2 * i.MX nand boot control block(bcb).
4 * Based on the common/imx-bbu-nand-fcb.c from barebox and imx kobs-ng
6 * Copyright (C) 2017 Jagan Teki <jagan@amarulasolutions.com>
7 * Copyright (C) 2016 Sergey Kubushyn <ksi@koi8.net>
9 * Reconstucted by Han Xu <han.xu@nxp.com>
11 * SPDX-License-Identifier: GPL-2.0+
19 #include <dm/devres.h>
20 #include <linux/bug.h>
23 #include <jffs2/jffs2.h>
24 #include <linux/bch.h>
25 #include <linux/mtd/mtd.h>
26 #include <linux/mtd/rawnand.h>
28 #include <asm/arch/sys_proto.h>
29 #include <asm/mach-imx/imx-nandbcb.h>
30 #include <asm/mach-imx/imximage.cfg>
32 #include <linux/mtd/mtd.h>
36 #include "../../../cmd/legacy-mtd-utils.h"
38 /* FCB related flags */
39 /* FCB layout with leading 12B reserved */
40 #define FCB_LAYOUT_RESV_12B BIT(0)
41 /* FCB layout with leading 32B meta data */
42 #define FCB_LAYOUT_META_32B BIT(1)
43 /* FCB encrypted by Hamming code */
44 #define FCB_ENCODE_HAMMING BIT(2)
45 /* FCB encrypted by 40bit BCH */
46 #define FCB_ENCODE_BCH_40b BIT(3)
47 /* FCB encrypted by 62bit BCH */
48 #define FCB_ENCODE_BCH_62b BIT(4)
49 /* FCB encrypted by BCH */
50 #define FCB_ENCODE_BCH (FCB_ENCODE_BCH_40b | FCB_ENCODE_BCH_62b)
51 /* FCB data was randomized */
52 #define FCB_RANDON_ENABLED BIT(5)
54 /* Firmware related flags */
56 #define FIRMWARE_NEED_PADDING BIT(8)
58 #define FIRMWARE_EXTRA_ONE BIT(9)
59 /* Secondary firmware on fixed address */
60 #define FIRMWARE_SECONDARY_FIXED_ADDR BIT(10)
62 /* Boot search related flags */
63 #define BT_SEARCH_CNT_FROM_FUSE BIT(16)
65 struct platform_config {
69 static struct platform_config plat_config;
72 static struct platform_config imx6qdl_plat_config = {
73 .misc_flags = FCB_LAYOUT_RESV_12B |
75 FIRMWARE_NEED_PADDING,
78 static struct platform_config imx6sx_plat_config = {
79 .misc_flags = FCB_LAYOUT_META_32B |
81 FIRMWARE_NEED_PADDING |
85 static struct platform_config imx7d_plat_config = {
86 .misc_flags = FCB_LAYOUT_META_32B |
88 FIRMWARE_NEED_PADDING |
93 static struct platform_config imx6ul_plat_config = {
94 .misc_flags = FCB_LAYOUT_META_32B |
96 FIRMWARE_NEED_PADDING,
99 static struct platform_config imx8mq_plat_config = {
100 .misc_flags = FCB_LAYOUT_META_32B |
102 FIRMWARE_NEED_PADDING |
107 /* all other imx8mm */
108 static struct platform_config imx8mm_plat_config = {
109 .misc_flags = FCB_LAYOUT_META_32B |
111 FIRMWARE_NEED_PADDING |
116 static struct platform_config imx8mn_plat_config = {
117 .misc_flags = FCB_LAYOUT_META_32B |
120 FIRMWARE_SECONDARY_FIXED_ADDR |
121 BT_SEARCH_CNT_FROM_FUSE,
125 static struct platform_config imx8q_plat_config = {
126 .misc_flags = FCB_LAYOUT_META_32B |
129 FIRMWARE_SECONDARY_FIXED_ADDR |
130 BT_SEARCH_CNT_FROM_FUSE,
133 /* boot search related variables and definitions */
134 static int g_boot_search_count = 4;
135 static int g_boot_secondary_offset;
136 static int g_boot_search_stride;
137 static int g_pages_per_stride;
139 /* mtd config structure */
142 struct mtd_info *mtd;
146 loff_t boot_stream1_address;
147 loff_t boot_stream2_address;
148 size_t boot_stream1_size;
149 size_t boot_stream2_size;
150 size_t max_boot_stream_size;
151 int stride_size_in_byte;
152 int search_area_size_in_bytes;
153 int search_area_size_in_pages;
154 int secondary_boot_stream_off_in_MB;
157 /* boot_stream config structure */
158 struct boot_stream_config {
170 #define FW_ALL FW1_ONLY | FW2_ONLY
171 #define FW_INX(x) (1 << (x))
173 /* NAND convert macros */
174 #define CONV_TO_PAGES(x) ((u32)(x) / (u32)(mtd->writesize))
175 #define CONV_TO_BLOCKS(x) ((u32)(x) / (u32)(mtd->erasesize))
177 #define GETBIT(v, n) (((v) >> (n)) & 0x1)
178 #define IMX8MQ_SPL_SZ 0x3e000
179 #define IMX8MQ_HDMI_FW_SZ 0x19c00
181 static int nandbcb_get_info(int argc, char * const argv[],
182 struct boot_config *boot_cfg)
185 struct mtd_info *mtd;
187 dev = nand_curr_device;
189 printf("failed to get nand_curr_device, run nand device\n");
190 return CMD_RET_FAILURE;
193 mtd = get_nand_dev_by_index(dev);
195 printf("failed to get mtd info\n");
196 return CMD_RET_FAILURE;
202 return CMD_RET_SUCCESS;
205 static int nandbcb_get_size(int argc, char * const argv[], int num,
206 struct boot_config *boot_cfg)
209 loff_t offset, size, maxsize;
210 struct mtd_info *mtd;
216 if (mtd_arg_off_size(argc - num, argv + num, &dev, &offset, &size,
217 &maxsize, MTD_DEV_TYPE_NAND, mtd->size))
218 return CMD_RET_FAILURE;
220 boot_cfg->maxsize = maxsize;
221 boot_cfg->offset = offset;
223 debug("max: %llx, offset: %llx\n", maxsize, offset);
225 if (size && size != maxsize)
226 boot_cfg->input_size = size;
228 return CMD_RET_SUCCESS;
231 static int nandbcb_set_boot_config(int argc, char * const argv[],
232 struct boot_config *boot_cfg)
234 struct mtd_info *mtd;
236 loff_t boot_stream1_address, boot_stream2_address, max_boot_stream_size;
238 if (!boot_cfg->mtd) {
239 printf("Didn't get the mtd info, quit\n");
240 return CMD_RET_FAILURE;
246 * set the search count as 4
247 * set each FCB/DBBT/Firmware offset at the beginning of blocks
248 * customers may change the value as needed
251 /* if need more compact layout, change these values */
252 /* g_boot_search_count was set as 4 at the definition*/
253 /* g_pages_per_stride was set as block size */
255 g_pages_per_stride = mtd->erasesize / mtd->writesize;
257 g_boot_search_stride = mtd->writesize * g_pages_per_stride;
259 boot_cfg->stride_size_in_byte = g_boot_search_stride * mtd->writesize;
260 boot_cfg->search_area_size_in_bytes =
261 g_boot_search_count * g_boot_search_stride;
262 boot_cfg->search_area_size_in_pages =
263 boot_cfg->search_area_size_in_bytes / mtd->writesize;
265 /* after FCB/DBBT, split the rest of area for two Firmwares */
266 if (!boot_cfg->maxsize) {
267 printf("Didn't get the maxsize, quit\n");
268 return CMD_RET_FAILURE;
270 maxsize = boot_cfg->maxsize;
271 /* align to page boundary */
272 maxsize = ((u32)(maxsize + mtd->writesize - 1)) / (u32)mtd->writesize
275 boot_stream1_address = 2 * boot_cfg->search_area_size_in_bytes;
276 boot_stream2_address = ((maxsize - boot_stream1_address) / 2 +
277 boot_stream1_address);
279 if (g_boot_secondary_offset)
280 boot_stream2_address =
281 (loff_t)g_boot_secondary_offset * 1024 * 1024;
283 max_boot_stream_size = boot_stream2_address - boot_stream1_address;
286 if (max_boot_stream_size <= 0) {
287 debug("st1_addr: %llx, st2_addr: %llx, max: %llx\n",
288 boot_stream1_address, boot_stream2_address,
289 max_boot_stream_size);
290 printf("something wrong with firmware address settings\n");
291 return CMD_RET_FAILURE;
293 boot_cfg->boot_stream1_address = boot_stream1_address;
294 boot_cfg->boot_stream2_address = boot_stream2_address;
295 boot_cfg->max_boot_stream_size = max_boot_stream_size;
297 /* set the boot_stream size as the input size now */
298 if (boot_cfg->input_size) {
299 boot_cfg->boot_stream1_size = boot_cfg->input_size;
300 boot_cfg->boot_stream2_size = boot_cfg->input_size;
303 return CMD_RET_SUCCESS;
306 static int nandbcb_check_space(struct boot_config *boot_cfg)
308 size_t maxsize = boot_cfg->maxsize;
309 size_t max_boot_stream_size = boot_cfg->max_boot_stream_size;
310 loff_t boot_stream2_address = boot_cfg->boot_stream2_address;
312 if (boot_cfg->boot_stream1_size &&
313 boot_cfg->boot_stream1_size > max_boot_stream_size) {
314 printf("boot stream1 doesn't fit, check partition size or settings\n");
315 return CMD_RET_FAILURE;
318 if (boot_cfg->boot_stream2_size &&
319 boot_cfg->boot_stream2_size > maxsize - boot_stream2_address) {
320 printf("boot stream2 doesn't fit, check partition size or settings\n");
321 return CMD_RET_FAILURE;
324 return CMD_RET_SUCCESS;
327 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
328 static uint8_t reverse_bit(uint8_t b)
330 b = (b & 0xf0) >> 4 | (b & 0x0f) << 4;
331 b = (b & 0xcc) >> 2 | (b & 0x33) << 2;
332 b = (b & 0xaa) >> 1 | (b & 0x55) << 1;
337 static void encode_bch_ecc(void *buf, struct fcb_block *fcb, int eccbits)
342 int ecc_buf_size = (m * eccbits + 7) / 8;
343 struct bch_control *bch = init_bch(m, eccbits, 0);
344 u8 *ecc_buf = kzalloc(ecc_buf_size, GFP_KERNEL);
345 u8 *tmp_buf = kzalloc(blocksize * numblocks, GFP_KERNEL);
349 * The blocks here are bit aligned. If eccbits is a multiple of 8,
350 * we just can copy bytes. Otherwiese we must move the blocks to
351 * the next free bit position.
353 WARN_ON(eccbits % 8);
355 memcpy(tmp_buf, fcb, sizeof(*fcb));
357 for (i = 0; i < numblocks; i++) {
358 memset(ecc_buf, 0, ecc_buf_size);
359 psrc = tmp_buf + i * blocksize;
360 pdst = buf + i * (blocksize + ecc_buf_size);
362 /* copy data byte aligned to destination buf */
363 memcpy(pdst, psrc, blocksize);
366 * imx-kobs use a modified encode_bch which reverse the
367 * bit order of the data before calculating bch.
368 * Do this in the buffer and use the bch lib here.
370 for (j = 0; j < blocksize; j++)
371 psrc[j] = reverse_bit(psrc[j]);
373 encode_bch(bch, psrc, blocksize, ecc_buf);
375 /* reverse ecc bit */
376 for (j = 0; j < ecc_buf_size; j++)
377 ecc_buf[j] = reverse_bit(ecc_buf[j]);
379 /* Here eccbuf is byte aligned and we can just copy it */
380 memcpy(pdst + blocksize, ecc_buf, ecc_buf_size);
389 static u8 calculate_parity_13_8(u8 d)
393 p |= (GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 3) ^ GETBIT(d, 2)) << 0;
394 p |= (GETBIT(d, 7) ^ GETBIT(d, 5) ^ GETBIT(d, 4) ^ GETBIT(d, 2) ^
396 p |= (GETBIT(d, 7) ^ GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 1) ^
398 p |= (GETBIT(d, 7) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 0)) << 3;
399 p |= (GETBIT(d, 6) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 2) ^
400 GETBIT(d, 1) ^ GETBIT(d, 0)) << 4;
405 static void encode_hamming_13_8(void *_src, void *_ecc, size_t size)
411 for (i = 0; i < size; i++)
412 ecc[i] = calculate_parity_13_8(src[i]);
416 static u32 calc_chksum(void *buf, size_t size)
422 for (i = 0; i < size; i++)
428 static void fill_fcb(struct fcb_block *fcb, struct boot_config *boot_cfg)
430 struct mtd_info *mtd = boot_cfg->mtd;
431 struct nand_chip *chip = mtd_to_nand(mtd);
432 struct mxs_nand_info *nand_info = nand_get_controller_data(chip);
433 struct mxs_nand_layout l;
435 mxs_nand_get_layout(mtd, &l);
437 fcb->fingerprint = FCB_FINGERPRINT;
438 fcb->version = FCB_VERSION_1;
442 fcb->addr_setup = 25;
443 fcb->dsample_time = 6;
445 fcb->pagesize = mtd->writesize;
446 fcb->oob_pagesize = mtd->writesize + mtd->oobsize;
447 fcb->sectors = mtd->erasesize / mtd->writesize;
449 fcb->meta_size = l.meta_size;
450 fcb->nr_blocks = l.nblocks;
451 fcb->ecc_nr = l.data0_size;
452 fcb->ecc_level = l.ecc0;
453 fcb->ecc_size = l.datan_size;
454 fcb->ecc_type = l.eccn;
455 fcb->bchtype = l.gf_len;
457 /* DBBT search area starts from the next block after all FCB */
458 fcb->dbbt_start = boot_cfg->search_area_size_in_pages;
460 fcb->bb_byte = nand_info->bch_geometry.block_mark_byte_offset;
461 fcb->bb_start_bit = nand_info->bch_geometry.block_mark_bit_offset;
463 fcb->phy_offset = mtd->writesize;
467 fcb->fw1_start = CONV_TO_PAGES(boot_cfg->boot_stream1_address);
468 fcb->fw2_start = CONV_TO_PAGES(boot_cfg->boot_stream2_address);
469 fcb->fw1_pages = CONV_TO_PAGES(boot_cfg->boot_stream1_size);
470 fcb->fw2_pages = CONV_TO_PAGES(boot_cfg->boot_stream2_size);
472 fcb->checksum = calc_chksum((void *)fcb + 4, sizeof(*fcb) - 4);
475 static int fill_dbbt_data(struct mtd_info *mtd, void *buf, int num_blocks)
477 int n, n_bad_blocks = 0;
479 u32 *n_bad_blocksp = buf + 0x4;
481 for (n = 0; n < num_blocks; n++) {
482 loff_t offset = (loff_t)n * mtd->erasesize;
483 if (mtd_block_isbad(mtd, offset)) {
490 *n_bad_blocksp = n_bad_blocks;
496 * return 1 - bad block
497 * return 0 - read successfully
498 * return < 0 - read failed
500 static int read_fcb(struct boot_config *boot_cfg, struct fcb_block *fcb,
503 struct mtd_info *mtd;
510 fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize, GFP_KERNEL);
512 debug("failed to allocate fcb_raw_page\n");
518 * User BCH hardware to decode ECC for FCB
520 if (plat_config.misc_flags & FCB_ENCODE_BCH) {
521 size = sizeof(struct fcb_block);
523 /* switch nand BCH to FCB compatible settings */
524 if (plat_config.misc_flags & FCB_ENCODE_BCH_62b)
525 mxs_nand_mode_fcb_62bit(mtd);
526 else if (plat_config.misc_flags & FCB_ENCODE_BCH_40b)
527 mxs_nand_mode_fcb_40bit(mtd);
529 ret = nand_read_skip_bad(mtd, off, &size, NULL, mtd->size, (u_char *)fcb);
531 /* switch BCH back */
532 mxs_nand_mode_normal(mtd);
533 printf("NAND FCB read from 0x%llx offset 0x%zx read: %s\n",
534 off, size, ret ? "ERROR" : "OK");
536 } else if (plat_config.misc_flags & FCB_ENCODE_HAMMING) {
538 mtd_oob_ops_t ops = {
539 .datbuf = (u8 *)fcb_raw_page,
540 .oobbuf = ((u8 *)fcb_raw_page) + mtd->writesize,
541 .len = mtd->writesize,
542 .ooblen = mtd->oobsize,
546 ret = mtd_read_oob(mtd, off, &ops);
547 printf("NAND FCB read from 0x%llx offset 0x%zx read: %s\n",
548 off, ops.len, ret ? "ERROR" : "OK");
552 goto fcb_raw_page_err;
554 if ((plat_config.misc_flags & FCB_ENCODE_HAMMING) &&
555 (plat_config.misc_flags & FCB_LAYOUT_RESV_12B))
556 memcpy(fcb, fcb_raw_page + 12, sizeof(struct fcb_block));
558 /* TODO: check if it can pass Hamming check */
566 static int write_fcb(struct boot_config *boot_cfg, struct fcb_block *fcb)
568 struct mtd_info *mtd;
569 void *fcb_raw_page = NULL;
577 * We prepare raw page only for i.MX6, for i.MX7 we
578 * leverage BCH hw module instead
580 if ((plat_config.misc_flags & FCB_ENCODE_HAMMING) &&
581 (plat_config.misc_flags & FCB_LAYOUT_RESV_12B)) {
582 fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize,
585 debug("failed to allocate fcb_raw_page\n");
590 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
591 /* 40 bit BCH, for i.MX6UL(L) */
592 encode_bch_ecc(fcb_raw_page + 32, fcb, 40);
594 memcpy(fcb_raw_page + 12, fcb, sizeof(struct fcb_block));
595 encode_hamming_13_8(fcb_raw_page + 12,
596 fcb_raw_page + 12 + 512, 512);
599 * Set the first and second byte of OOB data to 0xFF,
600 * not 0x00. These bytes are used as the Manufacturers Bad
601 * Block Marker (MBBM). Since the FCB is mostly written to
602 * the first page in a block, a scan for
603 * factory bad blocks will detect these blocks as bad, e.g.
604 * when function nand_scan_bbt() is executed to build a new
607 memset(fcb_raw_page + mtd->writesize, 0xFF, 2);
610 /* start writing FCB from the very beginning */
613 for (i = 0; i < g_boot_search_count; i++) {
614 if (mtd_block_isbad(mtd, off)) {
615 printf("Block %d is bad, skipped\n", i);
616 off += mtd->erasesize;
621 * User BCH hardware module to generate ECC for FCB
623 if (plat_config.misc_flags & FCB_ENCODE_BCH) {
624 size = sizeof(struct fcb_block);
626 /* switch nand BCH to FCB compatible settings */
627 if (plat_config.misc_flags & FCB_ENCODE_BCH_62b)
628 mxs_nand_mode_fcb_62bit(mtd);
629 else if (plat_config.misc_flags & FCB_ENCODE_BCH_40b)
630 mxs_nand_mode_fcb_40bit(mtd);
632 ret = nand_write(mtd, off, &size, (u_char *)fcb);
634 /* switch BCH back */
635 mxs_nand_mode_normal(mtd);
636 printf("NAND FCB write to 0x%zx offset 0x%llx written: %s\n",
637 size, off, ret ? "ERROR" : "OK");
639 } else if (plat_config.misc_flags & FCB_ENCODE_HAMMING) {
641 mtd_oob_ops_t ops = {
642 .datbuf = (u8 *)fcb_raw_page,
643 .oobbuf = ((u8 *)fcb_raw_page) +
645 .len = mtd->writesize,
646 .ooblen = mtd->oobsize,
650 ret = mtd_write_oob(mtd, off, &ops);
651 printf("NAND FCB write to 0x%llx offset 0x%zx written: %s\n", off, ops.len, ret ? "ERROR" : "OK");
655 goto fcb_raw_page_err;
657 /* next writing location */
658 off += g_boot_search_stride;
668 * return 1 - bad block
669 * return 0 - read successfully
670 * return < 0 - read failed
672 static int read_dbbt(struct boot_config *boot_cfg, struct dbbt_block *dbbt,
673 void *dbbt_data_page, loff_t off)
677 struct mtd_info *mtd;
683 size = sizeof(struct dbbt_block);
684 ret = nand_read_skip_bad(mtd, off, &size, &actual_size, mtd->size, (u_char *)dbbt);
685 printf("NAND DBBT read from 0x%llx offset 0x%zx read: %s\n",
686 off, size, ret ? "ERROR" : "OK");
690 /* dbbtpages == 0 if no bad blocks */
691 if (dbbt->dbbtpages > 0) {
692 to = off + 4 * mtd->writesize + actual_size - size;
693 size = mtd->writesize;
694 ret = nand_read_skip_bad(mtd, to, &size, NULL, mtd->size, dbbt_data_page);
695 printf("DBBT data read from 0x%llx offset 0x%zx read: %s\n",
696 to, size, ret ? "ERROR" : "OK");
705 static int write_dbbt(struct boot_config *boot_cfg, struct dbbt_block *dbbt,
706 void *dbbt_data_page)
711 struct mtd_info *mtd;
716 /* start writing DBBT after all FCBs */
717 off = boot_cfg->search_area_size_in_bytes;
718 size = mtd->writesize;
720 for (i = 0; i < g_boot_search_count; i++) {
721 if (mtd_block_isbad(mtd, off)) {
722 printf("Block %d is bad, skipped\n",
723 (int)(i + CONV_TO_BLOCKS(off)));
724 off += mtd->erasesize;
728 ret = nand_write(mtd, off, &size, (u_char *)dbbt);
729 printf("NAND DBBT write to 0x%llx offset 0x%zx written: %s\n",
730 off, size, ret ? "ERROR" : "OK");
734 /* dbbtpages == 0 if no bad blocks */
735 if (dbbt->dbbtpages > 0) {
736 to = off + 4 * mtd->writesize;
737 ret = nand_write(mtd, to, &size, dbbt_data_page);
738 printf("DBBT data write to 0x%llx offset 0x%zx written: %s\n",
739 to, size, ret ? "ERROR" : "OK");
745 /* next writing location */
746 off += g_boot_search_stride;
752 /* reuse the check_skip_len from nand_util.c with minor change*/
753 static int check_skip_length(struct boot_config *boot_cfg, loff_t offset,
754 size_t length, size_t *used)
756 struct mtd_info *mtd = boot_cfg->mtd;
757 size_t maxsize = boot_cfg->maxsize;
758 size_t len_excl_bad = 0;
761 while (len_excl_bad < length) {
762 size_t block_len, block_off;
765 if (offset >= maxsize)
768 block_start = offset & ~(loff_t)(mtd->erasesize - 1);
769 block_off = offset & (mtd->erasesize - 1);
770 block_len = mtd->erasesize - block_off;
772 if (!nand_block_isbad(mtd, block_start))
773 len_excl_bad += block_len;
781 /* If the length is not a multiple of block_len, adjust. */
782 if (len_excl_bad > length)
783 *used -= (len_excl_bad - length);
788 static int nandbcb_get_next_good_blk_addr(struct boot_config *boot_cfg,
789 struct boot_stream_config *bs_cfg)
791 struct mtd_info *mtd = boot_cfg->mtd;
792 loff_t offset = bs_cfg->bs_addr;
793 size_t length = bs_cfg->bs_size;
797 ret = check_skip_length(boot_cfg, offset, length, &used);
802 /* get next image address */
803 bs_cfg->next_bs_addr = (u32)(offset + used + mtd->erasesize - 1)
804 / (u32)mtd->erasesize * mtd->erasesize;
809 static int nandbcb_write_bs_skip_bad(struct boot_config *boot_cfg,
810 struct boot_stream_config *bs_cfg)
812 struct mtd_info *mtd;
814 loff_t offset, maxsize;
818 bool padding_flag = false;
821 offset = bs_cfg->bs_addr;
822 maxsize = boot_cfg->maxsize;
823 size = bs_cfg->bs_size;
825 /* some boot images may need leading offset */
826 if (bs_cfg->need_padding &&
827 (plat_config.misc_flags & FIRMWARE_NEED_PADDING))
831 length = ALIGN(size + FLASH_OFFSET_STANDARD, mtd->writesize);
833 length = ALIGN(size, mtd->writesize);
835 buf = kzalloc(length, GFP_KERNEL);
837 printf("failed to allocate buffer for firmware\n");
843 memcpy(buf + FLASH_OFFSET_STANDARD, bs_cfg->bs_buf, size);
845 memcpy(buf, bs_cfg->bs_buf, size);
847 ret = nand_write_skip_bad(mtd, offset, &length, NULL, maxsize,
848 (u_char *)buf, WITH_WR_VERIFY);
849 printf("Write %s @0x%llx offset, 0x%zx bytes written: %s\n",
850 bs_cfg->bs_label, offset, length, ret ? "ERROR" : "OK");
853 /* write image failed, quit */
856 /* get next good blk address if needed */
857 if (bs_cfg->need_padding) {
858 ret = nandbcb_get_next_good_blk_addr(boot_cfg, bs_cfg);
860 printf("Next image cannot fit in NAND partition\n");
865 /* now we know how the exact image size written to NAND */
866 bs_cfg->bs_size = length;
873 static int nandbcb_write_fw(struct boot_config *boot_cfg, u_char *buf,
880 struct boot_stream_config bs_cfg;
883 for (i = 0; i < 2; ++i) {
884 if (!(FW_INX(i) & index))
888 offset = boot_cfg->boot_stream1_address;
889 size = boot_cfg->boot_stream1_size;
891 offset = boot_cfg->boot_stream2_address;
892 size = boot_cfg->boot_stream2_size;
896 if (!(plat_config.misc_flags & FIRMWARE_EXTRA_ONE)) {
897 memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
898 sprintf(bs_cfg.bs_label, "firmware%d", i);
899 bs_cfg.bs_addr = offset;
900 bs_cfg.bs_size = size;
902 bs_cfg.need_padding = 1;
904 ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
908 /* update the boot stream size */
910 boot_cfg->boot_stream1_size = bs_cfg.bs_size;
912 boot_cfg->boot_stream2_size = bs_cfg.bs_size;
915 /* some platforms need extra firmware */
916 memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
917 sprintf(bs_cfg.bs_label, "fw%d_part%d", i, 1);
918 bs_cfg.bs_addr = offset;
919 bs_cfg.bs_size = IMX8MQ_HDMI_FW_SZ;
921 bs_cfg.need_padding = 1;
923 ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
927 /* update the boot stream size */
929 boot_cfg->boot_stream1_size = bs_cfg.bs_size;
931 boot_cfg->boot_stream2_size = bs_cfg.bs_size;
933 /* get next image address */
934 next_bs_addr = bs_cfg.next_bs_addr;
936 memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
937 sprintf(bs_cfg.bs_label, "fw%d_part%d", i, 2);
938 bs_cfg.bs_addr = next_bs_addr;
939 bs_cfg.bs_size = IMX8MQ_SPL_SZ;
940 bs_cfg.bs_buf = (u_char *)(buf + IMX8MQ_HDMI_FW_SZ);
941 bs_cfg.need_padding = 0;
943 ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
952 static int nandbcb_init(struct boot_config *boot_cfg, u_char *buf)
954 struct mtd_info *mtd;
955 nand_erase_options_t opts;
956 struct fcb_block *fcb;
957 struct dbbt_block *dbbt;
958 void *dbbt_page, *dbbt_data_page;
963 maxsize = boot_cfg->maxsize;
964 off = boot_cfg->offset;
967 memset(&opts, 0, sizeof(opts));
969 opts.length = maxsize - 1;
970 ret = nand_erase_opts(mtd, &opts);
972 printf("%s: erase failed (ret = %d)\n", __func__, ret);
977 * Reference documentation from i.MX6DQRM section 8.5.2.2
979 * Nand Boot Control Block(BCB) contains two data structures,
980 * - Firmware Configuration Block(FCB)
981 * - Discovered Bad Block Table(DBBT)
985 * - DBBT search page address,
986 * - start page address of primary firmware
987 * - start page address of secondary firmware
990 * - number of blocks = mtd partition size / mtd erasesize
991 * - two firmware blocks, primary and secondary
992 * - first 4 block for FCB/DBBT
993 * - rest split in half for primary and secondary firmware
994 * - same firmware write twice
998 ret = nandbcb_write_fw(boot_cfg, buf, FW_ALL);
1003 fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
1005 debug("failed to allocate fcb\n");
1009 fill_fcb(fcb, boot_cfg);
1011 ret = write_fcb(boot_cfg, fcb);
1014 dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
1016 debug("failed to allocate dbbt_page\n");
1021 dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1022 if (!dbbt_data_page) {
1023 debug("failed to allocate dbbt_data_page\n");
1030 dbbt->fingerprint = DBBT_FINGERPRINT;
1031 dbbt->version = DBBT_VERSION_1;
1032 ret = fill_dbbt_data(mtd, dbbt_data_page, CONV_TO_BLOCKS(maxsize));
1034 goto dbbt_data_page_err;
1036 dbbt->dbbtpages = 1;
1039 ret = write_dbbt(boot_cfg, dbbt, dbbt_data_page);
1041 printf("failed to write FCB/DBBT\n");
1044 kfree(dbbt_data_page);
1053 static int do_nandbcb_bcbonly(int argc, char *const argv[])
1055 struct fcb_block *fcb;
1056 struct dbbt_block *dbbt;
1057 struct mtd_info *mtd;
1058 nand_erase_options_t opts;
1061 void *dbbt_page, *dbbt_data_page;
1063 struct boot_config cfg;
1066 return CMD_RET_USAGE;
1068 memset(&cfg, 0, sizeof(struct boot_config));
1069 if (nandbcb_get_info(argc, argv, &cfg))
1070 return CMD_RET_FAILURE;
1072 /* only get the partition info */
1073 if (nandbcb_get_size(2, argv, 1, &cfg))
1074 return CMD_RET_FAILURE;
1076 if (nandbcb_set_boot_config(argc, argv, &cfg))
1077 return CMD_RET_FAILURE;
1081 cfg.boot_stream1_address = hextoul(argv[2], NULL);
1082 cfg.boot_stream1_size = hextoul(argv[3], NULL);
1083 cfg.boot_stream1_size = ALIGN(cfg.boot_stream1_size, mtd->writesize);
1086 cfg.boot_stream2_address = hextoul(argv[4], NULL);
1087 cfg.boot_stream2_size = hextoul(argv[5], NULL);
1088 cfg.boot_stream2_size = ALIGN(cfg.boot_stream2_size,
1093 nandbcb_check_space(&cfg);
1095 maxsize = cfg.maxsize;
1098 /* erase the previous FCB/DBBT */
1099 memset(&opts, 0, sizeof(opts));
1101 opts.length = g_boot_search_stride * 2;
1102 ret = nand_erase_opts(mtd, &opts);
1104 printf("%s: erase failed (ret = %d)\n", __func__, ret);
1105 return CMD_RET_FAILURE;
1109 fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
1111 printf("failed to allocate fcb\n");
1113 return CMD_RET_FAILURE;
1116 fill_fcb(fcb, &cfg);
1119 ret = write_fcb(&cfg, fcb);
1122 dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
1124 printf("failed to allocate dbbt_page\n");
1129 dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1130 if (!dbbt_data_page) {
1131 printf("failed to allocate dbbt_data_page\n");
1138 dbbt->fingerprint = DBBT_FINGERPRINT;
1139 dbbt->version = DBBT_VERSION_1;
1140 ret = fill_dbbt_data(mtd, dbbt_data_page, CONV_TO_BLOCKS(maxsize));
1142 goto dbbt_data_page_err;
1144 dbbt->dbbtpages = 1;
1147 ret = write_dbbt(&cfg, dbbt, dbbt_data_page);
1150 kfree(dbbt_data_page);
1157 printf("failed to write FCB/DBBT\n");
1158 return CMD_RET_FAILURE;
1161 return CMD_RET_SUCCESS;
1164 /* dump data which is read from NAND chip */
1165 void dump_structure(struct boot_config *boot_cfg, struct fcb_block *fcb,
1166 struct dbbt_block *dbbt, void *dbbt_data_page)
1169 struct mtd_info *mtd = boot_cfg->mtd;
1171 #define P1(x) printf(" %s = 0x%08x\n", #x, fcb->x)
1177 #define P1(x) printf(" %s = %d\n", #x, fcb->x)
1222 #if !defined(CONFIG_MX6) || defined(CONFIG_MX6SX) || \
1223 defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
1224 P1(onfi_sync_enable);
1225 P1(onfi_sync_speed);
1226 P1(onfi_sync_nand_data);
1228 P1(disbbm_search_limit);
1229 P1(read_retry_enable);
1232 #define P1(x) printf(" %s = 0x%08x\n", #x, dbbt->x)
1238 #define P1(x) printf(" %s = %d\n", #x, dbbt->x)
1242 for (i = 0; i < dbbt->dbbtpages; ++i)
1243 printf("%d ", *((u32 *)(dbbt_data_page + i)));
1245 if (!(plat_config.misc_flags & FIRMWARE_EXTRA_ONE)) {
1246 printf("Firmware: image #0 @ 0x%x size 0x%x\n",
1247 fcb->fw1_start, fcb->fw1_pages * mtd->writesize);
1248 printf("Firmware: image #1 @ 0x%x size 0x%x\n",
1249 fcb->fw2_start, fcb->fw2_pages * mtd->writesize);
1251 printf("Firmware: image #0 @ 0x%x size 0x%x\n",
1252 fcb->fw1_start, fcb->fw1_pages * mtd->writesize);
1253 printf("Firmware: image #1 @ 0x%x size 0x%x\n",
1254 fcb->fw2_start, fcb->fw2_pages * mtd->writesize);
1255 /* TODO: Add extra image information */
1259 static bool check_fingerprint(void *data, int fingerprint)
1263 return (*(int *)(data + off) == fingerprint);
1266 static int fuse_secondary_boot(u32 bank, u32 word, u32 mask, u32 off)
1272 err = fuse_read(bank, word, &val);
1276 val = (val & mask) >> off;
1296 static int fuse_to_search_count(u32 bank, u32 word, u32 mask, u32 off)
1302 /* by default, the boot search count from fuse should be 2 */
1303 err = fuse_read(bank, word, &val);
1307 val = (val & mask) >> off;
1325 static int nandbcb_dump(struct boot_config *boot_cfg)
1329 struct mtd_info *mtd = boot_cfg->mtd;
1330 struct fcb_block fcb, fcb_copy;
1331 struct dbbt_block dbbt, dbbt_copy;
1332 void *dbbt_data_page, *dbbt_data_page_copy;
1333 bool fcb_not_found, dbbt_not_found;
1336 dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1337 if (!dbbt_data_page) {
1338 printf("failed to allocate dbbt_data_page\n");
1343 dbbt_data_page_copy = kzalloc(mtd->writesize, GFP_KERNEL);
1344 if (!dbbt_data_page_copy) {
1345 printf("failed to allocate dbbt_data_page\n");
1353 for (i = 0; i < g_boot_search_count; ++i) {
1354 if (fcb_not_found) {
1355 ret = read_fcb(boot_cfg, &fcb, off);
1358 goto dbbt_page_copy_err;
1362 if (check_fingerprint(&fcb, FCB_FINGERPRINT))
1365 ret = read_fcb(boot_cfg, &fcb_copy, off);
1368 goto dbbt_page_copy_err;
1369 if (memcmp(&fcb, &fcb_copy,
1370 sizeof(struct fcb_block))) {
1371 printf("FCB copies are not identical\n");
1373 goto dbbt_page_copy_err;
1377 /* next read location */
1378 off += g_boot_search_stride;
1383 off = boot_cfg->search_area_size_in_bytes;
1384 for (i = 0; i < g_boot_search_count; ++i) {
1385 if (dbbt_not_found) {
1386 ret = read_dbbt(boot_cfg, &dbbt, dbbt_data_page, off);
1389 goto dbbt_page_copy_err;
1393 if (check_fingerprint(&dbbt, DBBT_FINGERPRINT))
1396 ret = read_dbbt(boot_cfg, &dbbt_copy,
1397 dbbt_data_page_copy, off);
1400 goto dbbt_page_copy_err;
1401 if (memcmp(&dbbt, &dbbt_copy,
1402 sizeof(struct dbbt_block))) {
1403 printf("DBBT copies are not identical\n");
1405 goto dbbt_page_copy_err;
1407 if (dbbt.dbbtpages > 0 &&
1408 memcmp(dbbt_data_page, dbbt_data_page_copy,
1410 printf("DBBT data copies are not identical\n");
1412 goto dbbt_page_copy_err;
1416 /* next read location */
1417 off += g_boot_search_stride;
1420 dump_structure(boot_cfg, &fcb, &dbbt, dbbt_data_page);
1423 kfree(dbbt_data_page_copy);
1425 kfree(dbbt_data_page);
1430 static int do_nandbcb_dump(int argc, char * const argv[])
1432 struct boot_config cfg;
1436 return CMD_RET_USAGE;
1438 memset(&cfg, 0, sizeof(struct boot_config));
1439 if (nandbcb_get_info(argc, argv, &cfg))
1440 return CMD_RET_FAILURE;
1442 if (nandbcb_get_size(argc, argv, 1, &cfg))
1443 return CMD_RET_FAILURE;
1445 if (nandbcb_set_boot_config(argc, argv, &cfg))
1446 return CMD_RET_FAILURE;
1448 ret = nandbcb_dump(&cfg);
1455 static int do_nandbcb_init(int argc, char * const argv[])
1462 struct boot_config cfg;
1465 return CMD_RET_USAGE;
1467 memset(&cfg, 0, sizeof(struct boot_config));
1468 if (nandbcb_get_info(argc, argv, &cfg))
1469 return CMD_RET_FAILURE;
1471 if (nandbcb_get_size(argc, argv, 2, &cfg))
1472 return CMD_RET_FAILURE;
1473 size = cfg.boot_stream1_size;
1475 if (nandbcb_set_boot_config(argc, argv, &cfg))
1476 return CMD_RET_FAILURE;
1478 addr = hextoul(argv[1], &endp);
1479 if (*argv[1] == 0 || *endp != 0)
1480 return CMD_RET_FAILURE;
1482 buf = map_physmem(addr, size, MAP_WRBACK);
1484 puts("failed to map physical memory\n");
1485 return CMD_RET_FAILURE;
1488 ret = nandbcb_init(&cfg, buf);
1490 return ret == 0 ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
1493 static int do_nandbcb(struct cmd_tbl *cmdtp, int flag, int argc,
1502 /* check the platform config first */
1504 plat_config = imx6sx_plat_config;
1505 } else if (is_mx7()) {
1506 plat_config = imx7d_plat_config;
1507 } else if (is_mx6ul() || is_mx6ull()) {
1508 plat_config = imx6ul_plat_config;
1509 } else if (is_mx6() && !is_mx6sx() && !is_mx6ul() && !is_mx6ull()) {
1510 plat_config = imx6qdl_plat_config;
1511 } else if (is_imx8mq()) {
1512 plat_config = imx8mq_plat_config;
1513 } else if (is_imx8mm()) {
1514 plat_config = imx8mm_plat_config;
1515 } else if (is_imx8mn() || is_imx8mp()) {
1516 plat_config = imx8mn_plat_config;
1517 } else if (is_imx8qm() || is_imx8qxp()) {
1518 plat_config = imx8q_plat_config;
1520 printf("ERROR: Unknown platform\n");
1521 return CMD_RET_FAILURE;
1524 if ((plat_config.misc_flags) & BT_SEARCH_CNT_FROM_FUSE) {
1526 g_boot_search_count = fuse_to_search_count(0, 720, 0xc0, 6);
1527 if (is_imx8mn() || is_imx8mp())
1528 g_boot_search_count = fuse_to_search_count(2, 2, 0x6000, 13);
1529 printf("search count set to %d from fuse\n",
1530 g_boot_search_count);
1533 if (plat_config.misc_flags & FIRMWARE_SECONDARY_FIXED_ADDR) {
1535 g_boot_secondary_offset = fuse_secondary_boot(2, 1, 0xff0000, 16);
1542 if (strcmp(cmd, "init") == 0) {
1543 ret = do_nandbcb_init(argc, argv);
1547 if (strcmp(cmd, "dump") == 0) {
1548 ret = do_nandbcb_dump(argc, argv);
1552 if (strcmp(cmd, "bcbonly") == 0) {
1553 ret = do_nandbcb_bcbonly(argc, argv);
1561 return CMD_RET_USAGE;
1564 #ifdef CONFIG_SYS_LONGHELP
1565 static char nandbcb_help_text[] =
1566 "init addr off|partition len - update 'len' bytes starting at\n"
1567 " 'off|part' to memory address 'addr', skipping bad blocks\n"
1568 "nandbcb bcbonly off|partition fw1-off fw1-size [fw2-off fw2-size]\n"
1569 " - write BCB only (FCB and DBBT)\n"
1570 " where `fwx-size` is fw sizes in bytes, `fw1-off`\n"
1571 " and `fw2-off` - firmware offsets\n"
1572 " FIY, BCB isn't erased automatically, so mtd erase should\n"
1573 " be called in advance before writing new BCB:\n"
1574 " > mtd erase mx7-bcb\n"
1575 "nandbcb dump off|partition - dump/verify boot structures\n";
1578 U_BOOT_CMD(nandbcb, 7, 1, do_nandbcb,
1579 "i.MX NAND Boot Control Blocks write",