1 /* 2 * Freescale i.MX28 image generator 3 * 4 * Copyright (C) 2011 Marek Vasut <marek.vasut@gmail.com> 5 * on behalf of DENX Software Engineering GmbH 6 * 7 * SPDX-License-Identifier: GPL-2.0+ 8 */ 9 10 #include <fcntl.h> 11 #include <sys/stat.h> 12 #include <sys/types.h> 13 #include <unistd.h> 14 15 #include "compiler.h" 16 17 /* Taken from <linux/kernel.h> */ 18 #define __round_mask(x, y) ((__typeof__(x))((y)-1)) 19 #define round_down(x, y) ((x) & ~__round_mask(x, y)) 20 21 /* 22 * Default BCB layout. 23 * 24 * TWEAK this if you have blown any OCOTP fuses. 25 */ 26 #define STRIDE_PAGES 64 27 #define STRIDE_COUNT 4 28 29 /* 30 * Layout for 256Mb big NAND with 2048b page size, 64b OOB size and 31 * 128kb erase size. 32 * 33 * TWEAK this if you have different kind of NAND chip. 34 */ 35 static uint32_t nand_writesize = 2048; 36 static uint32_t nand_oobsize = 64; 37 static uint32_t nand_erasesize = 128 * 1024; 38 39 /* 40 * Sector on which the SigmaTel boot partition (0x53) starts. 41 */ 42 static uint32_t sd_sector = 2048; 43 44 /* 45 * Each of the U-Boot bootstreams is at maximum 1MB big. 46 * 47 * TWEAK this if, for some wild reason, you need to boot bigger image. 48 */ 49 #define MAX_BOOTSTREAM_SIZE (1 * 1024 * 1024) 50 51 /* i.MX28 NAND controller-specific constants. DO NOT TWEAK! */ 52 #define MXS_NAND_DMA_DESCRIPTOR_COUNT 4 53 #define MXS_NAND_CHUNK_DATA_CHUNK_SIZE 512 54 #define MXS_NAND_METADATA_SIZE 10 55 #define MXS_NAND_BITS_PER_ECC_LEVEL 13 56 #define MXS_NAND_COMMAND_BUFFER_SIZE 32 57 58 struct mx28_nand_fcb { 59 uint32_t checksum; 60 uint32_t fingerprint; 61 uint32_t version; 62 struct { 63 uint8_t data_setup; 64 uint8_t data_hold; 65 uint8_t address_setup; 66 uint8_t dsample_time; 67 uint8_t nand_timing_state; 68 uint8_t rea; 69 uint8_t rloh; 70 uint8_t rhoh; 71 } timing; 72 uint32_t page_data_size; 73 uint32_t total_page_size; 74 uint32_t sectors_per_block; 75 uint32_t number_of_nands; /* Ignored */ 76 uint32_t total_internal_die; /* Ignored */ 77 uint32_t cell_type; /* Ignored */ 78 uint32_t ecc_block_n_ecc_type; 79 uint32_t ecc_block_0_size; 80 uint32_t ecc_block_n_size; 81 uint32_t ecc_block_0_ecc_type; 82 uint32_t metadata_bytes; 83 uint32_t num_ecc_blocks_per_page; 84 uint32_t ecc_block_n_ecc_level_sdk; /* Ignored */ 85 uint32_t ecc_block_0_size_sdk; /* Ignored */ 86 uint32_t ecc_block_n_size_sdk; /* Ignored */ 87 uint32_t ecc_block_0_ecc_level_sdk; /* Ignored */ 88 uint32_t num_ecc_blocks_per_page_sdk; /* Ignored */ 89 uint32_t metadata_bytes_sdk; /* Ignored */ 90 uint32_t erase_threshold; 91 uint32_t boot_patch; 92 uint32_t patch_sectors; 93 uint32_t firmware1_starting_sector; 94 uint32_t firmware2_starting_sector; 95 uint32_t sectors_in_firmware1; 96 uint32_t sectors_in_firmware2; 97 uint32_t dbbt_search_area_start_address; 98 uint32_t badblock_marker_byte; 99 uint32_t badblock_marker_start_bit; 100 uint32_t bb_marker_physical_offset; 101 }; 102 103 struct mx28_nand_dbbt { 104 uint32_t checksum; 105 uint32_t fingerprint; 106 uint32_t version; 107 uint32_t number_bb; 108 uint32_t number_2k_pages_bb; 109 }; 110 111 struct mx28_nand_bbt { 112 uint32_t nand; 113 uint32_t number_bb; 114 uint32_t badblock[510]; 115 }; 116 117 struct mx28_sd_drive_info { 118 uint32_t chip_num; 119 uint32_t drive_type; 120 uint32_t tag; 121 uint32_t first_sector_number; 122 uint32_t sector_count; 123 }; 124 125 struct mx28_sd_config_block { 126 uint32_t signature; 127 uint32_t primary_boot_tag; 128 uint32_t secondary_boot_tag; 129 uint32_t num_copies; 130 struct mx28_sd_drive_info drv_info[1]; 131 }; 132 133 static inline uint32_t mx28_nand_ecc_chunk_cnt(uint32_t page_data_size) 134 { 135 return page_data_size / MXS_NAND_CHUNK_DATA_CHUNK_SIZE; 136 } 137 138 static inline uint32_t mx28_nand_ecc_size_in_bits(uint32_t ecc_strength) 139 { 140 return ecc_strength * MXS_NAND_BITS_PER_ECC_LEVEL; 141 } 142 143 static inline uint32_t mx28_nand_get_ecc_strength(uint32_t page_data_size, 144 uint32_t page_oob_size) 145 { 146 int ecc_strength; 147 148 /* 149 * Determine the ECC layout with the formula: 150 * ECC bits per chunk = (total page spare data bits) / 151 * (bits per ECC level) / (chunks per page) 152 * where: 153 * total page spare data bits = 154 * (page oob size - meta data size) * (bits per byte) 155 */ 156 ecc_strength = ((page_oob_size - MXS_NAND_METADATA_SIZE) * 8) 157 / (MXS_NAND_BITS_PER_ECC_LEVEL * 158 mx28_nand_ecc_chunk_cnt(page_data_size)); 159 160 return round_down(ecc_strength, 2); 161 } 162 163 static inline uint32_t mx28_nand_get_mark_offset(uint32_t page_data_size, 164 uint32_t ecc_strength) 165 { 166 uint32_t chunk_data_size_in_bits; 167 uint32_t chunk_ecc_size_in_bits; 168 uint32_t chunk_total_size_in_bits; 169 uint32_t block_mark_chunk_number; 170 uint32_t block_mark_chunk_bit_offset; 171 uint32_t block_mark_bit_offset; 172 173 chunk_data_size_in_bits = MXS_NAND_CHUNK_DATA_CHUNK_SIZE * 8; 174 chunk_ecc_size_in_bits = mx28_nand_ecc_size_in_bits(ecc_strength); 175 176 chunk_total_size_in_bits = 177 chunk_data_size_in_bits + chunk_ecc_size_in_bits; 178 179 /* Compute the bit offset of the block mark within the physical page. */ 180 block_mark_bit_offset = page_data_size * 8; 181 182 /* Subtract the metadata bits. */ 183 block_mark_bit_offset -= MXS_NAND_METADATA_SIZE * 8; 184 185 /* 186 * Compute the chunk number (starting at zero) in which the block mark 187 * appears. 188 */ 189 block_mark_chunk_number = 190 block_mark_bit_offset / chunk_total_size_in_bits; 191 192 /* 193 * Compute the bit offset of the block mark within its chunk, and 194 * validate it. 195 */ 196 block_mark_chunk_bit_offset = block_mark_bit_offset - 197 (block_mark_chunk_number * chunk_total_size_in_bits); 198 199 if (block_mark_chunk_bit_offset > chunk_data_size_in_bits) 200 return 1; 201 202 /* 203 * Now that we know the chunk number in which the block mark appears, 204 * we can subtract all the ECC bits that appear before it. 205 */ 206 block_mark_bit_offset -= 207 block_mark_chunk_number * chunk_ecc_size_in_bits; 208 209 return block_mark_bit_offset; 210 } 211 212 static inline uint32_t mx28_nand_mark_byte_offset(void) 213 { 214 uint32_t ecc_strength; 215 ecc_strength = mx28_nand_get_ecc_strength(nand_writesize, nand_oobsize); 216 return mx28_nand_get_mark_offset(nand_writesize, ecc_strength) >> 3; 217 } 218 219 static inline uint32_t mx28_nand_mark_bit_offset(void) 220 { 221 uint32_t ecc_strength; 222 ecc_strength = mx28_nand_get_ecc_strength(nand_writesize, nand_oobsize); 223 return mx28_nand_get_mark_offset(nand_writesize, ecc_strength) & 0x7; 224 } 225 226 static uint32_t mx28_nand_block_csum(uint8_t *block, uint32_t size) 227 { 228 uint32_t csum = 0; 229 int i; 230 231 for (i = 0; i < size; i++) 232 csum += block[i]; 233 234 return csum ^ 0xffffffff; 235 } 236 237 static struct mx28_nand_fcb *mx28_nand_get_fcb(uint32_t size) 238 { 239 struct mx28_nand_fcb *fcb; 240 uint32_t bcb_size_bytes; 241 uint32_t stride_size_bytes; 242 uint32_t bootstream_size_pages; 243 uint32_t fw1_start_page; 244 uint32_t fw2_start_page; 245 246 fcb = malloc(nand_writesize); 247 if (!fcb) { 248 printf("MX28 NAND: Unable to allocate FCB\n"); 249 return NULL; 250 } 251 252 memset(fcb, 0, nand_writesize); 253 254 fcb->fingerprint = 0x20424346; 255 fcb->version = 0x01000000; 256 257 /* 258 * FIXME: These here are default values as found in kobs-ng. We should 259 * probably retrieve the data from NAND or something. 260 */ 261 fcb->timing.data_setup = 80; 262 fcb->timing.data_hold = 60; 263 fcb->timing.address_setup = 25; 264 fcb->timing.dsample_time = 6; 265 266 fcb->page_data_size = nand_writesize; 267 fcb->total_page_size = nand_writesize + nand_oobsize; 268 fcb->sectors_per_block = nand_erasesize / nand_writesize; 269 270 fcb->num_ecc_blocks_per_page = (nand_writesize / 512) - 1; 271 fcb->ecc_block_0_size = 512; 272 fcb->ecc_block_n_size = 512; 273 fcb->metadata_bytes = 10; 274 fcb->ecc_block_n_ecc_type = mx28_nand_get_ecc_strength( 275 nand_writesize, nand_oobsize) >> 1; 276 fcb->ecc_block_0_ecc_type = mx28_nand_get_ecc_strength( 277 nand_writesize, nand_oobsize) >> 1; 278 if (fcb->ecc_block_n_ecc_type == 0) { 279 printf("MX28 NAND: Unsupported NAND geometry\n"); 280 goto err; 281 } 282 283 fcb->boot_patch = 0; 284 fcb->patch_sectors = 0; 285 286 fcb->badblock_marker_byte = mx28_nand_mark_byte_offset(); 287 fcb->badblock_marker_start_bit = mx28_nand_mark_bit_offset(); 288 fcb->bb_marker_physical_offset = nand_writesize; 289 290 stride_size_bytes = STRIDE_PAGES * nand_writesize; 291 bcb_size_bytes = stride_size_bytes * STRIDE_COUNT; 292 293 bootstream_size_pages = (size + (nand_writesize - 1)) / 294 nand_writesize; 295 296 fw1_start_page = 2 * bcb_size_bytes / nand_writesize; 297 fw2_start_page = (2 * bcb_size_bytes + MAX_BOOTSTREAM_SIZE) / 298 nand_writesize; 299 300 fcb->firmware1_starting_sector = fw1_start_page; 301 fcb->firmware2_starting_sector = fw2_start_page; 302 fcb->sectors_in_firmware1 = bootstream_size_pages; 303 fcb->sectors_in_firmware2 = bootstream_size_pages; 304 305 fcb->dbbt_search_area_start_address = STRIDE_PAGES * STRIDE_COUNT; 306 307 return fcb; 308 309 err: 310 free(fcb); 311 return NULL; 312 } 313 314 static struct mx28_nand_dbbt *mx28_nand_get_dbbt(void) 315 { 316 struct mx28_nand_dbbt *dbbt; 317 318 dbbt = malloc(nand_writesize); 319 if (!dbbt) { 320 printf("MX28 NAND: Unable to allocate DBBT\n"); 321 return NULL; 322 } 323 324 memset(dbbt, 0, nand_writesize); 325 326 dbbt->fingerprint = 0x54424244; 327 dbbt->version = 0x1; 328 329 return dbbt; 330 } 331 332 static inline uint8_t mx28_nand_parity_13_8(const uint8_t b) 333 { 334 uint32_t parity = 0, tmp; 335 336 tmp = ((b >> 6) ^ (b >> 5) ^ (b >> 3) ^ (b >> 2)) & 1; 337 parity |= tmp << 0; 338 339 tmp = ((b >> 7) ^ (b >> 5) ^ (b >> 4) ^ (b >> 2) ^ (b >> 1)) & 1; 340 parity |= tmp << 1; 341 342 tmp = ((b >> 7) ^ (b >> 6) ^ (b >> 5) ^ (b >> 1) ^ (b >> 0)) & 1; 343 parity |= tmp << 2; 344 345 tmp = ((b >> 7) ^ (b >> 4) ^ (b >> 3) ^ (b >> 0)) & 1; 346 parity |= tmp << 3; 347 348 tmp = ((b >> 6) ^ (b >> 4) ^ (b >> 3) ^ 349 (b >> 2) ^ (b >> 1) ^ (b >> 0)) & 1; 350 parity |= tmp << 4; 351 352 return parity; 353 } 354 355 static uint8_t *mx28_nand_fcb_block(struct mx28_nand_fcb *fcb) 356 { 357 uint8_t *block; 358 uint8_t *ecc; 359 int i; 360 361 block = malloc(nand_writesize + nand_oobsize); 362 if (!block) { 363 printf("MX28 NAND: Unable to allocate FCB block\n"); 364 return NULL; 365 } 366 367 memset(block, 0, nand_writesize + nand_oobsize); 368 369 /* Update the FCB checksum */ 370 fcb->checksum = mx28_nand_block_csum(((uint8_t *)fcb) + 4, 508); 371 372 /* Figure 12-11. in iMX28RM, rev. 1, says FCB is at offset 12 */ 373 memcpy(block + 12, fcb, sizeof(struct mx28_nand_fcb)); 374 375 /* ECC is at offset 12 + 512 */ 376 ecc = block + 12 + 512; 377 378 /* Compute the ECC parity */ 379 for (i = 0; i < sizeof(struct mx28_nand_fcb); i++) 380 ecc[i] = mx28_nand_parity_13_8(block[i + 12]); 381 382 return block; 383 } 384 385 static int mx28_nand_write_fcb(struct mx28_nand_fcb *fcb, uint8_t *buf) 386 { 387 uint32_t offset; 388 uint8_t *fcbblock; 389 int ret = 0; 390 int i; 391 392 fcbblock = mx28_nand_fcb_block(fcb); 393 if (!fcbblock) 394 return -1; 395 396 for (i = 0; i < STRIDE_PAGES * STRIDE_COUNT; i += STRIDE_PAGES) { 397 offset = i * nand_writesize; 398 memcpy(buf + offset, fcbblock, nand_writesize + nand_oobsize); 399 /* Mark the NAND page is OK. */ 400 buf[offset + nand_writesize] = 0xff; 401 } 402 403 free(fcbblock); 404 return ret; 405 } 406 407 static int mx28_nand_write_dbbt(struct mx28_nand_dbbt *dbbt, uint8_t *buf) 408 { 409 uint32_t offset; 410 int i = STRIDE_PAGES * STRIDE_COUNT; 411 412 for (; i < 2 * STRIDE_PAGES * STRIDE_COUNT; i += STRIDE_PAGES) { 413 offset = i * nand_writesize; 414 memcpy(buf + offset, dbbt, sizeof(struct mx28_nand_dbbt)); 415 } 416 417 return 0; 418 } 419 420 static int mx28_nand_write_firmware(struct mx28_nand_fcb *fcb, int infd, 421 uint8_t *buf) 422 { 423 int ret; 424 off_t size; 425 uint32_t offset1, offset2; 426 427 size = lseek(infd, 0, SEEK_END); 428 lseek(infd, 0, SEEK_SET); 429 430 offset1 = fcb->firmware1_starting_sector * nand_writesize; 431 offset2 = fcb->firmware2_starting_sector * nand_writesize; 432 433 ret = read(infd, buf + offset1, size); 434 if (ret != size) 435 return -1; 436 437 memcpy(buf + offset2, buf + offset1, size); 438 439 return 0; 440 } 441 442 static void usage(void) 443 { 444 printf( 445 "Usage: mxsboot [ops] <type> <infile> <outfile>\n" 446 "Augment BootStream file with a proper header for i.MX28 boot\n" 447 "\n" 448 " <type> type of image:\n" 449 " \"nand\" for NAND image\n" 450 " \"sd\" for SD image\n" 451 " <infile> input file, the u-boot.sb bootstream\n" 452 " <outfile> output file, the bootable image\n" 453 "\n"); 454 printf( 455 "For NAND boot, these options are accepted:\n" 456 " -w <size> NAND page size\n" 457 " -o <size> NAND OOB size\n" 458 " -e <size> NAND erase size\n" 459 "\n" 460 "For SD boot, these options are accepted:\n" 461 " -p <sector> Sector where the SGTL partition starts\n" 462 ); 463 } 464 465 static int mx28_create_nand_image(int infd, int outfd) 466 { 467 struct mx28_nand_fcb *fcb; 468 struct mx28_nand_dbbt *dbbt; 469 int ret = -1; 470 uint8_t *buf; 471 int size; 472 ssize_t wr_size; 473 474 size = nand_writesize * 512 + 2 * MAX_BOOTSTREAM_SIZE; 475 476 buf = malloc(size); 477 if (!buf) { 478 printf("Can not allocate output buffer of %d bytes\n", size); 479 goto err0; 480 } 481 482 memset(buf, 0, size); 483 484 fcb = mx28_nand_get_fcb(MAX_BOOTSTREAM_SIZE); 485 if (!fcb) { 486 printf("Unable to compile FCB\n"); 487 goto err1; 488 } 489 490 dbbt = mx28_nand_get_dbbt(); 491 if (!dbbt) { 492 printf("Unable to compile DBBT\n"); 493 goto err2; 494 } 495 496 ret = mx28_nand_write_fcb(fcb, buf); 497 if (ret) { 498 printf("Unable to write FCB to buffer\n"); 499 goto err3; 500 } 501 502 ret = mx28_nand_write_dbbt(dbbt, buf); 503 if (ret) { 504 printf("Unable to write DBBT to buffer\n"); 505 goto err3; 506 } 507 508 ret = mx28_nand_write_firmware(fcb, infd, buf); 509 if (ret) { 510 printf("Unable to write firmware to buffer\n"); 511 goto err3; 512 } 513 514 wr_size = write(outfd, buf, size); 515 if (wr_size != size) { 516 ret = -1; 517 goto err3; 518 } 519 520 ret = 0; 521 522 err3: 523 free(dbbt); 524 err2: 525 free(fcb); 526 err1: 527 free(buf); 528 err0: 529 return ret; 530 } 531 532 static int mx28_create_sd_image(int infd, int outfd) 533 { 534 int ret = -1; 535 uint32_t *buf; 536 int size; 537 off_t fsize; 538 ssize_t wr_size; 539 struct mx28_sd_config_block *cb; 540 541 fsize = lseek(infd, 0, SEEK_END); 542 lseek(infd, 0, SEEK_SET); 543 size = fsize + 4 * 512; 544 545 buf = malloc(size); 546 if (!buf) { 547 printf("Can not allocate output buffer of %d bytes\n", size); 548 goto err0; 549 } 550 551 ret = read(infd, (uint8_t *)buf + 4 * 512, fsize); 552 if (ret != fsize) { 553 ret = -1; 554 goto err1; 555 } 556 557 cb = (struct mx28_sd_config_block *)buf; 558 559 cb->signature = cpu_to_le32(0x00112233); 560 cb->primary_boot_tag = cpu_to_le32(0x1); 561 cb->secondary_boot_tag = cpu_to_le32(0x1); 562 cb->num_copies = cpu_to_le32(1); 563 cb->drv_info[0].chip_num = cpu_to_le32(0x0); 564 cb->drv_info[0].drive_type = cpu_to_le32(0x0); 565 cb->drv_info[0].tag = cpu_to_le32(0x1); 566 cb->drv_info[0].first_sector_number = cpu_to_le32(sd_sector + 4); 567 cb->drv_info[0].sector_count = cpu_to_le32((size - 4) / 512); 568 569 wr_size = write(outfd, buf, size); 570 if (wr_size != size) { 571 ret = -1; 572 goto err1; 573 } 574 575 ret = 0; 576 577 err1: 578 free(buf); 579 err0: 580 return ret; 581 } 582 583 static int parse_ops(int argc, char **argv) 584 { 585 int i; 586 int tmp; 587 char *end; 588 enum param { 589 PARAM_WRITE, 590 PARAM_OOB, 591 PARAM_ERASE, 592 PARAM_PART, 593 PARAM_SD, 594 PARAM_NAND 595 }; 596 int type; 597 598 if (argc < 4) 599 return -1; 600 601 for (i = 1; i < argc; i++) { 602 if (!strncmp(argv[i], "-w", 2)) 603 type = PARAM_WRITE; 604 else if (!strncmp(argv[i], "-o", 2)) 605 type = PARAM_OOB; 606 else if (!strncmp(argv[i], "-e", 2)) 607 type = PARAM_ERASE; 608 else if (!strncmp(argv[i], "-p", 2)) 609 type = PARAM_PART; 610 else /* SD/MMC */ 611 break; 612 613 tmp = strtol(argv[++i], &end, 10); 614 if (tmp % 2) 615 return -1; 616 if (tmp <= 0) 617 return -1; 618 619 if (type == PARAM_WRITE) 620 nand_writesize = tmp; 621 if (type == PARAM_OOB) 622 nand_oobsize = tmp; 623 if (type == PARAM_ERASE) 624 nand_erasesize = tmp; 625 if (type == PARAM_PART) 626 sd_sector = tmp; 627 } 628 629 if (strcmp(argv[i], "sd") && strcmp(argv[i], "nand")) 630 return -1; 631 632 if (i + 3 != argc) 633 return -1; 634 635 return i; 636 } 637 638 int main(int argc, char **argv) 639 { 640 int infd, outfd; 641 int ret = 0; 642 int offset; 643 644 offset = parse_ops(argc, argv); 645 if (offset < 0) { 646 usage(); 647 ret = 1; 648 goto err1; 649 } 650 651 infd = open(argv[offset + 1], O_RDONLY); 652 if (infd < 0) { 653 printf("Input BootStream file can not be opened\n"); 654 ret = 2; 655 goto err1; 656 } 657 658 outfd = open(argv[offset + 2], O_CREAT | O_TRUNC | O_WRONLY, 659 S_IRUSR | S_IWUSR); 660 if (outfd < 0) { 661 printf("Output file can not be created\n"); 662 ret = 3; 663 goto err2; 664 } 665 666 if (!strcmp(argv[offset], "sd")) 667 ret = mx28_create_sd_image(infd, outfd); 668 else if (!strcmp(argv[offset], "nand")) 669 ret = mx28_create_nand_image(infd, outfd); 670 671 close(outfd); 672 err2: 673 close(infd); 674 err1: 675 return ret; 676 } 677