Skip to contentSkip to conversation

mtd: add Broadcom BCM63xx image tag partition parser

PATCH Applied Florian Fainelli 3 participants 3 messages Sep 12, 2010 – Oct 24, 2010

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 mtd: add Broadcom BCM63xx image tag partition parser

This patch adds support for parsing Broadcom BCM63xx image tag format and creating MTD partitions accordingly. This driver is a platform_device which can be instantiated accordingly by bcm63xx board support code.

---

arch/mips/include/asm/mach-bcm63xx/bcm963xx_tag.h new file +97 -0
new file mode 100644
index 0000000..5325084
@@ -0,0 +1,97 @@
+#ifndef __BCM963XX_TAG_H
+#define __BCM963XX_TAG_H
+
+#define TAGVER_LEN		4	/* Length of Tag Version */
+#define TAGLAYOUT_LEN		4	/* Length of FlashLayoutVer */
+#define SIG1_LEN		20	/* Company Signature 1 Length */
+#define SIG2_LEN		14	/* Company Signature 2 Lenght */
+#define BOARDID_LEN		16	/* Length of BoardId */
+#define ENDIANFLAG_LEN		2	/* Endian Flag Length */
+#define CHIPID_LEN		6	/* Chip Id Length */
+#define IMAGE_LEN		10	/* Length of Length Field */
+#define ADDRESS_LEN		12	/* Length of Address field */
+#define DUALFLAG_LEN		2	/* Dual Image flag Length */
+#define INACTIVEFLAG_LEN	2	/* Inactie Flag Length */
+#define RSASIG_LEN		20	/* Length of RSA Signature in tag */
+#define TAGINFO1_LEN		30	/* Length of vendor information field1 in tag */
+#define FLASHLAYOUTVER_LEN	4	/* Length of Flash Layout Version String tag */
+#define TAGINFO2_LEN		16	/* Length of vendor information field2 in tag */
+#define CRC_LEN			4	/* Length of CRC in bytes */
+#define ALTTAGINFO_LEN		54	/* Alternate length for vendor information; Pirelli */
+
+#define NUM_PIRELLI		2
+#define IMAGETAG_CRC_START	0xFFFFFFFF
+
+#define PIRELLI_BOARDS { \
+	"AGPF-S0", \
+	"DWV-S0", \
+}
+
+/*
+ * The broadcom firmware assumes the rootfs starts the image,
+ * therefore uses the rootfs start (flash_image_address)
+ * to determine where to flash the image.  Since we have the kernel first
+ * we have to give it the kernel address, but the crc uses the length
+ * associated with this address (root_length), which is added to the kernel
+ * length (kernel_length) to determine the length of image to flash and thus
+ * needs to be rootfs + deadcode (jffs2 EOF marker)
+*/
+
+struct bcm_tag {
+	/* 0-3: Version of the image tag */
+	char tag_version[TAGVER_LEN];
+	/* 4-23: Company Line 1 */
+	char sig_1[SIG1_LEN];
+	/*  24-37: Company Line 2 */
+	char sig_2[SIG2_LEN];
+	/* 38-43: Chip this image is for */
+	char chip_id[CHIPID_LEN];
+	/* 44-59: Board name */
+	char board_id[BOARDID_LEN];
+	/* 60-61: Map endianness -- 1 BE 0 LE */
+	char big_endian[ENDIANFLAG_LEN];
+	/* 62-71: Total length of image */
+	char total_length[IMAGE_LEN];
+	/* 72-83: Address in memory of CFE */
+	char cfe__address[ADDRESS_LEN];
+	/* 84-93: Size of CFE */
+	char cfe_length[IMAGE_LEN];
+	/* 94-105: Address in memory of image start
+	 * (kernel for OpenWRT, rootfs for stock firmware)
+	 */
+	char flash_image_start[ADDRESS_LEN];
+	/* 106-115: Size of rootfs */
+	char root_length[IMAGE_LEN];
+	/* 116-127: Address in memory of kernel */
+	char kernel_address[ADDRESS_LEN];
+	/* 128-137: Size of kernel */
+	char kernel_length[IMAGE_LEN];
+	/* 138-139: Unused at the moment */
+	char dual_image[DUALFLAG_LEN];
+	/* 140-141: Unused at the moment */
+	char inactive_flag[INACTIVEFLAG_LEN];
+	/* 142-161: RSA Signature (not used; some vendors may use this) */
+	char rsa_signature[RSASIG_LEN];
+	/* 162-191: Compilation and related information (not used in OpenWrt) */
+	char information1[TAGINFO1_LEN];
+	/* 192-195: Version flash layout */
+	char flash_layout_ver[FLASHLAYOUTVER_LEN];
+	/* 196-199: kernel+rootfs CRC32 */
+	char fskernel_crc[CRC_LEN];
+	/* 200-215: Unused except on Alice Gate where is is information */
+	char information2[TAGINFO2_LEN];
+	/* 216-219: CRC32 of image less imagetag (kernel for Alice Gate) */
+	char image_crc[CRC_LEN];
+	/* 220-223: CRC32 of rootfs partition */
+	char rootfs_crc[CRC_LEN];
+	/* 224-227: CRC32 of kernel partition */
+	char kernel_crc[CRC_LEN];
+	/* 228-235: Unused at present */
+	char reserved1[8];
+	/* 236-239: CRC32 of header excluding tagVersion */
+	char header_crc[CRC_LEN];
+	/* 240-255: Unused at present */
+	char reserved2[16];
+};
+
+#endif /* __BCM63XX_TAG_H */
drivers/mtd/maps/Kconfig +9 -0
index 701d942..e5eb65c 100644
@@ -251,6 +251,15 @@ config MTD_NETtel
 	help
 	  Support for flash chips on NETtel/SecureEdge/SnapGear boards.
 
+config MTD_BCM963XX
+        tristate "Map driver for Broadcom BCM963xx boards"
+        depends on BCM63XX
+	select MTD_MAP_BANK_WIDTH_2
+	select MTD_CFI_I1
+        help
+	  Support for parsing CFE image tag and creating MTD partitions on
+	  Broadcom BCM63xx boards.
+
 config MTD_DILNETPC
 	tristate "CFI Flash device mapped on DIL/Net PC"
 	depends on X86 && MTD_CONCAT && MTD_PARTITIONS && MTD_CFI_INTELEXT && BROKEN
drivers/mtd/maps/Makefile +1 -0
index f216bb5..c7869c7 100644
@@ -58,3 +58,4 @@ obj-$(CONFIG_MTD_BFIN_ASYNC)	+= bfin-async-flash.o
 obj-$(CONFIG_MTD_RBTX4939)	+= rbtx4939-flash.o
 obj-$(CONFIG_MTD_VMU)		+= vmu-flash.o
 obj-$(CONFIG_MTD_GPIO_ADDR)	+= gpio-addr-flash.o
+obj-$(CONFIG_MTD_BCM963XX)	+= bcm963xx-flash.o
drivers/mtd/maps/bcm963xx-flash.c new file +271 -0

271 lines not on this page · raw message

#1 lore raw
Quoted 7 lines · Florian Fainelli

This patch adds support for parsing Broadcom BCM63xx image tag format and creating MTD partitions accordingly. This driver is a platform_device which can be instantiated accordingly by bcm63xx board support code.

Pushed to l2-mtd-2.6.git without my "Signed-off-by", thanks.

Signature · 2 lines
Best Regards,
Artem Bityutskiy (Артём Битюцкий)
#2 lore raw
In reply to Florian Fainelli
Quoted 6 lines · Florian Fainelli
drivers/mtd/maps/bcm963xx-flash.c new file +5 -0
+       ret = master->read(master, master->erasesize, sizeof(struct bcm_tag),
+                                                       &retlen, (void *)buf);
+       if (retlen != sizeof(struct bcm_tag)) {
+               vfree(buf);
+               return -EIO;

drivers/mtd/maps/bcm963xx-flash.c line 83

Quoted 10 lines
drivers/mtd/maps/bcm963xx-flash.c new file +10 -0
+       }
+
+       sscanf(buf->kernel_address, "%u", &kerneladdr);
+       sscanf(buf->kernel_length, "%u", &kernellen);
+       sscanf(buf->total_length, "%u", &totallen);
+       tagversion = &(buf->tag_version[0]);
+       boardid = &(buf->board_id[0]);
+
+       printk(KERN_INFO PFX "CFE boot tag found with version %s "
+                               "and board type %s\n", tagversion, boardid); 

Um, that looks easy to crash, given that you aren't even checking the CRC before you do this, and you aren't checking that any of these strings are actually NUL-terminated.

I'm applying it as-is, since I'm extremely late -- I've been slacking. But please could I have a fix?

Signature · 2 lines
David Woodhouse                            Open Source Technology Centre
[email protected]                              Intel Corporation