Ubuntu18
Flash芯片型号是 GD9FS1G8F2AMGI,兆芯工业级 128Mx8,2K+128B Page,128K+8K Block。
芯片ID是 C8 A1 80 15 42
加载mtd和ubi模块
modprobe mtdblock
modprobe ubi
加载nandsim模拟nand设备
modprobe nandsim first_id_byte=0xc8 second_id_byte=0xa1 third_id_byte=0x80 fourth_id_byte=0x15
前三字节是厂商ID和芯片ID,重点是第四字节,决定了mtd设备的 Block Size 和 Page Size
查询刚nandsim生成的mtd设备
cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 "NAND simulator partition 0"
ls -la /dev/mtd*
crw------- 1 root root 90, 0 9月 17 10:33 /dev/mtd0
crw------- 1 root root 90, 1 9月 17 10:33 /dev/mtd0ro
brw-rw---- 1 root disk 31, 0 9月 17 10:33 /dev/mtdblock0
mtdinfo /dev/mtd0
mtd0
Name: NAND simulator partition 0
Type: nand
Eraseblock size: 131072 bytes, 128.0 KiB
Amount of eraseblocks: 1024 (134217728 bytes, 128.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 512 bytes
OOB size: 64 bytes
Character device major/minor: 90:0
Bad blocks are allowed: true
Device is writable: true
将 ubi 与 /dev/mtd0 关联
modprobe ubi mtd=0
将 rootfs.ubi 加载到mtd设备,需要 mtd-utils 工具箱 (ubuntu apt install mtd-utils)
解除绑定
ubidetach /dev/ubi_ctrl -m 0
我手上这个固件前面会有一个flash.scr的脚本,需要把这个脚本去掉才是ubi的镜像,另外这个bin文件有2个一模一样的ubi,结尾还有个desc table
只需要提取其中一个ubi就可以了。
定位ubi镜像方法简单,搜索ubi_ec_hdr结构体签名 55424923 即可,剔除前面的脚本部分,剔除第二个备份ubi,保存为 1.ubi,
大小是0xCE0000字节,保证是块大小对齐就是正确的
将ubi分区格式化并加载 1.ubi
ubiformat /dev/mtd0 -s 2048 -f 1.ubi -O 2048
ubiformat: mtd0 (nand), size 134217728 bytes (128.0 MiB), 1024 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1023 -- 100 % complete
ubiformat: 1024 eraseblocks are supposedly empty
ubiformat: flashing eraseblock 102 -- 100 % complete
ubiformat: formatting eraseblock 1023 -- 100 % complete
将ubi模块与已载入了rootfs.ubi的mtd模块关联 (-O 是 VID header offset)
ubiattach /dev/ubi_ctrl -m 0 -O 2048
UBI device number 0, total 1024 LEBs (130023424 bytes, 124.0 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
查询ubi0信息
ubinfo /dev/ubi0
ubi0
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 1024 (130023424 bytes, 124.0 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 20
Current maximum erase counter value: 1
Minimum input/output unit size: 2048 bytes
Character device major/minor: 241:0
Present volumes: 0, 1, 2
有3个卷,查询每个卷
root@meng-virtual-machine:~# ubinfo /dev/ubi0_0
Volume ID: 0 (on ubi0)
Type: static
Alignment: 1
Size: 50 LEBs (6348800 bytes, 6.1 MiB)
Data bytes: 3543536 bytes (3.4 MiB)
State: OK
Name: kernel
Character device major/minor: 241:1
root@meng-virtual-machine:~# ubinfo /dev/ubi0_1
Volume ID: 1 (on ubi0)
Type: dynamic
Alignment: 1
Size: 73 LEBs (9269248 bytes, 8.8 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 241:2
root@meng-virtual-machine:~# ubinfo /dev/ubi0_2
Volume ID: 2 (on ubi0)
Type: dynamic
Alignment: 1
Size: 875 LEBs (111104000 bytes, 106.0 MiB)
State: OK
Name: rootfs_data
Character device major/minor: 241:3
从名字上看
ubi0_0 是 kernel
ubi0_1 是 ubi_rootfs
ubi0_2 是 rootfs_data
hd 分别查询 ubi0_0 ubi0_1 ubi0_2
root@meng-virtual-machine:~# hd /dev/ubi0_0|more
00000000 d0 0d fe ed 00 36 11 f0 00 00 00 38 00 36 0a c4 |.....6.....8.6..|
00000010 00 00 00 28 00 00 00 11 00 00 00 10 00 00 00 00 |...(............|
00000020 00 00 00 6c 00 36 0a 8c 00 00 00 00 00 00 00 00 |...l.6..........|
00000030 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 |................|
00000040 00 00 00 03 00 00 00 04 00 00 00 5c 5f 5d de a1 |...........\_]..|
00000050 00 00 00 03 00 00 00 24 00 00 00 00 41 52 4d 20 |.......$....ARM |
00000060 51 53 44 4b 20 46 49 54 20 28 46 6c 61 74 74 65 |QSDK FIT (Flatte|
00000070 6e 65 64 20 49 6d 61 67 65 20 54 72 65 65 29 00 |ned Image Tree).|
00000080 00 00 00 03 00 00 00 04 00 00 00 0c 00 00 00 01 |................|
00000090 00 00 00 01 69 6d 61 67 65 73 00 00 00 00 00 01 |....images......|
000000a0 6b 65 72 6e 65 6c 40 31 00 00 00 00 00 00 00 03 |kernel@1........|
000000b0 00 00 00 16 00 00 00 00 41 52 4d 20 51 53 44 4b |........ARM QSDK|
000000c0 20 4c 69 6e 75 78 2d 34 2e 34 2e 36 30 00 00 00 | Linux-4.4.60...|
000000d0 00 00 00 03 00 33 36 18 00 00 00 1b 1f 8b 08 08 |.....36.........|
000000e0 97 de 5d 5f 02 03 49 6d 61 67 65 00 ec dd 0b 98 |..]_..Image.....|
000000f0 1c 55 9d f0 ff 53 dd 3d 33 9d c9 90 e9 b9 44 86 |.U...S.=3.....D.|
00000100 10 98 ce 05 0c 10 a0 72 01 42 08 49 0f 64 37 11 |.......r.B.I.d7.|
00000110 83 74 20 40 64 d9 75 54 74 d1 65 65 50 d6 cd ee |.t @d.uTt.eeP...|
00000120 fa 6e ba 92 09 c4 90 98 c9 85 8b 6c d8 74 10 fd |.n.........l.t..|
00000130 a3 8b 0f 03 e2 8a 2c 68 07 c1 55 cc ae 83 b2 ea |......,h..U.....|
00000140 df 6b 57 77 ca 4c 32 38 0e 57 b9 c9 fc 7f bf aa |.kWw.L28.W......|
00000150 d3 99 ce 90 84 80 eb fb ee ff 7d be 9f e7 a9 e7 |..........}.....|
00000160 54 55 d7 e5 9c 53 e7 9c 3a 75 e9 ee c1 7d f1 01 |TU...S..:u...}..|
ubi0_0 确实是内核
root@meng-virtual-machine:~# hd /dev/ubi0_1|more
00000000 68 73 71 73 a7 03 00 00 ad de 5d 5f 00 00 04 00 |hsqs......]_....|
00000010 21 00 00 00 04 00 12 00 c0 06 01 00 04 00 00 00 |!...............|
00000020 c3 1b 3e 18 00 00 00 00 4e 7a 8a 00 00 00 00 00 |..>.....Nz......|
00000030 46 7a 8a 00 00 00 00 00 ff ff ff ff ff ff ff ff |Fz..............|
00000040 66 2d 8a 00 00 00 00 00 fa 4c 8a 00 00 00 00 00 |f-.......L......|
00000050 52 73 8a 00 00 00 00 00 38 7a 8a 00 00 00 00 00 |Rs......8z......|
00000060 0c 80 1c 00 09 00 90 00 40 00 00 00 04 00 fd 37 |[email protected]|
00000070 7a 58 5a 00 00 01 69 22 de 36 04 c1 d6 b4 06 80 |zXZ...i".6......|
00000080 80 10 07 00 21 01 0c 00 00 00 16 08 87 5d e2 6e |....!........].n|
00000090 6f ef fe 6c 00 3f 91 45 84 60 0e fc 4a 56 ff 04 |o..l.?.E.`..JV..|
000000a0 b4 8a 1d f8 70 30 c3 c3 2d 7b d2 1f 89 2b 2d 7f |....p0..-{...+-.|
000000b0 4e 76 a1 1d 0d 41 65 7b 42 6e 86 af 44 e6 07 ca |Nv...Ae{Bn..D...|
000000c0 14 ad 64 7d e6 85 21 df 9c 1b 40 6d 32 3e 61 ff |..d}..!...@m2>a.|
000000d0 4e 5c 3c aa 66 db fd 4f 50 c8 09 b9 f6 8f c0 70 |N\<.f..OP......p|
000000e0 20 cb 3f 0c 16 4e 61 8e 8c 88 78 ae 2d 51 83 2c | .?..Na...x.-Q.,|
000000f0 bd 9a 2f f8 ad 05 6b c5 10 80 30 68 b5 9c ec 84 |../...k...0h....|
00000100 3a 46 e9 45 9d f3 81 04 3f 22 b3 e7 d9 9b 4e 38 |:F.E....?"....N8|
00000110 74 43 0b 52 cf d8 7e 1f 41 12 05 be a2 bf 49 49 |tC.R..~.A.....II|
00000120 d9 93 62 2d 9a c2 b3 c7 09 25 5f c7 d5 33 16 ed |..b-.....%_..3..|
00000130 00 75 e8 c1 79 6b 4c 93 75 1a d5 fd 80 49 e3 32 |.u..ykL.u....I.2|
00000140 e6 3d 69 d4 33 28 b6 d1 1e ee c6 d2 d2 e1 b5 38 |.=i.3(.........8|
00000150 78 fc e9 b9 78 71 ca b9 4a 45 26 71 40 16 f6 5d |x...xq..JE&q@..]|
00000160 2a 3b 17 ff 16 4d d0 68 f1 fa 2f 2b b1 e9 83 13 |*;...M.h../+....|
ubi0_1 是 squashfs 格式的rootfs
root@meng-virtual-machine:~# hd /dev/ubi0_2|more
00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
ubi0_2 就是flash上的空闲空间了,全是ff
挂载rootfs(挂不上,应该怎么挂?)
mkdir /mnt/rootfs
ubiblock -c /dev/ubi0_0
mount -t squashfs /dev/ubiblock0_1 /mnt/rootfs/
解包rootfs
cp /dev/ubi0_1 rootfs.squashfs
unsquashfs rootfs.squashfs