2 * i.MX6 nand boot control block(bcb).
4 * Based on the common/imx-bbu-nand-fcb.c from barebox and imx kobs-ng
6 * Copyright (C) 2017 Jagan Teki <jagan@amarulasolutions.com>
7 * Copyright (C) 2016 Sergey Kubushyn <ksi@koi8.net>
9 * SPDX-License-Identifier: GPL-2.0+
16 #include <jffs2/jffs2.h>
17 #include <linux/bch.h>
18 #include <linux/mtd/mtd.h>
20 #include <asm/arch/sys_proto.h>
21 #include <asm/mach-imx/imx-nandbcb.h>
22 #include <asm/mach-imx/imximage.cfg>
24 #include <linux/mtd/mtd.h>
27 #define BF_VAL(v, bf) (((v) & bf##_MASK) >> bf##_OFFSET)
28 #define GETBIT(v, n) (((v) >> (n)) & 0x1)
30 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
31 static uint8_t reverse_bit(uint8_t b)
33 b = (b & 0xf0) >> 4 | (b & 0x0f) << 4;
34 b = (b & 0xcc) >> 2 | (b & 0x33) << 2;
35 b = (b & 0xaa) >> 1 | (b & 0x55) << 1;
40 static void encode_bch_ecc(void *buf, struct fcb_block *fcb, int eccbits)
45 int ecc_buf_size = (m * eccbits + 7) / 8;
46 struct bch_control *bch = init_bch(m, eccbits, 0);
47 u8 *ecc_buf = kzalloc(ecc_buf_size, GFP_KERNEL);
48 u8 *tmp_buf = kzalloc(blocksize * numblocks, GFP_KERNEL);
52 * The blocks here are bit aligned. If eccbits is a multiple of 8,
53 * we just can copy bytes. Otherwiese we must move the blocks to
54 * the next free bit position.
58 memcpy(tmp_buf, fcb, sizeof(*fcb));
60 for (i = 0; i < numblocks; i++) {
61 memset(ecc_buf, 0, ecc_buf_size);
62 psrc = tmp_buf + i * blocksize;
63 pdst = buf + i * (blocksize + ecc_buf_size);
65 /* copy data byte aligned to destination buf */
66 memcpy(pdst, psrc, blocksize);
69 * imx-kobs use a modified encode_bch which reverse the
70 * bit order of the data before calculating bch.
71 * Do this in the buffer and use the bch lib here.
73 for (j = 0; j < blocksize; j++)
74 psrc[j] = reverse_bit(psrc[j]);
76 encode_bch(bch, psrc, blocksize, ecc_buf);
79 for (j = 0; j < ecc_buf_size; j++)
80 ecc_buf[j] = reverse_bit(ecc_buf[j]);
82 /* Here eccbuf is byte aligned and we can just copy it */
83 memcpy(pdst + blocksize, ecc_buf, ecc_buf_size);
92 static u8 calculate_parity_13_8(u8 d)
96 p |= (GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 3) ^ GETBIT(d, 2)) << 0;
97 p |= (GETBIT(d, 7) ^ GETBIT(d, 5) ^ GETBIT(d, 4) ^ GETBIT(d, 2) ^
99 p |= (GETBIT(d, 7) ^ GETBIT(d, 6) ^ GETBIT(d, 5) ^ GETBIT(d, 1) ^
101 p |= (GETBIT(d, 7) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 0)) << 3;
102 p |= (GETBIT(d, 6) ^ GETBIT(d, 4) ^ GETBIT(d, 3) ^ GETBIT(d, 2) ^
103 GETBIT(d, 1) ^ GETBIT(d, 0)) << 4;
108 static void encode_hamming_13_8(void *_src, void *_ecc, size_t size)
114 for (i = 0; i < size; i++)
115 ecc[i] = calculate_parity_13_8(src[i]);
119 static u32 calc_chksum(void *buf, size_t size)
125 for (i = 0; i < size; i++)
131 static void fill_fcb(struct fcb_block *fcb, struct mtd_info *mtd,
132 u32 fw1_start, u32 fw2_start, u32 fw_pages)
134 struct nand_chip *chip = mtd_to_nand(mtd);
135 struct mxs_nand_info *nand_info = nand_get_controller_data(chip);
136 struct mxs_nand_layout l;
138 mxs_nand_get_layout(mtd, &l);
140 fcb->fingerprint = FCB_FINGERPRINT;
141 fcb->version = FCB_VERSION_1;
143 fcb->pagesize = mtd->writesize;
144 fcb->oob_pagesize = mtd->writesize + mtd->oobsize;
145 fcb->sectors = mtd->erasesize / mtd->writesize;
147 fcb->meta_size = l.meta_size;
148 fcb->nr_blocks = l.nblocks;
149 fcb->ecc_nr = l.data0_size;
150 fcb->ecc_level = l.ecc0;
151 fcb->ecc_size = l.datan_size;
152 fcb->ecc_type = l.eccn;
154 /* Also hardcoded in kobs-ng */
158 fcb->addr_setup = 25;
159 fcb->dsample_time = 6;
160 } else if (is_mx7()) {
163 fcb->addr_setup = 15;
164 fcb->dsample_time = 6;
167 /* DBBT search area starts at second page on first block */
170 fcb->bb_byte = nand_info->bch_geometry.block_mark_byte_offset;
171 fcb->bb_start_bit = nand_info->bch_geometry.block_mark_bit_offset;
173 fcb->phy_offset = mtd->writesize;
175 fcb->nr_blocks = mtd->writesize / fcb->ecc_nr - 1;
178 fcb->disbbm_search = 0;
180 fcb->fw1_start = fw1_start; /* Firmware image starts on this sector */
181 fcb->fw2_start = fw2_start; /* Secondary FW Image starting Sector */
182 fcb->fw1_pages = fw_pages; /* Number of sectors in firmware image */
183 fcb->fw2_pages = fw_pages; /* Number of sector in secondary FW image */
185 fcb->checksum = calc_chksum((void *)fcb + 4, sizeof(*fcb) - 4);
188 static int dbbt_fill_data(struct mtd_info *mtd, void *buf, int num_blocks)
190 int n, n_bad_blocks = 0;
192 u32 *n_bad_blocksp = buf + 0x4;
194 for (n = 0; n < num_blocks; n++) {
195 loff_t offset = n * mtd->erasesize;
196 if (mtd_block_isbad(mtd, offset)) {
203 *n_bad_blocksp = n_bad_blocks;
208 static int write_fcb_dbbt(struct mtd_info *mtd, struct fcb_block *fcb,
209 struct dbbt_block *dbbt, void *dbbt_data_page,
212 void *fcb_raw_page = 0;
217 * We prepare raw page only for i.MX6, for i.MX7 we
218 * leverage BCH hw module instead
222 fcb_raw_page = kzalloc(mtd->writesize + mtd->oobsize,
225 debug("failed to allocate fcb_raw_page\n");
230 #if defined(CONFIG_MX6UL) || defined(CONFIG_MX6ULL)
231 /* 40 bit BCH, for i.MX6UL(L) */
232 encode_bch_ecc(fcb_raw_page + 32, fcb, 40);
234 memcpy(fcb_raw_page + 12, fcb, sizeof(struct fcb_block));
235 encode_hamming_13_8(fcb_raw_page + 12,
236 fcb_raw_page + 12 + 512, 512);
239 * Set the first and second byte of OOB data to 0xFF,
240 * not 0x00. These bytes are used as the Manufacturers Bad
241 * Block Marker (MBBM). Since the FCB is mostly written to
242 * the first page in a block, a scan for
243 * factory bad blocks will detect these blocks as bad, e.g.
244 * when function nand_scan_bbt() is executed to build a new
247 memset(fcb_raw_page + mtd->writesize, 0xFF, 2);
249 for (i = 0; i < 2; i++) {
250 if (mtd_block_isbad(mtd, off)) {
251 printf("Block %d is bad, skipped\n", i);
256 * User BCH ECC hardware module for i.MX7
259 u32 off = i * mtd->erasesize;
260 size_t rwsize = sizeof(*fcb);
262 printf("Writing %d bytes to 0x%x: ", rwsize, off);
264 /* switch nand BCH to FCB compatible settings */
265 mxs_nand_mode_fcb(mtd);
266 ret = nand_write(mtd, off, &rwsize,
267 (unsigned char *)fcb);
268 mxs_nand_mode_normal(mtd);
270 printf("%s\n", ret ? "ERROR" : "OK");
271 } else if (is_mx6()) {
273 mtd_oob_ops_t ops = {
274 .datbuf = (u8 *)fcb_raw_page,
275 .oobbuf = ((u8 *)fcb_raw_page) +
277 .len = mtd->writesize,
278 .ooblen = mtd->oobsize,
282 ret = mtd_write_oob(mtd, mtd->erasesize * i, &ops);
284 goto fcb_raw_page_err;
285 debug("NAND fcb write: 0x%x offset 0x%x written: %s\n",
286 mtd->erasesize * i, ops.len, ret ?
290 ret = mtd_write(mtd, mtd->erasesize * i + mtd->writesize,
291 mtd->writesize, &dummy, (void *)dbbt);
293 goto fcb_raw_page_err;
294 debug("NAND dbbt write: 0x%x offset, 0x%x bytes written: %s\n",
295 mtd->erasesize * i + mtd->writesize, dummy,
296 ret ? "ERROR" : "OK");
298 /* dbbtpages == 0 if no bad blocks */
299 if (dbbt->dbbtpages > 0) {
300 loff_t to = (mtd->erasesize * i + mtd->writesize * 5);
302 ret = mtd_write(mtd, to, mtd->writesize, &dummy,
305 goto fcb_raw_page_err;
316 static int nandbcb_update(struct mtd_info *mtd, loff_t off, size_t size,
317 size_t maxsize, const u_char *buf)
319 nand_erase_options_t opts;
320 struct fcb_block *fcb;
321 struct dbbt_block *dbbt;
323 void *fwbuf, *dbbt_page, *dbbt_data_page;
324 u32 fw1_start, fw1_pages;
325 int nr_blks, nr_blks_fcb, fw1_blk;
330 memset(&opts, 0, sizeof(opts));
332 opts.length = maxsize - 1;
333 ret = nand_erase_opts(mtd, &opts);
335 printf("%s: erase failed (ret = %d)\n", __func__, ret);
340 * Reference documentation from i.MX6DQRM section 8.5.2.2
342 * Nand Boot Control Block(BCB) contains two data structures,
343 * - Firmware Configuration Block(FCB)
344 * - Discovered Bad Block Table(DBBT)
348 * - DBBT search page address,
349 * - start page address of primary firmware
350 * - start page address of secondary firmware
353 * - number of blocks = mtd partition size / mtd erasesize
354 * - two firmware blocks, primary and secondary
355 * - first 4 block for FCB/DBBT
356 * - rest split in half for primary and secondary firmware
357 * - same firmware will write two times
360 nr_blks = maxsize / mtd->erasesize;
361 fw1_blk = nr_blks_fcb;
364 fwsize = ALIGN(size + FLASH_OFFSET_STANDARD + mtd->writesize,
366 fwbuf = kzalloc(fwsize, GFP_KERNEL);
368 debug("failed to allocate fwbuf\n");
373 memcpy(fwbuf + FLASH_OFFSET_STANDARD, buf, size);
374 fw1_off = fw1_blk * mtd->erasesize;
375 ret = nand_write_skip_bad(mtd, fw1_off, &fwsize, NULL, maxsize,
376 (u_char *)fwbuf, WITH_WR_VERIFY);
377 printf("NAND fw write: 0x%llx offset, 0x%x bytes written: %s\n",
378 fw1_off, fwsize, ret ? "ERROR" : "OK");
383 fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
385 debug("failed to allocate fcb\n");
390 fw1_start = (fw1_blk * mtd->erasesize) / mtd->writesize;
391 fw1_pages = size / mtd->writesize + 1;
392 fill_fcb(fcb, mtd, fw1_start, 0, fw1_pages);
395 dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
397 debug("failed to allocate dbbt_page\n");
402 dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
403 if (!dbbt_data_page) {
404 debug("failed to allocate dbbt_data_page\n");
411 dbbt->fingerprint = DBBT_FINGERPRINT2;
412 dbbt->version = DBBT_VERSION_1;
413 ret = dbbt_fill_data(mtd, dbbt_data_page, nr_blks);
415 goto dbbt_data_page_err;
419 /* write fcb and dbbt to nand */
420 ret = write_fcb_dbbt(mtd, fcb, dbbt, dbbt_data_page, off);
422 printf("failed to write FCB/DBBT\n");
425 kfree(dbbt_data_page);
436 static int do_nandbcb_bcbonly(int argc, char * const argv[])
438 struct fcb_block *fcb;
439 struct dbbt_block *dbbt;
440 u32 fw_len, fw1_off, fw2_off;
441 struct mtd_info *mtd;
442 void *dbbt_page, *dbbt_data_page;
445 dev = nand_curr_device;
446 if ((dev < 0) || (dev >= CONFIG_SYS_MAX_NAND_DEVICE) ||
447 (!get_nand_dev_by_index(dev))) {
448 puts("No devices available\n");
449 return CMD_RET_FAILURE;
452 mtd = get_nand_dev_by_index(dev);
455 return CMD_RET_FAILURE;
457 fw_len = simple_strtoul(argv[1], NULL, 16);
458 fw1_off = simple_strtoul(argv[2], NULL, 16);
461 fw2_off = simple_strtoul(argv[3], NULL, 16);
466 fcb = kzalloc(sizeof(*fcb), GFP_KERNEL);
468 debug("failed to allocate fcb\n");
470 return CMD_RET_FAILURE;
473 fill_fcb(fcb, mtd, fw1_off / mtd->writesize,
474 fw2_off / mtd->writesize, fw_len / mtd->writesize);
477 dbbt_page = kzalloc(mtd->writesize, GFP_KERNEL);
479 debug("failed to allocate dbbt_page\n");
484 dbbt_data_page = kzalloc(mtd->writesize, GFP_KERNEL);
485 if (!dbbt_data_page) {
486 debug("failed to allocate dbbt_data_page\n");
493 dbbt->fingerprint = DBBT_FINGERPRINT2;
494 dbbt->version = DBBT_VERSION_1;
495 ret = dbbt_fill_data(mtd, dbbt_data_page, 0);
497 goto dbbt_data_page_err;
501 /* write fcb and dbbt to nand */
502 ret = write_fcb_dbbt(mtd, fcb, dbbt, dbbt_data_page, 0);
504 kfree(dbbt_data_page);
511 printf("failed to write FCB/DBBT\n");
512 return CMD_RET_FAILURE;
515 return CMD_RET_SUCCESS;
518 static int do_nandbcb_update(int argc, char * const argv[])
520 struct mtd_info *mtd;
521 loff_t addr, offset, size, maxsize;
528 return CMD_RET_USAGE;
530 dev = nand_curr_device;
532 printf("failed to get nand_curr_device, run nand device\n");
533 return CMD_RET_FAILURE;
536 addr = simple_strtoul(argv[1], &endp, 16);
537 if (*argv[1] == 0 || *endp != 0)
538 return CMD_RET_FAILURE;
540 mtd = get_nand_dev_by_index(dev);
541 if (mtd_arg_off_size(argc - 2, argv + 2, &dev, &offset, &size,
542 &maxsize, MTD_DEV_TYPE_NAND, mtd->size))
543 return CMD_RET_FAILURE;
545 buf = map_physmem(addr, size, MAP_WRBACK);
547 puts("failed to map physical memory\n");
548 return CMD_RET_FAILURE;
551 ret = nandbcb_update(mtd, offset, size, maxsize, buf);
553 return ret == 0 ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
556 static int do_nandbcb(cmd_tbl_t *cmdtp, int flag, int argc,
569 if (strcmp(cmd, "update") == 0) {
570 ret = do_nandbcb_update(argc, argv);
574 if (strcmp(cmd, "bcbonly") == 0) {
575 ret = do_nandbcb_bcbonly(argc, argv);
583 return CMD_RET_USAGE;
586 #ifdef CONFIG_SYS_LONGHELP
587 static char nandbcb_help_text[] =
588 "update addr off|partition len - update 'len' bytes starting at\n"
589 " 'off|part' to memory address 'addr', skipping bad blocks\n"
590 "bcbonly fw-size fw1-off [fw2-off] - write only BCB (FCB and DBBT)\n"
591 " where `fw-size` is fw sizes in bytes, `fw1-off` and\n"
592 " and `fw2-off` - firmware offsets ";
595 U_BOOT_CMD(nandbcb, 5, 1, do_nandbcb,