How to boot wince7.0 from nandflash on imx6q

leoyanfeng · ‎12-03-2015

Hello everybody:

I want to boot wince7.0 from nandflash on my imx6 board.Now,my board can boot from SD,and then write fcb,dbbt and eboot.nb0 to nandflash.But when switching to boot from nandflash,the board can't boot.The waveforms of date0 and data7 are absolutely same.When boot from SD,read\write\formt nandflash operations are ok.The flash is K9F2G08U0C.SLC(2048+64).Anybody can help me.Thank you.

PS:some questions about fcb:

1.when writing fcb,ecc need to be enable or not?

2.In imx28 refence manual,there is 12 bytes offset before fcb.The offset is needed in imx6?And Is the offset including meta data?

Sorry for my poor english.

leoyanfeng · ‎12-09-2015

Hi everybody:

Everything is ok now.The device can boot from nandflash now.

1.FCB data(There are 12 bytes offset at the beginning of databug.When ecc is disable, there is no metadata.Firstly,gpmi write pagebuf to nand and secondly write auxbuf.

When ecc is enable,gpmi write auxbuf to nand firstly.)

00 00 00 00 00 00 00 00 00 00 00 00 05 fb ff ff

46 43 42 20 00 00 00 01 50 3c 19 06 00 00 00 00

00 08 00 00 40 08 00 00 40 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 04 00 00 00 00 02 00 00

00 02 00 00 04 00 00 00 0a 00 00 00 03 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 02 00 00 00 41 00 00 cc 00 00 00

cc 00 00 00 00 01 00 00 cf 07 00 00 00 00 00 00

00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 0f 15 06 06

10 1f 03 07 00 00 00 1c 0f 17 1f 05 00 00 00 00

00 19 00 00 15 19 00 00 15 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 13 00 00 00 00 16 00 00

00 16 00 00 13 00 00 00 0f 00 00 00 0a 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 16 00 00 00 09 00 00 11 00 00 00

11 00 00 00 00 1c 00 00 1b 19 00 00 00 00 00 00

00 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

OOB:

ff ff ff ff ff ff ff ff

2.dbbt:

bold data is metadata.10 bytes.Ecc is enable now.

00 ff ff ff ff ff ff ff ff ff 00 00 00 00 44 42

42 54 00 00 00 01 00 00 00 00 01 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 c3 c9 0f f0 55 65

1c 05 7d d8 fa dd e6 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

OOB:

ff 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00

00 92 2a bd 77 36 7e e7

bd 28 20 22 28 92 00 00

3.You should cut the first 4K data in eboot.nb0 if the eboot.nb0 has rom signature.Then you should add 1k padding to the eboot.nb0 for IVT.

4.You can find more information from the imx50's bsp.

Thanks.

View solution in original post

leoyanfeng · ‎12-09-2015

Hi everybody:

Everything is ok now.The device can boot from nandflash now.

1.FCB data(There are 12 bytes offset at the beginning of databug.When ecc is disable, there is no metadata.Firstly,gpmi write pagebuf to nand and secondly write auxbuf.

When ecc is enable,gpmi write auxbuf to nand firstly.)

00 00 00 00 00 00 00 00 00 00 00 00 05 fb ff ff

46 43 42 20 00 00 00 01 50 3c 19 06 00 00 00 00

00 08 00 00 40 08 00 00 40 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 04 00 00 00 00 02 00 00

00 02 00 00 04 00 00 00 0a 00 00 00 03 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 02 00 00 00 41 00 00 cc 00 00 00

cc 00 00 00 00 01 00 00 cf 07 00 00 00 00 00 00

00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 0f 15 06 06

10 1f 03 07 00 00 00 1c 0f 17 1f 05 00 00 00 00

00 19 00 00 15 19 00 00 15 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 13 00 00 00 00 16 00 00

00 16 00 00 13 00 00 00 0f 00 00 00 0a 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 16 00 00 00 09 00 00 11 00 00 00

11 00 00 00 00 1c 00 00 1b 19 00 00 00 00 00 00

00 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

OOB:

ff ff ff ff ff ff ff ff

2.dbbt:

bold data is metadata.10 bytes.Ecc is enable now.

00 ff ff ff ff ff ff ff ff ff 00 00 00 00 44 42

42 54 00 00 00 01 00 00 00 00 01 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 c3 c9 0f f0 55 65

1c 05 7d d8 fa dd e6 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

OOB:

ff 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00

00 92 2a bd 77 36 7e e7

bd 28 20 22 28 92 00 00

3.You should cut the first 4K data in eboot.nb0 if the eboot.nb0 has rom signature.Then you should add 1k padding to the eboot.nb0 for IVT.

4.You can find more information from the imx50's bsp.

Thanks.

igorpadykov · ‎12-06-2015

Hi leo

for analyzing fcb one can write eboot to nand using kobs-ng tool, it automatically write

fcb to necessary place to nand. Use mfg tools from one of i.MX6 product

pages (replace uboot with eboot) and use profiles for Sabre-AI board

http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=RDIMX6SABREBRD&fpsp=1&tab=Design_Tool...

1. regarding ecc, according to sect.8.5.2.2 NAND Flash Boot Flow and

Boot Control Blocks (BCB) i.MX6DQ Reference Manual (rev.3 7/2015)

http://cache.freescale.com/files/32bit/doc/ref_manual/IMX6DQRM.pdf

The hardware ECC level to use is embedded inside FCB block. The FCB data structure is

also protected using ECC. Driver reads raw 2112 bytes of first sector and runs through

software ECC engine that determines whether FCB data is valid or not.

2. FCB is the first sector in the first good block. (sect.8.5.2.3 RM)

Best regards

igor

-----------------------------------------------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer button. Thank you!

-----------------------------------------------------------------------------------------------------------------------

leoyanfeng · ‎12-07-2015

Hi igor:

Thanks for you reply.

I can write uboot to nand with mfgtool.And My board can boot from nand now.

But when replacing uboot with eboot,the board can not boot.

I dump the data in nandflash and have some questions.

1.The layout of nand dump data is real layout in nandflash.Is it right?

2.When ecc is disable,there is no metadata.The driver write 2048 bytes to nandflash.

3.Is the oob area last 64 bytes in nandflash?

4.where are the logic address data used by filesystem written to?

=> nand info

Device 0: nand0, sector size 128 KiB

Page size 2048 b

OOB size 64 b

Erase size 131072 b

=> nand device

Device 0: nand0, sector size 128 KiB

Page size 2048 b

OOB size 64 b

Erase size 131072 b

=> nand dump 0

Page 00000000 dump:

00 00 00 00 00 00 00 00 00 00 00 00 05 fb ff ff

46 43 42 20 00 00 00 01 50 3c 19 06 00 00 00 00

00 08 00 00 40 08 00 00 40 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 04 00 00 00 00 02 00 00

00 02 00 00 04 00 00 00 0a 00 00 00 03 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 02 00 00 00 41 00 00 cc 00 00 00

cc 00 00 00 00 01 00 00 cf 07 00 00 00 00 00 00

00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 0f 15 06 06

10 1f 03 07 00 00 00 1c 0f 17 1f 05 00 00 00 00

00 19 00 00 15 19 00 00 15 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 13 00 00 00 00 16 00 00

00 16 00 00 13 00 00 00 0f 00 00 00 0a 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 16 00 00 00 09 00 00 11 00 00 00

11 00 00 00 00 1c 00 00 1b 19 00 00 00 00 00 00

00 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

OOB:

ff ff ff ff ff ff ff ff

=>

nand: device found, Manufacturer ID: 0xec, Chip ID: 0xda

nand: Samsung NAND 256MiB 3,3V 8-bit

nand: 256MiB, SLC, page size: 2048, OOB size: 64

Bad block table not found for chip 0

Scanning device for bad blocks

Bad eraseblock 394 at 0x000003140000

Bad eraseblock 562 at 0x000004640000

Bad eraseblock 954 at 0x000007740000

Bad eraseblock 1380 at 0x00000ac80000

Bad eraseblock 1663 at 0x00000cfe0000

Bad eraseblock 1682 at 0x00000d240000

Bad block table written to 0x00000ffe0000, version 0x01

Bad block table written to 0x00000ffc0000, version 0x01

4 cmdlinepart partitions found on MTD device gpmi-nand

Creating 4 MTD partitions on "gpmi-nand":

0x000000000000-0x000004000000 : "boot"

0x000004000000-0x000005000000 : "kernel"

0x000005000000-0x000006000000 : "dtb"

0x000006000000-0x000010000000 : "rootfs"

gpmi-nand 112000.gpmi-nand: driver registered.

fec 2188000.ethernet (unregistered net_device): Invalid MAC address: 00:00:00:00:00:00

fec 2188000.ethernet (unregistered net_device): Using random MAC address: ae:27:a1:6e:83:d2

libphy: fec_enet_mii_bus: probed

fec 2188000.ethernet eth0: registered PHC device 0

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver

usbcore: registered new interface driver usb-storage

mousedev: PS/2 mouse device common for all mice

egalax_ts 0-0004: Failed to read firmware version

egalax_ts: probe of 0-0004 failed with error -110

i2c-core: driver [isl29023] using legacy suspend method

i2c-core: driver [isl29023] using legacy resume method

snvs_rtc 20cc034.snvs-rtc-lp: rtc core: registered 20cc034.snvs-rtc-lp as rtc0

i2c /dev entries driver

mxc_v4l2_output v4l2_out.41: V4L2 device registered as video16

mxc_v4l2_output v4l2_out.41: V4L2 device registered as video17

mxc_v4l2_output v4l2_out.41: V4L2 device registered as video18

mxc_v4l2_output v4l2_out.41: V4L2 device registered as video19

mxc_v4l2_output v4l2_out.41: V4L2 device registered as video20

i2c-core: driver [mag3110] using legacy suspend method

i2c-core: driver [mag3110] using legacy resume method

imx2-wdt 20bc000.wdog: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)

cpuidle: using governor ladder

cpuidle: using governor menu

sdhci: Secure Digital Host Controller Interface driver

sdhci: Copyright(c) Pierre Ossman

sdhci-pltfm: SDHCI platform and OF driver helper

mmc0: no vqmmc regulator found

mmc0: no vmmc regulator found

mmc0: SDHCI controller on 2190000.usdhc [2190000.usdhc] using ADMA

mmc2: no vqmmc regulator found

mmc2: no vmmc regulator found

mmc2: SDHCI controller on 2198000.usdhc [2198000.usdhc] using ADMA

Galcore version 5.0.11.25762

th=/dev/mtd0 $FILE"

MTD CONFIG:

chip_0_device_path = "/dev/mtd0"

chip_1_device_path = "(null)"

search_exponent = 2

data_setup_time = 80

data_hold_time = 60

address_setup_time = 25

data_sample_time = 6

row_address_size = 3

column_address_size = 2

read_command_code1 = 0

read_command_code2 = 48

boot_stream_major_version = 1

boot_stream_minor_version = 0

boot_stream_sub_version = 0

ncb_version = 3

boot_stream_1_address = 0

boot_stream_2_address = 0

-- We add the 1k-padding to the uboot.

.tmp_kobs_ng: verifying using key '00000000000000000000000000000000'

.tmp_kobs_ng: is a valid bootstream for key '00000000000000000000000000000000'

mtd: opening: "/dev/mtd0"

mtd: '/dev/mtd0' bad block @ 0x3140000 (MTD)

NFC geometry :

ECC Strength : 8

Page Size in Bytes : 2112

Metadata size : 10

ECC Chunk Size in byte : 512

ECC Chunk count : 4

Block Mark Byte Offset : 1999

Block Mark Bit Offset : 0

====================================================

mtd: opened '/dev/mtd0' - '(null)'

mtd: max_boot_stream_size_in_bytes = 33030144

mtd: boot_stream_size_in_bytes = 417792

mtd: boot_stream_size_in_pages = 204

mtd: #1 0x00100000 - 0x02080000 (0x00166000)

mtd: #2 0x02080000 - 0x04000000 (0x020e6000)

FCB

m_u32Checksum = 0x00000000

m_u32FingerPrint = 0x20424346

m_u32Version = 0x01000000

m_NANDTiming.m_u8DataSetup = 80

m_NANDTiming.m_u8DataHold = 60

m_NANDTiming.m_u8AddressSetup = 25

m_NANDTiming.m_u8DSAMPLE_TIME = 6

m_u32PageDataSize = 2048

m_u32TotalPageSize = 2112

m_u32SectorsPerBlock = 64

m_u32NumberOfNANDs = 0

m_u32TotalInternalDie = 0

m_u32CellType = 0

m_u32EccBlockNEccType = 4

m_u32EccBlock0Size = 512

m_u32EccBlockNSize = 512

m_u32EccBlock0EccType = 4

m_u32MetadataBytes = 10

m_u32NumEccBlocksPerPage = 3

m_u32EccBlockNEccLevelSDK = 0

m_u32EccBlock0SizeSDK = 0

m_u32EccBlockNSizeSDK = 0

m_u32EccBlock0EccLevelSDK = 0

m_u32NumEccBlocksPerPageSDK = 0

m_u32MetadataBytesSDK = 0

m_u32EraseThreshold = 0

m_u32Firmware1_startingPage = 512

m_u32Firmware2_startingPage = 16640

m_u32PagesInFirmware1 = 204

m_u32PagesInFirmware2 = 204

m_u32DBBTSearchAreaStartAddress = 256

m_u32BadBlockMarkerByte = 1999

m_u32BadBlockMarkerStartBit = 0

m_u32BBMarkerPhysicalOffset = 2048

m_u32BCHType = 0

m_NANDTMTiming.m_u32TMTiming2_ReadLatency = 0

m_NANDTMTiming.m_u32TMTiming2_PreambleDelay = 0

m_NANDTMTiming.m_u32TMTiming2_CEDelay = 0

m_NANDTMTiming.m_u32TMTiming2_PostambleDelay = 0

m_NANDTMTiming.m_u32TMTiming2_CmdAddPause = 0

m_NANDTMTiming.m_u32TMTiming2_DataPause = 0

m_NANDTMTiming.m_u32TMSpeed = 0

m_NANDTMTiming.m_u32TMTiming1_BusyTimeout = 0

m_u32DISBBM = 0

m_u32BBMarkerPhysicalOffsetInSpareData = 0

DBBT

m_u32Checksum = 0x00000000

m_u32FingerPrint = 0x54424244

m_u32Version = 0x01000000

m_u32DBBTNumOfPages = 1

BBTN#0

uNAND = 0

uNumberBB = 1

BADBLOCKS:

0x18a

Firmware: image #0 @ 0x100000 size 0x66000 - available 0x1f80000

Firmware: image #1 @ 0x2080000 size 0x66000 - available 0x1f80000

-------------- Start to write the [ FCB ] -----

mtd: erasing @0:0x0-0x20000

mtd: Writing FCB0 [ @0:0x0 ] (840) *

mtd: erasing @0:0x20000-0x40000

mtd: Writing FCB1 [ @0:0x20000 ] (840) *

mtd: erasing @0:0x40000-0x60000

mtd: Writing FCB2 [ @0:0x40000 ] (840) *

mtd: erasing @0:0x60000-0x80000

mtd: Writing FCB3 [ @0:0x60000 ] (840) *

mtd_commit_bcb(FCB): status 0

-------------- Start to write the [ DBBT ] -----

mtd: erasing @0:0x80000-0xa0000

mtd: Writing DBBT0 [ @0:0x80000 ] (800) *

mtd: erasing @0:0xa0000-0xc0000

mtd: Writing DBBT1 [ @0:0xa0000 ] (800) *

mtd: erasing @0:0xc0000-0xe0000

mtd: Writing DBBT2 [ @0:0xc0000 ] (800) *

mtd: erasing @0:0xe0000-0x100000

mtd: Writing DBBT3 [ @0:0xe0000 ] (800) *

mtd_commit_bcb(DBBT): status 0

mtd: PUTTING down DBBT0 BBTN0 @0x82000 (0x800)

mtd: PUTTING down DBBT1 BBTN0 @0xa2000 (0x800)

mtd: PUTTING down DBBT2 BBTN0 @0xc2000 (0x800)

mtd: PUTTING down DBBT3 BBTN0 @0xe2000 (0x800)

---------- Start to write the [ .tmp_kobs_ng ]----

mtd: Writting .tmp_kobs_ng: #0 @0: 0x00100000 - 0x00166000

mtd: erasing @0:0x100000-0x120000

mtd: erasing @0:0x120000-0x140000

mtd: erasing @0:0x140000-0x160000

mtd: erasing @0:0x160000-0x180000

mtd: We write one page for save guard. *

mtd: Writting .tmp_kobs_ng: #1 @0: 0x02080000 - 0x020e6000

mtd: erasing @0:0x2080000-0x20a0000

mtd: erasing @0:0x20a0000-0x20c0000

mtd: erasing @0:0x20c0000-0x20e0000

mtd: erasing @0:0x20e0000-0x2100000

mtd: We write one page for save guard. *

UTP: sending Success to kernel for command $ kobs-ng init -x -v --chip_0_device_path=/dev/mtd0 $FILE.

utp_poll: pass returned.

UTP: received command '$ echo Update Complete!'

UTP: executing "echo Update Complete!"

Update Complete!

UTP: sending Success to kernel for command $ echo Update Complete!.

utp_poll: pass returned.

igorpadykov · ‎12-07-2015

Hi leo

FSL does not support wince7.0 on i.MX6 platform,

suggest to apply for additional help to third parties, who support it:

like adeneo or iwavesystems.

Best regards

igor

How to boot wince7.0 from nandflash on imx6q

How to boot wince7.0 from nandflash on imx6q

i.MX2x

i.MX50

i.MX6_All

i.MX6DL

i.MX6Dual

i.MX6DualPlus6QuadPlus

i.MX6Quad

i.MX6S

i.MX6SL

i.MX6SoloX

i.MX6UL

Windows