arch/arm/mach-imx/cmd_nandbcb.c

   1 /*
   2  * i.MX6 nand boot control block(bcb).
   3  *
   4  * Based on the common/imx-bbu-nand-fcb.c from barebox and imx kobs-ng
   5  *
   6  * Copyright (C) 2017 Jagan Teki <jagan@amarulasolutions.com>
   7  * Copyright (C) 2016 Sergey Kubushyn <ksi@koi8.net>
   8  *
   9  * SPDX-License-Identifier:     GPL-2.0+
  10  */
  11
  12 #include <common.h>
  13 #include <malloc.h>
  14 #include <nand.h>
  15 #include <dm/devres.h>
  16
  17 #include <asm/io.h>
  18 #include <jffs2/jffs2.h>
  19 #include <linux/bch.h>
  20 #include <linux/mtd/mtd.h>
  21
  22 #include <asm/arch/sys_proto.h>
  23 #include <asm/mach-imx/imx-nandbcb.h>
  24 #include <asm/mach-imx/imximage.cfg>
  25 #include <mxs_nand.h>
  26 #include <linux/mtd/mtd.h>
  27 #include <nand.h>
  28 #include <div64.h>
  29
  30 #include "../../../cmd/legacy-mtd-utils.h"
  31
  32 #define BF_VAL(v, bf)           (((v) & bf##_MASK) >> bf##_OFFSET)
  33 #define GETBIT(v, n)            (((v) >> (n)) & 0x1)
  34 #define IMX8MQ_SPL_SZ 0x3e000
  35 #define IMX8MQ_HDMI_FW_SZ 0x19c00
  36 #define BOOT_SEARCH_COUNT 2
  37
  38 struct mtd_info *dump_mtd;
  39 static loff_t dump_nandboot_size;
  40 static struct fcb_block dump_fill_fcb;
  41 static struct dbbt_block dump_fill_dbbt;
  42 static struct fcb_block dump_nand_fcb[BOOT_SEARCH_COUNT];
  43 static struct dbbt_block dump_nand_dbbt[BOOT_SEARCH_COUNT];
  44 static u32 dump_fcb_off[BOOT_SEARCH_COUNT];
  45 static u32 dump_dbbt_off[BOOT_SEARCH_COUNT];
  46
  47 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
  48 static uint8_t reverse_bit(uint8_t b)
  49 {
  50         b = (b & 0xf0) >> 4 | (b & 0x0f) << 4;
  51         b = (b & 0xcc) >> 2 | (b & 0x33) << 2;
  52         b = (b & 0xaa) >> 1 | (b & 0x55) << 1;
  53
  54         return b;
  55 }
  56
  57 static void encode_bch_ecc(void *buf, struct fcb_block *fcb, int eccbits)
  58 {
  59         int i, j, m = 13;
  60         int blocksize = 128;
  61         int numblocks = 8;
  62         int ecc_buf_size = (m * eccbits + 7) / 8;
  63         struct bch_control *bch = init_bch(m, eccbits, 0);
  64         u8 *ecc_buf = kzalloc(ecc_buf_size, GFP_KERNEL);
  65         u8 *tmp_buf = kzalloc(blocksize * numblocks, GFP_KERNEL);
  66         u8 *psrc, *pdst;
  67
  68         /*
  69          * The blocks here are bit aligned. If eccbits is a multiple of 8,
  70          * we just can copy bytes. Otherwiese we must move the blocks to
  71          * the next free bit position.
  72          */
  73         WARN_ON(eccbits % 8);
  74
  75         memcpy(tmp_buf, fcb, sizeof(*fcb));
  76
  77         for (i = 0; i < numblocks; i++) {
  78                 memset(ecc_buf, 0, ecc_buf_size);
  79                 psrc = tmp_buf + i * blocksize;
  80                 pdst = buf + i * (blocksize + ecc_buf_size);
  81
  82                 /* copy data byte aligned to destination buf */
  83                 memcpy(pdst, psrc, blocksize);
  84
  85                 /*
  86                  * imx-kobs use a modified encode_bch which reverse the
  87                  * bit order of the data before calculating bch.
  88                  * Do this in the buffer and use the bch lib here.
  89                  */
  90                 for (j = 0; j < blocksize; j++)
  91                         psrc[j] = reverse_bit(psrc[j]);
  92
  93                 encode_bch(bch, psrc, blocksize, ecc_buf);
  94
  95                 /* reverse ecc bit */
  96                 for (j = 0; j < ecc_buf_size; j++)
  97                         ecc_buf[j] = reverse_bit(ecc_buf[j]);
  98
  99                 /* Here eccbuf is byte aligned and we can just copy it */
 100                 memcpy(pdst + blocksize, ecc_buf, ecc_buf_size);
 101         }
 102
 103         kfree(ecc_buf);
 104         kfree(tmp_buf);
 105         free_bch(bch);
 106 }
 107 #else
 108
 109 static u8 calculate_parity_13_8(u8 d)
 110 {
 111         u8 p = 0;
 112
 113         p |= (GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 3) ^ GETBIT(d, 2)) << 0;
 114         p |= (GETBIT(d, 7) ^ GETBIT(d, 5) ^ GETBIT(d, 4) ^ GETBIT(d, 2) ^
 115               GETBIT(d, 1)) << 1;
 116         p |= (GETBIT(d, 7) ^ GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 1) ^
 117               GETBIT(d, 0)) << 2;
 118         p |= (GETBIT(d, 7) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 0)) << 3;
 119         p |= (GETBIT(d, 6) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 2) ^
 120               GETBIT(d, 1) ^ GETBIT(d, 0)) << 4;
 121
 122         return p;
 123 }
 124
 125 static void encode_hamming_13_8(void *_src, void *_ecc, size_t size)
 126 {
 127         int i;
 128         u8 *src = _src;
 129         u8 *ecc = _ecc;
 130
 131         for (i = 0; i < size; i++)
 132                 ecc[i] = calculate_parity_13_8(src[i]);
 133 }
 134 #endif
 135
 136 static u32 calc_chksum(void *buf, size_t size)
 137 {
 138         u32 chksum = 0;
 139         u8 *bp = buf;
 140         size_t i;
 141
 142         for (i = 0; i < size; i++)
 143                 chksum += bp[i];
 144
 145         return ~chksum;
 146 }
 147
 148 static void fill_fcb(struct fcb_block *fcb, struct mtd_info *mtd,
 149                      u32 fw1_start, u32 fw2_start, u32 fw_pages)
 150 {
 151         struct nand_chip *chip = mtd_to_nand(mtd);
 152         struct mxs_nand_info *nand_info = nand_get_controller_data(chip);
 153         struct mxs_nand_layout l;
 154
 155         mxs_nand_get_layout(mtd, &l);
 156
 157         fcb->fingerprint = FCB_FINGERPRINT;
 158         fcb->version = FCB_VERSION_1;
 159
 160         fcb->pagesize = mtd->writesize;
 161         fcb->oob_pagesize = mtd->writesize + mtd->oobsize;
 162         fcb->sectors = mtd->erasesize / mtd->writesize;
 163
 164         fcb->meta_size = l.meta_size;
 165         fcb->nr_blocks = l.nblocks;
 166         fcb->ecc_nr = l.data0_size;
 167         fcb->ecc_level = l.ecc0;
 168         fcb->ecc_size = l.datan_size;
 169         fcb->ecc_type = l.eccn;
 170         fcb->bchtype = l.gf_len;
 171
 172         /* Also hardcoded in kobs-ng */
 173         if (is_mx6() || is_imx8m()) {
 174                 fcb->datasetup = 80;
 175                 fcb->datahold = 60;
 176                 fcb->addr_setup = 25;
 177                 fcb->dsample_time = 6;
 178         } else if (is_mx7()) {
 179                 fcb->datasetup = 10;
 180                 fcb->datahold = 7;
 181                 fcb->addr_setup = 15;
 182                 fcb->dsample_time = 6;
 183         }
 184
 185         /* DBBT search area starts at second page on first block */
 186         fcb->dbbt_start = 1;
 187
 188         fcb->bb_byte = nand_info->bch_geometry.block_mark_byte_offset;
 189         fcb->bb_start_bit = nand_info->bch_geometry.block_mark_bit_offset;
 190
 191         fcb->phy_offset = mtd->writesize;
 192
 193         fcb->nr_blocks = mtd->writesize / fcb->ecc_nr - 1;
 194
 195         fcb->disbbm = 0;
 196         fcb->disbbm_search = 0;
 197
 198         fcb->fw1_start = fw1_start; /* Firmware image starts on this sector */
 199         fcb->fw2_start = fw2_start; /* Secondary FW Image starting Sector */
 200         fcb->fw1_pages = fw_pages; /* Number of sectors in firmware image */
 201         fcb->fw2_pages = fw_pages; /* Number of sector in secondary FW image */
 202
 203         fcb->checksum = calc_chksum((void *)fcb + 4, sizeof(*fcb) - 4);
 204 }
 205
 206 static int dbbt_fill_data(struct mtd_info *mtd, void *buf, int num_blocks)
 207 {
 208         int n, n_bad_blocks = 0;
 209         u32 *bb = buf + 0x8;
 210         u32 *n_bad_blocksp = buf + 0x4;
 211
 212         for (n = 0; n < num_blocks; n++) {
 213                 loff_t offset = n * mtd->erasesize;
 214                         if (mtd_block_isbad(mtd, offset)) {
 215                                 n_bad_blocks++;
 216                                 *bb = n;
 217                                 bb++;
 218                 }
 219         }
 220
 221         *n_bad_blocksp = n_bad_blocks;
 222
 223         return n_bad_blocks;
 224 }
 225
 226 static int write_fcb_dbbt_and_readback(struct mtd_info *mtd,
 227                                        struct fcb_block *fcb,
 228                                        struct dbbt_block *dbbt,
 229                                        void *dbbt_data_page, loff_t off)
 230 {
 231         void *fcb_raw_page = 0;
 232         int i, ret;
 233         size_t dummy;
 234
 235         /*
 236          * We prepare raw page only for i.MX6, for i.MX7 we
 237          * leverage BCH hw module instead
 238          */
 239         if (is_mx6()) {
 240                 /* write fcb/dbbt */
 241                 fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize,
 242                                        GFP_KERNEL);
 243                 if (!fcb_raw_page) {
 244                         debug("failed to allocate fcb_raw_page\n");
 245                         ret = -ENOMEM;
 246                         return ret;
 247                 }
 248
 249 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
 250                 /* 40 bit BCH, for i.MX6UL(L) */
 251                 encode_bch_ecc(fcb_raw_page + 32, fcb, 40);
 252 #else
 253                 memcpy(fcb_raw_page + 12, fcb, sizeof(struct fcb_block));
 254                 encode_hamming_13_8(fcb_raw_page + 12,
 255                                     fcb_raw_page + 12 + 512, 512);
 256 #endif
 257                 /*
 258                  * Set the first and second byte of OOB data to 0xFF,
 259                  * not 0x00. These bytes are used as the Manufacturers Bad
 260                  * Block Marker (MBBM). Since the FCB is mostly written to
 261                  * the first page in a block, a scan for
 262                  * factory bad blocks will detect these blocks as bad, e.g.
 263                  * when function nand_scan_bbt() is executed to build a new
 264                  * bad block table.
 265                  */
 266                 memset(fcb_raw_page + mtd->writesize, 0xFF, 2);
 267         }
 268         for (i = 0; i < 2; i++) {
 269                 if (mtd_block_isbad(mtd, off)) {
 270                         printf("Block %d is bad, skipped\n", i);
 271                         continue;
 272                 }
 273
 274                 /*
 275                  * User BCH ECC hardware module for i.MX7
 276                  */
 277                 if (is_mx7() || is_imx8m()) {
 278                         u32 off = i * mtd->erasesize;
 279                         size_t rwsize = sizeof(*fcb);
 280
 281                         printf("Writing %zd bytes to 0x%x: ", rwsize, off);
 282
 283                         /* switch nand BCH to FCB compatible settings */
 284                         mxs_nand_mode_fcb(mtd);
 285                         ret = nand_write(mtd, off, &rwsize,
 286                                          (unsigned char *)fcb);
 287
 288                         dump_fcb_off[i] = off;
 289                         nand_read(mtd, off, &rwsize,
 290                                   (unsigned char *)(dump_nand_fcb + i));
 291
 292                         mxs_nand_mode_normal(mtd);
 293
 294                         printf("%s\n", ret ? "ERROR" : "OK");
 295                 } else if (is_mx6()) {
 296                         /* raw write */
 297                         mtd_oob_ops_t ops = {
 298                                 .datbuf = (u8 *)fcb_raw_page,
 299                                 .oobbuf = ((u8 *)fcb_raw_page) +
 300                                           mtd->writesize,
 301                                 .len = mtd->writesize,
 302                                 .ooblen = mtd->oobsize,
 303                                 .mode = MTD_OPS_RAW
 304                         };
 305
 306                         ret = mtd_write_oob(mtd, mtd->erasesize * i, &ops);
 307                         if (ret)
 308                                 goto fcb_raw_page_err;
 309                         debug("NAND fcb write: 0x%x offset 0x%zx written: %s\n",
 310                               mtd->erasesize * i, ops.len, ret ?
 311                               "ERROR" : "OK");
 312
 313                         ops.datbuf = (u8 *)(dump_nand_fcb + i);
 314                         ops.oobbuf = ((u8 *)(dump_nand_fcb + i)) + mtd->writesize;
 315                         mtd_read_oob(mtd, mtd->erasesize * i, &ops);
 316                 }
 317
 318                 ret = mtd_write(mtd, mtd->erasesize * i + mtd->writesize,
 319                                 mtd->writesize, &dummy, (void *)dbbt);
 320                 if (ret)
 321                         goto fcb_raw_page_err;
 322                 debug("NAND dbbt write: 0x%x offset, 0x%zx bytes written: %s\n",
 323                       mtd->erasesize * i + mtd->writesize, dummy,
 324                       ret ? "ERROR" : "OK");
 325
 326                 dump_dbbt_off[i] = mtd->erasesize * i + mtd->writesize;
 327                 size_t rwsize = sizeof(*dbbt);
 328
 329                 nand_read(mtd, dump_dbbt_off[i], &rwsize,
 330                           (unsigned char *)(dump_nand_dbbt + i));
 331
 332                 /* dbbtpages == 0 if no bad blocks */
 333                 if (dbbt->dbbtpages > 0) {
 334                         loff_t to = (mtd->erasesize * i + mtd->writesize * 5);
 335
 336                         ret = mtd_write(mtd, to, mtd->writesize, &dummy,
 337                                         dbbt_data_page);
 338                         if (ret)
 339                                 goto fcb_raw_page_err;
 340                 }
 341         }
 342
 343 fcb_raw_page_err:
 344         if (is_mx6())
 345                 kfree(fcb_raw_page);
 346
 347         return ret;
 348 }
 349
 350 static int nandbcb_update(struct mtd_info *mtd, loff_t off, size_t size,
 351                           size_t maxsize, const u_char *buf)
 352 {
 353         nand_erase_options_t opts;
 354         struct fcb_block *fcb;
 355         struct dbbt_block *dbbt;
 356         loff_t fw1_off;
 357         void *fwbuf, *dbbt_page, *dbbt_data_page;
 358         u32 fw1_start, fw1_pages;
 359         int nr_blks, nr_blks_fcb, fw1_blk;
 360         size_t fwsize;
 361         int ret;
 362         size_t extra_fwsize;
 363         void *extra_fwbuf;
 364         loff_t extra_fw1_off;
 365
 366         /* erase */
 367         memset(&opts, 0, sizeof(opts));
 368         opts.offset = off;
 369         opts.length = maxsize - 1;
 370         ret = nand_erase_opts(mtd, &opts);
 371         if (ret) {
 372                 printf("%s: erase failed (ret = %d)\n", __func__, ret);
 373                 return ret;
 374         }
 375
 376         /*
 377          * Reference documentation from i.MX6DQRM section 8.5.2.2
 378          *
 379          * Nand Boot Control Block(BCB) contains two data structures,
 380          * - Firmware Configuration Block(FCB)
 381          * - Discovered Bad Block Table(DBBT)
 382          *
 383          * FCB contains,
 384          * - nand timings
 385          * - DBBT search page address,
 386          * - start page address of primary firmware
 387          * - start page address of secondary firmware
 388          *
 389          * setup fcb:
 390          * - number of blocks = mtd partition size / mtd erasesize
 391          * - two firmware blocks, primary and secondary
 392          * - first 4 block for FCB/DBBT
 393          * - rest split in half for primary and secondary firmware
 394          * - same firmware will write two times
 395          */
 396         nr_blks_fcb = BOOT_SEARCH_COUNT;
 397         nr_blks = maxsize / mtd->erasesize;
 398         fw1_blk = nr_blks_fcb;
 399
 400         /* write fw */
 401         fwbuf = NULL;
 402         if (is_mx6() || is_mx7()) {
 403                 fwsize = ALIGN(size + FLASH_OFFSET_STANDARD + mtd->writesize,
 404                                mtd->writesize);
 405                 fwbuf = kzalloc(fwsize, GFP_KERNEL);
 406                 if (!fwbuf) {
 407                         debug("failed to allocate fwbuf\n");
 408                         ret = -ENOMEM;
 409                         goto err;
 410                 }
 411
 412                 memcpy(fwbuf + FLASH_OFFSET_STANDARD, buf, size);
 413                 fw1_off = fw1_blk * mtd->erasesize;
 414                 ret = nand_write_skip_bad(mtd, fw1_off, &fwsize, NULL, maxsize,
 415                                           (u_char *)fwbuf, WITH_WR_VERIFY);
 416                 printf("NAND fw write: 0x%llx offset, 0x%zx bytes written: %s\n",
 417                        fw1_off, fwsize, ret ? "ERROR" : "OK");
 418                 if (ret)
 419                         goto fwbuf_err;
 420         } else if (is_imx8m()) {
 421                 fwsize = ALIGN(IMX8MQ_SPL_SZ + FLASH_OFFSET_STANDARD + mtd->writesize, mtd->writesize);
 422                 fwbuf = kzalloc(fwsize, GFP_KERNEL);
 423                 if (!fwbuf) {
 424                         printf("failed to allocate fwbuf\n");
 425                         ret = -ENOMEM;
 426                         goto err;
 427                 }
 428
 429                 memcpy(fwbuf + FLASH_OFFSET_STANDARD, buf, IMX8MQ_SPL_SZ);
 430                 fw1_off = fw1_blk * mtd->erasesize;
 431                 ret = nand_write_skip_bad(mtd, fw1_off, &fwsize, NULL, maxsize,
 432                                           (u_char *)fwbuf, WITH_WR_VERIFY);
 433                 printf("NAND fw write: 0x%llx offset, 0x%zx bytes written: %s\n",
 434                        fw1_off, fwsize, ret ? "ERROR" : "OK");
 435                 if (ret)
 436                         goto fwbuf_err;
 437
 438                 extra_fwsize = ALIGN(IMX8MQ_SPL_SZ + mtd->writesize, mtd->writesize);
 439                 extra_fwbuf = kzalloc(extra_fwsize, GFP_KERNEL);
 440                 extra_fw1_off = fw1_off + mtd->erasesize * ((IMX8MQ_SPL_SZ + mtd->erasesize - 1) / mtd->erasesize);
 441                 if (!extra_fwbuf) {
 442                         printf("failed to allocate fwbuf\n");
 443                         ret = -ENOMEM;
 444                         goto fwbuf_err;
 445                 }
 446
 447                 memcpy(extra_fwbuf, buf + IMX8MQ_HDMI_FW_SZ, IMX8MQ_SPL_SZ);
 448                 ret = nand_write_skip_bad(mtd, extra_fw1_off, &extra_fwsize, NULL, maxsize,
 449                                           (u_char *)extra_fwbuf, WITH_WR_VERIFY);
 450                 printf("NAND extra_fw write: 0x%llx offset, 0x%zx bytes written: %s\n",
 451                        extra_fw1_off, extra_fwsize, ret ? "ERROR" : "OK");
 452                 if (ret) {
 453                         kfree(extra_fwbuf);
 454                         goto fwbuf_err;
 455                 }
 456         }
 457
 458         /* fill fcb */
 459         fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
 460         if (!fcb) {
 461                 debug("failed to allocate fcb\n");
 462                 ret = -ENOMEM;
 463                 goto fwbuf_err;
 464         }
 465
 466         fw1_start = (fw1_blk * mtd->erasesize) / mtd->writesize;
 467         fw1_pages = size / mtd->writesize + 1;
 468         if (is_imx8m())
 469                 fw1_pages = (IMX8MQ_SPL_SZ + (mtd->writesize - 1)) / mtd->writesize;
 470         fill_fcb(fcb, mtd, fw1_start, 0, fw1_pages);
 471
 472         dump_fill_fcb = *fcb;
 473
 474         /* fill dbbt */
 475         dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
 476         if (!dbbt_page) {
 477                 debug("failed to allocate dbbt_page\n");
 478                 ret = -ENOMEM;
 479                 goto fcb_err;
 480         }
 481
 482         dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
 483         if (!dbbt_data_page) {
 484                 debug("failed to allocate dbbt_data_page\n");
 485                 ret = -ENOMEM;
 486                 goto dbbt_page_err;
 487         }
 488
 489         dbbt = dbbt_page;
 490         dbbt->checksum = 0;
 491         dbbt->fingerprint = DBBT_FINGERPRINT2;
 492         dbbt->version = DBBT_VERSION_1;
 493         ret = dbbt_fill_data(mtd, dbbt_data_page, nr_blks);
 494         if (ret < 0)
 495                 goto dbbt_data_page_err;
 496         else if (ret > 0)
 497                 dbbt->dbbtpages = 1;
 498
 499         dump_fill_dbbt = *dbbt;
 500
 501         /* write fcb and dbbt to nand */
 502         ret = write_fcb_dbbt_and_readback(mtd, fcb, dbbt, dbbt_data_page, off);
 503         if (ret < 0)
 504                 printf("failed to write FCB/DBBT\n");
 505
 506 dbbt_data_page_err:
 507         kfree(dbbt_data_page);
 508 dbbt_page_err:
 509         kfree(dbbt_page);
 510 fcb_err:
 511         kfree(fcb);
 512 fwbuf_err:
 513         kfree(fwbuf);
 514 err:
 515         return ret;
 516 }
 517
 518 static int do_nandbcb_bcbonly(int argc, char * const argv[])
 519 {
 520         struct fcb_block *fcb;
 521         struct dbbt_block *dbbt;
 522         u32 fw_len, fw1_off, fw2_off;
 523         struct mtd_info *mtd;
 524         void *dbbt_page, *dbbt_data_page;
 525         int dev, ret;
 526
 527         dev = nand_curr_device;
 528         if ((dev < 0) || (dev >= CONFIG_SYS_MAX_NAND_DEVICE) ||
 529             (!get_nand_dev_by_index(dev))) {
 530                 puts("No devices available\n");
 531                 return CMD_RET_FAILURE;
 532         }
 533
 534         mtd = get_nand_dev_by_index(dev);
 535
 536         if (argc < 3)
 537                 return CMD_RET_FAILURE;
 538
 539         fw_len = simple_strtoul(argv[1], NULL, 16);
 540         fw1_off = simple_strtoul(argv[2], NULL, 16);
 541
 542         if (argc > 3)
 543                 fw2_off = simple_strtoul(argv[3], NULL, 16);
 544         else
 545                 fw2_off = fw1_off;
 546
 547         /* fill fcb */
 548         fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
 549         if (!fcb) {
 550                 debug("failed to allocate fcb\n");
 551                 ret = -ENOMEM;
 552                 return CMD_RET_FAILURE;
 553         }
 554
 555         fill_fcb(fcb, mtd, fw1_off / mtd->writesize,
 556                  fw2_off / mtd->writesize, fw_len / mtd->writesize);
 557
 558         /* fill dbbt */
 559         dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
 560         if (!dbbt_page) {
 561                 debug("failed to allocate dbbt_page\n");
 562                 ret = -ENOMEM;
 563                 goto fcb_err;
 564         }
 565
 566         dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
 567         if (!dbbt_data_page) {
 568                 debug("failed to allocate dbbt_data_page\n");
 569                 ret = -ENOMEM;
 570                 goto dbbt_page_err;
 571         }
 572
 573         dbbt = dbbt_page;
 574         dbbt->checksum = 0;
 575         dbbt->fingerprint = DBBT_FINGERPRINT2;
 576         dbbt->version = DBBT_VERSION_1;
 577         ret = dbbt_fill_data(mtd, dbbt_data_page, 0);
 578         if (ret < 0)
 579                 goto dbbt_data_page_err;
 580         else if (ret > 0)
 581                 dbbt->dbbtpages = 1;
 582
 583         /* write fcb and dbbt to nand */
 584         ret = write_fcb_dbbt_and_readback(mtd, fcb, dbbt, dbbt_data_page, 0);
 585 dbbt_data_page_err:
 586         kfree(dbbt_data_page);
 587 dbbt_page_err:
 588         kfree(dbbt_page);
 589 fcb_err:
 590         kfree(fcb);
 591
 592         if (ret < 0) {
 593                 printf("failed to write FCB/DBBT\n");
 594                 return CMD_RET_FAILURE;
 595         }
 596
 597         return CMD_RET_SUCCESS;
 598 }
 599
 600 /* dump data which is planned to be encoded and written to NAND chip */
 601 void mtd_cfg_dump(void)
 602 {
 603         u64 blocks;
 604
 605         printf("MTD CONFIG:\n");
 606         printf("  %s = %d\n", "data_setup_time", dump_fill_fcb.datasetup);
 607         printf("  %s = %d\n", "data_hold_time", dump_fill_fcb.datahold);
 608         printf("  %s = %d\n", "address_setup_time", dump_fill_fcb.addr_setup);
 609         printf("  %s = %d\n", "data_sample_time", dump_fill_fcb.dsample_time);
 610
 611         printf("NFC geometry :\n");
 612         printf("\tECC Strength       : %d\n", dump_mtd->ecc_strength);
 613         printf("\tPage Size in Bytes : %d\n", dump_fill_fcb.oob_pagesize);
 614         printf("\tMetadata size      : %d\n", dump_fill_fcb.meta_size);
 615         printf("\tECC Chunk Size in byte : %d\n", dump_fill_fcb.ecc_size);
 616         printf("\tECC Chunk count        : %d\n", dump_fill_fcb.nr_blocks + 1);
 617         printf("\tBlock Mark Byte Offset : %d\n", dump_fill_fcb.bb_byte);
 618         printf("\tBlock Mark Bit Offset  : %d\n", dump_fill_fcb.bb_start_bit);
 619         printf("====================================================\n");
 620
 621         printf("mtd: partition #0\n");
 622         printf("  %s = %d\n", "type", dump_mtd->type);
 623         printf("  %s = %d\n", "flags", dump_mtd->flags);
 624         printf("  %s = %llu\n", "size", dump_nandboot_size);
 625         printf("  %s = %d\n", "erasesize", dump_mtd->erasesize);
 626         printf("  %s = %d\n", "writesize", dump_mtd->writesize);
 627         printf("  %s = %d\n", "oobsize", dump_mtd->oobsize);
 628         blocks = dump_nandboot_size;
 629         do_div(blocks, dump_mtd->erasesize);
 630         printf("  %s = %llu\n", "blocks", blocks);
 631 }
 632
 633 /* dump data which is read from NAND chip */
 634 void mtd_dump_structure(int i)
 635 {
 636         #define P1(x) printf("  %s = 0x%08x\n", #x, dump_nand_fcb[i].x)
 637                 printf("FCB %d:\n", i);
 638                 P1(checksum);
 639                 P1(fingerprint);
 640                 P1(version);
 641         #undef P1
 642         #define P1(x)   printf("  %s = %d\n", #x, dump_nand_fcb[i].x)
 643                 P1(datasetup);
 644                 P1(datahold);
 645                 P1(addr_setup);
 646                 P1(dsample_time);
 647                 P1(pagesize);
 648                 P1(oob_pagesize);
 649                 P1(sectors);
 650                 P1(nr_nand);
 651                 P1(nr_die);
 652                 P1(celltype);
 653                 P1(ecc_type);
 654                 P1(ecc_nr);
 655                 P1(ecc_size);
 656                 P1(ecc_level);
 657                 P1(meta_size);
 658                 P1(nr_blocks);
 659                 P1(ecc_type_sdk);
 660                 P1(ecc_nr_sdk);
 661                 P1(ecc_size_sdk);
 662                 P1(ecc_level_sdk);
 663                 P1(nr_blocks_sdk);
 664                 P1(meta_size_sdk);
 665                 P1(erase_th);
 666                 P1(bootpatch);
 667                 P1(patch_size);
 668                 P1(fw1_start);
 669                 P1(fw2_start);
 670                 P1(fw1_pages);
 671                 P1(fw2_pages);
 672                 P1(dbbt_start);
 673                 P1(bb_byte);
 674                 P1(bb_start_bit);
 675                 P1(phy_offset);
 676                 P1(bchtype);
 677                 P1(readlatency);
 678                 P1(predelay);
 679                 P1(cedelay);
 680                 P1(postdelay);
 681                 P1(cmdaddpause);
 682                 P1(datapause);
 683                 P1(tmspeed);
 684                 P1(busytimeout);
 685                 P1(disbbm);
 686                 P1(spare_offset);
 687                 P1(onfi_sync_enable);
 688                 P1(onfi_sync_speed);
 689                 P1(onfi_sync_nand_data);
 690                 P1(disbbm_search);
 691                 P1(disbbm_search_limit);
 692                 P1(read_retry_enable);
 693         #undef P1
 694         #define P1(x)   printf("  %s = 0x%08x\n", #x, dump_nand_dbbt[i].x)
 695                 printf("DBBT %d:\n", i);
 696                 P1(checksum);
 697                 P1(fingerprint);
 698                 P1(version);
 699         #undef P1
 700         #define P1(x)   printf("  %s = %d\n", #x, dump_nand_dbbt[i].x)
 701                 P1(numberbb);
 702         #undef P1
 703
 704         printf("Firmware: image #0 @ 0x%x size 0x%x - available 0x%llx\n",
 705                dump_nand_fcb[i].fw1_start * dump_nand_fcb[i].pagesize,
 706                dump_nand_fcb[i].fw1_pages * dump_nand_fcb[i].pagesize,
 707                dump_nandboot_size - dump_nand_fcb[i].fw1_start *
 708                dump_nand_fcb[i].pagesize);
 709         if (is_imx8m()) {
 710                 printf("Extra Firmware: image #0 @ 0x%x size 0x%x - available 0x%llx\n",
 711                        dump_nand_fcb[i].fw1_start *
 712                        dump_nand_fcb[i].pagesize + dump_mtd->erasesize *
 713                        ((IMX8MQ_SPL_SZ + dump_mtd->erasesize - 1) /
 714                         dump_mtd->erasesize),
 715                        dump_nand_fcb[i].fw1_pages * dump_nand_fcb[i].pagesize,
 716                        dump_nandboot_size -
 717                        (dump_nand_fcb[i].fw1_start *
 718                         dump_nand_fcb[i].pagesize + dump_mtd->erasesize *
 719                         ((IMX8MQ_SPL_SZ + dump_mtd->erasesize - 1) /
 720                          dump_mtd->erasesize)));
 721         }
 722 }
 723
 724 static int do_nandbcb_dump(int argc, char * const argv[])
 725 {
 726         int num;
 727         int stride;
 728         int search_area_sz;
 729         bool bab_block_table[BOOT_SEARCH_COUNT];
 730         int bab_block_flag;
 731
 732         if (argc != 2)
 733                 return CMD_RET_USAGE;
 734
 735         switch (argv[1][0]) {
 736         case '0':
 737                 num = 0;
 738                 break;
 739         case '1':
 740                 num = 1;
 741                 break;
 742         default:
 743                 return CMD_RET_USAGE;
 744         }
 745
 746         /* dump data which is planned to be encoded and written to NAND chip */
 747         mtd_cfg_dump();
 748
 749         stride = dump_mtd->erasesize;
 750         search_area_sz = BOOT_SEARCH_COUNT * stride;
 751         printf("stride: %x, search_area_sz: %x\n", stride, search_area_sz);
 752
 753         bab_block_flag = 0;
 754         for (int i = 0; i < BOOT_SEARCH_COUNT; i++) {
 755                 if (mtd_block_isbad(dump_mtd,
 756                                     (loff_t)(dump_mtd->erasesize * i))) {
 757                         bab_block_table[i] = 1;
 758                         bab_block_flag = 1;
 759                         continue;
 760                 }
 761                 bab_block_table[i] = 0;
 762                 if (!memcmp(dump_nand_fcb + i, &dump_fill_fcb,
 763                             sizeof(dump_fill_fcb))) {
 764                         printf("mtd: found FCB%d candidate version %08x @%d:0x%x\n",
 765                                i, dump_nand_fcb[i].version, i, dump_fcb_off[i]);
 766                 } else {
 767                         printf("mtd: FCB%d not found\n", i);
 768                 }
 769         }
 770
 771         for (int i = 0; i < BOOT_SEARCH_COUNT; i++) {
 772                 if (mtd_block_isbad(dump_mtd,
 773                                     (loff_t)(dump_mtd->erasesize * i)))
 774                         continue;
 775
 776                 if (!memcmp(dump_nand_dbbt + i, &dump_fill_dbbt,
 777                             sizeof(dump_fill_dbbt))) {
 778                         printf("mtd: DBBT%d found\n", i);
 779                         printf("mtd: Valid DBBT%d found @%d:0x%x\n",
 780                                i, i, dump_dbbt_off[i]);
 781
 782                 } else {
 783                         printf("mtd: DBBT%d not found\n", i);
 784                 }
 785         }
 786         if (bab_block_flag == 0) {
 787                 printf("no bad block found, dbbt: %08x\n",
 788                        dump_fill_dbbt.fingerprint);
 789         } else {
 790                 for (int i = 0; i < BOOT_SEARCH_COUNT; i++) {
 791                         if (bab_block_table[i] == 1)
 792                                 printf("mtd: bad block @ 0x%llx\n",
 793                                        (loff_t)(dump_mtd->erasesize * i));
 794                 }
 795         }
 796
 797         /* dump data which is read from NAND chip */
 798         if (num > (BOOT_SEARCH_COUNT - 1))
 799                 return CMD_RET_USAGE;
 800
 801         if (bab_block_table[num] == 1) {
 802                 printf("mtd: bad block @ 0x%llx (FCB - DBBT)\n",
 803                        (loff_t)(dump_mtd->erasesize * num));
 804                 return CMD_RET_USAGE;
 805         }
 806
 807         mtd_dump_structure(num);
 808
 809         return 0;
 810 }
 811
 812 static int do_nandbcb_update(int argc, char * const argv[])
 813 {
 814         struct mtd_info *mtd;
 815         loff_t addr, offset, size, maxsize;
 816         char *endp;
 817         u_char *buf;
 818         int dev;
 819         int ret;
 820
 821         if (argc != 4)
 822                 return CMD_RET_USAGE;
 823
 824         dev = nand_curr_device;
 825         if (dev < 0) {
 826                 printf("failed to get nand_curr_device, run nand device\n");
 827                 return CMD_RET_FAILURE;
 828         }
 829
 830         addr = simple_strtoul(argv[1], &endp, 16);
 831         if (*argv[1] == 0 || *endp != 0)
 832                 return CMD_RET_FAILURE;
 833
 834         mtd = get_nand_dev_by_index(dev);
 835         if (mtd_arg_off_size(argc - 2, argv + 2, &dev, &offset, &size,
 836                              &maxsize, MTD_DEV_TYPE_NAND, mtd->size))
 837                 return CMD_RET_FAILURE;
 838
 839         /* dump_mtd and dump_nandboot_size are used for "nandbcb dump [-v]" */
 840         dump_mtd = mtd;
 841         dump_nandboot_size = maxsize;
 842
 843         buf = map_physmem(addr, size, MAP_WRBACK);
 844         if (!buf) {
 845                 puts("failed to map physical memory\n");
 846                 return CMD_RET_FAILURE;
 847         }
 848
 849         ret = nandbcb_update(mtd, offset, size, maxsize, buf);
 850
 851         return ret == 0 ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
 852 }
 853
 854 static int do_nandbcb(cmd_tbl_t *cmdtp, int flag, int argc,
 855                       char * const argv[])
 856 {
 857         const char *cmd;
 858         int ret = 0;
 859
 860         if (argc < 3)
 861                 goto usage;
 862
 863         cmd = argv[1];
 864         --argc;
 865         ++argv;
 866
 867         if (strcmp(cmd, "update") == 0) {
 868                 ret = do_nandbcb_update(argc, argv);
 869                 goto done;
 870         }
 871
 872         if (strcmp(cmd, "dump") == 0) {
 873                 ret = do_nandbcb_dump(argc, argv);
 874                 goto done;
 875         }
 876
 877         if (strcmp(cmd, "bcbonly") == 0) {
 878                 ret = do_nandbcb_bcbonly(argc, argv);
 879                 goto done;
 880         }
 881
 882 done:
 883         if (ret != -1)
 884                 return ret;
 885 usage:
 886         return CMD_RET_USAGE;
 887 }
 888
 889 #ifdef CONFIG_SYS_LONGHELP
 890 static char nandbcb_help_text[] =
 891         "update addr off|partition len  - update 'len' bytes starting at\n"
 892         "       'off|part' to memory address 'addr', skipping  bad blocks\n"
 893         "bcbonly fw-size fw1-off [fw2-off] - write only BCB (FCB and DBBT)\n"
 894         "       where `fw-size` is fw sizes in bytes, `fw1-off`\n"
 895         "       and `fw2-off` - firmware offsets\n"
 896         "       FIY, BCB isn't erased automatically, so mtd erase should\n"
 897         "       be called in advance before writing new BCB:\n"
 898         "           > mtd erase mx7-bcb\n"
 899         "nandbcb dump num - verify/dump boot structures\n"
 900         "       'num' can be set to 0 and 1";
 901 #endif
 902
 903 U_BOOT_CMD(nandbcb, 5, 1, do_nandbcb,
 904            "i.MX6/i.MX7 NAND Boot Control Blocks write",
 905            nandbcb_help_text
 906 );