arch/arm/mach-imx/cmd_nandbcb.c

   1 /*
   2  * i.MX nand boot control block(bcb).
   3  *
   4  * Based on the common/imx-bbu-nand-fcb.c from barebox and imx kobs-ng
   5  *
   6  * Copyright (C) 2017 Jagan Teki <jagan@amarulasolutions.com>
   7  * Copyright (C) 2016 Sergey Kubushyn <ksi@koi8.net>
   8  *
   9  * Reconstucted by Han Xu <han.xu@nxp.com>
  10  *
  11  * SPDX-License-Identifier:     GPL-2.0+
  12  */
  13
  14 #include <common.h>
  15 #include <command.h>
  16 #include <malloc.h>
  17 #include <nand.h>
  18 #include <dm/devres.h>
  19
  20 #include <asm/io.h>
  21 #include <jffs2/jffs2.h>
  22 #include <linux/bch.h>
  23 #include <linux/mtd/mtd.h>
  24
  25 #include <asm/arch/sys_proto.h>
  26 #include <asm/mach-imx/imx-nandbcb.h>
  27 #include <asm/mach-imx/imximage.cfg>
  28 #include <mxs_nand.h>
  29 #include <linux/mtd/mtd.h>
  30 #include <nand.h>
  31 #include <fuse.h>
  32
  33 #include "../../../cmd/legacy-mtd-utils.h"
  34
  35 /* FCB related flags */
  36 /* FCB layout with leading 12B reserved */
  37 #define FCB_LAYOUT_RESV_12B             BIT(0)
  38 /* FCB layout with leading 32B meta data */
  39 #define FCB_LAYOUT_META_32B             BIT(1)
  40 /* FCB encrypted by Hamming code */
  41 #define FCB_ENCODE_HAMMING              BIT(2)
  42 /* FCB encrypted by 40bit BCH */
  43 #define FCB_ENCODE_BCH_40b              BIT(3)
  44 /* FCB encrypted by 62bit BCH */
  45 #define FCB_ENCODE_BCH_62b              BIT(4)
  46 /* FCB encrypted by BCH */
  47 #define FCB_ENCODE_BCH                  (FCB_ENCODE_BCH_40b | FCB_ENCODE_BCH_62b)
  48 /* FCB data was randomized */
  49 #define FCB_RANDON_ENABLED              BIT(5)
  50
  51 /* Firmware related flags */
  52 /* No 1K padding */
  53 #define FIRMWARE_NEED_PADDING           BIT(8)
  54 /* Extra firmware*/
  55 #define FIRMWARE_EXTRA_ONE              BIT(9)
  56 /* Secondary firmware on fixed address */
  57 #define FIRMWARE_SECONDARY_FIXED_ADDR   BIT(10)
  58
  59 /* Boot search related flags */
  60 #define BT_SEARCH_CNT_FROM_FUSE         BIT(16)
  61
  62 struct platform_config {
  63         int misc_flags;
  64 };
  65
  66 static struct platform_config plat_config;
  67
  68 /* imx6q/dl/solo */
  69 static struct platform_config imx6qdl_plat_config = {
  70         .misc_flags = FCB_LAYOUT_RESV_12B |
  71                      FCB_ENCODE_HAMMING |
  72                      FIRMWARE_NEED_PADDING,
  73 };
  74
  75 static struct platform_config imx6sx_plat_config = {
  76         .misc_flags = FCB_LAYOUT_META_32B |
  77                      FCB_ENCODE_BCH_62b |
  78                      FIRMWARE_NEED_PADDING |
  79                      FCB_RANDON_ENABLED,
  80 };
  81
  82 static struct platform_config imx7d_plat_config = {
  83         .misc_flags = FCB_LAYOUT_META_32B |
  84                      FCB_ENCODE_BCH_62b |
  85                      FIRMWARE_NEED_PADDING |
  86                      FCB_RANDON_ENABLED,
  87 };
  88
  89 /* imx6ul/ull/ulz */
  90 static struct platform_config imx6ul_plat_config = {
  91         .misc_flags = FCB_LAYOUT_META_32B |
  92                      FCB_ENCODE_BCH_40b |
  93                      FIRMWARE_NEED_PADDING,
  94 };
  95
  96 static struct platform_config imx8mq_plat_config = {
  97         .misc_flags = FCB_LAYOUT_META_32B |
  98                      FCB_ENCODE_BCH_62b |
  99                      FIRMWARE_NEED_PADDING |
 100                      FCB_RANDON_ENABLED |
 101                      FIRMWARE_EXTRA_ONE,
 102 };
 103
 104 /* all other imx8mm */
 105 static struct platform_config imx8mm_plat_config = {
 106         .misc_flags = FCB_LAYOUT_META_32B |
 107                      FCB_ENCODE_BCH_62b |
 108                      FIRMWARE_NEED_PADDING |
 109                      FCB_RANDON_ENABLED,
 110 };
 111
 112 /* imx8mn */
 113 static struct platform_config imx8mn_plat_config = {
 114         .misc_flags = FCB_LAYOUT_META_32B |
 115                      FCB_ENCODE_BCH_62b |
 116                      FCB_RANDON_ENABLED |
 117                      FIRMWARE_SECONDARY_FIXED_ADDR |
 118                      BT_SEARCH_CNT_FROM_FUSE,
 119 };
 120
 121 /* imx8qx/qm */
 122 static struct platform_config imx8q_plat_config = {
 123         .misc_flags = FCB_LAYOUT_META_32B |
 124                      FCB_ENCODE_BCH_62b |
 125                      FCB_RANDON_ENABLED |
 126                      FIRMWARE_SECONDARY_FIXED_ADDR |
 127                      BT_SEARCH_CNT_FROM_FUSE,
 128 };
 129
 130 /* boot search related variables and definitions */
 131 static int g_boot_search_count = 4;
 132 static int g_boot_search_stride;
 133 static int g_pages_per_stride;
 134
 135 /* mtd config structure */
 136 struct boot_config {
 137         int dev;
 138         struct mtd_info *mtd;
 139         loff_t maxsize;
 140         loff_t input_size;
 141         loff_t offset;
 142         loff_t boot_stream1_address;
 143         loff_t boot_stream2_address;
 144         size_t boot_stream1_size;
 145         size_t boot_stream2_size;
 146         size_t max_boot_stream_size;
 147         int stride_size_in_byte;
 148         int search_area_size_in_bytes;
 149         int search_area_size_in_pages;
 150         int secondary_boot_stream_off_in_MB;
 151 };
 152
 153 /* boot_stream config structure */
 154 struct boot_stream_config {
 155         char bs_label[32];
 156         loff_t bs_addr;
 157         size_t bs_size;
 158         void *bs_buf;
 159         loff_t next_bs_addr;
 160         bool need_padding;
 161 };
 162
 163 /* FW index */
 164 #define FW1_ONLY        1
 165 #define FW2_ONLY        2
 166 #define FW_ALL          FW1_ONLY | FW2_ONLY
 167 #define FW_INX(x)       (1 << (x))
 168
 169 /* NAND convert macros */
 170 #define CONV_TO_PAGES(x)        ((u32)(x) / (u32)(mtd->writesize))
 171 #define CONV_TO_BLOCKS(x)       ((u32)(x) / (u32)(mtd->erasesize))
 172
 173 #define GETBIT(v, n)            (((v) >> (n)) & 0x1)
 174 #define IMX8MQ_SPL_SZ 0x3e000
 175 #define IMX8MQ_HDMI_FW_SZ 0x19c00
 176
 177 static int nandbcb_get_info(int argc, char * const argv[],
 178                             struct boot_config *boot_cfg)
 179 {
 180         int dev;
 181         struct mtd_info *mtd;
 182
 183         dev = nand_curr_device;
 184         if (dev < 0) {
 185                 printf("failed to get nand_curr_device, run nand device\n");
 186                 return CMD_RET_FAILURE;
 187         }
 188
 189         mtd = get_nand_dev_by_index(dev);
 190         if (!mtd) {
 191                 printf("failed to get mtd info\n");
 192                 return CMD_RET_FAILURE;
 193         }
 194
 195         boot_cfg->dev = dev;
 196         boot_cfg->mtd = mtd;
 197
 198         return CMD_RET_SUCCESS;
 199 }
 200
 201 static int nandbcb_get_size(int argc, char * const argv[], int num,
 202                             struct boot_config *boot_cfg)
 203 {
 204         int dev;
 205         loff_t offset, size, maxsize;
 206         struct mtd_info *mtd;
 207
 208         dev = boot_cfg->dev;
 209         mtd = boot_cfg->mtd;
 210         size = 0;
 211
 212         if (mtd_arg_off_size(argc - num, argv + num, &dev, &offset, &size,
 213                              &maxsize, MTD_DEV_TYPE_NAND, mtd->size))
 214                 return CMD_RET_FAILURE;
 215
 216         boot_cfg->maxsize = maxsize;
 217         boot_cfg->offset = offset;
 218
 219         debug("max: %llx, offset: %llx\n", maxsize, offset);
 220
 221         if (size && size != maxsize)
 222                 boot_cfg->input_size = size;
 223
 224         return CMD_RET_SUCCESS;
 225 }
 226
 227 static int nandbcb_set_boot_config(int argc, char * const argv[],
 228                                    struct boot_config *boot_cfg)
 229 {
 230         struct mtd_info *mtd;
 231         loff_t maxsize;
 232         loff_t boot_stream1_address, boot_stream2_address, max_boot_stream_size;
 233
 234         if (!boot_cfg->mtd) {
 235                 printf("Didn't get the mtd info, quit\n");
 236                 return CMD_RET_FAILURE;
 237         }
 238         mtd = boot_cfg->mtd;
 239
 240         /*
 241          * By default
 242          * set the search count as 4
 243          * set each FCB/DBBT/Firmware offset at the beginning of blocks
 244          * customers may change the value as needed
 245          */
 246
 247         /* if need more compact layout, change these values */
 248         /* g_boot_search_count was set as 4 at the definition*/
 249         /* g_pages_per_stride was set as block size */
 250
 251         g_pages_per_stride = mtd->erasesize / mtd->writesize;
 252
 253         g_boot_search_stride = mtd->writesize * g_pages_per_stride;
 254
 255         boot_cfg->stride_size_in_byte = g_boot_search_stride * mtd->writesize;
 256         boot_cfg->search_area_size_in_bytes =
 257                 g_boot_search_count * g_boot_search_stride;
 258         boot_cfg->search_area_size_in_pages =
 259                 boot_cfg->search_area_size_in_bytes / mtd->writesize;
 260
 261         /* after FCB/DBBT, split the rest of area for two Firmwares */
 262         if (!boot_cfg->maxsize) {
 263                 printf("Didn't get the maxsize, quit\n");
 264                 return CMD_RET_FAILURE;
 265         }
 266         maxsize = boot_cfg->maxsize;
 267         /* align to page boundary */
 268         maxsize = ((u32)(maxsize + mtd->writesize - 1)) / (u32)mtd->writesize
 269                         * mtd->writesize;
 270
 271         boot_stream1_address = 2 * boot_cfg->search_area_size_in_bytes;
 272         boot_stream2_address = ((maxsize - boot_stream1_address) / 2 +
 273                                boot_stream1_address);
 274
 275         if (boot_cfg->secondary_boot_stream_off_in_MB)
 276                 boot_stream2_address = boot_cfg->secondary_boot_stream_off_in_MB * 1024 * 1024;
 277
 278         max_boot_stream_size = boot_stream2_address - boot_stream1_address;
 279
 280         /* sanity check */
 281         if (max_boot_stream_size <= 0) {
 282                 debug("st1_addr: %llx, st2_addr: %llx, max: %llx\n",
 283                       boot_stream1_address, boot_stream2_address,
 284                       max_boot_stream_size);
 285                 printf("something wrong with firmware address settings\n");
 286                 return CMD_RET_FAILURE;
 287         }
 288         boot_cfg->boot_stream1_address = boot_stream1_address;
 289         boot_cfg->boot_stream2_address = boot_stream2_address;
 290         boot_cfg->max_boot_stream_size = max_boot_stream_size;
 291
 292         /* set the boot_stream size as the input size now */
 293         if (boot_cfg->input_size) {
 294                 boot_cfg->boot_stream1_size = boot_cfg->input_size;
 295                 boot_cfg->boot_stream2_size = boot_cfg->input_size;
 296         }
 297
 298         return CMD_RET_SUCCESS;
 299 }
 300
 301 static int nandbcb_check_space(struct boot_config *boot_cfg)
 302 {
 303         size_t maxsize = boot_cfg->maxsize;
 304         size_t max_boot_stream_size = boot_cfg->max_boot_stream_size;
 305         loff_t boot_stream2_address = boot_cfg->boot_stream2_address;
 306
 307         if (boot_cfg->boot_stream1_size &&
 308             boot_cfg->boot_stream1_size > max_boot_stream_size) {
 309                 printf("boot stream1 doesn't fit, check partition size or settings\n");
 310                 return CMD_RET_FAILURE;
 311         }
 312
 313         if (boot_cfg->boot_stream2_size &&
 314             boot_cfg->boot_stream2_size > maxsize - boot_stream2_address) {
 315                 printf("boot stream2 doesn't fit, check partition size or settings\n");
 316                 return CMD_RET_FAILURE;
 317         }
 318
 319         return CMD_RET_SUCCESS;
 320 }
 321
 322 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
 323 static uint8_t reverse_bit(uint8_t b)
 324 {
 325         b = (b & 0xf0) >> 4 | (b & 0x0f) << 4;
 326         b = (b & 0xcc) >> 2 | (b & 0x33) << 2;
 327         b = (b & 0xaa) >> 1 | (b & 0x55) << 1;
 328
 329         return b;
 330 }
 331
 332 static void encode_bch_ecc(void *buf, struct fcb_block *fcb, int eccbits)
 333 {
 334         int i, j, m = 13;
 335         int blocksize = 128;
 336         int numblocks = 8;
 337         int ecc_buf_size = (m * eccbits + 7) / 8;
 338         struct bch_control *bch = init_bch(m, eccbits, 0);
 339         u8 *ecc_buf = kzalloc(ecc_buf_size, GFP_KERNEL);
 340         u8 *tmp_buf = kzalloc(blocksize * numblocks, GFP_KERNEL);
 341         u8 *psrc, *pdst;
 342
 343         /*
 344          * The blocks here are bit aligned. If eccbits is a multiple of 8,
 345          * we just can copy bytes. Otherwiese we must move the blocks to
 346          * the next free bit position.
 347          */
 348         WARN_ON(eccbits % 8);
 349
 350         memcpy(tmp_buf, fcb, sizeof(*fcb));
 351
 352         for (i = 0; i < numblocks; i++) {
 353                 memset(ecc_buf, 0, ecc_buf_size);
 354                 psrc = tmp_buf + i * blocksize;
 355                 pdst = buf + i * (blocksize + ecc_buf_size);
 356
 357                 /* copy data byte aligned to destination buf */
 358                 memcpy(pdst, psrc, blocksize);
 359
 360                 /*
 361                  * imx-kobs use a modified encode_bch which reverse the
 362                  * bit order of the data before calculating bch.
 363                  * Do this in the buffer and use the bch lib here.
 364                  */
 365                 for (j = 0; j < blocksize; j++)
 366                         psrc[j] = reverse_bit(psrc[j]);
 367
 368                 encode_bch(bch, psrc, blocksize, ecc_buf);
 369
 370                 /* reverse ecc bit */
 371                 for (j = 0; j < ecc_buf_size; j++)
 372                         ecc_buf[j] = reverse_bit(ecc_buf[j]);
 373
 374                 /* Here eccbuf is byte aligned and we can just copy it */
 375                 memcpy(pdst + blocksize, ecc_buf, ecc_buf_size);
 376         }
 377
 378         kfree(ecc_buf);
 379         kfree(tmp_buf);
 380         free_bch(bch);
 381 }
 382 #else
 383
 384 static u8 calculate_parity_13_8(u8 d)
 385 {
 386         u8 p = 0;
 387
 388         p |= (GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 3) ^ GETBIT(d, 2)) << 0;
 389         p |= (GETBIT(d, 7) ^ GETBIT(d, 5) ^ GETBIT(d, 4) ^ GETBIT(d, 2) ^
 390               GETBIT(d, 1)) << 1;
 391         p |= (GETBIT(d, 7) ^ GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 1) ^
 392               GETBIT(d, 0)) << 2;
 393         p |= (GETBIT(d, 7) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 0)) << 3;
 394         p |= (GETBIT(d, 6) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 2) ^
 395               GETBIT(d, 1) ^ GETBIT(d, 0)) << 4;
 396
 397         return p;
 398 }
 399
 400 static void encode_hamming_13_8(void *_src, void *_ecc, size_t size)
 401 {
 402         int i;
 403         u8 *src = _src;
 404         u8 *ecc = _ecc;
 405
 406         for (i = 0; i < size; i++)
 407                 ecc[i] = calculate_parity_13_8(src[i]);
 408 }
 409 #endif
 410
 411 static u32 calc_chksum(void *buf, size_t size)
 412 {
 413         u32 chksum = 0;
 414         u8 *bp = buf;
 415         size_t i;
 416
 417         for (i = 0; i < size; i++)
 418                 chksum += bp[i];
 419
 420         return ~chksum;
 421 }
 422
 423 static void fill_fcb(struct fcb_block *fcb, struct boot_config *boot_cfg)
 424 {
 425         struct mtd_info *mtd = boot_cfg->mtd;
 426         struct nand_chip *chip = mtd_to_nand(mtd);
 427         struct mxs_nand_info *nand_info = nand_get_controller_data(chip);
 428         struct mxs_nand_layout l;
 429
 430         mxs_nand_get_layout(mtd, &l);
 431
 432         fcb->fingerprint = FCB_FINGERPRINT;
 433         fcb->version = FCB_VERSION_1;
 434
 435         fcb->datasetup = 80;
 436         fcb->datahold = 60;
 437         fcb->addr_setup = 25;
 438         fcb->dsample_time = 6;
 439
 440         fcb->pagesize = mtd->writesize;
 441         fcb->oob_pagesize = mtd->writesize + mtd->oobsize;
 442         fcb->sectors = mtd->erasesize / mtd->writesize;
 443
 444         fcb->meta_size = l.meta_size;
 445         fcb->nr_blocks = l.nblocks;
 446         fcb->ecc_nr = l.data0_size;
 447         fcb->ecc_level = l.ecc0;
 448         fcb->ecc_size = l.datan_size;
 449         fcb->ecc_type = l.eccn;
 450         fcb->bchtype = l.gf_len;
 451
 452         /* DBBT search area starts from the next block after all FCB */
 453         fcb->dbbt_start = boot_cfg->search_area_size_in_pages;
 454
 455         fcb->bb_byte = nand_info->bch_geometry.block_mark_byte_offset;
 456         fcb->bb_start_bit = nand_info->bch_geometry.block_mark_bit_offset;
 457
 458         fcb->phy_offset = mtd->writesize;
 459
 460         fcb->disbbm = 0;
 461
 462         fcb->fw1_start = CONV_TO_PAGES(boot_cfg->boot_stream1_address);
 463         fcb->fw2_start = CONV_TO_PAGES(boot_cfg->boot_stream2_address);
 464         fcb->fw1_pages = CONV_TO_PAGES(boot_cfg->boot_stream1_size);
 465         fcb->fw2_pages = CONV_TO_PAGES(boot_cfg->boot_stream2_size);
 466
 467         fcb->checksum = calc_chksum((void *)fcb + 4, sizeof(*fcb) - 4);
 468 }
 469
 470 static int fill_dbbt_data(struct mtd_info *mtd, void *buf, int num_blocks)
 471 {
 472         int n, n_bad_blocks = 0;
 473         u32 *bb = buf + 0x8;
 474         u32 *n_bad_blocksp = buf + 0x4;
 475
 476         for (n = 0; n < num_blocks; n++) {
 477                 loff_t offset = n * mtd->erasesize;
 478                         if (mtd_block_isbad(mtd, offset)) {
 479                                 n_bad_blocks++;
 480                                 *bb = n;
 481                                 bb++;
 482                 }
 483         }
 484
 485         *n_bad_blocksp = n_bad_blocks;
 486
 487         return n_bad_blocks;
 488 }
 489
 490 /*
 491  * return 1     - bad block
 492  * return 0     - read successfully
 493  * return < 0   - read failed
 494  */
 495 static int read_fcb(struct boot_config *boot_cfg, struct fcb_block *fcb,
 496                     loff_t off)
 497 {
 498         struct mtd_info *mtd;
 499         void *fcb_raw_page;
 500         size_t size;
 501         int ret = 0;
 502
 503         mtd = boot_cfg->mtd;
 504         fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize, GFP_KERNEL);
 505
 506         if (mtd_block_isbad(mtd, off)) {
 507                 printf("Block %d is bad, skipped\n", (int)CONV_TO_BLOCKS(off));
 508                 return 1;
 509         }
 510
 511         /*
 512          * User BCH hardware to decode ECC for FCB
 513          */
 514         if (plat_config.misc_flags & FCB_ENCODE_BCH) {
 515                 size = sizeof(struct fcb_block);
 516
 517                 /* switch nand BCH to FCB compatible settings */
 518                 if (plat_config.misc_flags & FCB_ENCODE_BCH_62b)
 519                         mxs_nand_mode_fcb_62bit(mtd);
 520                 else if (plat_config.misc_flags & FCB_ENCODE_BCH_40b)
 521                         mxs_nand_mode_fcb_40bit(mtd);
 522
 523                 ret = nand_read(mtd, off, &size, (u_char *)fcb);
 524
 525                 /* switch BCH back */
 526                 mxs_nand_mode_normal(mtd);
 527                 printf("NAND FCB read from 0x%llx offset 0x%zx read: %s\n",
 528                        off, size, ret ? "ERROR" : "OK");
 529
 530         } else if (plat_config.misc_flags & FCB_ENCODE_HAMMING) {
 531                 /* raw read*/
 532                 mtd_oob_ops_t ops = {
 533                         .datbuf = (u8 *)fcb_raw_page,
 534                         .oobbuf = ((u8 *)fcb_raw_page) + mtd->writesize,
 535                         .len = mtd->writesize,
 536                         .ooblen = mtd->oobsize,
 537                         .mode = MTD_OPS_RAW
 538                         };
 539
 540                 ret = mtd_read_oob(mtd, off, &ops);
 541                 printf("NAND FCB read from 0x%llx offset 0x%zx read: %s\n",
 542                        off, ops.len, ret ? "ERROR" : "OK");
 543         }
 544
 545         if (ret)
 546                 goto fcb_raw_page_err;
 547
 548         if ((plat_config.misc_flags & FCB_ENCODE_HAMMING) &&
 549             (plat_config.misc_flags & FCB_LAYOUT_RESV_12B))
 550                 memcpy(fcb, fcb_raw_page + 12, sizeof(struct fcb_block));
 551
 552 /* TODO: check if it can pass Hamming check */
 553
 554 fcb_raw_page_err:
 555         kfree(fcb_raw_page);
 556
 557         return ret;
 558 }
 559
 560 static int write_fcb(struct boot_config *boot_cfg, struct fcb_block *fcb)
 561 {
 562         struct mtd_info *mtd;
 563         void *fcb_raw_page = NULL;
 564         int i, ret;
 565         loff_t off;
 566         size_t size;
 567
 568         mtd = boot_cfg->mtd;
 569
 570         /*
 571          * We prepare raw page only for i.MX6, for i.MX7 we
 572          * leverage BCH hw module instead
 573          */
 574         if ((plat_config.misc_flags & FCB_ENCODE_HAMMING) &&
 575             (plat_config.misc_flags & FCB_LAYOUT_RESV_12B)) {
 576                 fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize,
 577                                        GFP_KERNEL);
 578                 if (!fcb_raw_page) {
 579                         debug("failed to allocate fcb_raw_page\n");
 580                         ret = -ENOMEM;
 581                         return ret;
 582                 }
 583
 584 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
 585                 /* 40 bit BCH, for i.MX6UL(L) */
 586                 encode_bch_ecc(fcb_raw_page + 32, fcb, 40);
 587 #else
 588                 memcpy(fcb_raw_page + 12, fcb, sizeof(struct fcb_block));
 589                 encode_hamming_13_8(fcb_raw_page + 12,
 590                                     fcb_raw_page + 12 + 512, 512);
 591 #endif
 592                 /*
 593                  * Set the first and second byte of OOB data to 0xFF,
 594                  * not 0x00. These bytes are used as the Manufacturers Bad
 595                  * Block Marker (MBBM). Since the FCB is mostly written to
 596                  * the first page in a block, a scan for
 597                  * factory bad blocks will detect these blocks as bad, e.g.
 598                  * when function nand_scan_bbt() is executed to build a new
 599                  * bad block table.
 600                  */
 601                 memset(fcb_raw_page + mtd->writesize, 0xFF, 2);
 602         }
 603
 604         /* start writing FCB from the very beginning */
 605         off = 0;
 606
 607         for (i = 0; i < g_boot_search_count; i++) {
 608                 if (mtd_block_isbad(mtd, off)) {
 609                         printf("Block %d is bad, skipped\n", i);
 610                         continue;
 611                 }
 612
 613                 /*
 614                  * User BCH hardware module to generate ECC for FCB
 615                  */
 616                 if (plat_config.misc_flags & FCB_ENCODE_BCH) {
 617                         size = sizeof(struct fcb_block);
 618
 619                         /* switch nand BCH to FCB compatible settings */
 620                         if (plat_config.misc_flags & FCB_ENCODE_BCH_62b)
 621                                 mxs_nand_mode_fcb_62bit(mtd);
 622                         else if (plat_config.misc_flags & FCB_ENCODE_BCH_40b)
 623                                 mxs_nand_mode_fcb_40bit(mtd);
 624
 625                         ret = nand_write(mtd, off, &size, (u_char *)fcb);
 626
 627                         /* switch BCH back */
 628                         mxs_nand_mode_normal(mtd);
 629                         printf("NAND FCB write to 0x%zx offset 0x%llx written: %s\n",
 630                                size, off, ret ? "ERROR" : "OK");
 631
 632                 } else if (plat_config.misc_flags & FCB_ENCODE_HAMMING) {
 633                         /* raw write */
 634                         mtd_oob_ops_t ops = {
 635                                 .datbuf = (u8 *)fcb_raw_page,
 636                                 .oobbuf = ((u8 *)fcb_raw_page) +
 637                                           mtd->writesize,
 638                                 .len = mtd->writesize,
 639                                 .ooblen = mtd->oobsize,
 640                                 .mode = MTD_OPS_RAW
 641                         };
 642
 643                         ret = mtd_write_oob(mtd, off, &ops);
 644                         printf("NAND FCB write to 0x%llxx offset 0x%zx written: %s\n", off, ops.len, ret ? "ERROR" : "OK");
 645                 }
 646
 647                 if (ret)
 648                         goto fcb_raw_page_err;
 649
 650                 /* next writing location */
 651                 off += g_boot_search_stride;
 652         }
 653
 654         return 0;
 655
 656 fcb_raw_page_err:
 657         kfree(fcb_raw_page);
 658
 659         return ret;
 660 }
 661
 662 /*
 663  * return 1     - bad block
 664  * return 0     - read successfully
 665  * return < 0   - read failed
 666  */
 667 static int read_dbbt(struct boot_config *boot_cfg, struct dbbt_block *dbbt,
 668                       void *dbbt_data_page, loff_t off)
 669 {
 670         size_t size;
 671         struct mtd_info *mtd;
 672         loff_t to;
 673         int ret;
 674
 675         mtd = boot_cfg->mtd;
 676
 677         if (mtd_block_isbad(mtd, off)) {
 678                 printf("Block %d is bad, skipped\n",
 679                        (int)CONV_TO_BLOCKS(off));
 680                 return 1;
 681         }
 682
 683         size = sizeof(struct dbbt_block);
 684         ret = nand_read(mtd, off, &size, (u_char *)dbbt);
 685         printf("NAND DBBT read from 0x%llx offset 0x%zx read: %s\n",
 686                off, size, ret ? "ERROR" : "OK");
 687         if (ret)
 688                 return ret;
 689
 690         /* dbbtpages == 0 if no bad blocks */
 691         if (dbbt->dbbtpages > 0) {
 692                 to = off + 4 * mtd->writesize;
 693                 size = mtd->writesize;
 694                 ret = nand_read(mtd, to, &size, dbbt_data_page);
 695                 printf("DBBT data read from 0x%llx offset 0x%zx read: %s\n",
 696                        to, size, ret ? "ERROR" : "OK");
 697
 698                 if (ret)
 699                         return ret;
 700         }
 701
 702         return 0;
 703 }
 704
 705 static int write_dbbt(struct boot_config *boot_cfg, struct dbbt_block *dbbt,
 706                       void *dbbt_data_page)
 707 {
 708         int i;
 709         loff_t off, to;
 710         size_t size;
 711         struct mtd_info *mtd;
 712         int ret;
 713
 714         mtd = boot_cfg->mtd;
 715
 716         /* start writing DBBT after all FCBs */
 717         off = boot_cfg->search_area_size_in_bytes;
 718         size = mtd->writesize;
 719
 720         for (i = 0; i < g_boot_search_count; i++) {
 721                 if (mtd_block_isbad(mtd, off)) {
 722                         printf("Block %d is bad, skipped\n",
 723                                (int)(i + CONV_TO_BLOCKS(off)));
 724                         continue;
 725                 }
 726
 727                 ret = nand_write(mtd, off, &size, (u_char *)dbbt);
 728                 printf("NAND DBBT write to 0x%llx offset 0x%zx written: %s\n",
 729                        off, size, ret ? "ERROR" : "OK");
 730                 if (ret)
 731                         return ret;
 732
 733                 /* dbbtpages == 0 if no bad blocks */
 734                 if (dbbt->dbbtpages > 0) {
 735                         to = off + 4 * mtd->writesize;
 736                         ret = nand_write(mtd, to, &size, dbbt_data_page);
 737                         printf("DBBT data write to 0x%llx offset 0x%zx written: %s\n",
 738                                to, size, ret ? "ERROR" : "OK");
 739
 740                 if (ret)
 741                         return ret;
 742                 }
 743
 744                 /* next writing location */
 745                 off += g_boot_search_stride;
 746         }
 747
 748         return 0;
 749 }
 750
 751 /* reuse the check_skip_len from nand_util.c with minor change*/
 752 static int check_skip_length(struct boot_config *boot_cfg, loff_t offset,
 753                              size_t length, size_t *used)
 754 {
 755         struct mtd_info *mtd = boot_cfg->mtd;
 756         size_t maxsize = boot_cfg->maxsize;
 757         size_t len_excl_bad = 0;
 758         int ret = 0;
 759
 760         while (len_excl_bad < length) {
 761                 size_t block_len, block_off;
 762                 loff_t block_start;
 763
 764                 if (offset >= maxsize)
 765                         return -1;
 766
 767                 block_start = offset & ~(loff_t)(mtd->erasesize - 1);
 768                 block_off = offset & (mtd->erasesize - 1);
 769                 block_len = mtd->erasesize - block_off;
 770
 771                 if (!nand_block_isbad(mtd, block_start))
 772                         len_excl_bad += block_len;
 773                 else
 774                         ret = 1;
 775
 776                 offset += block_len;
 777                 *used += block_len;
 778         }
 779
 780         /* If the length is not a multiple of block_len, adjust. */
 781         if (len_excl_bad > length)
 782                 *used -= (len_excl_bad - length);
 783
 784         return ret;
 785 }
 786
 787 static int nandbcb_get_next_good_blk_addr(struct boot_config *boot_cfg,
 788                                           struct boot_stream_config *bs_cfg)
 789 {
 790         struct mtd_info *mtd = boot_cfg->mtd;
 791         loff_t offset = bs_cfg->bs_addr;
 792         size_t length = bs_cfg->bs_size;
 793         size_t used = 0;
 794         int ret;
 795
 796         ret = check_skip_length(boot_cfg, offset, length, &used);
 797
 798         if (ret < 0)
 799                 return ret;
 800
 801         /* get next image address */
 802         bs_cfg->next_bs_addr = (u32)(offset + used + mtd->erasesize - 1)
 803                                  / (u32)mtd->erasesize * mtd->erasesize;
 804
 805         return ret;
 806 }
 807
 808 static int nandbcb_write_bs_skip_bad(struct boot_config *boot_cfg,
 809                                      struct boot_stream_config *bs_cfg)
 810 {
 811         struct mtd_info *mtd;
 812         void *buf;
 813         loff_t offset, maxsize;
 814         size_t size;
 815         size_t length;
 816         int ret;
 817         bool padding_flag = false;
 818
 819         mtd = boot_cfg->mtd;
 820         offset = bs_cfg->bs_addr;
 821         maxsize = boot_cfg->maxsize;
 822         size = bs_cfg->bs_size;
 823
 824         /* some boot images may need leading offset */
 825         if (bs_cfg->need_padding &&
 826             (plat_config.misc_flags & FIRMWARE_NEED_PADDING))
 827                 padding_flag = 1;
 828
 829         if (padding_flag)
 830                 length = ALIGN(size + FLASH_OFFSET_STANDARD, mtd->writesize);
 831         else
 832                 length = ALIGN(size, mtd->writesize);
 833
 834         buf = kzalloc(length, GFP_KERNEL);
 835         if (!buf) {
 836                 printf("failed to allocate buffer for firmware\n");
 837                 ret = -ENOMEM;
 838                 return ret;
 839         }
 840
 841         if (padding_flag)
 842                 memcpy(buf + FLASH_OFFSET_STANDARD, bs_cfg->bs_buf, size);
 843         else
 844                 memcpy(buf, bs_cfg->bs_buf, size);
 845
 846         ret = nand_write_skip_bad(mtd, offset, &length, NULL, maxsize,
 847                                   (u_char *)buf, WITH_WR_VERIFY);
 848         printf("Write %s @0x%llx offset, 0x%zx bytes written: %s\n",
 849                bs_cfg->bs_label, offset, length, ret ? "ERROR" : "OK");
 850
 851         if (ret)
 852                 /* write image failed, quit */
 853                 goto err;
 854
 855         /* get next good blk address if needed */
 856         if (bs_cfg->need_padding) {
 857                 ret = nandbcb_get_next_good_blk_addr(boot_cfg, bs_cfg);
 858                 if (ret < 0) {
 859                         printf("Next image cannot fit in NAND partition\n");
 860                         goto err;
 861                 }
 862         }
 863
 864         /* now we know how the exact image size written to NAND */
 865         bs_cfg->bs_size = length;
 866         return 0;
 867 err:
 868         kfree(buf);
 869         return ret;
 870 }
 871
 872 static int nandbcb_write_fw(struct boot_config *boot_cfg, u_char *buf,
 873                             int index)
 874 {
 875         int i;
 876         loff_t offset;
 877         size_t size;
 878         loff_t next_bs_addr;
 879         struct boot_stream_config bs_cfg;
 880         int ret;
 881
 882         for (i = 0; i < 2; ++i) {
 883                 if (!(FW_INX(i) & index))
 884                         continue;
 885
 886                 if (i == 0) {
 887                         offset = boot_cfg->boot_stream1_address;
 888                         size = boot_cfg->boot_stream1_size;
 889                 } else {
 890                         offset = boot_cfg->boot_stream2_address;
 891                         size = boot_cfg->boot_stream2_size;
 892                 }
 893
 894                 /* write Firmware*/
 895                 if (!(plat_config.misc_flags & FIRMWARE_EXTRA_ONE)) {
 896                         memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
 897                         sprintf(bs_cfg.bs_label, "firmware%d", i);
 898                         bs_cfg.bs_addr = offset;
 899                         bs_cfg.bs_size = size;
 900                         bs_cfg.bs_buf = buf;
 901                         bs_cfg.need_padding = 1;
 902
 903                         ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
 904                         if (ret)
 905                                 return ret;
 906
 907                         /* update the boot stream size */
 908                         if (i == 0)
 909                                 boot_cfg->boot_stream1_size = bs_cfg.bs_size;
 910                         else
 911                                 boot_cfg->boot_stream2_size = bs_cfg.bs_size;
 912
 913                 } else {
 914                 /* some platforms need extra firmware */
 915                         memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
 916                         sprintf(bs_cfg.bs_label, "fw%d_part%d", i, 1);
 917                         bs_cfg.bs_addr = offset;
 918                         bs_cfg.bs_size = IMX8MQ_HDMI_FW_SZ;
 919                         bs_cfg.bs_buf = buf;
 920                         bs_cfg.need_padding = 1;
 921
 922                         ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
 923                         if (ret)
 924                                 return ret;
 925
 926                         /* update the boot stream size */
 927                         if (i == 0)
 928                                 boot_cfg->boot_stream1_size = bs_cfg.bs_size;
 929                         else
 930                                 boot_cfg->boot_stream2_size = bs_cfg.bs_size;
 931
 932                         /* get next image address */
 933                         next_bs_addr = bs_cfg.next_bs_addr;
 934
 935                         memset(&bs_cfg, 0, sizeof(struct boot_stream_config));
 936                         sprintf(bs_cfg.bs_label, "fw%d_part%d", i, 2);
 937                         bs_cfg.bs_addr = next_bs_addr;
 938                         bs_cfg.bs_size = IMX8MQ_SPL_SZ;
 939                         bs_cfg.bs_buf = (u_char *)(buf + IMX8MQ_HDMI_FW_SZ);
 940                         bs_cfg.need_padding = 0;
 941
 942                         ret = nandbcb_write_bs_skip_bad(boot_cfg, &bs_cfg);
 943                         if (ret)
 944                                 return ret;
 945                 }
 946         }
 947
 948         return 0;
 949 }
 950
 951 static int nandbcb_init(struct boot_config *boot_cfg, u_char *buf)
 952 {
 953         struct mtd_info *mtd;
 954         nand_erase_options_t opts;
 955         struct fcb_block *fcb;
 956         struct dbbt_block *dbbt;
 957         void *dbbt_page, *dbbt_data_page;
 958         int ret;
 959         loff_t maxsize, off;
 960
 961         mtd = boot_cfg->mtd;
 962         maxsize = boot_cfg->maxsize;
 963         off = boot_cfg->offset;
 964
 965         /* erase */
 966         memset(&opts, 0, sizeof(opts));
 967         opts.offset = off;
 968         opts.length = maxsize - 1;
 969         ret = nand_erase_opts(mtd, &opts);
 970         if (ret) {
 971                 printf("%s: erase failed (ret = %d)\n", __func__, ret);
 972                 return ret;
 973         }
 974
 975         /*
 976          * Reference documentation from i.MX6DQRM section 8.5.2.2
 977          *
 978          * Nand Boot Control Block(BCB) contains two data structures,
 979          * - Firmware Configuration Block(FCB)
 980          * - Discovered Bad Block Table(DBBT)
 981          *
 982          * FCB contains,
 983          * - nand timings
 984          * - DBBT search page address,
 985          * - start page address of primary firmware
 986          * - start page address of secondary firmware
 987          *
 988          * setup fcb:
 989          * - number of blocks = mtd partition size / mtd erasesize
 990          * - two firmware blocks, primary and secondary
 991          * - first 4 block for FCB/DBBT
 992          * - rest split in half for primary and secondary firmware
 993          * - same firmware write twice
 994          */
 995
 996         /* write Firmware*/
 997         ret = nandbcb_write_fw(boot_cfg, buf, FW_ALL);
 998         if (ret)
 999                 goto err;
1000
1001         /* fill fcb */
1002         fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
1003         if (!fcb) {
1004                 debug("failed to allocate fcb\n");
1005                 ret = -ENOMEM;
1006                 return ret;
1007         }
1008         fill_fcb(fcb, boot_cfg);
1009
1010         ret = write_fcb(boot_cfg, fcb);
1011
1012         /* fill dbbt */
1013         dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
1014         if (!dbbt_page) {
1015                 debug("failed to allocate dbbt_page\n");
1016                 ret = -ENOMEM;
1017                 goto fcb_err;
1018         }
1019
1020         dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1021         if (!dbbt_data_page) {
1022                 debug("failed to allocate dbbt_data_page\n");
1023                 ret = -ENOMEM;
1024                 goto dbbt_page_err;
1025         }
1026
1027         dbbt = dbbt_page;
1028         dbbt->checksum = 0;
1029         dbbt->fingerprint = DBBT_FINGERPRINT;
1030         dbbt->version = DBBT_VERSION_1;
1031         ret = fill_dbbt_data(mtd, dbbt_data_page, CONV_TO_BLOCKS(maxsize));
1032         if (ret < 0)
1033                 goto dbbt_data_page_err;
1034         else if (ret > 0)
1035                 dbbt->dbbtpages = 1;
1036
1037         /* write dbbt */
1038         ret = write_dbbt(boot_cfg, dbbt, dbbt_data_page);
1039         if (ret < 0)
1040                 printf("failed to write FCB/DBBT\n");
1041
1042 dbbt_data_page_err:
1043         kfree(dbbt_data_page);
1044 dbbt_page_err:
1045         kfree(dbbt_page);
1046 fcb_err:
1047         kfree(fcb);
1048 err:
1049         return ret;
1050 }
1051
1052 static int do_nandbcb_bcbonly(int argc, char *const argv[])
1053 {
1054         struct fcb_block *fcb;
1055         struct dbbt_block *dbbt;
1056         struct mtd_info *mtd;
1057         nand_erase_options_t opts;
1058         size_t maxsize;
1059         loff_t off;
1060         void *dbbt_page, *dbbt_data_page;
1061         int ret;
1062         struct boot_config cfg;
1063
1064         if (argc < 4)
1065                 return CMD_RET_USAGE;
1066
1067         memset(&cfg, 0, sizeof(struct boot_config));
1068         if (nandbcb_get_info(argc, argv, &cfg))
1069                 return CMD_RET_FAILURE;
1070
1071         /* only get the partition info */
1072         if (nandbcb_get_size(2, argv, 1, &cfg))
1073                 return CMD_RET_FAILURE;
1074
1075         if (nandbcb_set_boot_config(argc, argv, &cfg))
1076                 return CMD_RET_FAILURE;
1077
1078         mtd = cfg.mtd;
1079
1080         cfg.boot_stream1_address = simple_strtoul(argv[2], NULL, 16);
1081         cfg.boot_stream1_size = simple_strtoul(argv[3], NULL, 16);
1082         cfg.boot_stream1_size = ALIGN(cfg.boot_stream1_size, mtd->writesize);
1083
1084         if (argc > 5) {
1085                 cfg.boot_stream2_address = simple_strtoul(argv[4], NULL, 16);
1086                 cfg.boot_stream2_size = simple_strtoul(argv[5], NULL, 16);
1087                 cfg.boot_stream2_size = ALIGN(cfg.boot_stream2_size,
1088                                               mtd->writesize);
1089         }
1090
1091         /* sanity check */
1092         nandbcb_check_space(&cfg);
1093
1094         maxsize = cfg.maxsize;
1095         off = cfg.offset;
1096
1097         /* erase the previous FCB/DBBT */
1098         memset(&opts, 0, sizeof(opts));
1099         opts.offset = off;
1100         opts.length = g_boot_search_stride * 2;
1101         ret = nand_erase_opts(mtd, &opts);
1102         if (ret) {
1103                 printf("%s: erase failed (ret = %d)\n", __func__, ret);
1104                 return CMD_RET_FAILURE;
1105         }
1106
1107         /* fill fcb */
1108         fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
1109         if (!fcb) {
1110                 printf("failed to allocate fcb\n");
1111                 ret = -ENOMEM;
1112                 return CMD_RET_FAILURE;
1113         }
1114
1115         fill_fcb(fcb, &cfg);
1116
1117         /* write fcb */
1118         ret = write_fcb(&cfg, fcb);
1119
1120         /* fill dbbt */
1121         dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
1122         if (!dbbt_page) {
1123                 printf("failed to allocate dbbt_page\n");
1124                 ret = -ENOMEM;
1125                 goto fcb_err;
1126         }
1127
1128         dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1129         if (!dbbt_data_page) {
1130                 printf("failed to allocate dbbt_data_page\n");
1131                 ret = -ENOMEM;
1132                 goto dbbt_page_err;
1133         }
1134
1135         dbbt = dbbt_page;
1136         dbbt->checksum = 0;
1137         dbbt->fingerprint = DBBT_FINGERPRINT;
1138         dbbt->version = DBBT_VERSION_1;
1139         ret = fill_dbbt_data(mtd, dbbt_data_page, CONV_TO_BLOCKS(maxsize));
1140         if (ret < 0)
1141                 goto dbbt_data_page_err;
1142         else if (ret > 0)
1143                 dbbt->dbbtpages = 1;
1144
1145         /* write dbbt */
1146         ret = write_dbbt(&cfg, dbbt, dbbt_data_page);
1147
1148 dbbt_data_page_err:
1149         kfree(dbbt_data_page);
1150 dbbt_page_err:
1151         kfree(dbbt_page);
1152 fcb_err:
1153         kfree(fcb);
1154
1155         if (ret < 0) {
1156                 printf("failed to write FCB/DBBT\n");
1157                 return CMD_RET_FAILURE;
1158         }
1159
1160         return CMD_RET_SUCCESS;
1161 }
1162
1163 /* dump data which is read from NAND chip */
1164 void dump_structure(struct boot_config *boot_cfg, struct fcb_block *fcb,
1165                     struct dbbt_block *dbbt, void *dbbt_data_page)
1166 {
1167         int i;
1168         struct mtd_info *mtd = boot_cfg->mtd;
1169
1170         #define P1(x) printf("  %s = 0x%08x\n", #x, fcb->x)
1171                 printf("FCB\n");
1172                 P1(checksum);
1173                 P1(fingerprint);
1174                 P1(version);
1175         #undef P1
1176         #define P1(x)   printf("  %s = %d\n", #x, fcb->x)
1177                 P1(datasetup);
1178                 P1(datahold);
1179                 P1(addr_setup);
1180                 P1(dsample_time);
1181                 P1(pagesize);
1182                 P1(oob_pagesize);
1183                 P1(sectors);
1184                 P1(nr_nand);
1185                 P1(nr_die);
1186                 P1(celltype);
1187                 P1(ecc_type);
1188                 P1(ecc_nr);
1189                 P1(ecc_size);
1190                 P1(ecc_level);
1191                 P1(meta_size);
1192                 P1(nr_blocks);
1193                 P1(ecc_type_sdk);
1194                 P1(ecc_nr_sdk);
1195                 P1(ecc_size_sdk);
1196                 P1(ecc_level_sdk);
1197                 P1(nr_blocks_sdk);
1198                 P1(meta_size_sdk);
1199                 P1(erase_th);
1200                 P1(bootpatch);
1201                 P1(patch_size);
1202                 P1(fw1_start);
1203                 P1(fw2_start);
1204                 P1(fw1_pages);
1205                 P1(fw2_pages);
1206                 P1(dbbt_start);
1207                 P1(bb_byte);
1208                 P1(bb_start_bit);
1209                 P1(phy_offset);
1210                 P1(bchtype);
1211                 P1(readlatency);
1212                 P1(predelay);
1213                 P1(cedelay);
1214                 P1(postdelay);
1215                 P1(cmdaddpause);
1216                 P1(datapause);
1217                 P1(tmspeed);
1218                 P1(busytimeout);
1219                 P1(disbbm);
1220                 P1(spare_offset);
1221 #if !defined(CONFIG_MX6) || defined(CONFIG_MX6SX) || \
1222         defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
1223                 P1(onfi_sync_enable);
1224                 P1(onfi_sync_speed);
1225                 P1(onfi_sync_nand_data);
1226                 P1(disbbm_search);
1227                 P1(disbbm_search_limit);
1228                 P1(read_retry_enable);
1229 #endif
1230         #undef P1
1231         #define P1(x)   printf("  %s = 0x%08x\n", #x, dbbt->x)
1232                 printf("DBBT :\n");
1233                 P1(checksum);
1234                 P1(fingerprint);
1235                 P1(version);
1236         #undef P1
1237         #define P1(x)   printf("  %s = %d\n", #x, dbbt->x)
1238                 P1(dbbtpages);
1239         #undef P1
1240
1241         for (i = 0; i < dbbt->dbbtpages; ++i)
1242                 printf("%d ", *((u32 *)(dbbt_data_page + i)));
1243
1244         if (!(plat_config.misc_flags & FIRMWARE_EXTRA_ONE)) {
1245                 printf("Firmware: image #0 @ 0x%x size 0x%x\n",
1246                        fcb->fw1_start, fcb->fw1_pages * mtd->writesize);
1247                 printf("Firmware: image #1 @ 0x%x size 0x%x\n",
1248                        fcb->fw2_start, fcb->fw2_pages * mtd->writesize);
1249         } else {
1250                 printf("Firmware: image #0 @ 0x%x size 0x%x\n",
1251                        fcb->fw1_start, fcb->fw1_pages * mtd->writesize);
1252                 printf("Firmware: image #1 @ 0x%x size 0x%x\n",
1253                        fcb->fw2_start, fcb->fw2_pages * mtd->writesize);
1254                 /* TODO: Add extra image information */
1255         }
1256 }
1257
1258 static bool check_fingerprint(void *data, int fingerprint)
1259 {
1260         int off = 4;
1261
1262         return (*(int *)(data + off) == fingerprint);
1263 }
1264
1265 static int fuse_to_search_count(u32 bank, u32 word, u32 mask, u32 off)
1266 {
1267         int err;
1268         u32 val;
1269         int ret;
1270
1271         /* by default, the boot search count from fuse should be 2 */
1272         err = fuse_read(bank, word, &val);
1273         if (err)
1274                 return 2;
1275
1276         val = (val & mask) >> off;
1277
1278         switch (val) {
1279                 case 0:
1280                         ret = 2;
1281                         break;
1282                 case 1:
1283                 case 2:
1284                 case 3:
1285                         ret = 1 << val;
1286                         break;
1287                 default:
1288                         ret = 2;
1289         }
1290
1291         return ret;
1292 }
1293
1294 static int nandbcb_dump(struct boot_config *boot_cfg)
1295 {
1296         int i;
1297         loff_t off;
1298         struct mtd_info *mtd = boot_cfg->mtd;
1299         struct fcb_block fcb, fcb_copy;
1300         struct dbbt_block dbbt, dbbt_copy;
1301         void *dbbt_data_page, *dbbt_data_page_copy;
1302         bool fcb_not_found, dbbt_not_found;
1303         int ret = 0;
1304
1305         dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
1306         if (!dbbt_data_page) {
1307                 printf("failed to allocate dbbt_data_page\n");
1308                 ret = -ENOMEM;
1309                 return ret;
1310         }
1311
1312         dbbt_data_page_copy = kzalloc(mtd->writesize, GFP_KERNEL);
1313         if (!dbbt_data_page_copy) {
1314                 printf("failed to allocate dbbt_data_page\n");
1315                 ret = -ENOMEM;
1316                 goto dbbt_page_err;
1317         }
1318
1319         /* read fcb */
1320         fcb_not_found = 1;
1321         off = 0;
1322         for (i = 0; i < g_boot_search_count; ++i) {
1323                 if (fcb_not_found) {
1324                         ret = read_fcb(boot_cfg, &fcb, off);
1325
1326                         if (ret < 0)
1327                                 goto dbbt_page_copy_err;
1328                         else if (ret == 1)
1329                                 continue;
1330                         else if (ret == 0)
1331                                 if (check_fingerprint(&fcb, FCB_FINGERPRINT))
1332                                         fcb_not_found = 0;
1333                 } else {
1334                         ret = read_fcb(boot_cfg, &fcb_copy, off);
1335
1336                         if (ret < 0)
1337                                 goto dbbt_page_copy_err;
1338                         if (memcmp(&fcb, &fcb_copy,
1339                                    sizeof(struct fcb_block))) {
1340                                 printf("FCB copies are not identical\n");
1341                                 ret = -EINVAL;
1342                                 goto dbbt_page_copy_err;
1343                         }
1344                 }
1345
1346                 /* next read location */
1347                 off += g_boot_search_stride;
1348         }
1349
1350         /* read dbbt*/
1351         dbbt_not_found = 1;
1352         off = boot_cfg->search_area_size_in_bytes;
1353         for (i = 0; i < g_boot_search_count; ++i) {
1354                 if (dbbt_not_found) {
1355                         ret = read_dbbt(boot_cfg, &dbbt, dbbt_data_page, off);
1356
1357                         if (ret < 0)
1358                                 goto dbbt_page_copy_err;
1359                         else if (ret == 1)
1360                                 continue;
1361                         else if (ret == 0)
1362                                 if (check_fingerprint(&dbbt, DBBT_FINGERPRINT))
1363                                         dbbt_not_found = 0;
1364                 } else {
1365                         ret = read_dbbt(boot_cfg, &dbbt_copy,
1366                                         dbbt_data_page_copy, off);
1367
1368                         if (ret < 0)
1369                                 goto dbbt_page_copy_err;
1370                         if (memcmp(&dbbt, &dbbt_copy,
1371                                    sizeof(struct dbbt_block))) {
1372                                 printf("DBBT copies are not identical\n");
1373                                 ret = -EINVAL;
1374                                 goto dbbt_page_copy_err;
1375                         }
1376                         if (dbbt.dbbtpages > 0 &&
1377                             memcmp(dbbt_data_page, dbbt_data_page_copy,
1378                                    mtd->writesize)) {
1379                                 printf("DBBT data copies are not identical\n");
1380                                 ret = -EINVAL;
1381                                 goto dbbt_page_copy_err;
1382                         }
1383                 }
1384
1385                 /* next read location */
1386                 off += g_boot_search_stride;
1387         }
1388
1389         dump_structure(boot_cfg, &fcb, &dbbt, dbbt_data_page);
1390
1391 dbbt_page_copy_err:
1392         kfree(dbbt_data_page_copy);
1393 dbbt_page_err:
1394         kfree(dbbt_data_page);
1395
1396         return ret;
1397 }
1398
1399 static int do_nandbcb_dump(int argc, char * const argv[])
1400 {
1401         struct boot_config cfg;
1402         int ret;
1403
1404         if (argc != 2)
1405                 return CMD_RET_USAGE;
1406
1407         memset(&cfg, 0, sizeof(struct boot_config));
1408         if (nandbcb_get_info(argc, argv, &cfg))
1409                 return CMD_RET_FAILURE;
1410
1411         if (nandbcb_get_size(argc, argv, 1, &cfg))
1412                 return CMD_RET_FAILURE;
1413
1414         if (nandbcb_set_boot_config(argc, argv, &cfg))
1415                 return CMD_RET_FAILURE;
1416
1417         ret = nandbcb_dump(&cfg);
1418         if (ret)
1419                 return ret;
1420
1421         return ret;
1422 }
1423
1424 static int do_nandbcb_init(int argc, char * const argv[])
1425 {
1426         u_char *buf;
1427         size_t size;
1428         loff_t addr;
1429         char *endp;
1430         int ret;
1431         struct boot_config cfg;
1432
1433         if (argc != 4)
1434                 return CMD_RET_USAGE;
1435
1436         memset(&cfg, 0, sizeof(struct boot_config));
1437         if (nandbcb_get_info(argc, argv, &cfg))
1438                 return CMD_RET_FAILURE;
1439
1440         if (nandbcb_get_size(argc, argv, 2, &cfg))
1441                 return CMD_RET_FAILURE;
1442         size = cfg.boot_stream1_size;
1443
1444         if (nandbcb_set_boot_config(argc, argv, &cfg))
1445                 return CMD_RET_FAILURE;
1446
1447         addr = simple_strtoul(argv[1], &endp, 16);
1448         if (*argv[1] == 0 || *endp != 0)
1449                 return CMD_RET_FAILURE;
1450
1451         buf = map_physmem(addr, size, MAP_WRBACK);
1452         if (!buf) {
1453                 puts("failed to map physical memory\n");
1454                 return CMD_RET_FAILURE;
1455         }
1456
1457         ret = nandbcb_init(&cfg, buf);
1458
1459         return ret == 0 ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
1460 }
1461
1462 static int do_nandbcb(struct cmd_tbl *cmdtp, int flag, int argc,
1463                       char *const argv[])
1464 {
1465         const char *cmd;
1466         int ret = 0;
1467
1468         if (argc < 3)
1469                 goto usage;
1470
1471         /* check the platform config first */
1472         if (is_mx6sx()) {
1473                 plat_config = imx6sx_plat_config;
1474         } else if (is_mx7()) {
1475                 plat_config = imx7d_plat_config;
1476         } else if (is_mx6ul() || is_mx6ull()) {
1477                 plat_config = imx6ul_plat_config;
1478         } else if (is_mx6() && !is_mx6sx() && !is_mx6ul() && !is_mx6ull()) {
1479                 plat_config = imx6qdl_plat_config;
1480         } else if (is_imx8mq()) {
1481                 plat_config = imx8mq_plat_config;
1482         } else if (is_imx8mm()) {
1483                 plat_config = imx8mm_plat_config;
1484         } else if (is_imx8mn()) {
1485                 plat_config = imx8mn_plat_config;
1486         } else if (is_imx8qm() || is_imx8qxp()) {
1487                 plat_config = imx8q_plat_config;
1488         } else {
1489                 printf("ERROR: Unknown platform\n");
1490                 return CMD_RET_FAILURE;
1491         }
1492
1493         if (plat_config.misc_flags & BT_SEARCH_CNT_FROM_FUSE) {
1494                 if (is_imx8qxp()) {
1495                         g_boot_search_count = fuse_to_search_count(0, 720,
1496                                                                    0xc0, 6);
1497                         printf("search count set to %d from fuse\n",
1498                                g_boot_search_count);
1499                 }
1500         }
1501
1502         cmd = argv[1];
1503         --argc;
1504         ++argv;
1505
1506         if (strcmp(cmd, "init") == 0) {
1507                 ret = do_nandbcb_init(argc, argv);
1508                 goto done;
1509         }
1510
1511         if (strcmp(cmd, "dump") == 0) {
1512                 ret = do_nandbcb_dump(argc, argv);
1513                 goto done;
1514         }
1515
1516         if (strcmp(cmd, "bcbonly") == 0) {
1517                 ret = do_nandbcb_bcbonly(argc, argv);
1518                 goto done;
1519         }
1520
1521 done:
1522         if (ret != -1)
1523                 return ret;
1524 usage:
1525         return CMD_RET_USAGE;
1526 }
1527
1528 #ifdef CONFIG_SYS_LONGHELP
1529 static char nandbcb_help_text[] =
1530         "init addr off|partition len - update 'len' bytes starting at\n"
1531         "       'off|part' to memory address 'addr', skipping  bad blocks\n"
1532         "nandbcb bcbonly off|partition fw1-off fw1-size [fw2-off fw2-size]\n"
1533         "           - write BCB only (FCB and DBBT)\n"
1534         "       where `fwx-size` is fw sizes in bytes, `fw1-off`\n"
1535         "       and `fw2-off` - firmware offsets\n"
1536         "       FIY, BCB isn't erased automatically, so mtd erase should\n"
1537         "       be called in advance before writing new BCB:\n"
1538         "           > mtd erase mx7-bcb\n"
1539         "nandbcb dump off|partition - dump/verify boot structures\n";
1540 #endif
1541
1542 U_BOOT_CMD(nandbcb, 7, 1, do_nandbcb,
1543            "i.MX NAND Boot Control Blocks write",
1544            nandbcb_help_text
1545 );