1 /* 2 * Freescale i.MX28 image generator 3 * 4 * Copyright (C) 2011 Marek Vasut <marek.vasut@gmail.com> 5 * on behalf of DENX Software Engineering GmbH 6 * 7 * SPDX-License-Identifier: GPL-2.0+ 8 */ 9 10 #include <fcntl.h> 11 #include <sys/stat.h> 12 #include <sys/types.h> 13 #include <unistd.h> 14 15 #include "compiler.h" 16 17 /* 18 * Default BCB layout. 19 * 20 * TWEAK this if you have blown any OCOTP fuses. 21 */ 22 #define STRIDE_PAGES 64 23 #define STRIDE_COUNT 4 24 25 /* 26 * Layout for 256Mb big NAND with 2048b page size, 64b OOB size and 27 * 128kb erase size. 28 * 29 * TWEAK this if you have different kind of NAND chip. 30 */ 31 static uint32_t nand_writesize = 2048; 32 static uint32_t nand_oobsize = 64; 33 static uint32_t nand_erasesize = 128 * 1024; 34 35 /* 36 * Sector on which the SigmaTel boot partition (0x53) starts. 37 */ 38 static uint32_t sd_sector = 2048; 39 40 /* 41 * Each of the U-Boot bootstreams is at maximum 1MB big. 42 * 43 * TWEAK this if, for some wild reason, you need to boot bigger image. 44 */ 45 #define MAX_BOOTSTREAM_SIZE (1 * 1024 * 1024) 46 47 /* i.MX28 NAND controller-specific constants. DO NOT TWEAK! */ 48 #define MXS_NAND_DMA_DESCRIPTOR_COUNT 4 49 #define MXS_NAND_CHUNK_DATA_CHUNK_SIZE 512 50 #define MXS_NAND_METADATA_SIZE 10 51 #define MXS_NAND_COMMAND_BUFFER_SIZE 32 52 53 struct mx28_nand_fcb { 54 uint32_t checksum; 55 uint32_t fingerprint; 56 uint32_t version; 57 struct { 58 uint8_t data_setup; 59 uint8_t data_hold; 60 uint8_t address_setup; 61 uint8_t dsample_time; 62 uint8_t nand_timing_state; 63 uint8_t rea; 64 uint8_t rloh; 65 uint8_t rhoh; 66 } timing; 67 uint32_t page_data_size; 68 uint32_t total_page_size; 69 uint32_t sectors_per_block; 70 uint32_t number_of_nands; /* Ignored */ 71 uint32_t total_internal_die; /* Ignored */ 72 uint32_t cell_type; /* Ignored */ 73 uint32_t ecc_block_n_ecc_type; 74 uint32_t ecc_block_0_size; 75 uint32_t ecc_block_n_size; 76 uint32_t ecc_block_0_ecc_type; 77 uint32_t metadata_bytes; 78 uint32_t num_ecc_blocks_per_page; 79 uint32_t ecc_block_n_ecc_level_sdk; /* Ignored */ 80 uint32_t ecc_block_0_size_sdk; /* Ignored */ 81 uint32_t ecc_block_n_size_sdk; /* Ignored */ 82 uint32_t ecc_block_0_ecc_level_sdk; /* Ignored */ 83 uint32_t num_ecc_blocks_per_page_sdk; /* Ignored */ 84 uint32_t metadata_bytes_sdk; /* Ignored */ 85 uint32_t erase_threshold; 86 uint32_t boot_patch; 87 uint32_t patch_sectors; 88 uint32_t firmware1_starting_sector; 89 uint32_t firmware2_starting_sector; 90 uint32_t sectors_in_firmware1; 91 uint32_t sectors_in_firmware2; 92 uint32_t dbbt_search_area_start_address; 93 uint32_t badblock_marker_byte; 94 uint32_t badblock_marker_start_bit; 95 uint32_t bb_marker_physical_offset; 96 }; 97 98 struct mx28_nand_dbbt { 99 uint32_t checksum; 100 uint32_t fingerprint; 101 uint32_t version; 102 uint32_t number_bb; 103 uint32_t number_2k_pages_bb; 104 }; 105 106 struct mx28_nand_bbt { 107 uint32_t nand; 108 uint32_t number_bb; 109 uint32_t badblock[510]; 110 }; 111 112 struct mx28_sd_drive_info { 113 uint32_t chip_num; 114 uint32_t drive_type; 115 uint32_t tag; 116 uint32_t first_sector_number; 117 uint32_t sector_count; 118 }; 119 120 struct mx28_sd_config_block { 121 uint32_t signature; 122 uint32_t primary_boot_tag; 123 uint32_t secondary_boot_tag; 124 uint32_t num_copies; 125 struct mx28_sd_drive_info drv_info[1]; 126 }; 127 128 static inline uint32_t mx28_nand_ecc_size_in_bits(uint32_t ecc_strength) 129 { 130 return ecc_strength * 13; 131 } 132 133 static inline uint32_t mx28_nand_get_ecc_strength(uint32_t page_data_size, 134 uint32_t page_oob_size) 135 { 136 if (page_data_size == 2048) 137 return 8; 138 139 if (page_data_size == 4096) { 140 if (page_oob_size == 128) 141 return 8; 142 143 if (page_oob_size == 218) 144 return 16; 145 146 if (page_oob_size == 224) 147 return 16; 148 } 149 150 return 0; 151 } 152 153 static inline uint32_t mx28_nand_get_mark_offset(uint32_t page_data_size, 154 uint32_t ecc_strength) 155 { 156 uint32_t chunk_data_size_in_bits; 157 uint32_t chunk_ecc_size_in_bits; 158 uint32_t chunk_total_size_in_bits; 159 uint32_t block_mark_chunk_number; 160 uint32_t block_mark_chunk_bit_offset; 161 uint32_t block_mark_bit_offset; 162 163 chunk_data_size_in_bits = MXS_NAND_CHUNK_DATA_CHUNK_SIZE * 8; 164 chunk_ecc_size_in_bits = mx28_nand_ecc_size_in_bits(ecc_strength); 165 166 chunk_total_size_in_bits = 167 chunk_data_size_in_bits + chunk_ecc_size_in_bits; 168 169 /* Compute the bit offset of the block mark within the physical page. */ 170 block_mark_bit_offset = page_data_size * 8; 171 172 /* Subtract the metadata bits. */ 173 block_mark_bit_offset -= MXS_NAND_METADATA_SIZE * 8; 174 175 /* 176 * Compute the chunk number (starting at zero) in which the block mark 177 * appears. 178 */ 179 block_mark_chunk_number = 180 block_mark_bit_offset / chunk_total_size_in_bits; 181 182 /* 183 * Compute the bit offset of the block mark within its chunk, and 184 * validate it. 185 */ 186 block_mark_chunk_bit_offset = block_mark_bit_offset - 187 (block_mark_chunk_number * chunk_total_size_in_bits); 188 189 if (block_mark_chunk_bit_offset > chunk_data_size_in_bits) 190 return 1; 191 192 /* 193 * Now that we know the chunk number in which the block mark appears, 194 * we can subtract all the ECC bits that appear before it. 195 */ 196 block_mark_bit_offset -= 197 block_mark_chunk_number * chunk_ecc_size_in_bits; 198 199 return block_mark_bit_offset; 200 } 201 202 static inline uint32_t mx28_nand_mark_byte_offset(void) 203 { 204 uint32_t ecc_strength; 205 ecc_strength = mx28_nand_get_ecc_strength(nand_writesize, nand_oobsize); 206 return mx28_nand_get_mark_offset(nand_writesize, ecc_strength) >> 3; 207 } 208 209 static inline uint32_t mx28_nand_mark_bit_offset(void) 210 { 211 uint32_t ecc_strength; 212 ecc_strength = mx28_nand_get_ecc_strength(nand_writesize, nand_oobsize); 213 return mx28_nand_get_mark_offset(nand_writesize, ecc_strength) & 0x7; 214 } 215 216 static uint32_t mx28_nand_block_csum(uint8_t *block, uint32_t size) 217 { 218 uint32_t csum = 0; 219 int i; 220 221 for (i = 0; i < size; i++) 222 csum += block[i]; 223 224 return csum ^ 0xffffffff; 225 } 226 227 static struct mx28_nand_fcb *mx28_nand_get_fcb(uint32_t size) 228 { 229 struct mx28_nand_fcb *fcb; 230 uint32_t bcb_size_bytes; 231 uint32_t stride_size_bytes; 232 uint32_t bootstream_size_pages; 233 uint32_t fw1_start_page; 234 uint32_t fw2_start_page; 235 236 fcb = malloc(nand_writesize); 237 if (!fcb) { 238 printf("MX28 NAND: Unable to allocate FCB\n"); 239 return NULL; 240 } 241 242 memset(fcb, 0, nand_writesize); 243 244 fcb->fingerprint = 0x20424346; 245 fcb->version = 0x01000000; 246 247 /* 248 * FIXME: These here are default values as found in kobs-ng. We should 249 * probably retrieve the data from NAND or something. 250 */ 251 fcb->timing.data_setup = 80; 252 fcb->timing.data_hold = 60; 253 fcb->timing.address_setup = 25; 254 fcb->timing.dsample_time = 6; 255 256 fcb->page_data_size = nand_writesize; 257 fcb->total_page_size = nand_writesize + nand_oobsize; 258 fcb->sectors_per_block = nand_erasesize / nand_writesize; 259 260 fcb->num_ecc_blocks_per_page = (nand_writesize / 512) - 1; 261 fcb->ecc_block_0_size = 512; 262 fcb->ecc_block_n_size = 512; 263 fcb->metadata_bytes = 10; 264 265 if (nand_writesize == 2048) { 266 fcb->ecc_block_n_ecc_type = 4; 267 fcb->ecc_block_0_ecc_type = 4; 268 } else if (nand_writesize == 4096) { 269 if (nand_oobsize == 128) { 270 fcb->ecc_block_n_ecc_type = 4; 271 fcb->ecc_block_0_ecc_type = 4; 272 } else if (nand_oobsize == 218) { 273 fcb->ecc_block_n_ecc_type = 8; 274 fcb->ecc_block_0_ecc_type = 8; 275 } else if (nand_oobsize == 224) { 276 fcb->ecc_block_n_ecc_type = 8; 277 fcb->ecc_block_0_ecc_type = 8; 278 } 279 } 280 281 if (fcb->ecc_block_n_ecc_type == 0) { 282 printf("MX28 NAND: Unsupported NAND geometry\n"); 283 goto err; 284 } 285 286 fcb->boot_patch = 0; 287 fcb->patch_sectors = 0; 288 289 fcb->badblock_marker_byte = mx28_nand_mark_byte_offset(); 290 fcb->badblock_marker_start_bit = mx28_nand_mark_bit_offset(); 291 fcb->bb_marker_physical_offset = nand_writesize; 292 293 stride_size_bytes = STRIDE_PAGES * nand_writesize; 294 bcb_size_bytes = stride_size_bytes * STRIDE_COUNT; 295 296 bootstream_size_pages = (size + (nand_writesize - 1)) / 297 nand_writesize; 298 299 fw1_start_page = 2 * bcb_size_bytes / nand_writesize; 300 fw2_start_page = (2 * bcb_size_bytes + MAX_BOOTSTREAM_SIZE) / 301 nand_writesize; 302 303 fcb->firmware1_starting_sector = fw1_start_page; 304 fcb->firmware2_starting_sector = fw2_start_page; 305 fcb->sectors_in_firmware1 = bootstream_size_pages; 306 fcb->sectors_in_firmware2 = bootstream_size_pages; 307 308 fcb->dbbt_search_area_start_address = STRIDE_PAGES * STRIDE_COUNT; 309 310 return fcb; 311 312 err: 313 free(fcb); 314 return NULL; 315 } 316 317 static struct mx28_nand_dbbt *mx28_nand_get_dbbt(void) 318 { 319 struct mx28_nand_dbbt *dbbt; 320 321 dbbt = malloc(nand_writesize); 322 if (!dbbt) { 323 printf("MX28 NAND: Unable to allocate DBBT\n"); 324 return NULL; 325 } 326 327 memset(dbbt, 0, nand_writesize); 328 329 dbbt->fingerprint = 0x54424244; 330 dbbt->version = 0x1; 331 332 return dbbt; 333 } 334 335 static inline uint8_t mx28_nand_parity_13_8(const uint8_t b) 336 { 337 uint32_t parity = 0, tmp; 338 339 tmp = ((b >> 6) ^ (b >> 5) ^ (b >> 3) ^ (b >> 2)) & 1; 340 parity |= tmp << 0; 341 342 tmp = ((b >> 7) ^ (b >> 5) ^ (b >> 4) ^ (b >> 2) ^ (b >> 1)) & 1; 343 parity |= tmp << 1; 344 345 tmp = ((b >> 7) ^ (b >> 6) ^ (b >> 5) ^ (b >> 1) ^ (b >> 0)) & 1; 346 parity |= tmp << 2; 347 348 tmp = ((b >> 7) ^ (b >> 4) ^ (b >> 3) ^ (b >> 0)) & 1; 349 parity |= tmp << 3; 350 351 tmp = ((b >> 6) ^ (b >> 4) ^ (b >> 3) ^ 352 (b >> 2) ^ (b >> 1) ^ (b >> 0)) & 1; 353 parity |= tmp << 4; 354 355 return parity; 356 } 357 358 static uint8_t *mx28_nand_fcb_block(struct mx28_nand_fcb *fcb) 359 { 360 uint8_t *block; 361 uint8_t *ecc; 362 int i; 363 364 block = malloc(nand_writesize + nand_oobsize); 365 if (!block) { 366 printf("MX28 NAND: Unable to allocate FCB block\n"); 367 return NULL; 368 } 369 370 memset(block, 0, nand_writesize + nand_oobsize); 371 372 /* Update the FCB checksum */ 373 fcb->checksum = mx28_nand_block_csum(((uint8_t *)fcb) + 4, 508); 374 375 /* Figure 12-11. in iMX28RM, rev. 1, says FCB is at offset 12 */ 376 memcpy(block + 12, fcb, sizeof(struct mx28_nand_fcb)); 377 378 /* ECC is at offset 12 + 512 */ 379 ecc = block + 12 + 512; 380 381 /* Compute the ECC parity */ 382 for (i = 0; i < sizeof(struct mx28_nand_fcb); i++) 383 ecc[i] = mx28_nand_parity_13_8(block[i + 12]); 384 385 return block; 386 } 387 388 static int mx28_nand_write_fcb(struct mx28_nand_fcb *fcb, uint8_t *buf) 389 { 390 uint32_t offset; 391 uint8_t *fcbblock; 392 int ret = 0; 393 int i; 394 395 fcbblock = mx28_nand_fcb_block(fcb); 396 if (!fcbblock) 397 return -1; 398 399 for (i = 0; i < STRIDE_PAGES * STRIDE_COUNT; i += STRIDE_PAGES) { 400 offset = i * nand_writesize; 401 memcpy(buf + offset, fcbblock, nand_writesize + nand_oobsize); 402 /* Mark the NAND page is OK. */ 403 buf[offset + nand_writesize] = 0xff; 404 } 405 406 free(fcbblock); 407 return ret; 408 } 409 410 static int mx28_nand_write_dbbt(struct mx28_nand_dbbt *dbbt, uint8_t *buf) 411 { 412 uint32_t offset; 413 int i = STRIDE_PAGES * STRIDE_COUNT; 414 415 for (; i < 2 * STRIDE_PAGES * STRIDE_COUNT; i += STRIDE_PAGES) { 416 offset = i * nand_writesize; 417 memcpy(buf + offset, dbbt, sizeof(struct mx28_nand_dbbt)); 418 } 419 420 return 0; 421 } 422 423 static int mx28_nand_write_firmware(struct mx28_nand_fcb *fcb, int infd, 424 uint8_t *buf) 425 { 426 int ret; 427 off_t size; 428 uint32_t offset1, offset2; 429 430 size = lseek(infd, 0, SEEK_END); 431 lseek(infd, 0, SEEK_SET); 432 433 offset1 = fcb->firmware1_starting_sector * nand_writesize; 434 offset2 = fcb->firmware2_starting_sector * nand_writesize; 435 436 ret = read(infd, buf + offset1, size); 437 if (ret != size) 438 return -1; 439 440 memcpy(buf + offset2, buf + offset1, size); 441 442 return 0; 443 } 444 445 static void usage(void) 446 { 447 printf( 448 "Usage: mxsboot [ops] <type> <infile> <outfile>\n" 449 "Augment BootStream file with a proper header for i.MX28 boot\n" 450 "\n" 451 " <type> type of image:\n" 452 " \"nand\" for NAND image\n" 453 " \"sd\" for SD image\n" 454 " <infile> input file, the u-boot.sb bootstream\n" 455 " <outfile> output file, the bootable image\n" 456 "\n"); 457 printf( 458 "For NAND boot, these options are accepted:\n" 459 " -w <size> NAND page size\n" 460 " -o <size> NAND OOB size\n" 461 " -e <size> NAND erase size\n" 462 "\n" 463 "For SD boot, these options are accepted:\n" 464 " -p <sector> Sector where the SGTL partition starts\n" 465 ); 466 } 467 468 static int mx28_create_nand_image(int infd, int outfd) 469 { 470 struct mx28_nand_fcb *fcb; 471 struct mx28_nand_dbbt *dbbt; 472 int ret = -1; 473 uint8_t *buf; 474 int size; 475 ssize_t wr_size; 476 477 size = nand_writesize * 512 + 2 * MAX_BOOTSTREAM_SIZE; 478 479 buf = malloc(size); 480 if (!buf) { 481 printf("Can not allocate output buffer of %d bytes\n", size); 482 goto err0; 483 } 484 485 memset(buf, 0, size); 486 487 fcb = mx28_nand_get_fcb(MAX_BOOTSTREAM_SIZE); 488 if (!fcb) { 489 printf("Unable to compile FCB\n"); 490 goto err1; 491 } 492 493 dbbt = mx28_nand_get_dbbt(); 494 if (!dbbt) { 495 printf("Unable to compile DBBT\n"); 496 goto err2; 497 } 498 499 ret = mx28_nand_write_fcb(fcb, buf); 500 if (ret) { 501 printf("Unable to write FCB to buffer\n"); 502 goto err3; 503 } 504 505 ret = mx28_nand_write_dbbt(dbbt, buf); 506 if (ret) { 507 printf("Unable to write DBBT to buffer\n"); 508 goto err3; 509 } 510 511 ret = mx28_nand_write_firmware(fcb, infd, buf); 512 if (ret) { 513 printf("Unable to write firmware to buffer\n"); 514 goto err3; 515 } 516 517 wr_size = write(outfd, buf, size); 518 if (wr_size != size) { 519 ret = -1; 520 goto err3; 521 } 522 523 ret = 0; 524 525 err3: 526 free(dbbt); 527 err2: 528 free(fcb); 529 err1: 530 free(buf); 531 err0: 532 return ret; 533 } 534 535 static int mx28_create_sd_image(int infd, int outfd) 536 { 537 int ret = -1; 538 uint32_t *buf; 539 int size; 540 off_t fsize; 541 ssize_t wr_size; 542 struct mx28_sd_config_block *cb; 543 544 fsize = lseek(infd, 0, SEEK_END); 545 lseek(infd, 0, SEEK_SET); 546 size = fsize + 4 * 512; 547 548 buf = malloc(size); 549 if (!buf) { 550 printf("Can not allocate output buffer of %d bytes\n", size); 551 goto err0; 552 } 553 554 ret = read(infd, (uint8_t *)buf + 4 * 512, fsize); 555 if (ret != fsize) { 556 ret = -1; 557 goto err1; 558 } 559 560 cb = (struct mx28_sd_config_block *)buf; 561 562 cb->signature = 0x00112233; 563 cb->primary_boot_tag = 0x1; 564 cb->secondary_boot_tag = 0x1; 565 cb->num_copies = 1; 566 cb->drv_info[0].chip_num = 0x0; 567 cb->drv_info[0].drive_type = 0x0; 568 cb->drv_info[0].tag = 0x1; 569 cb->drv_info[0].first_sector_number = sd_sector + 4; 570 cb->drv_info[0].sector_count = (size - 4) / 512; 571 572 wr_size = write(outfd, buf, size); 573 if (wr_size != size) { 574 ret = -1; 575 goto err1; 576 } 577 578 ret = 0; 579 580 err1: 581 free(buf); 582 err0: 583 return ret; 584 } 585 586 static int parse_ops(int argc, char **argv) 587 { 588 int i; 589 int tmp; 590 char *end; 591 enum param { 592 PARAM_WRITE, 593 PARAM_OOB, 594 PARAM_ERASE, 595 PARAM_PART, 596 PARAM_SD, 597 PARAM_NAND 598 }; 599 int type; 600 601 if (argc < 4) 602 return -1; 603 604 for (i = 1; i < argc; i++) { 605 if (!strncmp(argv[i], "-w", 2)) 606 type = PARAM_WRITE; 607 else if (!strncmp(argv[i], "-o", 2)) 608 type = PARAM_OOB; 609 else if (!strncmp(argv[i], "-e", 2)) 610 type = PARAM_ERASE; 611 else if (!strncmp(argv[i], "-p", 2)) 612 type = PARAM_PART; 613 else /* SD/MMC */ 614 break; 615 616 tmp = strtol(argv[++i], &end, 10); 617 if (tmp % 2) 618 return -1; 619 if (tmp <= 0) 620 return -1; 621 622 if (type == PARAM_WRITE) 623 nand_writesize = tmp; 624 if (type == PARAM_OOB) 625 nand_oobsize = tmp; 626 if (type == PARAM_ERASE) 627 nand_erasesize = tmp; 628 if (type == PARAM_PART) 629 sd_sector = tmp; 630 } 631 632 if (strcmp(argv[i], "sd") && strcmp(argv[i], "nand")) 633 return -1; 634 635 if (i + 3 != argc) 636 return -1; 637 638 return i; 639 } 640 641 int main(int argc, char **argv) 642 { 643 int infd, outfd; 644 int ret = 0; 645 int offset; 646 647 offset = parse_ops(argc, argv); 648 if (offset < 0) { 649 usage(); 650 ret = 1; 651 goto err1; 652 } 653 654 infd = open(argv[offset + 1], O_RDONLY); 655 if (infd < 0) { 656 printf("Input BootStream file can not be opened\n"); 657 ret = 2; 658 goto err1; 659 } 660 661 outfd = open(argv[offset + 2], O_CREAT | O_TRUNC | O_WRONLY, 662 S_IRUSR | S_IWUSR); 663 if (outfd < 0) { 664 printf("Output file can not be created\n"); 665 ret = 3; 666 goto err2; 667 } 668 669 if (!strcmp(argv[offset], "sd")) 670 ret = mx28_create_sd_image(infd, outfd); 671 else if (!strcmp(argv[offset], "nand")) 672 ret = mx28_create_nand_image(infd, outfd); 673 674 close(outfd); 675 err2: 676 close(infd); 677 err1: 678 return ret; 679 } 680