Database Info

Samsung RIL reversing

Hi,
A while ago I've started to reverse engineer the (userland) baseband interface of my Samsung phone (GT-I8320 aka. H1) in an effort to see how far I can get Android running on the device (it ships with an OS based on LiMo and associated RIL).
Some Googling and inspection of other phones' RILs suggests that possibly quite some other Samsung smartphones use a similar baseband interface (Qualcomm MSM over dpram).
Searching XDA yield quite a few threads of Android upgrades blocked by a proprietary RIL. I couldn't find any traces of attempts to reverse a Samsung RIL though.
So, what I currently have is a really[/n] basic RIL implementation supporting baseband messages related to network registration (power up, imei/network info, signal info) and even outgoing calls (but that's all related to call management).
To anyone still reading this:
- Please direct me to any related effort (couldn't find any, as mentioned before).
- Direct anyone considering reversing a Samsung RIL here.
Finally, a set of goodies of unknown use:
- Known to work with my MSM6290 via a dpram interface.
- No idea how much free time I have to continue my effort.
- Might, or might not be of (limited) use for other Samsung phones.
Code: github.com/ius/samsung_h1_libmsm

You might want to check out this thread:
http : //forum.samdroid.net/f56/ril-development-froyo-3156/
Remove the space, cannot post links yet
This is for the Samsung Galaxy Spica, but may be a bit of help

hi!
I also tried to find out how samsung ril over dpram0 works...
@iuss
first of all .. amazing work.. thx
where did you get the information??? do you have any docs??

It's all based on reverse engineering of the LiMo telephony library (which is luckily pretty verbose) and it's associated logs.
I've found most similarities with Samsung RILs labeled as 'libsecril'. Those appear to use a similar interface.
I'm currently struggling to get the audio routing from the modem fixed on my board (in order to be able to test call functionality as I add it) before continuing to work on this.

I've found most similarities with Samsung RILs labeled as 'libsecril'. Those appear to use a similar interface.
Click to expand...
Click to collapse
Yes you are right, libsec-ril.so from galaxy spica uses exactly the same interface!
I opened it up in ida-pro and checked it!
@iuss:
are you good at reading asm??

[email protected] said:
@iuss:
are you good at reading asm??
Click to expand...
Click to collapse
I guess so. Anything specific you need help with?

I am testing now with your source and i can open dpram0 and power_on!
Further i can send commands, but i do not get an answer???
can you post an example .. (unlocking sim,..)
thx

It's not implemented (as is 99% of the rest). Should be trivial to implement though, I think it's the MSM_SEC_ISIM_AUTH message. Will certainly do so after the weekend, if I get my sound to work. - which is still not working. Could you try patching test.c using the following diff (after disabling the pin code if neccessary, and change the number). It should call the number - if it works for you, I'm probably missing a GPIO somewhere.
Code:
diff --git a/test.c b/test.c
index 28fae0e..a449342 100644
--- a/test.c
+++ b/test.c
@@ -18,10 +18,26 @@
*
*/
+#include <unistd.h>
#include <radio.h>
+static int flag = 0;
+
+static void do_stuff()
+{
+ msm_call_outgoing(0, "0123456798");
+}
+
static void on_receive(struct msm_request_info *info)
{
+ switch(info->type) {
+ case MSM_NET_REGIST:
+ if(!flag) {
+ flag = 1;
+ do_stuff();
+ }
+ break;
+ }
}
static struct msm_info msm = {

thx for the code!
I disabled the pin code and tried your changes!
the only message i get is
Code:
MSM_DISP_ICON_INFO NOTI (15/5) seq=179 req=0
i think the mobile is not connecting to network!

Hi,
You're testing this on a GT-I5700 (Spica) right?
Checked the dpram driver source, the ioctls are different. Hence the phone is not properly reset (by msm_power_on(), which turns the modem off first if needed). That's why you're only getting a status message regularly sent by the baseband (contains rssi and such).
Try this. Spica seems to have a few different ioctls too, but I've just dropped those as I'm not using them anyway.
- Edit: Wrong ioctls, see next 2 posts -

from where did you have the ioctls??
i checked libsec-ril.so
Code:
EXPORT onedram_phone_pow_on
onedram_phone_pow_on
PUSH {R4,LR}
LDR R4, =(_GLOBAL_OFFSET_TABLE_ - 0x33CC8)
LDR R0, =(fd_onedram_ptr - 0x45164)
LDR R1, =0x6FD0 ; request
ADD R4, PC
LDR R3, [R4,R0]
MOVS R2, #0
LDR R0, [R3] ; fd
BLX ioctl
CMP R0, #0
BGE loc_33CEE

My reference is the dpram driver shipped with GT-I5700_OpenSource.zip.
But I see that you're right, in true Samsung-style there are multiple defines for the ioctls. The ones in my patch are unused.
DPRAM_PHONE_POWON is indeed 0x6FD0. Try setting that as power_on ioctl.
DPRAM_PHONE_ON is 0xF0C0 - which seems to be called to init the OneDRAM memory, and appears to depend on POWON. If it doesn't work after the POWON ioctl, send this one as well (or even better, strace your original RIL to see the ioctls required).
There's one more ioctl (0x6FD3) related to booting, but I *think* it's only used when a modem image is uploaded. Refer to dpram.h/dpram.c for more info..

hi!
hmm it doesn't work!
Can you tell me how the image upload (over serial) works and if i need to do it??
Further how do you strace rild??
rild is startet from init and the sockets are created on startup!
if i stop rild it restarts and i can not strace it!
so i go to bed... good night

I don't know about the image upload. Either the bootloader handles it (didn't check in detail) or it's handled by the baseband itself. For my phone I can simply send the power_on ioctl and off it goes - probably it's just the same for Spica.
As for stracing, you might be able to modify init.rc so rild is started straced.
What might be easier though is simply reversing it. Seeing you already have the RIL lib in IDA, just find all xrefs to ioctl and you should be able to figure all needed.

hi,
I tried a lot, but i did not get it to work!
I changed the power_IOCTL to 0x6FD0!
It return 0 = OK
but the phone do not start!
The orignial lib loads a phone-image and a nv_data.bin and then it uses 0x6FD3 to start the phone.
But my assembly knowlegde not so good.
Can you have a look if you have time????
i attach libsec-ril.so. open it with ida and go to function RIL_Init!
the magic happens in dload_test
thx in advance

Had a quick look. You're right, Spica appears to load the phone fw/nvs from Android.
Quick writeup (in order):
- onedram_open(): Open /dev/dpram0
- dload_read_dbl(): Read /dev/bml9, 0x5000 bytes
- onedram_phone_pow_on(): ioctl 0x6fd0 (DPRAM_PHONE_POWON)
- dload_uart_init(): open /dev/s3c_serial0, 115200
- dload_hdlc_init(): init some data related to hdlc parsing
- dload_packet_init(): init some packet struct
- nop_req()
- onedram_phone_image_load(): ioctl 0x6fd1 (DPRAM_PHONEIMG_LOAD)
- onedram_nv_data_load(): load /efv/nv_data.bin 0x80000 bytes, ioctl(fd, 0x6FD2 (DPRAM_NVDATA_LOAD), buf_with_nvdata)
- onedram_phone_boot_start(): ioctl 0x6fd3 DPRAM_PHONE_BOOTSTART
onedram_nv_data_load() reads the nvdata and passes it as a param along with the ioctl, the nop_req is sent over the uart.
The baseband firmware itself seems to be read by libsecril, but not used (?) - the kernel driver contains code to read bml too when DPRAM_PHONEIMG_LOAD is issued.
I haven't traced into nop_req - no time to reverse it right now. You can import these functions from libsec-ril.so for testing (all are exported) and later replace them with your own implementation. (You can then easily strace your binary to recover the nop_req data).

I'm looking for RIL logs of Samsung phones in order to speed up development.
'logcat -b radio' might provide some, but given a specific phone model I could look up alternative log locations (i5500 for instance appears to dump RIL traffic to /data/log/).
Anyone able to help?

Nexus S
Hi,
out of curiosity I opened the 'libsec-ril.so' from the Nexus S in IDA.
although 'ioctl' is imported, I cannot really find calls to it.
Since i'm unfamiliar with Arm opcodes, I probably overlook something.
Does this code make sense to anyone ?
EDIT: Quite a lot of functions seem to call 'IPC_send_singleIPC', so I suppose
I might be looking at the wrong file...
EDIT2: Ahh, 'IPC_send_singleIPC' can print an IOCTL error message, just haven't found the actual call to ioctl() yet..
Code:
.text:00016BC4 EXPORT requestDTMFStop
.text:00016BC4 requestDTMFStop
.text:00016BC4 LDR R3, =(dword_62428 - 0x16BD0)
.text:00016BC6 PUSH {R4-R6,LR}
.text:00016BC8 MOV R4, R2
.text:00016BCA LDR R2, =0xFFFFFDC4
.text:00016BCC ADD R3, PC
.text:00016BCE MOV R6, R0
.text:00016BD0 MOV R5, R1
.text:00016BD2 LDR R0, [R3,R2]
.text:00016BD4 LDRB R3, [R0]
.text:00016BD6 CBZ R3, loc_16BEC
.text:00016BD8 LDR R3, =(aOndialtimeout - 0x16BE4)
.text:00016BDA MOVS R0, #6
.text:00016BDC LDR R1, =(aRil - 0x16BE6)
.text:00016BDE LDR R2, =(aS - 0x16BEA)
.text:00016BE0 ADD R3, PC ; "onDialTimeout"
.text:00016BE2 ADD R1, PC ; "RIL"
.text:00016BE4 ADDS R3, #0x6C
.text:00016BE6 ADD R2, PC ; "%s()"
.text:00016BE8 BLX sub_10D2C ; NOTE: this seems to be a printf() function
.text:00016BEC
.text:00016BEC loc_16BEC ; CODE XREF: .text:00016BD6j
.text:00016BEC MOV R0, R6
.text:00016BEE MOV R1, R5
.text:00016BF0 MOV R2, R4
.text:00016BF2 MOVS R3, #2
.text:00016BF4 BL sub_16B28
.text:00016BF8 POP {R4-R6,PC}
.text:00016BFA ; ---------------------------------------------------------------------------
.text:00016BFA NOP
.text:00016BFA ; ---------------------------------------------------------------------------
.text:00016BFC off_16BFC DCD dword_62428 - 0x16BD0 ; DATA XREF: .text:requestDTMFStopr
.text:00016C00 dword_16C00 DCD 0xFFFFFDC4 ; DATA XREF: .text:00016BCAr
.text:00016C04 off_16C04 DCD aOndialtimeout - 0x16BE4 ; DATA XREF: .text:00016BD8r
.text:00016C04 ; "onDialTimeout"
.text:00016C08 off_16C08 DCD aRil - 0x16BE6 ; DATA XREF: .text:00016BDCr
.text:00016C08 ; "RIL"
.text:00016C0C off_16C0C DCD aS - 0x16BEA ; DATA XREF: .text:00016BDEr
.text:00016C0C ; "%s()"
.text:00016C10 ; ---------------------------------------------------------------------------

Tuigje said:
out of curiosity I opened the 'libsec-ril.so' from the Nexus S in IDA.
although 'ioctl' is imported, I cannot really find calls to it.
Click to expand...
Click to collapse
Did you try to find xrefs to it?
Since i'm unfamiliar with Arm opcodes, I probably overlook something.
Does this code make sense to anyone ?
Click to expand...
Click to collapse
It does, but it's just an excerpt from a RIL request handler (requestDTMFStop).
EDIT: Quite a lot of functions seem to call 'IPC_send_singleIPC', so I suppose
I might be looking at the wrong file...
Click to expand...
Click to collapse
Wrong file? What are you looking for exactly? The send_single_IPC function is used to send a message to the baseband, thus it's called quite often.
Nexus S has a slightly different kernel driver for dpram, probably Google kindly requested Samsung to clean their crap up. Instead of a chardev + read/write they use ioctls to perform read/write. That would explain the ioctl references you're seeing in IPC_send_singleIPC.

iuss said:
Did you try to find xrefs to it?
Click to expand...
Click to collapse
Nope. I must have done something wrong loading the libsec-ril.so into IDA. all
imports are shown at the end of the file as:
Code:
extern:0009E54C ; int ioctl(int fd, unsigned __int32 request, ...)
extern:0009E54C IMPORT ioctl
It does, but it's just an excerpt from a RIL request handler (requestDTMFStop).
Wrong file? What are you looking for exactly? The send_single_IPC function is used to send a message to the baseband, thus it's called quite often.
Click to expand...
Click to collapse
Ok. I was wondering whether it is possible to get e.g. 'timing advance' data from the gsm-modem. So I started by digging through the android sources. Now I'm at libsec-ril.so. (and libril.so, but I can't make much sense out of that one yet).
Is it correct that libril.so and the kernel-mode gsm driver are also closed-source for the Nexus S ?
Edit: libril looks awfully similar to the android sources (device/libs/telephony/ril.cpp)
Do you know the name of the kernel driver (module filename), or is it directly compiled into the kernel ?
I haven't stumbled onto it yet, neither in the system.img nor in the ramdisk of the boot.img.
Nexus S has a slightly different kernel driver for dpram, probably Google kindly requested Samsung to clean their crap up. Instead of a chardev + read/write they use ioctls to perform read/write. That would explain the ioctl references you're seeing in IPC_send_singleIPC.
Click to expand...
Click to collapse
Is there any other place to get such information, or is it all hard work figuring this out by yourself ?

[dev] Photon nand

I need help from wince rom devs here. What I need now? I need all offsets from wince:
- xip start, hip end
- partitions offsets (start/end/type)
- ram start/end (I see from mtty command ramdump, ram offset start is 0x02e40000 but not sure if it is ram addresse becouse photon kernel offset start is 0x200000, so maybe kernel need to be adapted for 0x2e40000 ??
I used tinboot as a bootloader, created nbh image, uploaded it to nand and tried many times to get kernel booting but it could not boot. Also I see nothing in addresse 0x02e40000 after uploading tinboot to nand and (after) ussing mtty ramdump but I created nbh image including tinboot, kernel...etc to offset 0x2e40000 hmm, something is not good! Yes I understand it can not be good becouse I need to create image with proper offsets, edit mbr record...etc. Hmm, or maybe spl have some security check preventing tinboot to execute? I think first step need to be: understanding how it works, what we need, analysing ramdump, analysing RUU_signed.nbh(unpacking it, using only os.nb for analyse, finding all offsets inside...). If you coked roms succesfully and have that skills, please post here all your opinions, tools ...etc. Only hard part is geting kernel boot from nand, other parts is easy (creating system, data, cache partition)
Some interested links:
- emulating mtd device -> http://minimodding.com/tiki-index.php?page=ImageAccess
- best tutorial I seen (but not understand some parts like how to find xip start/end...offsets is problem!) -> http://forum.ppcgeeks.com/cdma-tp-development/70776-how-tos-developing-ii.html#post989528
- small bootloader (need to be adapted for photon!) -> http://www.neopeek.com/viewtopic.php?f=75&t=2319
Maybe you know where exist some tools for editing ram image, msflash, htc mbr...etc??
Maybe you have some friends who have skils with rom coking?
Maybe asking Cotulla (donating him also) for help? Whether you are willing to donate if he agrees to help?
Maybe mskip will help here?
All help is welcome!
I not know, but maybe dumping haret parts (including tags, boot, kernel, initrd) from memory, and porting it to nbh? Hmm, good idea , I will try
Some interesting links how to dump xip (hmm if successfully dump xip I will search for offsets in mtd dump... also partitions...etc) -> http://forum.xda-developers.com/showthread.php?t=616995
When we found all offsets it will be maybe easy to create android nbh (tinbot, kernel and initrd only - for probe... if success boot, than porting android to nand)

Start from porting LK bootloader
http://htc-linux.org/wiki/index.php?title=LK_Bootloader
get the one from codeaurora git. You may need to make adjustments to make it work on non-android msm7225. Maybe porting our fork for 7200A is easier. Depends on the AMSS (radio) version in your device.
this tree https://gitorious.org/lk-msm7200a-htc-wince/tinboot-for-lk-xda/trees/master contains the tinboot-based wrapper and scripts to embed LK bootloader binary into an NBH flashable to wince devices
sorry I cannot help you more here since I don't have photon and time to work on it, but if you spend more time reading htc-linux irc logs, you'll figure it out yourself
As for the boot address, it should be the same as in haret. Typically, 0x10000000

I need lk? Is possible using only tinboot to boot kernel? I tried to boot only kernel and zimage! Boot adrese for photon/haret is 0x200000

munjeni said:
I need lk? Is possible using only tinboot to boot kernel? I tried to boot only kernel and zimage! Boot adrese for photon/haret is 0x200000
Click to expand...
Click to collapse
tinboot sucks if not to say more. It is a nice thing on its own and is a great work from dzo but it is extremely annoying to make nand roms with it and you can get into serious problems like boot loop. LK gives nice features
1. fastboot protocol for flashing and recovery so you can just use OTA updates in CM7 like native devices
2. you can implement reboot to bootloader/reboot to recovery
3. it passes partition layout via ATAGs to kernel
4. you can enable some hardware (clocks, vregs) and be able to use single kernel for nand and haret
and most importantly, you can easily implement basic battery charging in LK. with tinboot, you can easily get stuck in the boot loop if you completely discharge your battery

ok I agre LK is better but we have not any android nand bootloader! I think smal bootloader will be best choice for first nand boot. Than porting LK bootloader after tinboot becouse tinboot is smaler and easy for the first test. Are you sure nand boot is possible? We not have hspl, we have perfect bootloader (spl)?? But tinboot have also option adding partition layout via ATAGs to kernel but I not care about partitions, only I was tried is to see black screen with white text dmesg in fb console (only kernel and initrd without nand partitioning) but I had no luck. Also, another thing, I no longer have a photon, I have now hd2 and try to figure out how everything works on it. Hehe, I can say that I was more comfortable with its compact photon (very fast android is in him, also colors is better in photon compared with the hd2!), hd2 phone is too big like as a building brick... maybe I will buy again photon
The only drawback is that there is not little support for photon by experienced developers, although the extra good phone, and I'm sorry about that!

You are right, I compiled LK from source and it runing ok in hd2, will try to port it to photon, thank you! There is also explanations for mbr record...etc...

photon nand is here:
http://pastebin.com/xAhnEXBU

djfastest said:
photon nand is here:
http://pastebin.com/xAhnEXBU
Click to expand...
Click to collapse
Yes, I created that paste and it is nand blocks! Os.nb start 0x02820000 block=321 from there is mbr...

munjeni said:
Yes, I created that paste and it is nand blocks! Os.nb start 0x02820000 block=321 from there is mbr...
Click to expand...
Click to collapse
munjeni: sspl

djfastest said:
munjeni- maybe this link be information
one man cah help
http://tiad8.com/nand-test-builds/455-nand-htc-hd-mini-android.html
Click to expand...
Click to collapse
you think this -> http://forum.xda-developers.com/showthread.php?t=1259659

i dont mind to try it but where's the nbh? and what ruu to use?

You need http://forum.xda-developers.com/showpost.php?p=18026197&postcount=10 and you need dft sspl. Also you need (after test attacment) to install wince rom but before you trying to install my attacment be sure to have an htc rom. Dft is one post before

munjeni said:
you think this -> http://forum.xda-developers.com/showthread.php?t=1259659
EDIT:
I created nbh image (only kernel), anyone want to try? If want, install RUU_signed.nbh with dft sspl and please let me know if you see black screen with white text on your screen after booting.
WARNING: do not try installing if you not have your favorite wince rom (original htc installer), becouse it will overwrite your wince rom!! Need testers! How to install wince again? Simple run your rom installer and all will back again to normal! It will not brick your device, it is safe, but you need to have original htc installer to install wince again!
Click to expand...
Click to collapse
OK i tested your boot .
The bootloader works well but remain in the white screen with green HTC, not black screen with white text.
Coming back to WM Rom. If you want i can test more changes today or tomorrow .
I think you are in the right way.
EDIT: WM again without problems. Good work munjeni.

Thank you!

It is possible to load in two ways - having collected nbh through враппер or харетом with such command line:
set ramsize 0x08000000
set ramaddr 0x00000000
set KERNEL lk.bin
set MTYPE 2006//well in general - everything, lk it isn't necessary, but харет it is necessary to deceive
set TAGS_OFFSET 0x300000
set KERNEL_OFFSET 0x00000000
pfw 0xa8250800 0//to disconnect MPU (protection of operative memory)
boot2
---------- Post added at 10:49 AM ---------- Previous post was at 10:37 AM ----------
sorry if you not understand what I posted here, google translate is BAD
how to start:
Start by reading http://htc-linux.org/wiki/index.php?title=LK_Bootloader
download original butloder (there is a link), then - for our wince device with gitorious, as well as
https://gitorious.org/lk-msm7200a-htc-wince...boot-for-lk-xda - wrapper to generate the nbh files vindovyh butlodera.
I do not know what to rpc and smem hd mini and how it is similar to the android, so I compare with the original butloder lk and see what's what. Rather, it is enough to copy all the stupid, that we have done for the 7200A, or even juzat it, despite the fact that you have a 7225 or 7227 - the code to control the CPU speed is not there, and everything else in these same SoC. So take my lk with gitorious, add your claret as has been done to htckovsky and htcrhodium. Carefully check the file target/msm7200a_htc_wince/init.c - it is necessary to check that the address is read from the model name devaysa, sure. here.
sorry if you not understand what I posted here, google translate is BAD

Did you tried...? Hmmm pfw 0xa8250800 0 ?? Maybe MPU realy need to be disabled before boot? Ok, but why zImage/haret not need mpu disabling? What address is for mpu? Where you found that info about haret/lk/mpu ?? Have link? Also, maybe problem is: we need new radio (I tried magldr in hd2 phone with new radio and magldr could not boot if you not have old radio!!!)...so hard job will be geting tinboot or lk working!
See memory map
Code:
v=virtual
p=physhical
==========================================================
v80000000-8cb00000 -> p00100000-0cc00000 cb00000
v8cb00000-8cc00000 -> p00000000-00100000 100000
v8cc00000-8cd00000 -> p0ff00000-10000000 100000
v8cd00000-8da00000 -> p0f200000-0ff00000 d00000
v90000000-90100000 -> p98000000-98100000 100000
v90100000-90200000 -> p9c000000-9c100000 100000
v90200000-90f00000 -> pac000000-acd00000 d00000
v90f00000-91000000 -> pa0e00000-a0f00000 100000
v91000000-91100000 -> pa0d00000-a0e00000 100000
v91100000-91200000 -> pa0d00000-a0e00000 100000
v91200000-91300000 -> pa0c00000-a0d00000 100000
v91300000-91500000 -> pa0a00000-a0c00000 200000
v91500000-91600000 -> pa0800000-a0900000 100000
v91600000-91700000 -> pa0700000-a0800000 100000
v91700000-91800000 -> pa0600000-a0700000 100000
v91800000-91900000 -> pa0500000-a0600000 100000
v91900000-91a00000 -> pa0400000-a0500000 100000
v91a00000-91c00000 -> pa0200000-a0400000 200000
v91c00000-91d00000 -> pa0100000-a0200000 100000
v91d00000-91e00000 -> pa0000000-a0100000 100000
v91e00000-91f00000 -> paa600000-aa700000 100000
v91f00000-92000000 -> paa500000-aa600000 100000
v92000000-92100000 -> paa300000-aa400000 100000
v92100000-92200000 -> pa8100000-a8200000 100000
v92200000-92300000 -> pa9d00000-a9e00000 100000
v92300000-92400000 -> pa9900000-a9a00000 100000
v92400000-92500000 -> pa8700000-a8800000 100000
v92500000-92600000 -> paa200000-aa300000 100000
v92600000-92700000 -> pa9c00000-a9d00000 100000
v92700000-92800000 -> pa9b00000-a9c00000 100000
v92800000-92900000 -> pa9a00000-a9b00000 100000
v92900000-92a00000 -> pa9800000-a9900000 100000
v92a00000-92b00000 -> pa9700000-a9800000 100000
v92b00000-92c00000 -> pa9600000-a9700000 100000
v92c00000-92d00000 -> pa9500000-a9600000 100000
v92d00000-92e00000 -> pa9400000-a9500000 100000
v92e00000-92f00000 -> pa9300000-a9400000 100000
v92f00000-93000000 -> pa9200000-a9300000 100000
v93000000-93100000 -> pa9100000-a9200000 100000
v93100000-93200000 -> pa9000000-a9100000 100000
v93200000-93300000 -> pa8800000-a8900000 100000
v93300000-93400000 -> pa8600000-a8700000 100000
v93400000-93500000 -> pa8500000-a8600000 100000
v93500000-93600000 -> pa8300000-a8400000 100000
v93600000-93700000 -> pa8200000-a8300000 100000
v93700000-93800000 -> pa8200000-a8300000 100000
v93800000-93900000 -> pa8200000-a8300000 100000
v93900000-93a00000 -> pa8200000-a8300000 100000
v93a00000-93b00000 -> pa8200000-a8300000 100000
v93b00000-93c00000 -> pa8000000-a8100000 100000
v93c00000-94100000 -> pc0000000-c0500000 500000
v94100000-94200000 -> p80100000-80200000 100000
v96000000-96200000 -> p88000000-88200000 200000
v96200000-98000000 -> p20000000-21e00000 1e00000
v98000000-98200000 -> p8c000000-8c200000 200000
v98200000-9a000000 -> p21e00000-23c00000 1e00000
v9a000000-9a200000 -> p90000000-90200000 200000
v9a200000-9c000000 -> p23c00000-25a00000 1e00000
v9c000000-9c100000 -> p94000000-94100000 100000
v9c100000-9d000000 -> p25a00000-26900000 f00000
v9d000000-9d100000 -> p98000000-98100000 100000
v9d100000-9e000000 -> p26900000-27800000 f00000
v9e000000-9e200000 -> p9c000000-9c200000 200000
v9e200000-9ea00000 -> p27800000-28000000 800000
v9f000000-9f100000 -> p80000000-80100000 100000
vf0400000-f0500000 -> p00000000-00100000 100000
vfffd0000-fffd4000 -> p01a10000-01a14000 4000
vffff0000-ffff1000 -> p01a14000-01a15000 1000
vffffc000-ffffd000 -> p01a15000-01a16000 1000
Also zImage from haret is loaded to 0x200000 ...etc
Also disabling memory protection is risic becouse if you disable memory protection maybe you overwrite spl (brick your device)... so I think disabling mpu is not necesarry!
Also I found good nbh generator (auto generate mbr record, 0xff bute, auto size "proper size"...etc), also there is explanation how mbr record working, how to calculate partition size and add to mbr...etc...etc:
Code:
/*
* nbgen.c
*
* Created on: Mar 22, 2011
* Author: cedesmith
*/
#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#include <strings.h>
#include <string.h>
#include <stdint.h>
struct NbgPart
{
char* fileName;
int start;
int end;
};
struct NbgData
{
char header[2*0x800];
int noParts;
struct NbgPart parts[16];
};
struct NbgData data;
struct PartEntry {
uint8_t BootInd;
uint8_t FirstHead;
uint8_t FirstSector;
uint8_t FirstTrack;
uint8_t FileSystem;
uint8_t LastHead;
uint8_t LastSector;
uint8_t LastTrack;
uint32_t StartSector;
uint32_t TotalSectors;
};
//#define blocks(x)((x)/0x20000+((x)%0x20000!=0?1:0))
void save(char* file, int nb);
int blocks(size_t bytes);
void PartSetCHS(struct PartEntry* part);
int main(int argc, char* argv[])
{
printf("nbgen v1.0 by cedesmith\n");
if(argc<2){
fprintf(stderr, " Usage: os.nb|os.payload\n", argv[0]);
return 1;
}
struct stat st;
if(stat("lk.bin", &st)!=0){
fprintf(stderr, "lk.bin not found\n", argv[1]);
return 3;
}
data.parts[0].fileName="lk.bin";
data.parts[0].start=2;
data.parts[0].end=blocks(st.st_size+0x800*2)*64;
data.noParts++;
//make file header
memset(data.header, 0, 0x800); //fill 1st sector with 00
data.header[0]=0xE9; //fill signature bytes
data.header[1]=0xFD;
data.header[2]=0xFF;
data.header[512-2]=0x55;
data.header[512-1]=0xAA;
//write partition
struct PartEntry* part = (struct PartEntry*)(data.header+0x1BE);
part->BootInd=0;
part->FileSystem=0x23;
part->StartSector=data.parts[0].start;
part->TotalSectors=data.parts[0].end-data.parts[0].start;
//cardsharing-x:
printf("part->BootInd=%x\n", part->BootInd);
printf("part->FileSystem=%x\n", part->FileSystem);
printf("part->StartSector=%x\n", part->StartSector);
printf("part->TotalSectors=%x\n", part->TotalSectors);
PartSetCHS(part);
//write MSFLASH50
memset(data.header+0x800, 0xFF, 0x800); //fill 2nd sector with FF
memset(data.header+0x800, 00, 0x64);
strncpy(data.header+0x800, "MSFLSH50", sizeof("MSFLSH50")-1); //MSFLSH50 signature
//save
int nb=0;
if(strcasecmp(strrchr(argv[1], '.'), ".nb")==0) nb=1;
save(argv[1], nb);
return 0;
}
void PartSetCHS(struct PartEntry* part)
{
uint32_t first=part->StartSector, last=part->StartSector+part->TotalSectors-1;
part->FirstHead=(uint8_t)(first%0x40 & 0xFF);
part->FirstTrack=(uint8_t)(first/0x40 & 0xFF);
part->FirstSector=(uint8_t)(((((first/0x40)>>8)<<6) & 0xFF)+1);
part->LastHead=(uint8_t) (last%0x40 & 0xFF);
part->LastTrack=(uint8_t)(last/0x40 & 0xFF);
part->LastSector=(uint8_t)(((((last/40)>>8)<<6) & 0xFF)+1);
//cardsharing-x:
printf("first head=%02x\n", part->FirstHead);
printf("first track=%02x\n", part->FirstTrack);
printf("first sector=%02x\n", part->FirstSector);
printf("last head=%02x\n", part->LastHead);
printf("last track=%02x\n", part->LastTrack);
printf("last sector=%02x\n", part->LastSector);
}
int blocks(size_t bytes)
{
// 1 physical nand block = 64 sectors = 0x20000 bytes
return bytes/0x20000+(bytes%0x20000!=0 ? 1 : 0);
}
void writetag(uint32_t no, uint32_t tag, FILE* out)
{
fwrite(&no, sizeof(no), 1, out);
fwrite(&tag, sizeof(tag), 1, out);
}
void save(char* file, int nb)
{
FILE* out=fopen(file, "w");
if(out==NULL){
fprintf(stderr, "failed to open %s\n", file);
exit(20);
}
uint32_t sectorNo=0x0, tag=0xFFFBFFFD;
// write file header block
fwrite(data.header, 1, 0x800, out);
if(nb) writetag(sectorNo, tag, out);
sectorNo++;
//write MSFLASH50 block
fwrite(data.header+0x800, 1, 0x800, out);
if(nb) writetag(sectorNo, tag, out);
sectorNo++;
char sector[0x800];
for(int i=0; i<data.noParts; i++){
struct NbgPart* part=&data.parts[i];
//write empty sectors before part
memset(sector, 0xFF, 0x800);
for(int is=sectorNo; is<part->start; is++){
fwrite(sector, 0x800, 1, out);
if(nb) writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
sectorNo++;
}
//write part from file
printf("writing %s\n", part->fileName);
FILE* in=fopen(part->fileName, "r");
if(in==NULL){
fprintf(stderr, "Failed to open %s\n", part->fileName);
exit(21);
}
while(!feof(in)){
int readed=0;
memset(sector, 0xFF, 0x800);
while(!feof(in) && readed<0x800) readed+=fread(sector+readed, 1, 0x800-readed, in);
fwrite(sector, 0x800, 1, out);
if(nb){
tag=0xFFFFFFFF;
for(int ib=0; ib<0x800; ib++)
if(sector[ib]!=0xFF)
tag=(i==0?0xFFFBFFFD:0xFFFBFFFF);
if(tag!=0xFFFFFFFF) writetag(sectorNo, tag, out);
else writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
}
sectorNo++;
}
fclose(in);
//printf("write empty sectors from %d to %d\n", sectorNo, part->end);
//write empty sectors at the end
memset(sector, 0xFF, 0x800);
for(int is=sectorNo; is<part->end; is++){
fwrite(sector, 0x800, 1, out);
if(nb) writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
sectorNo++;
}
} //for(int i=0; i<data.noParts; i++)
fclose(out);
}
But huh huh no way to see my zImage boot (black screen with white text) , maybe protection is very good (radio or spl or something other or I am wrong with something, wrong offsets?)
Also lk bootloader is bassed on kernel, so I no want to use lk now, I want first to see my zImage with tinboot, if I see my zImage booting I will try to port lk. I will add asm for mpu but I can not try it and I can not responsible if you brick your device. I will use my phone back to try with nbgen again

munjeni,
Please try to build lk and get it working on hd mini. The thing is that your radio is very similiar to the one we have on msm7200A and since we have spent much time getting it to work on msm7200A and have fixed most obvious bugs, it is unwise to ignore this work.
You do not need to disable MPU because haret loads linux to 0x1000_0000 and LK is loaded to 0x0 to allow it to load kernel to 0x1000_0000 and further without erasing LK itself in RAM.
LK is not based on linux. In fact, you should read the source code of our lk port to wince devices prior to making assumptions about how stuff is supposed to work. You can probably use cedesmith's nbh generator, but my modified tinboot tree also contains the utility to do it. And it quite works for htc kovsky.
One problem is that you cannot just boot the haret kernel from nand. You will have to fix some rpc issues (time_remote handler at least) and never touch uart[1-3] clocks, otherwise the arm9 will just crash on boot. My LK (on gitorious) contains enough initialization code to use the same kernel on haret and nand provided that you fix rpc issues. In fact, I'd advise to try just adding your board and display init code to the msm7200A target of my LK.
Good luck with that. Sorry I cannot help you more since I do not have an HD Mini myself.

Hey dude, thanks, do you want hd mini? Maybe our users donate you to buy hd mini? I have hd2 and hd2 is not interested phone to me like hd mini...hd mini is the best phone I used (small, compact, fast, have all needed, have wince, have android, have linux Debian...etc)...hd2 is big phone (notebook in pocket )... I will back to photon if we get nand boot!
Why haret kernel and nand kernel is not the same, I not understand (haret load it to memory, nand kernel is in memory, what is diference)?

Munjeni link to: https://gitorious.org/lk-msm7200a-htc-wince/tinboot-for-lk-xda/trees/master
sp3dev said:
munjeni,
Please try to build lk and get it working on hd mini. The thing is that your radio is very similiar to the one we have on msm7200A and since we have spent much time getting it to work on msm7200A and have fixed most obvious bugs, it is unwise to ignore this work.
You do not need to disable MPU because haret loads linux to 0x1000_0000 and LK is loaded to 0x0 to allow it to load kernel to 0x1000_0000 and further without erasing LK itself in RAM.
LK is not based on linux. In fact, you should read the source code of our lk port to wince devices prior to making assumptions about how stuff is supposed to work. You can probably use cedesmith's nbh generator, but my modified tinboot tree also contains the utility to do it. And it quite works for htc kovsky.
One problem is that you cannot just boot the haret kernel from nand. You will have to fix some rpc issues (time_remote handler at least) and never touch uart[1-3] clocks, otherwise the arm9 will just crash on boot. My LK (on gitorious) contains enough initialization code to use the same kernel on haret and nand provided that you fix rpc issues. In fact, I'd advise to try just adding your board and display init code to the msm7200A target of my LK.
Good luck with that. Sorry I cannot help you more since I do not have an HD Mini myself.
Click to expand...
Click to collapse
munjeni said:
Hey dude, thanks, do you want hd mini? Maybe our users donate you to buy hd mini? I have hd2 and hd2 is not interested phone to me like hd mini...hd mini is the best phone I used (small, compact, fast, have all needed, have wince, have android, have linux Debian...etc)...hd2 is big phone (notebook in pocket )... I will back to photon if we get nand boot!
Why haret kernel and nand kernel is not the same, I not understand (haret load it to memory, nand kernel is in memory, what is diference)?
Click to expand...
Click to collapse

Please do not quote me becouse you use whole page with your post! Also you posted attacment (I not understand what with that)

[Q]c# / development questions (background-img, checkbox)

Hi
i work on my first app, the info-part is finished. now i want add a simple question/answer-part. the first part with button for answers and questions works fine, but with the checkboxes i have some problems.
i want two or three solutions for one question, wich can be choose if i am click on one of these checkboxes. the answer is showing up in MessageBox and work so far, but the checkbox don't be cleared!?
What i have to do, to clear the checkbox. please help me! i don't know so much about the source-code c#, so every explanation will help me! Thanks!
xaml.cs
Code:
private void checkBox6_Checked(object sender, RoutedEventArgs e)
{
MessageBox.Show("Richtig!");
checkBox6.?? = checkBox6.??;
}
private void checkBox7_Checked(object sender, RoutedEventArgs e)
{
MessageBox.Show("Richtig!");
checkBox7.?? = checkBox7.??;
}
xaml
Code:
<TextBlock Height="73" HorizontalAlignment="Left" Margin="13,489,0,0" Name="DerTextblock13" VerticalAlignment="Top" TextWrapping="Wrap" Width="436" FontSize="22">Question?</TextBlock>
<CheckBox Content="YES" Height="72" HorizontalAlignment="Left" Margin="5,518,0,0" Name="checkBox6" VerticalAlignment="Top" Checked="checkBox6_Checked" />
<CheckBox Content="NO" Height="72" HorizontalAlignment="Right" Margin="0,518,18,0" Name="checkBox7" VerticalAlignment="Top" Checked="checkBox7_Checked" />

Just need to change the IsChecked property.
checkbox6.IsChecked = false;

hi
thanks for your comment.. i have read and search about "checkbox6.IsChecked = false;" and test it, but it doesn't work. i got this error in attached image.. checkbox6 is in content not available, but there is in content the checkbox6 (Name="checkbox6" and Checked="checkBox6_Checked")..
so i still don't know, why i get this error.. sorry for my stupid question..

Control names are case sensitive. It should be checkBox6.IsChecked = false;

oh man, what a stupid error.. thanks, case sensitive was the right keyword!

how can i change background-image for other xaml-site
hi
i don`t want open a new thread, so i ask here.
new problem! how can i change the background-image for an other xaml-site?
i searched a lot and find a lot, but nothing show me exactly how i can realize this.
in the source-code below, you see that i can change the background-image for example on mainpage.xaml.
Now i want integrate in my setting.xaml and settings.xaml.cs the same checkboxes to change the background-image on the mainpage.xaml.
What i have to do? Thanks for help!
xaml.cs
Code:
private void checkBox2_Checked(object sender, RoutedEventArgs e)
{
Uri uriR = new Uri("image/angler.png", UriKind.Relative);
BitmapImage imgSource = new BitmapImage(uriR);
this.imagechange.Source = imgSource;
checkBox1.IsChecked = false;
}
private void checkBox1_Checked(object sender, RoutedEventArgs e)
{
Uri uriR = new Uri("image/new-background.png", UriKind.Relative);
BitmapImage imgSource = new BitmapImage(uriR);
this.imagechange.Source = imgSource;
checkBox2.IsChecked = false;
}
xaml
Code:
<CheckBox Content="Hintergrund" Height="72" Margin="54,-33,0,0" Name="checkBox2" Checked="checkBox2_Checked" Width="163" FontSize="18" />
<CheckBox Content="Hintergrund 2" Height="72" Margin="0,-33,49,0" Name="checkBox1" Checked="checkBox1_Checked" Width="187" FontSize="18" />

Well done very good

Not sure if it's the best way, but one option would be to store the value you want to use in IsolatedStorageSettings. Then, when the page loads, it checks the value in ISS and applies that background (in its OnNavigatedTo event handler is probably best).

GoodDayToDie said:
Not sure if it's the best way, but one option would be to store the value you want to use in IsolatedStorageSettings. Then, when the page loads, it checks the value in ISS and applies that background (in its OnNavigatedTo event handler is probably best).
Click to expand...
Click to collapse
thanks, i have found a code to read an image in IsolatedStorage.. see below..
but i got a error.. i found a example-project, all works fine and i can read a image-file from IsolatedStorage. but in my app it doesn't work and i got these error..
also i had added the namespaces in xaml.cs
using System.IO.IsolatedStorage;
using System.IO;
xaml.cs
xaml-code
Code:
<Image x:Name="imagechange" Margin="30,62,38,204" Stretch="Fill" />
<Button Content="lesen" Height="72" HorizontalAlignment="Left" Margin="269,533,0,0" x:Name="lesen" VerticalAlignment="Top" Width="160" FontSize="19" Click="lesen_Click" />
vs 2010 are showing no faults in debugmodus! But if i click on button "lesen", i got the attached error. Please, where is the fault or what i have to do now?

does anyone has a idea about my described problem. sorry for my stupid questions, but that's all new for me and i want to learn it..

Do you have actual file "logo.jpg" on your ISF? Insert before opening:
if (myIsolatedStorage.FileExists("logo.jpg"))
{
... your code ...

sensboston said:
Do you have actual file "logo.jpg" on your ISF? Insert before opening:
if (myIsolatedStorage.FileExists("logo.jpg"))
{
... your code ...
Click to expand...
Click to collapse
hi
i had added your comment to source-code.. now, nothing happen, if i click on the button for reading the file from isolated storage..
how can i add the file "logo.jpg" to isolated storage?? i thought, i only have to put the file to my current project, like i did it with other images and then i can save or read the file to isolated storage.
I think this must be the fault. How can manage it? thanks..
Code:
private void lesen_Click(object sender, RoutedEventArgs e)
{
BitmapImage bi = new BitmapImage();
using (IsolatedStorageFile myIsolatedStorage = IsolatedStorageFile.GetUserStoreForApplication())
{
if (myIsolatedStorage.FileExists("logo.jpg"))
using (IsolatedStorageFileStream fileStream = myIsolatedStorage.OpenFile("logo.jpg", FileMode.Open, FileAccess.Read))
{
bi.SetSource(fileStream);
this.imagechange.Height = bi.PixelHeight;
this.imagechange.Width = bi.PixelWidth;
}
}
this.imagechange.Source = bi;
}

jayjojayson said:
i had added your code in comment to source-code.. now, nothing happen, if i click on the button for reading the file from isolated storage..
how can i add the file "logo.jpg" to isolated storage??
Click to expand...
Click to collapse
You may try to:
- download image from network and save to isf;
- copy from resource stream to isf;
- manually upload file to the app ISF using ISETool.exe or third-party tool.
jayjojayson said:
i thought, i only have to put the file to my current project, like i did it with other images and then i can save or read the file to isolated storage.
Click to expand...
Click to collapse
Wrong assumption.
P.S. Try this (btw, it's a first google link!): http://technodave.wordpress.com/201...ge-for-local-html-content-on-windows-phone-7/

hi
thanks a lot, it works... the first comment you have written are right..
i only have to save it first to isolated storage, before i can read the file.
thanks for your explanation to add files to ISF.. i have serach for that topic, but found nothing that describe how to added to ISF.. thanks for the link... i will read this in the evening...
now i have to find out, how i can change a image on a other site(xaml). than i can change for example in my setting.xaml the background in the mainpage.xaml
every day i learn new things, that's really exciting...

jayjojayson said:
now i have to find out, how i can change a image on a other site(xaml). than i can change for example in my setting.xaml the background in the mainpage.xaml
Click to expand...
Click to collapse
Sorry, I didn't read the whole thread before answering; seems like you are digging in the wrong direction. You don't need to use ISF (but it was a good practice for you), all you need is just a dynamical binding.
I'm too lazy to type code sample for you but (he-he!), our good friend google.com returned a good link for you http://www.eugenedotnet.com/2011/05...-property-in-silverlight-and-windows-phone-7/
P.S. Experience to use google should be "the must" in developer's experience.

entry Text in new line
Hi
i use google, my best friend, for a lot of my questions. but sometimes i don't know the right searchkeywords to do what i want to do (like image binding).
i have a new small problem. in my app i have 4 textboxes, that i use to write in some data. These 4 textboxes, i write to isolated storage in a textfile and let them summarized showing up in a textblock. This works fine.
Now, if i want write a new entry, these entry is written directly after the first entry.
example like is insert in textblock
Code:
▷Text - Text - Text - Text| ▷Text - Text - Text - Text|
But i want that the entry is written in a new line? How can i do this?
example like i want it
Code:
▷Text - Text - Text - Text|
▷Text - Text - Text - Text|
i know that i can create new lines with \n , \r\n and Environment.NewLine.
Code:
IsolatedStorageFile myIsolatedStorage = IsolatedStorageFile.GetUserStoreForApplication();
//create new file
using (StreamWriter writeFile = new StreamWriter(new IsolatedStorageFileStream("fangbuch.txt", FileMode.Create, FileAccess.Write, myIsolatedStorage)))
{
string someTextData = text.Text + "▷" + datum.Text + " - " + fisch.Text + " - " + größe.Text + "cm" + " - " + gewicht.Text + "Kg" + " | " + "\r\n";
writeFile.WriteLine(someTextData);
writeFile.Close();
}
if i use one of the elements to create a new line, like is showing in code above, the new (second) entry overwrite the first entry. What can i do now? thanks for your help.

You're using FileMode.Create, which will overwrite an existing file. You need to either use FileMode.OpenOrCreate and then seek to the end of the file, or you need to use FileMode.Append (this is the preferred approach).
Additionally, the StreamWriter.WriteFile function automatically appends a newline for you. There's no need to have them manually placed at the end of your text string.
http://msdn.microsoft.com/en-us/library/system.io.filemode.aspx

[Q] Help ?? trying to set up ddr ram for kernel 3.0.8 properly [ not a dummy ]

I was wondering if maybe someone here can maybe help me out with this. ive been working on it on and off for about 8 months now.
I am The lead developer for Team Osiris.
currently, still finishing up cm10 for the Zte warp.
Which is MSM8655 / MSM7X30 based
512mb ram
the problem iam having is with the 3.0.8 kernel iam developing.
we took the kernel source for the warp sequent. and modified it, and got it to boot on the warp.
we were using a moddified board-msm-7x30, but i recently made a new board file from scratch based on a Code Aurora generic board-msm-7x30.
i reworked the entire board, added and removed what needed to be done.
then i get to the real issue ive been trying to solve forever.
it seems no matter what i do. the system only sees 116mb ram. i know some is reserved for the os and what not. so i know thats not the issue.
on stock gb we had 512 physical, with 378 free.
this very same problem was also encounterd and fixed when we started cm10 using the 2.6.35.7 source for the phone.
that one turned out that memory4 was not online.. simple fix.
ive tried that on the 3x kernel with no luck.
memory4 doesnt even exist.
only memory0. using either board file.
Here is a snipet of the code iam trying to get memory online in the board.
Code:
// MEMBANKS
#define DDR_BANK1 0X20000000
#define DDR_BANK1_SIZE 0x00000100
#define DDR_BANK2 0X40000000
#define DDR_BANK2_SIZE 0x00000100
/// DO AWAY WITH ZTE FIXUP, IN FAVOR OF MSM7X30_FIXUP
static void __init msm7x30_fixup(struct machine_desc *desc,
struct tag *tags,
char **cmdline,
struct meminfo *mi)
{
mi->bank[0].start = DDR_BANK1 + PHYS_OFFSET;
mi->bank[0].size = DDR_BANK1_SIZE;
mi->bank[1].start = DDR_BANK2;
mi->bank[1].size = DDR_BANK2_SIZE;
return ;
}
static void __init msm7x30_init_early(void)
{
msm7x30_allocate_memory_regions();
}
again, the hex values may not be right.
ive done my research and iam kind of at a loss right now. in 2.6 it seems everything was in ebi0
and also with 8655 cpus everything is in ebi0.
ive tried other memory layouts from phones with the same hardware. no luck..
any help or direction would be appreciated

[Q] Extracting kernel image from a rom image

I am trying to build some kernel modules for a Tronsmart MK808ii but Tronsmart have not provided the config (No proc/config.gz) after some messing about I have managed to get some kernel modules to load (I have the Init and Exit pointers in the right place). My first aim is to allow the device to read usb cdroms and iso files for which I need to load isofs.ko cdrom.ko and sr_mod.ko
Actually things go pretty well except there appears to be a misalignment between struct gendisk in the module and kernel. when the genhd driver dereferences gendisk->part0 i get an oops. Looking at the code the only definable length object before part0 seems to be disk_name
In order to be more precise about what's happening and to determine the relative alignment of structures between my kernel and the supplied one I need to be able to disassemble the original kernel which I've extracted from the eeprom - ony problem is that neither file nor objdump know what to do with this image, so I'm presupposing it has some sort of header on it so the bootloader can find the image. The Image starts with KRNL$
Does anyone have an idea of how vmlinux image can be extracted from this rom image?
int major; /* major number of driver */
int first_minor;
int minors; /* maximum number of minors, =1 for
* disks that can't be partitioned. */
char disk_name[DISK_NAME_LEN]; /* name of major driver */
char *(*devnode)(struct gendisk *gd, mode_t *mode);
unsigned int events; /* supported events */
unsigned int async_events; /* async events, subset of all */
/* Array of pointers to partitions indexed by partno.
* Protected with matching bdev lock but stat and other
* non-critical accesses use RCU. Always access through
* helpers.
*/
struct disk_part_tbl __rcu *part_tbl;
struct hd_struct part0;