. The PRL (A6h) command clears the NVLOCK bit
to “0” to protect the NVLOCK related areas and registers. There is no command in the Power Supply Lock-down method to set the
NVLOCK bit to “1”, therefore the NVLOCK bit will remain at “0until the next power-off or hardware reset. The Power Supply Lock-
down method allows boot code the option of changing Security Regions 2 and 3 or the value in PRPR, by programming or erasing
these non-volatile areas, then protecting these non-volatile areas from further change for the remainder of normal system operation
by clearing the NVLOCK bit to “0”. This is sometimes called Boot-code controlled protection.
The Password method clears the Protection Register NVLOCK bit to 0 and sets the SECRRP bit = IRP[6] during POR or Hardware
Reset to protect the NVLOCK related areas and registers. The SECRRP bit determines whether Security Region 3 is readable. A
64-bit password may be permanently programmed and hidden for the password method. The PASSU (EAh) command can be used
to provide a password for comparison with the hidden password. If the password matches, the NVLOCK bit is set to “1” to unprotect
the NVLOCK related areas and registers. The PRL (A6h) command can be used to clear the NVLOCK bit to “0” to turn on protection
again.
The Permanent method permanently sets the SECRRP bit = 1 and clears NVLOCK to 0. This permanently protects the Security
Regions 2 and 3 and the PRPR.
The selection of the NVLOCK bit management method is made by programming OTP bits in the IRP Register (IRP[2 or 1 or 0] so as
to permanently select the method used.
An overview of all methods is shown in Figure 26 on page 54.
Document Number: 002-00124 Rev. *G Page 54 of 160
S25FL256L/S25FL128L
Figure 26. Permanent, Password and Power Supply Lock-down Protection Overview
Power on Reset or
Hardware Reset
Password
Protection Enabled
IRP[2]=0
Security
Region 3 Read
Password Protection
Enabled
IRP[6]=0
Power Supply
Lock-down
Protection Enabled
IRP[1]=0
NVLOCK = 0
Security Region 3
Read & Write Locked
Security Region 2
Write Locked
Pointer Region
Protection Write Locked
Password Unlock
NVLOCK = 1
Security Regions 2 & 3
and Pointer Region
Protection are Unlocked
Readable, Erasable and
Programmable
NVLOCK Bit Write
No
No
Yes
Yes
NVLOCK = 0
Security Region 2 & 3
Write Locked
Pointer Region
Protection Write Locked
Password Unlock
NVLOCK = 1
Security Regions 2 & 3
and Pointer Region
Protection are Unlocked
Erasable and
Programmable
NVLOCK Bit Write
No
No
Yes
Yes
NVLOCK = 1
Security Regions 2 & 3
and Pointer Region
Protection are Unlocked
Readable, Erasable and
Programmable
NVLOCK Bit Write
NVLOCK = 0
Security Regions 2 & 3
Write Locked
Pointer Region
Protection Write Locked
No
Yes
Yes
Yes
No
Default Power Lock
Protection
IRP Register Bits Locked
Status Register Protect
Locked
IRP Register Bits Locked
Status Register Protect
Locked
IRP Register Bits
Programmable
Status Register Protect
OTP Option
Programmable
Read Password Protection Mode
Protects Security Regions 3 from
Read, Erase and Programming,
Security Region 2 and Pointer
Region Protection from erase and
programming after powerup. A
password unlock Command will
enable changes to Security Region
2 & 3 and Pointer Region
Protection. A NVLOCK bit write
command turns the protection back
on.
Password Protection Mode
Protects Security Regions 2 & 3
and Pointer Region Protection from
erase and programming after
powerup. A password unlock
Command will enable changes to
Security Region 2 & 3 and Pointer
Region Protection. A NVLOCK bit
write command turns the protection
back on.
Power Supply Lock-down
Protection Mode
Does not protect Security Regions
2 & 3 and Pointer Region Protection
from erase and programming after
powerup. The NVLOCK Bit write
command protects Security
Regions 2 & 3 and Pointer Region
Protection until the next power off
or reset.
Default Mode
Does not protect Security Regions
2 & 3 and Pointer Region Protection
from erase and programming after
powerup. The NVLOCK Bit write
command protects Security
Regions 2 & 3 and Pointer Region
Protection until the next power off
or reset.
The OTP Option for Status Register
Protect is available to be
programmed.
Permanent
Protection Enabled
IRP[0]=0
IRP Register Bits Locked
Status Register Protect
Locked
NVLOCK =0
Permanent Erase and
Program Protection of
Security Regions 2 & 3
and Pointer Region
Protection
No No
Permanent Protection Mode
Permanently protects Security
Regions 2 & 3 and Pointer Region
Protection from Erase and
Programming
Note
If Security Region Lock bits LB 2 &
3 are protected CR1NV[5:4]=1, this
overrides the NVLOCK and the
Security Regions protected by the
LB bits will be permanently
protected from erase and
programming. If Read Password is
enabled Security Region 3 can still
be read password protected.
Yes Yes
No
NVLOCK = 1
Security Regions 2 & 3
and Pointer Region
Protection are Unlocked
Readable, Erasable and
Programmable
NVLOCK Bit Write
NVLOCK = 0
Security Regions 2 & 3
Write Locked
Pointer Region
Protection Write Locked
No
Yes
Document Number: 002-00124 Rev. *G Page 55 of 160
S25FL256L/S25FL128L
7.7.1 IRP Register
The IRP register is used to permanently configure the behavior of Individual and Region Protection (IRP) features (see Table 23 on
page 39).
As shipped from the factory, all devices default to the Power Supply Lock-down protection mode, with all regions unprotected.
The device programmer or host system must then choose which protection method to use by programming one of the, one-time
programmable bits, Permanent, Power Supply Lock-down or Password Protection Mode. Programming one of these bits locks the
part permanently in the selected mode:
Factory Defaults IRP Register
IRP[6] = “1” = Read Password Protection Mode not enabled.
IRP[4] = “1” = IBL bits power-up in protected state.
IRP[2] = “1” = Password Protection Mode not enabled.
IRP[1] = “1” = Power Supply Lock-down protection Mode not enabled but is the default mode.
IRP[0] = “1” = Permanent Protection Mode not enabled.
IRP register programming rules:
If the Read Password mode is chosen, the SECRRP bit must be programmed prior or at the same time as setting the Password
Protection mode Lock Bits IRP[2].