target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c

   1 /*
   2  *  Copyright (C) 2013 Gabor Juhos <juhosg@openwrt.org>
   3  *
   4  *  This program is free software; you can redistribute it and/or modify it
   5  *  under the terms of the GNU General Public License version 2 as published
   6  *  by the Free Software Foundation.
   7  *
   8  */
   9
  10 #define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/kernel.h>
  15 #include <linux/slab.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/mtd/mtd.h>
  18 #include <linux/mtd/partitions.h>
  19 #include <linux/version.h>
  20 #include <linux/byteorder/generic.h>
  21
  22 #include "mtdsplit.h"
  23
  24 /*
  25  * uimage_header itself is only 64B, but it may be prepended with another data.
  26  * Currently the biggest size is for Edimax devices: 20B + 64B
  27  */
  28 #define MAX_HEADER_LEN          84
  29
  30 #define IH_MAGIC        0x27051956      /* Image Magic Number           */
  31 #define IH_NMLEN                32      /* Image Name Length            */
  32
  33 #define IH_OS_LINUX             5       /* Linux        */
  34
  35 #define IH_TYPE_KERNEL          2       /* OS Kernel Image              */
  36 #define IH_TYPE_FILESYSTEM      7       /* Filesystem Image             */
  37
  38 /*
  39  * Legacy format image header,
  40  * all data in network byte order (aka natural aka bigendian).
  41  */
  42 struct uimage_header {
  43         uint32_t        ih_magic;       /* Image Header Magic Number    */
  44         uint32_t        ih_hcrc;        /* Image Header CRC Checksum    */
  45         uint32_t        ih_time;        /* Image Creation Timestamp     */
  46         uint32_t        ih_size;        /* Image Data Size              */
  47         uint32_t        ih_load;        /* Data  Load  Address          */
  48         uint32_t        ih_ep;          /* Entry Point Address          */
  49         uint32_t        ih_dcrc;        /* Image Data CRC Checksum      */
  50         uint8_t         ih_os;          /* Operating System             */
  51         uint8_t         ih_arch;        /* CPU architecture             */
  52         uint8_t         ih_type;        /* Image Type                   */
  53         uint8_t         ih_comp;        /* Compression Type             */
  54         uint8_t         ih_name[IH_NMLEN];      /* Image Name           */
  55 };
  56
  57 static int
  58 read_uimage_header(struct mtd_info *mtd, size_t offset, u_char *buf,
  59                    size_t header_len)
  60 {
  61         size_t retlen;
  62         int ret;
  63
  64         ret = mtd_read(mtd, offset, header_len, &retlen, buf);
  65         if (ret) {
  66                 pr_debug("read error in \"%s\"\n", mtd->name);
  67                 return ret;
  68         }
  69
  70         if (retlen != header_len) {
  71                 pr_debug("short read in \"%s\"\n", mtd->name);
  72                 return -EIO;
  73         }
  74
  75         return 0;
  76 }
  77
  78 /**
  79  * __mtdsplit_parse_uimage - scan partition and create kernel + rootfs parts
  80  *
  81  * @find_header: function to call for a block of data that will return offset
  82  *      of a valid uImage header if found
  83  */
  84 static int __mtdsplit_parse_uimage(struct mtd_info *master,
  85                                    const struct mtd_partition **pparts,
  86                                    struct mtd_part_parser_data *data,
  87                                    ssize_t (*find_header)(u_char *buf, size_t len))
  88 {
  89         struct mtd_partition *parts;
  90         u_char *buf;
  91         int nr_parts;
  92         size_t offset;
  93         size_t uimage_offset;
  94         size_t uimage_size = 0;
  95         size_t rootfs_offset;
  96         size_t rootfs_size = 0;
  97         int uimage_part, rf_part;
  98         int ret;
  99         enum mtdsplit_part_type type;
 100
 101         nr_parts = 2;
 102         parts = kzalloc(nr_parts * sizeof(*parts), GFP_KERNEL);
 103         if (!parts)
 104                 return -ENOMEM;
 105
 106         buf = vmalloc(MAX_HEADER_LEN);
 107         if (!buf) {
 108                 ret = -ENOMEM;
 109                 goto err_free_parts;
 110         }
 111
 112         /* find uImage on erase block boundaries */
 113         for (offset = 0; offset < master->size; offset += master->erasesize) {
 114                 struct uimage_header *header;
 115
 116                 uimage_size = 0;
 117
 118                 ret = read_uimage_header(master, offset, buf, MAX_HEADER_LEN);
 119                 if (ret)
 120                         continue;
 121
 122                 ret = find_header(buf, MAX_HEADER_LEN);
 123                 if (ret < 0) {
 124                         pr_debug("no valid uImage found in \"%s\" at offset %llx\n",
 125                                  master->name, (unsigned long long) offset);
 126                         continue;
 127                 }
 128                 header = (struct uimage_header *)(buf + ret);
 129
 130                 uimage_size = sizeof(*header) + be32_to_cpu(header->ih_size) + ret;
 131                 if ((offset + uimage_size) > master->size) {
 132                         pr_debug("uImage exceeds MTD device \"%s\"\n",
 133                                  master->name);
 134                         continue;
 135                 }
 136                 break;
 137         }
 138
 139         if (uimage_size == 0) {
 140                 pr_debug("no uImage found in \"%s\"\n", master->name);
 141                 ret = -ENODEV;
 142                 goto err_free_buf;
 143         }
 144
 145         uimage_offset = offset;
 146
 147         if (uimage_offset == 0) {
 148                 uimage_part = 0;
 149                 rf_part = 1;
 150
 151                 /* find the roots after the uImage */
 152                 ret = mtd_find_rootfs_from(master, uimage_offset + uimage_size,
 153                                            master->size, &rootfs_offset, &type);
 154                 if (ret) {
 155                         pr_debug("no rootfs after uImage in \"%s\"\n",
 156                                  master->name);
 157                         goto err_free_buf;
 158                 }
 159
 160                 rootfs_size = master->size - rootfs_offset;
 161                 uimage_size = rootfs_offset - uimage_offset;
 162         } else {
 163                 rf_part = 0;
 164                 uimage_part = 1;
 165
 166                 /* check rootfs presence at offset 0 */
 167                 ret = mtd_check_rootfs_magic(master, 0, &type);
 168                 if (ret) {
 169                         pr_debug("no rootfs before uImage in \"%s\"\n",
 170                                  master->name);
 171                         goto err_free_buf;
 172                 }
 173
 174                 rootfs_offset = 0;
 175                 rootfs_size = uimage_offset;
 176         }
 177
 178         if (rootfs_size == 0) {
 179                 pr_debug("no rootfs found in \"%s\"\n", master->name);
 180                 ret = -ENODEV;
 181                 goto err_free_buf;
 182         }
 183
 184         parts[uimage_part].name = KERNEL_PART_NAME;
 185         parts[uimage_part].offset = uimage_offset;
 186         parts[uimage_part].size = uimage_size;
 187
 188         if (type == MTDSPLIT_PART_TYPE_UBI)
 189                 parts[rf_part].name = UBI_PART_NAME;
 190         else
 191                 parts[rf_part].name = ROOTFS_PART_NAME;
 192         parts[rf_part].offset = rootfs_offset;
 193         parts[rf_part].size = rootfs_size;
 194
 195         vfree(buf);
 196
 197         *pparts = parts;
 198         return nr_parts;
 199
 200 err_free_buf:
 201         vfree(buf);
 202
 203 err_free_parts:
 204         kfree(parts);
 205         return ret;
 206 }
 207
 208 static ssize_t uimage_verify_default(u_char *buf, size_t len)
 209 {
 210         struct uimage_header *header = (struct uimage_header *)buf;
 211
 212         /* default sanity checks */
 213         if (be32_to_cpu(header->ih_magic) != IH_MAGIC) {
 214                 pr_debug("invalid uImage magic: %08x\n",
 215                          be32_to_cpu(header->ih_magic));
 216                 return -EINVAL;
 217         }
 218
 219         if (header->ih_os != IH_OS_LINUX) {
 220                 pr_debug("invalid uImage OS: %08x\n",
 221                          be32_to_cpu(header->ih_os));
 222                 return -EINVAL;
 223         }
 224
 225         if (header->ih_type != IH_TYPE_KERNEL) {
 226                 pr_debug("invalid uImage type: %08x\n",
 227                          be32_to_cpu(header->ih_type));
 228                 return -EINVAL;
 229         }
 230
 231         return 0;
 232 }
 233
 234 static int
 235 mtdsplit_uimage_parse_generic(struct mtd_info *master,
 236                               const struct mtd_partition **pparts,
 237                               struct mtd_part_parser_data *data)
 238 {
 239         return __mtdsplit_parse_uimage(master, pparts, data,
 240                                       uimage_verify_default);
 241 }
 242
 243 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
 244 static const struct of_device_id mtdsplit_uimage_of_match_table[] = {
 245         { .compatible = "denx,uimage" },
 246         {},
 247 };
 248 #endif
 249
 250 static struct mtd_part_parser uimage_generic_parser = {
 251         .owner = THIS_MODULE,
 252         .name = "uimage-fw",
 253 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
 254         .of_match_table = mtdsplit_uimage_of_match_table,
 255 #endif
 256         .parse_fn = mtdsplit_uimage_parse_generic,
 257         .type = MTD_PARSER_TYPE_FIRMWARE,
 258 };
 259
 260 #define FW_MAGIC_WNR2000V1      0x32303031
 261 #define FW_MAGIC_WNR2000V3      0x32303033
 262 #define FW_MAGIC_WNR2000V4      0x32303034
 263 #define FW_MAGIC_WNR2200        0x32323030
 264 #define FW_MAGIC_WNR612V2       0x32303631
 265 #define FW_MAGIC_WNR1000V2      0x31303031
 266 #define FW_MAGIC_WNR1000V2_VC   0x31303030
 267 #define FW_MAGIC_WNDR3700       0x33373030
 268 #define FW_MAGIC_WNDR3700V2     0x33373031
 269 #define FW_MAGIC_WPN824N        0x31313030
 270
 271 static ssize_t uimage_verify_wndr3700(u_char *buf, size_t len)
 272 {
 273         struct uimage_header *header = (struct uimage_header *)buf;
 274         uint8_t expected_type = IH_TYPE_FILESYSTEM;
 275
 276         switch (be32_to_cpu(header->ih_magic)) {
 277         case FW_MAGIC_WNR612V2:
 278         case FW_MAGIC_WNR1000V2:
 279         case FW_MAGIC_WNR1000V2_VC:
 280         case FW_MAGIC_WNR2000V1:
 281         case FW_MAGIC_WNR2000V3:
 282         case FW_MAGIC_WNR2200:
 283         case FW_MAGIC_WNDR3700:
 284         case FW_MAGIC_WNDR3700V2:
 285         case FW_MAGIC_WPN824N:
 286                 break;
 287         case FW_MAGIC_WNR2000V4:
 288                 expected_type = IH_TYPE_KERNEL;
 289                 break;
 290         default:
 291                 return -EINVAL;
 292         }
 293
 294         if (header->ih_os != IH_OS_LINUX ||
 295             header->ih_type != expected_type)
 296                 return -EINVAL;
 297
 298         return 0;
 299 }
 300
 301 static int
 302 mtdsplit_uimage_parse_netgear(struct mtd_info *master,
 303                               const struct mtd_partition **pparts,
 304                               struct mtd_part_parser_data *data)
 305 {
 306         return __mtdsplit_parse_uimage(master, pparts, data,
 307                                       uimage_verify_wndr3700);
 308 }
 309
 310 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
 311 static const struct of_device_id mtdsplit_uimage_netgear_of_match_table[] = {
 312         { .compatible = "netgear,uimage" },
 313         {},
 314 };
 315 #endif
 316
 317 static struct mtd_part_parser uimage_netgear_parser = {
 318         .owner = THIS_MODULE,
 319         .name = "netgear-fw",
 320 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
 321         .of_match_table = mtdsplit_uimage_netgear_of_match_table,
 322 #endif
 323         .parse_fn = mtdsplit_uimage_parse_netgear,
 324         .type = MTD_PARSER_TYPE_FIRMWARE,
 325 };
 326
 327 /**************************************************
 328  * Edimax
 329  **************************************************/
 330
 331 #define FW_EDIMAX_OFFSET        20
 332 #define FW_MAGIC_EDIMAX         0x43535953
 333
 334 static ssize_t uimage_find_edimax(u_char *buf, size_t len)
 335 {
 336         u32 *magic;
 337
 338         if (len < FW_EDIMAX_OFFSET + sizeof(struct uimage_header)) {
 339                 pr_err("Buffer too small for checking Edimax header\n");
 340                 return -ENOSPC;
 341         }
 342
 343         magic = (u32 *)buf;
 344         if (be32_to_cpu(*magic) != FW_MAGIC_EDIMAX)
 345                 return -EINVAL;
 346
 347         if (!uimage_verify_default(buf + FW_EDIMAX_OFFSET, len))
 348                 return FW_EDIMAX_OFFSET;
 349
 350         return -EINVAL;
 351 }
 352
 353 static int
 354 mtdsplit_uimage_parse_edimax(struct mtd_info *master,
 355                               const struct mtd_partition **pparts,
 356                               struct mtd_part_parser_data *data)
 357 {
 358         return __mtdsplit_parse_uimage(master, pparts, data,
 359                                        uimage_find_edimax);
 360 }
 361
 362 static struct mtd_part_parser uimage_edimax_parser = {
 363         .owner = THIS_MODULE,
 364         .name = "edimax-fw",
 365         .parse_fn = mtdsplit_uimage_parse_edimax,
 366         .type = MTD_PARSER_TYPE_FIRMWARE,
 367 };
 368
 369 /**************************************************
 370  * Init
 371  **************************************************/
 372
 373 static int __init mtdsplit_uimage_init(void)
 374 {
 375         register_mtd_parser(&uimage_generic_parser);
 376         register_mtd_parser(&uimage_netgear_parser);
 377         register_mtd_parser(&uimage_edimax_parser);
 378
 379         return 0;
 380 }
 381
 382 module_init(mtdsplit_uimage_init);