Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 1 | /* |
| 2 | * BCM47XX MTD partitioning |
| 3 | * |
| 4 | * Copyright © 2012 Rafał Miłecki <zajec5@gmail.com> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or modify |
| 7 | * it under the terms of the GNU General Public License version 2 as |
| 8 | * published by the Free Software Foundation. |
| 9 | * |
| 10 | */ |
| 11 | |
| 12 | #include <linux/module.h> |
| 13 | #include <linux/kernel.h> |
| 14 | #include <linux/slab.h> |
| 15 | #include <linux/mtd/mtd.h> |
| 16 | #include <linux/mtd/partitions.h> |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 17 | |
| 18 | /* 10 parts were found on sflash on Netgear WNDR4500 */ |
| 19 | #define BCM47XXPART_MAX_PARTS 12 |
| 20 | |
Rafał Miłecki | 5ca1088 | 2013-03-07 09:02:38 +0100 | [diff] [blame] | 21 | /* |
| 22 | * Amount of bytes we read when analyzing each block of flash memory. |
| 23 | * Set it big enough to allow detecting partition and reading important data. |
| 24 | */ |
Rafał Miłecki | 4f8aaf7 | 2013-12-21 19:39:11 +0100 | [diff] [blame] | 25 | #define BCM47XXPART_BYTES_TO_READ 0x4e8 |
Rafał Miłecki | 5ca1088 | 2013-03-07 09:02:38 +0100 | [diff] [blame] | 26 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 27 | /* Magics */ |
| 28 | #define BOARD_DATA_MAGIC 0x5246504D /* MPFR */ |
Rafał Miłecki | f0501e8 | 2013-12-21 19:39:12 +0100 | [diff] [blame] | 29 | #define BOARD_DATA_MAGIC2 0xBD0D0BBD |
Rafał Miłecki | 4f8aaf7 | 2013-12-21 19:39:11 +0100 | [diff] [blame] | 30 | #define CFE_MAGIC 0x43464531 /* 1EFC */ |
Rafał Miłecki | 33094c7 | 2013-10-21 22:35:34 +0200 | [diff] [blame] | 31 | #define FACTORY_MAGIC 0x59544346 /* FCTY */ |
Rafał Miłecki | 9e3afa5 | 2014-02-28 18:02:01 +0100 | [diff] [blame] | 32 | #define NVRAM_HEADER 0x48534C46 /* FLSH */ |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 33 | #define POT_MAGIC1 0x54544f50 /* POTT */ |
| 34 | #define POT_MAGIC2 0x504f /* OP */ |
| 35 | #define ML_MAGIC1 0x39685a42 |
| 36 | #define ML_MAGIC2 0x26594131 |
| 37 | #define TRX_MAGIC 0x30524448 |
Rafał Miłecki | 020c6bc | 2013-10-21 22:34:37 +0200 | [diff] [blame] | 38 | #define SQSH_MAGIC 0x71736873 /* shsq */ |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 39 | |
| 40 | struct trx_header { |
| 41 | uint32_t magic; |
| 42 | uint32_t length; |
| 43 | uint32_t crc32; |
| 44 | uint16_t flags; |
| 45 | uint16_t version; |
| 46 | uint32_t offset[3]; |
| 47 | } __packed; |
| 48 | |
| 49 | static void bcm47xxpart_add_part(struct mtd_partition *part, char *name, |
| 50 | u64 offset, uint32_t mask_flags) |
| 51 | { |
| 52 | part->name = name; |
| 53 | part->offset = offset; |
| 54 | part->mask_flags = mask_flags; |
| 55 | } |
| 56 | |
| 57 | static int bcm47xxpart_parse(struct mtd_info *master, |
| 58 | struct mtd_partition **pparts, |
| 59 | struct mtd_part_parser_data *data) |
| 60 | { |
| 61 | struct mtd_partition *parts; |
| 62 | uint8_t i, curr_part = 0; |
| 63 | uint32_t *buf; |
| 64 | size_t bytes_read; |
| 65 | uint32_t offset; |
Hauke Mehrtens | 25bad1d | 2013-01-24 17:39:58 +0100 | [diff] [blame] | 66 | uint32_t blocksize = master->erasesize; |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 67 | struct trx_header *trx; |
Rafał Miłecki | 396afe5 | 2013-01-06 16:08:36 +0100 | [diff] [blame] | 68 | int trx_part = -1; |
| 69 | int last_trx_part = -1; |
Rafał Miłecki | 91d542f | 2013-03-07 09:02:39 +0100 | [diff] [blame] | 70 | int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, }; |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 71 | |
Hauke Mehrtens | 25bad1d | 2013-01-24 17:39:58 +0100 | [diff] [blame] | 72 | if (blocksize <= 0x10000) |
| 73 | blocksize = 0x10000; |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 74 | |
| 75 | /* Alloc */ |
| 76 | parts = kzalloc(sizeof(struct mtd_partition) * BCM47XXPART_MAX_PARTS, |
| 77 | GFP_KERNEL); |
Hauke Mehrtens | 99b1d18 | 2013-10-13 22:53:49 +0200 | [diff] [blame] | 78 | if (!parts) |
| 79 | return -ENOMEM; |
| 80 | |
Rafał Miłecki | 5ca1088 | 2013-03-07 09:02:38 +0100 | [diff] [blame] | 81 | buf = kzalloc(BCM47XXPART_BYTES_TO_READ, GFP_KERNEL); |
Hauke Mehrtens | 99b1d18 | 2013-10-13 22:53:49 +0200 | [diff] [blame] | 82 | if (!buf) { |
| 83 | kfree(parts); |
| 84 | return -ENOMEM; |
| 85 | } |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 86 | |
| 87 | /* Parse block by block looking for magics */ |
| 88 | for (offset = 0; offset <= master->size - blocksize; |
| 89 | offset += blocksize) { |
| 90 | /* Nothing more in higher memory */ |
| 91 | if (offset >= 0x2000000) |
| 92 | break; |
| 93 | |
Rafał Miłecki | 00b7986 | 2014-02-26 14:02:06 +0100 | [diff] [blame] | 94 | if (curr_part >= BCM47XXPART_MAX_PARTS) { |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 95 | pr_warn("Reached maximum number of partitions, scanning stopped!\n"); |
| 96 | break; |
| 97 | } |
| 98 | |
| 99 | /* Read beginning of the block */ |
Rafał Miłecki | 5ca1088 | 2013-03-07 09:02:38 +0100 | [diff] [blame] | 100 | if (mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ, |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 101 | &bytes_read, (uint8_t *)buf) < 0) { |
| 102 | pr_err("mtd_read error while parsing (offset: 0x%X)!\n", |
| 103 | offset); |
| 104 | continue; |
| 105 | } |
| 106 | |
Rafał Miłecki | 4f8aaf7 | 2013-12-21 19:39:11 +0100 | [diff] [blame] | 107 | /* Magic or small NVRAM at 0x400 */ |
| 108 | if ((buf[0x4e0 / 4] == CFE_MAGIC && buf[0x4e4 / 4] == CFE_MAGIC) || |
| 109 | (buf[0x400 / 4] == NVRAM_HEADER)) { |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 110 | bcm47xxpart_add_part(&parts[curr_part++], "boot", |
| 111 | offset, MTD_WRITEABLE); |
| 112 | continue; |
| 113 | } |
| 114 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 115 | /* |
| 116 | * board_data starts with board_id which differs across boards, |
| 117 | * but we can use 'MPFR' (hopefully) magic at 0x100 |
| 118 | */ |
| 119 | if (buf[0x100 / 4] == BOARD_DATA_MAGIC) { |
| 120 | bcm47xxpart_add_part(&parts[curr_part++], "board_data", |
| 121 | offset, MTD_WRITEABLE); |
| 122 | continue; |
| 123 | } |
| 124 | |
Rafał Miłecki | 33094c7 | 2013-10-21 22:35:34 +0200 | [diff] [blame] | 125 | /* Found on Huawei E970 */ |
| 126 | if (buf[0x000 / 4] == FACTORY_MAGIC) { |
| 127 | bcm47xxpart_add_part(&parts[curr_part++], "factory", |
| 128 | offset, MTD_WRITEABLE); |
| 129 | continue; |
| 130 | } |
| 131 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 132 | /* POT(TOP) */ |
| 133 | if (buf[0x000 / 4] == POT_MAGIC1 && |
| 134 | (buf[0x004 / 4] & 0xFFFF) == POT_MAGIC2) { |
| 135 | bcm47xxpart_add_part(&parts[curr_part++], "POT", offset, |
| 136 | MTD_WRITEABLE); |
| 137 | continue; |
| 138 | } |
| 139 | |
| 140 | /* ML */ |
| 141 | if (buf[0x010 / 4] == ML_MAGIC1 && |
| 142 | buf[0x014 / 4] == ML_MAGIC2) { |
| 143 | bcm47xxpart_add_part(&parts[curr_part++], "ML", offset, |
| 144 | MTD_WRITEABLE); |
| 145 | continue; |
| 146 | } |
| 147 | |
| 148 | /* TRX */ |
| 149 | if (buf[0x000 / 4] == TRX_MAGIC) { |
Rafał Miłecki | 108ebcd | 2014-02-26 14:30:34 +0100 | [diff] [blame] | 150 | if (BCM47XXPART_MAX_PARTS - curr_part < 4) { |
| 151 | pr_warn("Not enough partitions left to register trx, scanning stopped!\n"); |
| 152 | break; |
| 153 | } |
| 154 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 155 | trx = (struct trx_header *)buf; |
| 156 | |
Rafał Miłecki | 396afe5 | 2013-01-06 16:08:36 +0100 | [diff] [blame] | 157 | trx_part = curr_part; |
| 158 | bcm47xxpart_add_part(&parts[curr_part++], "firmware", |
| 159 | offset, 0); |
| 160 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 161 | i = 0; |
| 162 | /* We have LZMA loader if offset[2] points to sth */ |
| 163 | if (trx->offset[2]) { |
| 164 | bcm47xxpart_add_part(&parts[curr_part++], |
| 165 | "loader", |
| 166 | offset + trx->offset[i], |
| 167 | 0); |
| 168 | i++; |
| 169 | } |
| 170 | |
| 171 | bcm47xxpart_add_part(&parts[curr_part++], "linux", |
| 172 | offset + trx->offset[i], 0); |
| 173 | i++; |
| 174 | |
| 175 | /* |
| 176 | * Pure rootfs size is known and can be calculated as: |
| 177 | * trx->length - trx->offset[i]. We don't fill it as |
| 178 | * we want to have jffs2 (overlay) in the same mtd. |
| 179 | */ |
| 180 | bcm47xxpart_add_part(&parts[curr_part++], "rootfs", |
| 181 | offset + trx->offset[i], 0); |
| 182 | i++; |
| 183 | |
Rafał Miłecki | 396afe5 | 2013-01-06 16:08:36 +0100 | [diff] [blame] | 184 | last_trx_part = curr_part - 1; |
| 185 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 186 | /* |
| 187 | * We have whole TRX scanned, skip to the next part. Use |
| 188 | * roundown (not roundup), as the loop will increase |
| 189 | * offset in next step. |
| 190 | */ |
| 191 | offset = rounddown(offset + trx->length, blocksize); |
| 192 | continue; |
| 193 | } |
Rafał Miłecki | 020c6bc | 2013-10-21 22:34:37 +0200 | [diff] [blame] | 194 | |
| 195 | /* Squashfs on devices not using TRX */ |
| 196 | if (buf[0x000 / 4] == SQSH_MAGIC) { |
| 197 | bcm47xxpart_add_part(&parts[curr_part++], "rootfs", |
| 198 | offset, 0); |
| 199 | continue; |
| 200 | } |
Rafał Miłecki | f0501e8 | 2013-12-21 19:39:12 +0100 | [diff] [blame] | 201 | |
| 202 | /* Read middle of the block */ |
| 203 | if (mtd_read(master, offset + 0x8000, 0x4, |
| 204 | &bytes_read, (uint8_t *)buf) < 0) { |
| 205 | pr_err("mtd_read error while parsing (offset: 0x%X)!\n", |
| 206 | offset); |
| 207 | continue; |
| 208 | } |
| 209 | |
| 210 | /* Some devices (ex. WNDR3700v3) don't have a standard 'MPFR' */ |
| 211 | if (buf[0x000 / 4] == BOARD_DATA_MAGIC2) { |
| 212 | bcm47xxpart_add_part(&parts[curr_part++], "board_data", |
| 213 | offset, MTD_WRITEABLE); |
| 214 | continue; |
| 215 | } |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 216 | } |
Rafał Miłecki | 91d542f | 2013-03-07 09:02:39 +0100 | [diff] [blame] | 217 | |
| 218 | /* Look for NVRAM at the end of the last block. */ |
| 219 | for (i = 0; i < ARRAY_SIZE(possible_nvram_sizes); i++) { |
Rafał Miłecki | 00b7986 | 2014-02-26 14:02:06 +0100 | [diff] [blame] | 220 | if (curr_part >= BCM47XXPART_MAX_PARTS) { |
Rafał Miłecki | 91d542f | 2013-03-07 09:02:39 +0100 | [diff] [blame] | 221 | pr_warn("Reached maximum number of partitions, scanning stopped!\n"); |
| 222 | break; |
| 223 | } |
| 224 | |
| 225 | offset = master->size - possible_nvram_sizes[i]; |
| 226 | if (mtd_read(master, offset, 0x4, &bytes_read, |
| 227 | (uint8_t *)buf) < 0) { |
| 228 | pr_err("mtd_read error while reading at offset 0x%X!\n", |
| 229 | offset); |
| 230 | continue; |
| 231 | } |
| 232 | |
| 233 | /* Standard NVRAM */ |
| 234 | if (buf[0] == NVRAM_HEADER) { |
| 235 | bcm47xxpart_add_part(&parts[curr_part++], "nvram", |
| 236 | master->size - blocksize, 0); |
| 237 | break; |
| 238 | } |
| 239 | } |
| 240 | |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 241 | kfree(buf); |
| 242 | |
| 243 | /* |
| 244 | * Assume that partitions end at the beginning of the one they are |
| 245 | * followed by. |
| 246 | */ |
Rafał Miłecki | 648bdbe | 2013-01-06 16:08:35 +0100 | [diff] [blame] | 247 | for (i = 0; i < curr_part; i++) { |
| 248 | u64 next_part_offset = (i < curr_part - 1) ? |
| 249 | parts[i + 1].offset : master->size; |
| 250 | |
| 251 | parts[i].size = next_part_offset - parts[i].offset; |
Rafał Miłecki | 396afe5 | 2013-01-06 16:08:36 +0100 | [diff] [blame] | 252 | if (i == last_trx_part && trx_part >= 0) |
| 253 | parts[trx_part].size = next_part_offset - |
| 254 | parts[trx_part].offset; |
Rafał Miłecki | 648bdbe | 2013-01-06 16:08:35 +0100 | [diff] [blame] | 255 | } |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 256 | |
| 257 | *pparts = parts; |
| 258 | return curr_part; |
| 259 | }; |
| 260 | |
| 261 | static struct mtd_part_parser bcm47xxpart_mtd_parser = { |
| 262 | .owner = THIS_MODULE, |
| 263 | .parse_fn = bcm47xxpart_parse, |
| 264 | .name = "bcm47xxpart", |
| 265 | }; |
| 266 | |
| 267 | static int __init bcm47xxpart_init(void) |
| 268 | { |
Axel Lin | 6e14a61 | 2013-12-01 19:01:06 +0800 | [diff] [blame] | 269 | register_mtd_parser(&bcm47xxpart_mtd_parser); |
| 270 | return 0; |
Rafał Miłecki | 3cf7f13 | 2012-08-30 07:41:16 +0200 | [diff] [blame] | 271 | } |
| 272 | |
| 273 | static void __exit bcm47xxpart_exit(void) |
| 274 | { |
| 275 | deregister_mtd_parser(&bcm47xxpart_mtd_parser); |
| 276 | } |
| 277 | |
| 278 | module_init(bcm47xxpart_init); |
| 279 | module_exit(bcm47xxpart_exit); |
| 280 | |
| 281 | MODULE_LICENSE("GPL"); |
| 282 | MODULE_DESCRIPTION("MTD partitioning for BCM47XX flash memories"); |