drivers/fastboot/fb_mmc.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright 2014 Broadcom Corporation.
   4  */
   5
   6 #include <config.h>
   7 #include <common.h>
   8 #include <blk.h>
   9 #include <env.h>
  10 #include <fastboot.h>
  11 #include <fastboot-internal.h>
  12 #include <fb_mmc.h>
  13 #include <flash.h>
  14 #include <image-sparse.h>
  15 #include <image.h>
  16 #include <part.h>
  17 #include <mmc.h>
  18 #include <div64.h>
  19 #include <linux/compat.h>
  20 #include <android_image.h>
  21
  22 #define FASTBOOT_MAX_BLK_WRITE 16384
  23
  24 #define BOOT_PARTITION_NAME "boot"
  25
  26 struct fb_mmc_sparse {
  27         struct blk_desc *dev_desc;
  28 };
  29
  30 static int part_get_info_by_name_or_alias(struct blk_desc *dev_desc,
  31                 const char *name, struct disk_partition *info)
  32 {
  33         int ret;
  34
  35         ret = part_get_info_by_name(dev_desc, name, info);
  36         if (ret < 0) {
  37                 /* strlen("fastboot_partition_alias_") + PART_NAME_LEN + 1 */
  38                 char env_alias_name[25 + PART_NAME_LEN + 1];
  39                 char *aliased_part_name;
  40
  41                 /* check for alias */
  42                 strcpy(env_alias_name, "fastboot_partition_alias_");
  43                 strncat(env_alias_name, name, PART_NAME_LEN);
  44                 aliased_part_name = env_get(env_alias_name);
  45                 if (aliased_part_name != NULL)
  46                         ret = part_get_info_by_name(dev_desc,
  47                                         aliased_part_name, info);
  48         }
  49         return ret;
  50 }
  51
  52 /**
  53  * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE
  54  *
  55  * @block_dev: Pointer to block device
  56  * @start: First block to write/erase
  57  * @blkcnt: Count of blocks
  58  * @buffer: Pointer to data buffer for write or NULL for erase
  59  */
  60 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start,
  61                                  lbaint_t blkcnt, const void *buffer)
  62 {
  63         lbaint_t blk = start;
  64         lbaint_t blks_written;
  65         lbaint_t cur_blkcnt;
  66         lbaint_t blks = 0;
  67         int i;
  68
  69         for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) {
  70                 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE);
  71                 if (buffer) {
  72                         if (fastboot_progress_callback)
  73                                 fastboot_progress_callback("writing");
  74                         blks_written = blk_dwrite(block_dev, blk, cur_blkcnt,
  75                                                   buffer + (i * block_dev->blksz));
  76                 } else {
  77                         if (fastboot_progress_callback)
  78                                 fastboot_progress_callback("erasing");
  79                         blks_written = blk_derase(block_dev, blk, cur_blkcnt);
  80                 }
  81                 blk += blks_written;
  82                 blks += blks_written;
  83         }
  84         return blks;
  85 }
  86
  87 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info,
  88                 lbaint_t blk, lbaint_t blkcnt, const void *buffer)
  89 {
  90         struct fb_mmc_sparse *sparse = info->priv;
  91         struct blk_desc *dev_desc = sparse->dev_desc;
  92
  93         return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer);
  94 }
  95
  96 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info,
  97                 lbaint_t blk, lbaint_t blkcnt)
  98 {
  99         return blkcnt;
 100 }
 101
 102 static void write_raw_image(struct blk_desc *dev_desc,
 103                             struct disk_partition *info, const char *part_name,
 104                             void *buffer, u32 download_bytes, char *response)
 105 {
 106         lbaint_t blkcnt;
 107         lbaint_t blks;
 108
 109         /* determine number of blocks to write */
 110         blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1));
 111         blkcnt = lldiv(blkcnt, info->blksz);
 112
 113         if (blkcnt > info->size) {
 114                 pr_err("too large for partition: '%s'\n", part_name);
 115                 fastboot_fail("too large for partition", response);
 116                 return;
 117         }
 118
 119         puts("Flashing Raw Image\n");
 120
 121         blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer);
 122
 123         if (blks != blkcnt) {
 124                 pr_err("failed writing to device %d\n", dev_desc->devnum);
 125                 fastboot_fail("failed writing to device", response);
 126                 return;
 127         }
 128
 129         printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz,
 130                part_name);
 131         fastboot_okay(NULL, response);
 132 }
 133
 134 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 135 static int fb_mmc_erase_mmc_hwpart(struct blk_desc *dev_desc)
 136 {
 137         lbaint_t blks;
 138
 139         debug("Start Erasing mmc hwpart[%u]...\n", dev_desc->hwpart);
 140
 141         blks = fb_mmc_blk_write(dev_desc, 0, dev_desc->lba, NULL);
 142
 143         if (blks != dev_desc->lba) {
 144                 pr_err("Failed to erase mmc hwpart[%u]\n", dev_desc->hwpart);
 145                 return 1;
 146         }
 147
 148         printf("........ erased %lu bytes from mmc hwpart[%u]\n",
 149                dev_desc->lba * dev_desc->blksz, dev_desc->hwpart);
 150
 151         return 0;
 152 }
 153
 154 static void fb_mmc_boot1_ops(struct blk_desc *dev_desc, void *buffer,
 155                              u32 buff_sz, char *response)
 156 {
 157         lbaint_t blkcnt;
 158         lbaint_t blks;
 159         unsigned long blksz;
 160
 161         // To operate on EMMC_BOOT1 (mmc0boot0), we first change the hwpart
 162         if (blk_dselect_hwpart(dev_desc, 1)) {
 163                 pr_err("Failed to select hwpart\n");
 164                 fastboot_fail("Failed to select hwpart", response);
 165                 return;
 166         }
 167
 168         if (buffer) { /* flash */
 169
 170                 /* determine number of blocks to write */
 171                 blksz = dev_desc->blksz;
 172                 blkcnt = ((buff_sz + (blksz - 1)) & ~(blksz - 1));
 173                 blkcnt = lldiv(blkcnt, blksz);
 174
 175                 if (blkcnt > dev_desc->lba) {
 176                         pr_err("Image size too large\n");
 177                         fastboot_fail("Image size too large", response);
 178                         return;
 179                 }
 180
 181                 debug("Start Flashing Image to EMMC_BOOT1...\n");
 182
 183                 blks = fb_mmc_blk_write(dev_desc, 0, blkcnt, buffer);
 184
 185                 if (blks != blkcnt) {
 186                         pr_err("Failed to write EMMC_BOOT1\n");
 187                         fastboot_fail("Failed to write EMMC_BOOT1", response);
 188                         return;
 189                 }
 190
 191                 printf("........ wrote %lu bytes to EMMC_BOOT1\n",
 192                        blkcnt * blksz);
 193         } else { /* erase */
 194                 if (fb_mmc_erase_mmc_hwpart(dev_desc)) {
 195                         fastboot_fail("Failed to erase EMMC_BOOT1", response);
 196                         return;
 197                 }
 198         }
 199
 200         fastboot_okay(NULL, response);
 201 }
 202 #endif
 203
 204 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 205 /**
 206  * Read Android boot image header from boot partition.
 207  *
 208  * @param[in] dev_desc MMC device descriptor
 209  * @param[in] info Boot partition info
 210  * @param[out] hdr Where to store read boot image header
 211  *
 212  * @return Boot image header sectors count or 0 on error
 213  */
 214 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc,
 215                                        struct disk_partition *info,
 216                                        struct andr_img_hdr *hdr,
 217                                        char *response)
 218 {
 219         ulong sector_size;              /* boot partition sector size */
 220         lbaint_t hdr_sectors;           /* boot image header sectors count */
 221         int res;
 222
 223         /* Calculate boot image sectors count */
 224         sector_size = info->blksz;
 225         hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_img_hdr), sector_size);
 226         if (hdr_sectors == 0) {
 227                 pr_err("invalid number of boot sectors: 0\n");
 228                 fastboot_fail("invalid number of boot sectors: 0", response);
 229                 return 0;
 230         }
 231
 232         /* Read the boot image header */
 233         res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr);
 234         if (res != hdr_sectors) {
 235                 pr_err("cannot read header from boot partition\n");
 236                 fastboot_fail("cannot read header from boot partition",
 237                               response);
 238                 return 0;
 239         }
 240
 241         /* Check boot header magic string */
 242         res = android_image_check_header(hdr);
 243         if (res != 0) {
 244                 pr_err("bad boot image magic\n");
 245                 fastboot_fail("boot partition not initialized", response);
 246                 return 0;
 247         }
 248
 249         return hdr_sectors;
 250 }
 251
 252 /**
 253  * Write downloaded zImage to boot partition and repack it properly.
 254  *
 255  * @param dev_desc MMC device descriptor
 256  * @param download_buffer Address to fastboot buffer with zImage in it
 257  * @param download_bytes Size of fastboot buffer, in bytes
 258  *
 259  * @return 0 on success or -1 on error
 260  */
 261 static int fb_mmc_update_zimage(struct blk_desc *dev_desc,
 262                                 void *download_buffer,
 263                                 u32 download_bytes,
 264                                 char *response)
 265 {
 266         uintptr_t hdr_addr;                     /* boot image header address */
 267         struct andr_img_hdr *hdr;               /* boot image header */
 268         lbaint_t hdr_sectors;                   /* boot image header sectors */
 269         u8 *ramdisk_buffer;
 270         u32 ramdisk_sector_start;
 271         u32 ramdisk_sectors;
 272         u32 kernel_sector_start;
 273         u32 kernel_sectors;
 274         u32 sectors_per_page;
 275         struct disk_partition info;
 276         int res;
 277
 278         puts("Flashing zImage\n");
 279
 280         /* Get boot partition info */
 281         res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info);
 282         if (res < 0) {
 283                 pr_err("cannot find boot partition\n");
 284                 fastboot_fail("cannot find boot partition", response);
 285                 return -1;
 286         }
 287
 288         /* Put boot image header in fastboot buffer after downloaded zImage */
 289         hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE);
 290         hdr = (struct andr_img_hdr *)hdr_addr;
 291
 292         /* Read boot image header */
 293         hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response);
 294         if (hdr_sectors == 0) {
 295                 pr_err("unable to read boot image header\n");
 296                 fastboot_fail("unable to read boot image header", response);
 297                 return -1;
 298         }
 299
 300         /* Check if boot image has second stage in it (we don't support it) */
 301         if (hdr->second_size > 0) {
 302                 pr_err("moving second stage is not supported yet\n");
 303                 fastboot_fail("moving second stage is not supported yet",
 304                               response);
 305                 return -1;
 306         }
 307
 308         /* Extract ramdisk location */
 309         sectors_per_page = hdr->page_size / info.blksz;
 310         ramdisk_sector_start = info.start + sectors_per_page;
 311         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 312                                              sectors_per_page;
 313         ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) *
 314                                        sectors_per_page;
 315
 316         /* Read ramdisk and put it in fastboot buffer after boot image header */
 317         ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz);
 318         res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 319                         ramdisk_buffer);
 320         if (res != ramdisk_sectors) {
 321                 pr_err("cannot read ramdisk from boot partition\n");
 322                 fastboot_fail("cannot read ramdisk from boot partition",
 323                               response);
 324                 return -1;
 325         }
 326
 327         /* Write new kernel size to boot image header */
 328         hdr->kernel_size = download_bytes;
 329         res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr);
 330         if (res == 0) {
 331                 pr_err("cannot writeback boot image header\n");
 332                 fastboot_fail("cannot write back boot image header", response);
 333                 return -1;
 334         }
 335
 336         /* Write the new downloaded kernel */
 337         kernel_sector_start = info.start + sectors_per_page;
 338         kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 339                                       sectors_per_page;
 340         res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors,
 341                          download_buffer);
 342         if (res == 0) {
 343                 pr_err("cannot write new kernel\n");
 344                 fastboot_fail("cannot write new kernel", response);
 345                 return -1;
 346         }
 347
 348         /* Write the saved ramdisk back */
 349         ramdisk_sector_start = info.start + sectors_per_page;
 350         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 351                                              sectors_per_page;
 352         res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 353                          ramdisk_buffer);
 354         if (res == 0) {
 355                 pr_err("cannot write back original ramdisk\n");
 356                 fastboot_fail("cannot write back original ramdisk", response);
 357                 return -1;
 358         }
 359
 360         puts("........ zImage was updated in boot partition\n");
 361         fastboot_okay(NULL, response);
 362         return 0;
 363 }
 364 #endif
 365
 366 /**
 367  * fastboot_mmc_get_part_info() - Lookup eMMC partion by name
 368  *
 369  * @part_name: Named partition to lookup
 370  * @dev_desc: Pointer to returned blk_desc pointer
 371  * @part_info: Pointer to returned struct disk_partition
 372  * @response: Pointer to fastboot response buffer
 373  */
 374 int fastboot_mmc_get_part_info(const char *part_name,
 375                                struct blk_desc **dev_desc,
 376                                struct disk_partition *part_info, char *response)
 377 {
 378         int r;
 379
 380         *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 381         if (!*dev_desc) {
 382                 fastboot_fail("block device not found", response);
 383                 return -ENOENT;
 384         }
 385         if (!part_name || !strcmp(part_name, "")) {
 386                 fastboot_fail("partition not given", response);
 387                 return -ENOENT;
 388         }
 389
 390         r = part_get_info_by_name_or_alias(*dev_desc, part_name, part_info);
 391         if (r < 0) {
 392                 fastboot_fail("partition not found", response);
 393                 return r;
 394         }
 395
 396         return r;
 397 }
 398
 399 /**
 400  * fastboot_mmc_flash_write() - Write image to eMMC for fastboot
 401  *
 402  * @cmd: Named partition to write image to
 403  * @download_buffer: Pointer to image data
 404  * @download_bytes: Size of image data
 405  * @response: Pointer to fastboot response buffer
 406  */
 407 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer,
 408                               u32 download_bytes, char *response)
 409 {
 410         struct blk_desc *dev_desc;
 411         struct disk_partition info;
 412
 413         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 414         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 415                 pr_err("invalid mmc device\n");
 416                 fastboot_fail("invalid mmc device", response);
 417                 return;
 418         }
 419
 420 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 421         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 422                 fb_mmc_boot1_ops(dev_desc, download_buffer,
 423                                  download_bytes, response);
 424                 return;
 425         }
 426 #endif
 427
 428 #if CONFIG_IS_ENABLED(EFI_PARTITION)
 429 #ifndef CONFIG_FASTBOOT_MMC_USER_NAME
 430         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) {
 431 #else
 432         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0 ||
 433             strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 434 #endif
 435                 printf("%s: updating MBR, Primary and Backup GPT(s)\n",
 436                        __func__);
 437                 if (is_valid_gpt_buf(dev_desc, download_buffer)) {
 438                         printf("%s: invalid GPT - refusing to write to flash\n",
 439                                __func__);
 440                         fastboot_fail("invalid GPT partition", response);
 441                         return;
 442                 }
 443                 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) {
 444                         printf("%s: writing GPT partitions failed\n", __func__);
 445                         fastboot_fail("writing GPT partitions failed",
 446                                       response);
 447                         return;
 448                 }
 449                 printf("........ success\n");
 450                 fastboot_okay(NULL, response);
 451                 return;
 452         }
 453 #endif
 454
 455 #if CONFIG_IS_ENABLED(DOS_PARTITION)
 456         if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) {
 457                 printf("%s: updating MBR\n", __func__);
 458                 if (is_valid_dos_buf(download_buffer)) {
 459                         printf("%s: invalid MBR - refusing to write to flash\n",
 460                                __func__);
 461                         fastboot_fail("invalid MBR partition", response);
 462                         return;
 463                 }
 464                 if (write_mbr_partition(dev_desc, download_buffer)) {
 465                         printf("%s: writing MBR partition failed\n", __func__);
 466                         fastboot_fail("writing MBR partition failed",
 467                                       response);
 468                         return;
 469                 }
 470                 printf("........ success\n");
 471                 fastboot_okay(NULL, response);
 472                 return;
 473         }
 474 #endif
 475
 476 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 477         if (strncasecmp(cmd, "zimage", 6) == 0) {
 478                 fb_mmc_update_zimage(dev_desc, download_buffer,
 479                                      download_bytes, response);
 480                 return;
 481         }
 482 #endif
 483
 484         if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) {
 485                 pr_err("cannot find partition: '%s'\n", cmd);
 486                 fastboot_fail("cannot find partition", response);
 487                 return;
 488         }
 489
 490         if (is_sparse_image(download_buffer)) {
 491                 struct fb_mmc_sparse sparse_priv;
 492                 struct sparse_storage sparse;
 493                 int err;
 494
 495                 sparse_priv.dev_desc = dev_desc;
 496
 497                 sparse.blksz = info.blksz;
 498                 sparse.start = info.start;
 499                 sparse.size = info.size;
 500                 sparse.write = fb_mmc_sparse_write;
 501                 sparse.reserve = fb_mmc_sparse_reserve;
 502                 sparse.mssg = fastboot_fail;
 503
 504                 printf("Flashing sparse image at offset " LBAFU "\n",
 505                        sparse.start);
 506
 507                 sparse.priv = &sparse_priv;
 508                 err = write_sparse_image(&sparse, cmd, download_buffer,
 509                                          response);
 510                 if (!err)
 511                         fastboot_okay(NULL, response);
 512         } else {
 513                 write_raw_image(dev_desc, &info, cmd, download_buffer,
 514                                 download_bytes, response);
 515         }
 516 }
 517
 518 /**
 519  * fastboot_mmc_flash_erase() - Erase eMMC for fastboot
 520  *
 521  * @cmd: Named partition to erase
 522  * @response: Pointer to fastboot response buffer
 523  */
 524 void fastboot_mmc_erase(const char *cmd, char *response)
 525 {
 526         int ret;
 527         struct blk_desc *dev_desc;
 528         struct disk_partition info;
 529         lbaint_t blks, blks_start, blks_size, grp_size;
 530         struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV);
 531
 532         if (mmc == NULL) {
 533                 pr_err("invalid mmc device\n");
 534                 fastboot_fail("invalid mmc device", response);
 535                 return;
 536         }
 537
 538         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 539         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 540                 pr_err("invalid mmc device\n");
 541                 fastboot_fail("invalid mmc device", response);
 542                 return;
 543         }
 544
 545 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 546         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 547                 /* erase EMMC boot1 */
 548                 fb_mmc_boot1_ops(dev_desc, NULL, 0, response);
 549                 return;
 550         }
 551 #endif
 552
 553 #ifdef CONFIG_FASTBOOT_MMC_USER_NAME
 554         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 555                 /* erase EMMC userdata */
 556                 if (fb_mmc_erase_mmc_hwpart(dev_desc))
 557                         fastboot_fail("Failed to erase EMMC_USER", response);
 558                 else
 559                         fastboot_okay(NULL, response);
 560                 return;
 561         }
 562 #endif
 563
 564         ret = part_get_info_by_name_or_alias(dev_desc, cmd, &info);
 565         if (ret < 0) {
 566                 pr_err("cannot find partition: '%s'\n", cmd);
 567                 fastboot_fail("cannot find partition", response);
 568                 return;
 569         }
 570
 571         /* Align blocks to erase group size to avoid erasing other partitions */
 572         grp_size = mmc->erase_grp_size;
 573         blks_start = (info.start + grp_size - 1) & ~(grp_size - 1);
 574         if (info.size >= grp_size)
 575                 blks_size = (info.size - (blks_start - info.start)) &
 576                                 (~(grp_size - 1));
 577         else
 578                 blks_size = 0;
 579
 580         printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n",
 581                blks_start, blks_start + blks_size);
 582
 583         blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL);
 584
 585         if (blks != blks_size) {
 586                 pr_err("failed erasing from device %d\n", dev_desc->devnum);
 587                 fastboot_fail("failed erasing from device", response);
 588                 return;
 589         }
 590
 591         printf("........ erased " LBAFU " bytes from '%s'\n",
 592                blks_size * info.blksz, cmd);
 593         fastboot_okay(NULL, response);
 594 }