[PATCH 0/3] i.MX6 NAND boot ROM workarounds

[PATCH 0/3] i.MX6 NAND boot ROM workarounds

[Sascha Hauer]

The i.MX6 NAND boot has some shortcomings in cornercases of the NAND boot
process. This series fixes them.

Sascha

Sascha Hauer (3):
  imx-bbu-nand-fcb: Improve error message
  imx-bbu-nand-fcb: Workaround ROM not being able to handle bad blocks
    properly
  imx-bbu-nand-fcb: Workaround ROM checking fingerprint before
    correcting bitflips

 common/imx-bbu-nand-fcb.c | 57 +++++++++++++++++++++++++++++++++------
 1 file changed, 49 insertions(+), 8 deletions(-)

-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 1/3] imx-bbu-nand-fcb: Improve error message

[Sascha Hauer]

When printing that a FCB is not readable it's interesting to know which
one is not readable. Print the block number in the message.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/imx-bbu-nand-fcb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/imx-bbu-nand-fcb.c b/common/imx-bbu-nand-fcb.c
index 2c8ca97926..5535a92d54 100644
--- a/common/imx-bbu-nand-fcb.c
+++ b/common/imx-bbu-nand-fcb.c
@@ -459,7 +459,7 @@ static int read_fcb(struct mtd_info *mtd, int num, struct fcb_block **retfcb)
 		fcb = read_fcb_hamming_13_8(rawpage);
 
 	if (IS_ERR(fcb)) {
-		pr_err("Cannot read fcb\n");
+		pr_err("Cannot read fcb on block %d\n", num);
 		ret = PTR_ERR(fcb);
 		goto err;
 	}
-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 2/3] imx-bbu-nand-fcb: Workaround ROM not being able to handle bad blocks properly

[Sascha Hauer]

When reading a firmware image the ROM only checks for a bad block when
advancing the read position, but not if the initial block is good.
Hence we cannot directly point to the first firmware block, but must
instead point to the first *good* firmware block.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/imx-bbu-nand-fcb.c | 45 +++++++++++++++++++++++++++++++++------
 1 file changed, 38 insertions(+), 7 deletions(-)

diff --git a/common/imx-bbu-nand-fcb.c b/common/imx-bbu-nand-fcb.c
index 5535a92d54..15ddf5d7b0 100644
--- a/common/imx-bbu-nand-fcb.c
+++ b/common/imx-bbu-nand-fcb.c
@@ -555,6 +555,40 @@ static int imx_bbu_firmware_start_block(struct mtd_info *mtd, int num)
 	return 4 + num * imx_bbu_firmware_max_blocks(mtd);
 }
 
+/**
+ * imx_bbu_firmware_fcb_start_page - get start page for a firmware slot
+ * @mtd: The mtd device
+ * @num: The slot number (0 or 1)
+ *
+ * This returns the start page for a firmware slot, to be written into the
+ * Firmwaren_startingPage field in the FCB.
+ */
+static int imx_bbu_firmware_fcb_start_page(struct mtd_info *mtd, int num)
+{
+	int block, blocksleft;
+	int pages_per_block = mtd->erasesize / mtd->writesize;
+
+	block = imx_bbu_firmware_start_block(mtd, num);
+
+	blocksleft = imx_bbu_firmware_max_blocks(mtd);
+
+	/*
+	 * The ROM only checks for a bad block when advancing the read position,
+	 * but not if the initial block is good, hence we cannot directly point
+	 * to the first firmware block, but must instead point to the first *good*
+	 * firmware block.
+	 */
+	while (mtd_peb_is_bad(mtd, block)) {
+		block++;
+		blocksleft--;
+		if (!blocksleft)
+			break;
+	}
+
+	return block * pages_per_block;
+}
+
+
 static int imx_bbu_write_firmware(struct mtd_info *mtd, unsigned num, void *buf,
 				  size_t len)
 {
@@ -1073,9 +1107,8 @@ static void read_firmware_all(struct mtd_info *mtd, struct fcb_block *fcb, void
 			     int *used_refresh, int *unused_refresh, int *used)
 {
 	void *primary = NULL, *secondary = NULL;
-	int pages_per_block = mtd->erasesize / mtd->writesize;
-	int fw0 = imx_bbu_firmware_start_block(mtd, 0) * pages_per_block;
-	int fw1 = imx_bbu_firmware_start_block(mtd, 1) * pages_per_block;
+	int fw0 = imx_bbu_firmware_fcb_start_page(mtd, 0);
+	int fw1 = imx_bbu_firmware_fcb_start_page(mtd, 1);
 	int first, ret, primary_refresh = 0, secondary_refresh = 0;
 
 	*used_refresh = 0;
@@ -1157,7 +1190,6 @@ static int imx_bbu_nand_update(struct bbu_handler *handler, struct bbu_data *dat
 	unsigned fw_size, partition_size;
 	enum filetype filetype;
 	unsigned num_blocks_fw;
-	int pages_per_block;
 	int used = 0;
 	int fw_orig_len;
 	int used_refresh = 0, unused_refresh = 0;
@@ -1180,7 +1212,6 @@ static int imx_bbu_nand_update(struct bbu_handler *handler, struct bbu_data *dat
 
 	mtd = bcb_cdev->mtd;
 	partition_size = mtd->size;
-	pages_per_block = mtd->erasesize / mtd->writesize;
 
 	for (i = 0; i < 4; i++) {
 		read_fcb(mtd, i, &fcb);
@@ -1263,8 +1294,8 @@ static int imx_bbu_nand_update(struct bbu_handler *handler, struct bbu_data *dat
 
 		free(fcb);
 		fcb = xzalloc(sizeof(*fcb));
-		fcb->Firmware1_startingPage = imx_bbu_firmware_start_block(mtd, !used) * pages_per_block;
-		fcb->Firmware2_startingPage = imx_bbu_firmware_start_block(mtd, used) * pages_per_block;
+		fcb->Firmware1_startingPage = imx_bbu_firmware_fcb_start_page(mtd, !used);
+		fcb->Firmware2_startingPage = imx_bbu_firmware_fcb_start_page(mtd, used);
 		fcb->PagesInFirmware1 = fw_size / mtd->writesize;
 		fcb->PagesInFirmware2 = fcb->PagesInFirmware1;
 
-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 3/3] imx-bbu-nand-fcb: Workaround ROM checking fingerprint before correcting bitflips

[Sascha Hauer]

The FCB block is protected with a ECC code which can correct 1bit errors
and detect 2bit errors. This works fine for all fields except the
fingerprint marker (Containing "FCB") which is used by the ROM to detect
if a FCB is present on that block or not. Here the ROM chooses to check
for the fingerprint *before* running the ECC correction. Thus a FCB is
not used by the ROM anymore when it has a bitflip in the fingerprint
marker. For us this means we have to rewrite the FCB in this case, so
reject the faulty FCB in read_fcb_hamming_13_8() which triggers a
rewrite during the check operation.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/imx-bbu-nand-fcb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/common/imx-bbu-nand-fcb.c b/common/imx-bbu-nand-fcb.c
index 15ddf5d7b0..aaa796bc81 100644
--- a/common/imx-bbu-nand-fcb.c
+++ b/common/imx-bbu-nand-fcb.c
@@ -318,6 +318,16 @@ struct fcb_block *read_fcb_hamming_13_8(void *rawpage)
 	fcb = rawpage + 12;
 	ecc = rawpage + 512 + 12;
 
+	/*
+	 * The ROM does the check for the correct fingerprint before correcting
+	 * bitflips. This means we cannot allow bitflips in the fingerprint and
+	 * bail out with an error if it's not correct.
+	 * This is currently done in the i.MX6qdl path. It needs to be checked if
+	 * the same happens in the BCH encoded variants (i.MX6ul(l)) aswell.
+	 */
+	if (((struct fcb_block *)fcb)->FingerPrint != 0x20424346)
+		return ERR_PTR(-EINVAL);
+
 	for (i = 0; i < 512; i++) {
 		parity = ecc[i];
 		np = calculate_parity_13_8(fcb[i]);
-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox