cmd_nand: fix crashing bug in nand read/write
[platform/kernel/u-boot.git] / common / cmd_nand.c
1 /*
2  * Driver for NAND support, Rick Bronson
3  * borrowed heavily from:
4  * (c) 1999 Machine Vision Holdings, Inc.
5  * (c) 1999, 2000 David Woodhouse <dwmw2@infradead.org>
6  *
7  * Ported 'dynenv' to 'nand env.oob' command
8  * (C) 2010 Nanometrics, Inc.
9  * 'dynenv' -- Dynamic environment offset in NAND OOB
10  * (C) Copyright 2006-2007 OpenMoko, Inc.
11  * Added 16-bit nand support
12  * (C) 2004 Texas Instruments
13  *
14  * Copyright 2010, 2012 Freescale Semiconductor
15  * The portions of this file whose copyright is held by Freescale and which
16  * are not considered a derived work of GPL v2-only code may be distributed
17  * and/or modified under the terms of the GNU General Public License as
18  * published by the Free Software Foundation; either version 2 of the
19  * License, or (at your option) any later version.
20  */
21
22 #include <common.h>
23 #include <linux/mtd/mtd.h>
24 #include <command.h>
25 #include <watchdog.h>
26 #include <malloc.h>
27 #include <asm/byteorder.h>
28 #include <jffs2/jffs2.h>
29 #include <nand.h>
30
31 #if defined(CONFIG_CMD_MTDPARTS)
32
33 /* partition handling routines */
34 int mtdparts_init(void);
35 int id_parse(const char *id, const char **ret_id, u8 *dev_type, u8 *dev_num);
36 int find_dev_and_part(const char *id, struct mtd_device **dev,
37                       u8 *part_num, struct part_info **part);
38 #endif
39
40 static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
41 {
42         int i;
43         u_char *datbuf, *oobbuf, *p;
44         static loff_t last;
45
46         if (repeat)
47                 off = last + nand->writesize;
48
49         last = off;
50
51         datbuf = malloc(nand->writesize);
52         oobbuf = malloc(nand->oobsize);
53         if (!datbuf || !oobbuf) {
54                 puts("No memory for page buffer\n");
55                 return 1;
56         }
57         off &= ~(nand->writesize - 1);
58         loff_t addr = (loff_t) off;
59         struct mtd_oob_ops ops;
60         memset(&ops, 0, sizeof(ops));
61         ops.datbuf = datbuf;
62         ops.oobbuf = oobbuf;
63         ops.len = nand->writesize;
64         ops.ooblen = nand->oobsize;
65         ops.mode = MTD_OOB_RAW;
66         i = nand->read_oob(nand, addr, &ops);
67         if (i < 0) {
68                 printf("Error (%d) reading page %08lx\n", i, off);
69                 free(datbuf);
70                 free(oobbuf);
71                 return 1;
72         }
73         printf("Page %08lx dump:\n", off);
74         i = nand->writesize >> 4;
75         p = datbuf;
76
77         while (i--) {
78                 if (!only_oob)
79                         printf("\t%02x %02x %02x %02x %02x %02x %02x %02x"
80                                "  %02x %02x %02x %02x %02x %02x %02x %02x\n",
81                                p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7],
82                                p[8], p[9], p[10], p[11], p[12], p[13], p[14],
83                                p[15]);
84                 p += 16;
85         }
86         puts("OOB:\n");
87         i = nand->oobsize >> 3;
88         p = oobbuf;
89         while (i--) {
90                 printf("\t%02x %02x %02x %02x %02x %02x %02x %02x\n",
91                        p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
92                 p += 8;
93         }
94         free(datbuf);
95         free(oobbuf);
96
97         return 0;
98 }
99
100 /* ------------------------------------------------------------------------- */
101
102 static int set_dev(int dev)
103 {
104         if (dev < 0 || dev >= CONFIG_SYS_MAX_NAND_DEVICE ||
105             !nand_info[dev].name) {
106                 puts("No such device\n");
107                 return -1;
108         }
109
110         if (nand_curr_device == dev)
111                 return 0;
112
113         printf("Device %d: %s", dev, nand_info[dev].name);
114         puts("... is now current device\n");
115         nand_curr_device = dev;
116
117 #ifdef CONFIG_SYS_NAND_SELECT_DEVICE
118         board_nand_select_device(nand_info[dev].priv, dev);
119 #endif
120
121         return 0;
122 }
123
124 static inline int str2off(const char *p, loff_t *num)
125 {
126         char *endptr;
127
128         *num = simple_strtoull(p, &endptr, 16);
129         return *p != '\0' && *endptr == '\0';
130 }
131
132 static inline int str2long(const char *p, ulong *num)
133 {
134         char *endptr;
135
136         *num = simple_strtoul(p, &endptr, 16);
137         return *p != '\0' && *endptr == '\0';
138 }
139
140 static int get_part(const char *partname, int *idx, loff_t *off, loff_t *size)
141 {
142 #ifdef CONFIG_CMD_MTDPARTS
143         struct mtd_device *dev;
144         struct part_info *part;
145         u8 pnum;
146         int ret;
147
148         ret = mtdparts_init();
149         if (ret)
150                 return ret;
151
152         ret = find_dev_and_part(partname, &dev, &pnum, &part);
153         if (ret)
154                 return ret;
155
156         if (dev->id->type != MTD_DEV_TYPE_NAND) {
157                 puts("not a NAND device\n");
158                 return -1;
159         }
160
161         *off = part->offset;
162         *size = part->size;
163         *idx = dev->id->num;
164
165         ret = set_dev(*idx);
166         if (ret)
167                 return ret;
168
169         return 0;
170 #else
171         puts("offset is not a number\n");
172         return -1;
173 #endif
174 }
175
176 static int arg_off(const char *arg, int *idx, loff_t *off, loff_t *maxsize)
177 {
178         if (!str2off(arg, off))
179                 return get_part(arg, idx, off, maxsize);
180
181         if (*off >= nand_info[*idx].size) {
182                 puts("Offset exceeds device limit\n");
183                 return -1;
184         }
185
186         *maxsize = nand_info[*idx].size - *off;
187         return 0;
188 }
189
190 static int arg_off_size(int argc, char *const argv[], int *idx,
191                         loff_t *off, loff_t *size)
192 {
193         int ret;
194         loff_t maxsize = 0;
195
196         if (argc == 0) {
197                 *off = 0;
198                 *size = nand_info[*idx].size;
199                 goto print;
200         }
201
202         ret = arg_off(argv[0], idx, off, &maxsize);
203         if (ret)
204                 return ret;
205
206         if (argc == 1) {
207                 *size = maxsize;
208                 goto print;
209         }
210
211         if (!str2off(argv[1], size)) {
212                 printf("'%s' is not a number\n", argv[1]);
213                 return -1;
214         }
215
216         if (*size > maxsize) {
217                 puts("Size exceeds partition or device limit\n");
218                 return -1;
219         }
220
221 print:
222         printf("device %d ", *idx);
223         if (*size == nand_info[*idx].size)
224                 puts("whole chip\n");
225         else
226                 printf("offset 0x%llx, size 0x%llx\n",
227                        (unsigned long long)*off, (unsigned long long)*size);
228         return 0;
229 }
230
231 #ifdef CONFIG_CMD_NAND_LOCK_UNLOCK
232 static void print_status(ulong start, ulong end, ulong erasesize, int status)
233 {
234         printf("%08lx - %08lx: %08lx blocks %s%s%s\n",
235                 start,
236                 end - 1,
237                 (end - start) / erasesize,
238                 ((status & NAND_LOCK_STATUS_TIGHT) ?  "TIGHT " : ""),
239                 ((status & NAND_LOCK_STATUS_LOCK) ?  "LOCK " : ""),
240                 ((status & NAND_LOCK_STATUS_UNLOCK) ?  "UNLOCK " : ""));
241 }
242
243 static void do_nand_status(nand_info_t *nand)
244 {
245         ulong block_start = 0;
246         ulong off;
247         int last_status = -1;
248
249         struct nand_chip *nand_chip = nand->priv;
250         /* check the WP bit */
251         nand_chip->cmdfunc(nand, NAND_CMD_STATUS, -1, -1);
252         printf("device is %swrite protected\n",
253                 (nand_chip->read_byte(nand) & 0x80 ?
254                 "NOT " : ""));
255
256         for (off = 0; off < nand->size; off += nand->erasesize) {
257                 int s = nand_get_lock_status(nand, off);
258
259                 /* print message only if status has changed */
260                 if (s != last_status && off != 0) {
261                         print_status(block_start, off, nand->erasesize,
262                                         last_status);
263                         block_start = off;
264                 }
265                 last_status = s;
266         }
267         /* Print the last block info */
268         print_status(block_start, off, nand->erasesize, last_status);
269 }
270 #endif
271
272 #ifdef CONFIG_ENV_OFFSET_OOB
273 unsigned long nand_env_oob_offset;
274
275 int do_nand_env_oob(cmd_tbl_t *cmdtp, int argc, char *const argv[])
276 {
277         int ret;
278         uint32_t oob_buf[ENV_OFFSET_SIZE/sizeof(uint32_t)];
279         nand_info_t *nand = &nand_info[0];
280         char *cmd = argv[1];
281
282         if (CONFIG_SYS_MAX_NAND_DEVICE == 0 || !nand->name) {
283                 puts("no devices available\n");
284                 return 1;
285         }
286
287         set_dev(0);
288
289         if (!strcmp(cmd, "get")) {
290                 ret = get_nand_env_oob(nand, &nand_env_oob_offset);
291                 if (ret)
292                         return 1;
293
294                 printf("0x%08lx\n", nand_env_oob_offset);
295         } else if (!strcmp(cmd, "set")) {
296                 loff_t addr;
297                 loff_t maxsize;
298                 struct mtd_oob_ops ops;
299                 int idx = 0;
300
301                 if (argc < 3)
302                         goto usage;
303
304                 if (arg_off(argv[2], &idx, &addr, &maxsize)) {
305                         puts("Offset or partition name expected\n");
306                         return 1;
307                 }
308
309                 if (idx != 0) {
310                         puts("Partition not on first NAND device\n");
311                         return 1;
312                 }
313
314                 if (nand->oobavail < ENV_OFFSET_SIZE) {
315                         printf("Insufficient available OOB bytes:\n"
316                                "%d OOB bytes available but %d required for "
317                                "env.oob support\n",
318                                nand->oobavail, ENV_OFFSET_SIZE);
319                         return 1;
320                 }
321
322                 if ((addr & (nand->erasesize - 1)) != 0) {
323                         printf("Environment offset must be block-aligned\n");
324                         return 1;
325                 }
326
327                 ops.datbuf = NULL;
328                 ops.mode = MTD_OOB_AUTO;
329                 ops.ooboffs = 0;
330                 ops.ooblen = ENV_OFFSET_SIZE;
331                 ops.oobbuf = (void *) oob_buf;
332
333                 oob_buf[0] = ENV_OOB_MARKER;
334                 oob_buf[1] = addr / nand->erasesize;
335
336                 ret = nand->write_oob(nand, ENV_OFFSET_SIZE, &ops);
337                 if (ret) {
338                         printf("Error writing OOB block 0\n");
339                         return ret;
340                 }
341
342                 ret = get_nand_env_oob(nand, &nand_env_oob_offset);
343                 if (ret) {
344                         printf("Error reading env offset in OOB\n");
345                         return ret;
346                 }
347
348                 if (addr != nand_env_oob_offset) {
349                         printf("Verification of env offset in OOB failed: "
350                                "0x%08llx expected but got 0x%08lx\n",
351                                (unsigned long long)addr, nand_env_oob_offset);
352                         return 1;
353                 }
354         } else {
355                 goto usage;
356         }
357
358         return ret;
359
360 usage:
361         return CMD_RET_USAGE;
362 }
363
364 #endif
365
366 static void nand_print_and_set_info(int idx)
367 {
368         nand_info_t *nand = &nand_info[idx];
369         struct nand_chip *chip = nand->priv;
370         const int bufsz = 32;
371         char buf[bufsz];
372
373         printf("Device %d: ", idx);
374         if (chip->numchips > 1)
375                 printf("%dx ", chip->numchips);
376         printf("%s, sector size %u KiB\n",
377                nand->name, nand->erasesize >> 10);
378         printf("  Page size  %8d b\n", nand->writesize);
379         printf("  OOB size   %8d b\n", nand->oobsize);
380         printf("  Erase size %8d b\n", nand->erasesize);
381
382         /* Set geometry info */
383         sprintf(buf, "%x", nand->writesize);
384         setenv("nand_writesize", buf);
385
386         sprintf(buf, "%x", nand->oobsize);
387         setenv("nand_oobsize", buf);
388
389         sprintf(buf, "%x", nand->erasesize);
390         setenv("nand_erasesize", buf);
391 }
392
393 static int raw_access(nand_info_t *nand, ulong addr, loff_t off, ulong count,
394                         int read)
395 {
396         int ret = 0;
397
398         while (count--) {
399                 /* Raw access */
400                 mtd_oob_ops_t ops = {
401                         .datbuf = (u8 *)addr,
402                         .oobbuf = ((u8 *)addr) + nand->writesize,
403                         .len = nand->writesize,
404                         .ooblen = nand->oobsize,
405                         .mode = MTD_OOB_RAW
406                 };
407
408                 if (read)
409                         ret = nand->read_oob(nand, off, &ops);
410                 else
411                         ret = nand->write_oob(nand, off, &ops);
412
413                 if (ret) {
414                         printf("%s: error at offset %llx, ret %d\n",
415                                 __func__, (long long)off, ret);
416                         break;
417                 }
418
419                 addr += nand->writesize + nand->oobsize;
420                 off += nand->writesize;
421         }
422
423         return ret;
424 }
425
426 int do_nand(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
427 {
428         int i, ret = 0;
429         ulong addr;
430         loff_t off, size;
431         char *cmd, *s;
432         nand_info_t *nand;
433 #ifdef CONFIG_SYS_NAND_QUIET
434         int quiet = CONFIG_SYS_NAND_QUIET;
435 #else
436         int quiet = 0;
437 #endif
438         const char *quiet_str = getenv("quiet");
439         int dev = nand_curr_device;
440         int repeat = flag & CMD_FLAG_REPEAT;
441
442         /* at least two arguments please */
443         if (argc < 2)
444                 goto usage;
445
446         if (quiet_str)
447                 quiet = simple_strtoul(quiet_str, NULL, 0) != 0;
448
449         cmd = argv[1];
450
451         /* Only "dump" is repeatable. */
452         if (repeat && strcmp(cmd, "dump"))
453                 return 0;
454
455         if (strcmp(cmd, "info") == 0) {
456
457                 putc('\n');
458                 for (i = 0; i < CONFIG_SYS_MAX_NAND_DEVICE; i++) {
459                         if (nand_info[i].name)
460                                 nand_print_and_set_info(i);
461                 }
462                 return 0;
463         }
464
465         if (strcmp(cmd, "device") == 0) {
466                 if (argc < 3) {
467                         putc('\n');
468                         if (dev < 0 || dev >= CONFIG_SYS_MAX_NAND_DEVICE)
469                                 puts("no devices available\n");
470                         else
471                                 nand_print_and_set_info(dev);
472                         return 0;
473                 }
474
475                 dev = (int)simple_strtoul(argv[2], NULL, 10);
476                 set_dev(dev);
477
478                 return 0;
479         }
480
481 #ifdef CONFIG_ENV_OFFSET_OOB
482         /* this command operates only on the first nand device */
483         if (strcmp(cmd, "env.oob") == 0)
484                 return do_nand_env_oob(cmdtp, argc - 1, argv + 1);
485 #endif
486
487         /* The following commands operate on the current device, unless
488          * overridden by a partition specifier.  Note that if somehow the
489          * current device is invalid, it will have to be changed to a valid
490          * one before these commands can run, even if a partition specifier
491          * for another device is to be used.
492          */
493         if (dev < 0 || dev >= CONFIG_SYS_MAX_NAND_DEVICE ||
494             !nand_info[dev].name) {
495                 puts("\nno devices available\n");
496                 return 1;
497         }
498         nand = &nand_info[dev];
499
500         if (strcmp(cmd, "bad") == 0) {
501                 printf("\nDevice %d bad blocks:\n", dev);
502                 for (off = 0; off < nand->size; off += nand->erasesize)
503                         if (nand_block_isbad(nand, off))
504                                 printf("  %08llx\n", (unsigned long long)off);
505                 return 0;
506         }
507
508         /*
509          * Syntax is:
510          *   0    1     2       3    4
511          *   nand erase [clean] [off size]
512          */
513         if (strncmp(cmd, "erase", 5) == 0 || strncmp(cmd, "scrub", 5) == 0) {
514                 nand_erase_options_t opts;
515                 /* "clean" at index 2 means request to write cleanmarker */
516                 int clean = argc > 2 && !strcmp("clean", argv[2]);
517                 int scrub_yes = argc > 2 && !strcmp("-y", argv[2]);
518                 int o = (clean || scrub_yes) ? 3 : 2;
519                 int scrub = !strncmp(cmd, "scrub", 5);
520                 int spread = 0;
521                 int args = 2;
522                 const char *scrub_warn =
523                         "Warning: "
524                         "scrub option will erase all factory set bad blocks!\n"
525                         "         "
526                         "There is no reliable way to recover them.\n"
527                         "         "
528                         "Use this command only for testing purposes if you\n"
529                         "         "
530                         "are sure of what you are doing!\n"
531                         "\nReally scrub this NAND flash? <y/N>\n";
532
533                 if (cmd[5] != 0) {
534                         if (!strcmp(&cmd[5], ".spread")) {
535                                 spread = 1;
536                         } else if (!strcmp(&cmd[5], ".part")) {
537                                 args = 1;
538                         } else if (!strcmp(&cmd[5], ".chip")) {
539                                 args = 0;
540                         } else {
541                                 goto usage;
542                         }
543                 }
544
545                 /*
546                  * Don't allow missing arguments to cause full chip/partition
547                  * erases -- easy to do accidentally, e.g. with a misspelled
548                  * variable name.
549                  */
550                 if (argc != o + args)
551                         goto usage;
552
553                 printf("\nNAND %s: ", cmd);
554                 /* skip first two or three arguments, look for offset and size */
555                 if (arg_off_size(argc - o, argv + o, &dev, &off, &size) != 0)
556                         return 1;
557
558                 nand = &nand_info[dev];
559
560                 memset(&opts, 0, sizeof(opts));
561                 opts.offset = off;
562                 opts.length = size;
563                 opts.jffs2  = clean;
564                 opts.quiet  = quiet;
565                 opts.spread = spread;
566
567                 if (scrub) {
568                         if (!scrub_yes)
569                                 puts(scrub_warn);
570
571                         if (scrub_yes)
572                                 opts.scrub = 1;
573                         else if (getc() == 'y') {
574                                 puts("y");
575                                 if (getc() == '\r')
576                                         opts.scrub = 1;
577                                 else {
578                                         puts("scrub aborted\n");
579                                         return -1;
580                                 }
581                         } else {
582                                 puts("scrub aborted\n");
583                                 return -1;
584                         }
585                 }
586                 ret = nand_erase_opts(nand, &opts);
587                 printf("%s\n", ret ? "ERROR" : "OK");
588
589                 return ret == 0 ? 0 : 1;
590         }
591
592         if (strncmp(cmd, "dump", 4) == 0) {
593                 if (argc < 3)
594                         goto usage;
595
596                 off = (int)simple_strtoul(argv[2], NULL, 16);
597                 ret = nand_dump(nand, off, !strcmp(&cmd[4], ".oob"), repeat);
598
599                 return ret == 0 ? 1 : 0;
600         }
601
602         if (strncmp(cmd, "read", 4) == 0 || strncmp(cmd, "write", 5) == 0) {
603                 size_t rwsize;
604                 ulong pagecount = 1;
605                 int read;
606                 int raw;
607
608                 if (argc < 4)
609                         goto usage;
610
611                 addr = (ulong)simple_strtoul(argv[2], NULL, 16);
612
613                 read = strncmp(cmd, "read", 4) == 0; /* 1 = read, 0 = write */
614                 printf("\nNAND %s: ", read ? "read" : "write");
615
616                 nand = &nand_info[dev];
617
618                 s = strchr(cmd, '.');
619
620                 if (s && !strcmp(s, ".raw")) {
621                         raw = 1;
622
623                         if (arg_off(argv[3], &dev, &off, &size))
624                                 return 1;
625
626                         if (argc > 4 && !str2long(argv[4], &pagecount)) {
627                                 printf("'%s' is not a number\n", argv[4]);
628                                 return 1;
629                         }
630
631                         if (pagecount * nand->writesize > size) {
632                                 puts("Size exceeds partition or device limit\n");
633                                 return -1;
634                         }
635
636                         rwsize = pagecount * (nand->writesize + nand->oobsize);
637                 } else {
638                         if (arg_off_size(argc - 3, argv + 3, &dev,
639                                                 &off, &size) != 0)
640                                 return 1;
641
642                         rwsize = size;
643                 }
644
645                 if (!s || !strcmp(s, ".jffs2") ||
646                     !strcmp(s, ".e") || !strcmp(s, ".i")) {
647                         if (read)
648                                 ret = nand_read_skip_bad(nand, off, &rwsize,
649                                                          (u_char *)addr);
650                         else
651                                 ret = nand_write_skip_bad(nand, off, &rwsize,
652                                                           (u_char *)addr, 0);
653 #ifdef CONFIG_CMD_NAND_TRIMFFS
654                 } else if (!strcmp(s, ".trimffs")) {
655                         if (read) {
656                                 printf("Unknown nand command suffix '%s'\n", s);
657                                 return 1;
658                         }
659                         ret = nand_write_skip_bad(nand, off, &rwsize,
660                                                 (u_char *)addr,
661                                                 WITH_DROP_FFS);
662 #endif
663 #ifdef CONFIG_CMD_NAND_YAFFS
664                 } else if (!strcmp(s, ".yaffs")) {
665                         if (read) {
666                                 printf("Unknown nand command suffix '%s'.\n", s);
667                                 return 1;
668                         }
669                         ret = nand_write_skip_bad(nand, off, &rwsize,
670                                                 (u_char *)addr,
671                                                 WITH_INLINE_OOB);
672 #endif
673                 } else if (!strcmp(s, ".oob")) {
674                         /* out-of-band data */
675                         mtd_oob_ops_t ops = {
676                                 .oobbuf = (u8 *)addr,
677                                 .ooblen = rwsize,
678                                 .mode = MTD_OOB_RAW
679                         };
680
681                         if (read)
682                                 ret = nand->read_oob(nand, off, &ops);
683                         else
684                                 ret = nand->write_oob(nand, off, &ops);
685                 } else if (raw) {
686                         ret = raw_access(nand, addr, off, pagecount, read);
687                 } else {
688                         printf("Unknown nand command suffix '%s'.\n", s);
689                         return 1;
690                 }
691
692                 printf(" %zu bytes %s: %s\n", rwsize,
693                        read ? "read" : "written", ret ? "ERROR" : "OK");
694
695                 return ret == 0 ? 0 : 1;
696         }
697
698         if (strcmp(cmd, "markbad") == 0) {
699                 argc -= 2;
700                 argv += 2;
701
702                 if (argc <= 0)
703                         goto usage;
704
705                 while (argc > 0) {
706                         addr = simple_strtoul(*argv, NULL, 16);
707
708                         if (nand->block_markbad(nand, addr)) {
709                                 printf("block 0x%08lx NOT marked "
710                                         "as bad! ERROR %d\n",
711                                         addr, ret);
712                                 ret = 1;
713                         } else {
714                                 printf("block 0x%08lx successfully "
715                                         "marked as bad\n",
716                                         addr);
717                         }
718                         --argc;
719                         ++argv;
720                 }
721                 return ret;
722         }
723
724         if (strcmp(cmd, "biterr") == 0) {
725                 /* todo */
726                 return 1;
727         }
728
729 #ifdef CONFIG_CMD_NAND_LOCK_UNLOCK
730         if (strcmp(cmd, "lock") == 0) {
731                 int tight = 0;
732                 int status = 0;
733                 if (argc == 3) {
734                         if (!strcmp("tight", argv[2]))
735                                 tight = 1;
736                         if (!strcmp("status", argv[2]))
737                                 status = 1;
738                 }
739                 if (status) {
740                         do_nand_status(nand);
741                 } else {
742                         if (!nand_lock(nand, tight)) {
743                                 puts("NAND flash successfully locked\n");
744                         } else {
745                                 puts("Error locking NAND flash\n");
746                                 return 1;
747                         }
748                 }
749                 return 0;
750         }
751
752         if (strcmp(cmd, "unlock") == 0) {
753                 if (arg_off_size(argc - 2, argv + 2, &dev, &off, &size) < 0)
754                         return 1;
755
756                 if (!nand_unlock(&nand_info[dev], off, size)) {
757                         puts("NAND flash successfully unlocked\n");
758                 } else {
759                         puts("Error unlocking NAND flash, "
760                              "write and erase will probably fail\n");
761                         return 1;
762                 }
763                 return 0;
764         }
765 #endif
766
767 usage:
768         return CMD_RET_USAGE;
769 }
770
771 U_BOOT_CMD(
772         nand, CONFIG_SYS_MAXARGS, 1, do_nand,
773         "NAND sub-system",
774         "info - show available NAND devices\n"
775         "nand device [dev] - show or set current device\n"
776         "nand read - addr off|partition size\n"
777         "nand write - addr off|partition size\n"
778         "    read/write 'size' bytes starting at offset 'off'\n"
779         "    to/from memory address 'addr', skipping bad blocks.\n"
780         "nand read.raw - addr off|partition [count]\n"
781         "nand write.raw - addr off|partition [count]\n"
782         "    Use read.raw/write.raw to avoid ECC and access the flash as-is.\n"
783 #ifdef CONFIG_CMD_NAND_TRIMFFS
784         "nand write.trimffs - addr off|partition size\n"
785         "    write 'size' bytes starting at offset 'off' from memory address\n"
786         "    'addr', skipping bad blocks and dropping any pages at the end\n"
787         "    of eraseblocks that contain only 0xFF\n"
788 #endif
789 #ifdef CONFIG_CMD_NAND_YAFFS
790         "nand write.yaffs - addr off|partition size\n"
791         "    write 'size' bytes starting at offset 'off' with yaffs format\n"
792         "    from memory address 'addr', skipping bad blocks.\n"
793 #endif
794         "nand erase[.spread] [clean] off size - erase 'size' bytes "
795         "from offset 'off'\n"
796         "    With '.spread', erase enough for given file size, otherwise,\n"
797         "    'size' includes skipped bad blocks.\n"
798         "nand erase.part [clean] partition - erase entire mtd partition'\n"
799         "nand erase.chip [clean] - erase entire chip'\n"
800         "nand bad - show bad blocks\n"
801         "nand dump[.oob] off - dump page\n"
802         "nand scrub [-y] off size | scrub.part partition | scrub.chip\n"
803         "    really clean NAND erasing bad blocks (UNSAFE)\n"
804         "nand markbad off [...] - mark bad block(s) at offset (UNSAFE)\n"
805         "nand biterr off - make a bit error at offset (UNSAFE)"
806 #ifdef CONFIG_CMD_NAND_LOCK_UNLOCK
807         "\n"
808         "nand lock [tight] [status]\n"
809         "    bring nand to lock state or display locked pages\n"
810         "nand unlock [offset] [size] - unlock section"
811 #endif
812 #ifdef CONFIG_ENV_OFFSET_OOB
813         "\n"
814         "nand env.oob - environment offset in OOB of block 0 of"
815         "    first device.\n"
816         "nand env.oob set off|partition - set enviromnent offset\n"
817         "nand env.oob get - get environment offset"
818 #endif
819 );
820
821 static int nand_load_image(cmd_tbl_t *cmdtp, nand_info_t *nand,
822                            ulong offset, ulong addr, char *cmd)
823 {
824         int r;
825         char *s;
826         size_t cnt;
827         image_header_t *hdr;
828 #if defined(CONFIG_FIT)
829         const void *fit_hdr = NULL;
830 #endif
831
832         s = strchr(cmd, '.');
833         if (s != NULL &&
834             (strcmp(s, ".jffs2") && strcmp(s, ".e") && strcmp(s, ".i"))) {
835                 printf("Unknown nand load suffix '%s'\n", s);
836                 bootstage_error(BOOTSTAGE_ID_NAND_SUFFIX);
837                 return 1;
838         }
839
840         printf("\nLoading from %s, offset 0x%lx\n", nand->name, offset);
841
842         cnt = nand->writesize;
843         r = nand_read_skip_bad(nand, offset, &cnt, (u_char *) addr);
844         if (r) {
845                 puts("** Read error\n");
846                 bootstage_error(BOOTSTAGE_ID_NAND_HDR_READ);
847                 return 1;
848         }
849         bootstage_mark(BOOTSTAGE_ID_NAND_HDR_READ);
850
851         switch (genimg_get_format ((void *)addr)) {
852         case IMAGE_FORMAT_LEGACY:
853                 hdr = (image_header_t *)addr;
854
855                 bootstage_mark(BOOTSTAGE_ID_NAND_TYPE);
856                 image_print_contents (hdr);
857
858                 cnt = image_get_image_size (hdr);
859                 break;
860 #if defined(CONFIG_FIT)
861         case IMAGE_FORMAT_FIT:
862                 fit_hdr = (const void *)addr;
863                 puts ("Fit image detected...\n");
864
865                 cnt = fit_get_size (fit_hdr);
866                 break;
867 #endif
868         default:
869                 bootstage_error(BOOTSTAGE_ID_NAND_TYPE);
870                 puts ("** Unknown image type\n");
871                 return 1;
872         }
873         bootstage_mark(BOOTSTAGE_ID_NAND_TYPE);
874
875         r = nand_read_skip_bad(nand, offset, &cnt, (u_char *) addr);
876         if (r) {
877                 puts("** Read error\n");
878                 bootstage_error(BOOTSTAGE_ID_NAND_READ);
879                 return 1;
880         }
881         bootstage_mark(BOOTSTAGE_ID_NAND_READ);
882
883 #if defined(CONFIG_FIT)
884         /* This cannot be done earlier, we need complete FIT image in RAM first */
885         if (genimg_get_format ((void *)addr) == IMAGE_FORMAT_FIT) {
886                 if (!fit_check_format (fit_hdr)) {
887                         bootstage_error(BOOTSTAGE_ID_NAND_FIT_READ);
888                         puts ("** Bad FIT image format\n");
889                         return 1;
890                 }
891                 bootstage_mark(BOOTSTAGE_ID_NAND_FIT_READ_OK);
892                 fit_print_contents (fit_hdr);
893         }
894 #endif
895
896         /* Loading ok, update default load address */
897
898         load_addr = addr;
899
900         return bootm_maybe_autostart(cmdtp, cmd);
901 }
902
903 int do_nandboot(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
904 {
905         char *boot_device = NULL;
906         int idx;
907         ulong addr, offset = 0;
908 #if defined(CONFIG_CMD_MTDPARTS)
909         struct mtd_device *dev;
910         struct part_info *part;
911         u8 pnum;
912
913         if (argc >= 2) {
914                 char *p = (argc == 2) ? argv[1] : argv[2];
915                 if (!(str2long(p, &addr)) && (mtdparts_init() == 0) &&
916                     (find_dev_and_part(p, &dev, &pnum, &part) == 0)) {
917                         if (dev->id->type != MTD_DEV_TYPE_NAND) {
918                                 puts("Not a NAND device\n");
919                                 return 1;
920                         }
921                         if (argc > 3)
922                                 goto usage;
923                         if (argc == 3)
924                                 addr = simple_strtoul(argv[1], NULL, 16);
925                         else
926                                 addr = CONFIG_SYS_LOAD_ADDR;
927                         return nand_load_image(cmdtp, &nand_info[dev->id->num],
928                                                part->offset, addr, argv[0]);
929                 }
930         }
931 #endif
932
933         bootstage_mark(BOOTSTAGE_ID_NAND_PART);
934         switch (argc) {
935         case 1:
936                 addr = CONFIG_SYS_LOAD_ADDR;
937                 boot_device = getenv("bootdevice");
938                 break;
939         case 2:
940                 addr = simple_strtoul(argv[1], NULL, 16);
941                 boot_device = getenv("bootdevice");
942                 break;
943         case 3:
944                 addr = simple_strtoul(argv[1], NULL, 16);
945                 boot_device = argv[2];
946                 break;
947         case 4:
948                 addr = simple_strtoul(argv[1], NULL, 16);
949                 boot_device = argv[2];
950                 offset = simple_strtoul(argv[3], NULL, 16);
951                 break;
952         default:
953 #if defined(CONFIG_CMD_MTDPARTS)
954 usage:
955 #endif
956                 bootstage_error(BOOTSTAGE_ID_NAND_SUFFIX);
957                 return CMD_RET_USAGE;
958         }
959         bootstage_mark(BOOTSTAGE_ID_NAND_SUFFIX);
960
961         if (!boot_device) {
962                 puts("\n** No boot device **\n");
963                 bootstage_error(BOOTSTAGE_ID_NAND_BOOT_DEVICE);
964                 return 1;
965         }
966         bootstage_mark(BOOTSTAGE_ID_NAND_BOOT_DEVICE);
967
968         idx = simple_strtoul(boot_device, NULL, 16);
969
970         if (idx < 0 || idx >= CONFIG_SYS_MAX_NAND_DEVICE || !nand_info[idx].name) {
971                 printf("\n** Device %d not available\n", idx);
972                 bootstage_error(BOOTSTAGE_ID_NAND_AVAILABLE);
973                 return 1;
974         }
975         bootstage_mark(BOOTSTAGE_ID_NAND_AVAILABLE);
976
977         return nand_load_image(cmdtp, &nand_info[idx], offset, addr, argv[0]);
978 }
979
980 U_BOOT_CMD(nboot, 4, 1, do_nandboot,
981         "boot from NAND device",
982         "[partition] | [[[loadAddr] dev] offset]"
983 );