1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright 2014 Broadcom Corporation. 4 */ 5 6 #include <config.h> 7 #include <common.h> 8 #include <blk.h> 9 #include <fastboot.h> 10 #include <fastboot-internal.h> 11 #include <fb_mmc.h> 12 #include <image-sparse.h> 13 #include <part.h> 14 #include <mmc.h> 15 #include <div64.h> 16 #include <linux/compat.h> 17 #include <android_image.h> 18 19 #define FASTBOOT_MAX_BLK_WRITE 16384 20 21 #define BOOT_PARTITION_NAME "boot" 22 23 struct fb_mmc_sparse { 24 struct blk_desc *dev_desc; 25 }; 26 27 static int part_get_info_by_name_or_alias(struct blk_desc *dev_desc, 28 const char *name, disk_partition_t *info) 29 { 30 int ret; 31 32 ret = part_get_info_by_name(dev_desc, name, info); 33 if (ret < 0) { 34 /* strlen("fastboot_partition_alias_") + 32(part_name) + 1 */ 35 char env_alias_name[25 + 32 + 1]; 36 char *aliased_part_name; 37 38 /* check for alias */ 39 strcpy(env_alias_name, "fastboot_partition_alias_"); 40 strncat(env_alias_name, name, 32); 41 aliased_part_name = env_get(env_alias_name); 42 if (aliased_part_name != NULL) 43 ret = part_get_info_by_name(dev_desc, 44 aliased_part_name, info); 45 } 46 return ret; 47 } 48 49 /** 50 * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE 51 * 52 * @block_dev: Pointer to block device 53 * @start: First block to write/erase 54 * @blkcnt: Count of blocks 55 * @buffer: Pointer to data buffer for write or NULL for erase 56 */ 57 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start, 58 lbaint_t blkcnt, const void *buffer) 59 { 60 lbaint_t blk = start; 61 lbaint_t blks_written; 62 lbaint_t cur_blkcnt; 63 lbaint_t blks = 0; 64 int i; 65 66 for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) { 67 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE); 68 if (buffer) { 69 if (fastboot_progress_callback) 70 fastboot_progress_callback("writing"); 71 blks_written = blk_dwrite(block_dev, blk, cur_blkcnt, 72 buffer + (i * block_dev->blksz)); 73 } else { 74 if (fastboot_progress_callback) 75 fastboot_progress_callback("erasing"); 76 blks_written = blk_derase(block_dev, blk, cur_blkcnt); 77 } 78 blk += blks_written; 79 blks += blks_written; 80 } 81 return blks; 82 } 83 84 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info, 85 lbaint_t blk, lbaint_t blkcnt, const void *buffer) 86 { 87 struct fb_mmc_sparse *sparse = info->priv; 88 struct blk_desc *dev_desc = sparse->dev_desc; 89 90 return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer); 91 } 92 93 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info, 94 lbaint_t blk, lbaint_t blkcnt) 95 { 96 return blkcnt; 97 } 98 99 static void write_raw_image(struct blk_desc *dev_desc, disk_partition_t *info, 100 const char *part_name, void *buffer, 101 u32 download_bytes, char *response) 102 { 103 lbaint_t blkcnt; 104 lbaint_t blks; 105 106 /* determine number of blocks to write */ 107 blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1)); 108 blkcnt = lldiv(blkcnt, info->blksz); 109 110 if (blkcnt > info->size) { 111 pr_err("too large for partition: '%s'\n", part_name); 112 fastboot_fail("too large for partition", response); 113 return; 114 } 115 116 puts("Flashing Raw Image\n"); 117 118 blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer); 119 120 if (blks != blkcnt) { 121 pr_err("failed writing to device %d\n", dev_desc->devnum); 122 fastboot_fail("failed writing to device", response); 123 return; 124 } 125 126 printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz, 127 part_name); 128 fastboot_okay(NULL, response); 129 } 130 131 #ifdef CONFIG_ANDROID_BOOT_IMAGE 132 /** 133 * Read Android boot image header from boot partition. 134 * 135 * @param[in] dev_desc MMC device descriptor 136 * @param[in] info Boot partition info 137 * @param[out] hdr Where to store read boot image header 138 * 139 * @return Boot image header sectors count or 0 on error 140 */ 141 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc, 142 disk_partition_t *info, 143 struct andr_img_hdr *hdr, 144 char *response) 145 { 146 ulong sector_size; /* boot partition sector size */ 147 lbaint_t hdr_sectors; /* boot image header sectors count */ 148 int res; 149 150 /* Calculate boot image sectors count */ 151 sector_size = info->blksz; 152 hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_img_hdr), sector_size); 153 if (hdr_sectors == 0) { 154 pr_err("invalid number of boot sectors: 0\n"); 155 fastboot_fail("invalid number of boot sectors: 0", response); 156 return 0; 157 } 158 159 /* Read the boot image header */ 160 res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr); 161 if (res != hdr_sectors) { 162 pr_err("cannot read header from boot partition\n"); 163 fastboot_fail("cannot read header from boot partition", 164 response); 165 return 0; 166 } 167 168 /* Check boot header magic string */ 169 res = android_image_check_header(hdr); 170 if (res != 0) { 171 pr_err("bad boot image magic\n"); 172 fastboot_fail("boot partition not initialized", response); 173 return 0; 174 } 175 176 return hdr_sectors; 177 } 178 179 /** 180 * Write downloaded zImage to boot partition and repack it properly. 181 * 182 * @param dev_desc MMC device descriptor 183 * @param download_buffer Address to fastboot buffer with zImage in it 184 * @param download_bytes Size of fastboot buffer, in bytes 185 * 186 * @return 0 on success or -1 on error 187 */ 188 static int fb_mmc_update_zimage(struct blk_desc *dev_desc, 189 void *download_buffer, 190 u32 download_bytes, 191 char *response) 192 { 193 uintptr_t hdr_addr; /* boot image header address */ 194 struct andr_img_hdr *hdr; /* boot image header */ 195 lbaint_t hdr_sectors; /* boot image header sectors */ 196 u8 *ramdisk_buffer; 197 u32 ramdisk_sector_start; 198 u32 ramdisk_sectors; 199 u32 kernel_sector_start; 200 u32 kernel_sectors; 201 u32 sectors_per_page; 202 disk_partition_t info; 203 int res; 204 205 puts("Flashing zImage\n"); 206 207 /* Get boot partition info */ 208 res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info); 209 if (res < 0) { 210 pr_err("cannot find boot partition\n"); 211 fastboot_fail("cannot find boot partition", response); 212 return -1; 213 } 214 215 /* Put boot image header in fastboot buffer after downloaded zImage */ 216 hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE); 217 hdr = (struct andr_img_hdr *)hdr_addr; 218 219 /* Read boot image header */ 220 hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response); 221 if (hdr_sectors == 0) { 222 pr_err("unable to read boot image header\n"); 223 fastboot_fail("unable to read boot image header", response); 224 return -1; 225 } 226 227 /* Check if boot image has second stage in it (we don't support it) */ 228 if (hdr->second_size > 0) { 229 pr_err("moving second stage is not supported yet\n"); 230 fastboot_fail("moving second stage is not supported yet", 231 response); 232 return -1; 233 } 234 235 /* Extract ramdisk location */ 236 sectors_per_page = hdr->page_size / info.blksz; 237 ramdisk_sector_start = info.start + sectors_per_page; 238 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) * 239 sectors_per_page; 240 ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) * 241 sectors_per_page; 242 243 /* Read ramdisk and put it in fastboot buffer after boot image header */ 244 ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz); 245 res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors, 246 ramdisk_buffer); 247 if (res != ramdisk_sectors) { 248 pr_err("cannot read ramdisk from boot partition\n"); 249 fastboot_fail("cannot read ramdisk from boot partition", 250 response); 251 return -1; 252 } 253 254 /* Write new kernel size to boot image header */ 255 hdr->kernel_size = download_bytes; 256 res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr); 257 if (res == 0) { 258 pr_err("cannot writeback boot image header\n"); 259 fastboot_fail("cannot write back boot image header", response); 260 return -1; 261 } 262 263 /* Write the new downloaded kernel */ 264 kernel_sector_start = info.start + sectors_per_page; 265 kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) * 266 sectors_per_page; 267 res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors, 268 download_buffer); 269 if (res == 0) { 270 pr_err("cannot write new kernel\n"); 271 fastboot_fail("cannot write new kernel", response); 272 return -1; 273 } 274 275 /* Write the saved ramdisk back */ 276 ramdisk_sector_start = info.start + sectors_per_page; 277 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) * 278 sectors_per_page; 279 res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors, 280 ramdisk_buffer); 281 if (res == 0) { 282 pr_err("cannot write back original ramdisk\n"); 283 fastboot_fail("cannot write back original ramdisk", response); 284 return -1; 285 } 286 287 puts("........ zImage was updated in boot partition\n"); 288 fastboot_okay(NULL, response); 289 return 0; 290 } 291 #endif 292 293 /** 294 * fastboot_mmc_get_part_info() - Lookup eMMC partion by name 295 * 296 * @part_name: Named partition to lookup 297 * @dev_desc: Pointer to returned blk_desc pointer 298 * @part_info: Pointer to returned disk_partition_t 299 * @response: Pointer to fastboot response buffer 300 */ 301 int fastboot_mmc_get_part_info(char *part_name, struct blk_desc **dev_desc, 302 disk_partition_t *part_info, char *response) 303 { 304 int r; 305 306 *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV); 307 if (!*dev_desc) { 308 fastboot_fail("block device not found", response); 309 return -ENOENT; 310 } 311 if (!part_name) { 312 fastboot_fail("partition not found", response); 313 return -ENOENT; 314 } 315 316 r = part_get_info_by_name_or_alias(*dev_desc, part_name, part_info); 317 if (r < 0) { 318 fastboot_fail("partition not found", response); 319 return r; 320 } 321 322 return r; 323 } 324 325 /** 326 * fastboot_mmc_flash_write() - Write image to eMMC for fastboot 327 * 328 * @cmd: Named partition to write image to 329 * @download_buffer: Pointer to image data 330 * @download_bytes: Size of image data 331 * @response: Pointer to fastboot response buffer 332 */ 333 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer, 334 u32 download_bytes, char *response) 335 { 336 struct blk_desc *dev_desc; 337 disk_partition_t info; 338 339 dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV); 340 if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) { 341 pr_err("invalid mmc device\n"); 342 fastboot_fail("invalid mmc device", response); 343 return; 344 } 345 346 #if CONFIG_IS_ENABLED(EFI_PARTITION) 347 if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) { 348 printf("%s: updating MBR, Primary and Backup GPT(s)\n", 349 __func__); 350 if (is_valid_gpt_buf(dev_desc, download_buffer)) { 351 printf("%s: invalid GPT - refusing to write to flash\n", 352 __func__); 353 fastboot_fail("invalid GPT partition", response); 354 return; 355 } 356 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) { 357 printf("%s: writing GPT partitions failed\n", __func__); 358 fastboot_fail("writing GPT partitions failed", 359 response); 360 return; 361 } 362 printf("........ success\n"); 363 fastboot_okay(NULL, response); 364 return; 365 } 366 #endif 367 368 #if CONFIG_IS_ENABLED(DOS_PARTITION) 369 if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) { 370 printf("%s: updating MBR\n", __func__); 371 if (is_valid_dos_buf(download_buffer)) { 372 printf("%s: invalid MBR - refusing to write to flash\n", 373 __func__); 374 fastboot_fail("invalid MBR partition", response); 375 return; 376 } 377 if (write_mbr_partition(dev_desc, download_buffer)) { 378 printf("%s: writing MBR partition failed\n", __func__); 379 fastboot_fail("writing MBR partition failed", 380 response); 381 return; 382 } 383 printf("........ success\n"); 384 fastboot_okay(NULL, response); 385 return; 386 } 387 #endif 388 389 #ifdef CONFIG_ANDROID_BOOT_IMAGE 390 if (strncasecmp(cmd, "zimage", 6) == 0) { 391 fb_mmc_update_zimage(dev_desc, download_buffer, 392 download_bytes, response); 393 return; 394 } 395 #endif 396 397 if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) { 398 pr_err("cannot find partition: '%s'\n", cmd); 399 fastboot_fail("cannot find partition", response); 400 return; 401 } 402 403 if (is_sparse_image(download_buffer)) { 404 struct fb_mmc_sparse sparse_priv; 405 struct sparse_storage sparse; 406 int err; 407 408 sparse_priv.dev_desc = dev_desc; 409 410 sparse.blksz = info.blksz; 411 sparse.start = info.start; 412 sparse.size = info.size; 413 sparse.write = fb_mmc_sparse_write; 414 sparse.reserve = fb_mmc_sparse_reserve; 415 sparse.mssg = fastboot_fail; 416 417 printf("Flashing sparse image at offset " LBAFU "\n", 418 sparse.start); 419 420 sparse.priv = &sparse_priv; 421 err = write_sparse_image(&sparse, cmd, download_buffer, 422 response); 423 if (!err) 424 fastboot_okay(NULL, response); 425 } else { 426 write_raw_image(dev_desc, &info, cmd, download_buffer, 427 download_bytes, response); 428 } 429 } 430 431 /** 432 * fastboot_mmc_flash_erase() - Erase eMMC for fastboot 433 * 434 * @cmd: Named partition to erase 435 * @response: Pointer to fastboot response buffer 436 */ 437 void fastboot_mmc_erase(const char *cmd, char *response) 438 { 439 int ret; 440 struct blk_desc *dev_desc; 441 disk_partition_t info; 442 lbaint_t blks, blks_start, blks_size, grp_size; 443 struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV); 444 445 if (mmc == NULL) { 446 pr_err("invalid mmc device\n"); 447 fastboot_fail("invalid mmc device", response); 448 return; 449 } 450 451 dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV); 452 if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) { 453 pr_err("invalid mmc device\n"); 454 fastboot_fail("invalid mmc device", response); 455 return; 456 } 457 458 ret = part_get_info_by_name_or_alias(dev_desc, cmd, &info); 459 if (ret < 0) { 460 pr_err("cannot find partition: '%s'\n", cmd); 461 fastboot_fail("cannot find partition", response); 462 return; 463 } 464 465 /* Align blocks to erase group size to avoid erasing other partitions */ 466 grp_size = mmc->erase_grp_size; 467 blks_start = (info.start + grp_size - 1) & ~(grp_size - 1); 468 if (info.size >= grp_size) 469 blks_size = (info.size - (blks_start - info.start)) & 470 (~(grp_size - 1)); 471 else 472 blks_size = 0; 473 474 printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n", 475 blks_start, blks_start + blks_size); 476 477 blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL); 478 479 if (blks != blks_size) { 480 pr_err("failed erasing from device %d\n", dev_desc->devnum); 481 fastboot_fail("failed erasing from device", response); 482 return; 483 } 484 485 printf("........ erased " LBAFU " bytes from '%s'\n", 486 blks_size * info.blksz, cmd); 487 fastboot_okay(NULL, response); 488 } 489