--- a/arch/mips/include/asm/mach-bcm63xx/bcm963xx_tag.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm963xx_tag.h
@@ -85,8 +85,10 @@ struct bcm_tag {
 	__u32 rootfs_crc;
 	/* 224-227: CRC32 of kernel partition */
 	__u32 kernel_crc;
-	/* 228-235: Unused at present */
-	char reserved1[8];
+	/* 228-231: Image sequence number */
+	char image_sequence[4];
+	/* 222-235: Openwrt: real rootfs length */
+	__u32 real_rootfs_length;
 	/* 236-239: CRC32 of header excluding last 20 bytes */
 	__u32 header_crc;
 	/* 240-255: Unused at present */
--- a/drivers/mtd/bcm63xxpart.c
+++ b/drivers/mtd/bcm63xxpart.c
@@ -110,7 +110,8 @@ static int bcm63xx_parse_cfe_partitions(
 		} else {
 			/* OpenWrt layout */
 			rootfsaddr = kerneladdr + kernellen;
-			rootfslen = spareaddr - rootfsaddr;
+			rootfslen = buf->real_rootfs_length;
+			spareaddr = rootfsaddr + rootfslen;
 		}
 	} else {
 		pr_warn("CFE boot tag CRC invalid (expected %08x, actual %08x)\n",