drivers/fastboot/fb_mmc.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright 2014 Broadcom Corporation.
   4  */
   5
   6 #include <config.h>
   7 #include <common.h>
   8 #include <blk.h>
   9 #include <env.h>
  10 #include <fastboot.h>
  11 #include <fastboot-internal.h>
  12 #include <fb_mmc.h>
  13 #include <flash.h>
  14 #include <image-sparse.h>
  15 #include <part.h>
  16 #include <mmc.h>
  17 #include <div64.h>
  18 #include <linux/compat.h>
  19 #include <android_image.h>
  20
  21 #define FASTBOOT_MAX_BLK_WRITE 16384
  22
  23 #define BOOT_PARTITION_NAME "boot"
  24
  25 struct fb_mmc_sparse {
  26         struct blk_desc *dev_desc;
  27 };
  28
  29 static int part_get_info_by_name_or_alias(struct blk_desc *dev_desc,
  30                 const char *name, disk_partition_t *info)
  31 {
  32         int ret;
  33
  34         ret = part_get_info_by_name(dev_desc, name, info);
  35         if (ret < 0) {
  36                 /* strlen("fastboot_partition_alias_") + PART_NAME_LEN + 1 */
  37                 char env_alias_name[25 + PART_NAME_LEN + 1];
  38                 char *aliased_part_name;
  39
  40                 /* check for alias */
  41                 strcpy(env_alias_name, "fastboot_partition_alias_");
  42                 strncat(env_alias_name, name, PART_NAME_LEN);
  43                 aliased_part_name = env_get(env_alias_name);
  44                 if (aliased_part_name != NULL)
  45                         ret = part_get_info_by_name(dev_desc,
  46                                         aliased_part_name, info);
  47         }
  48         return ret;
  49 }
  50
  51 /**
  52  * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE
  53  *
  54  * @block_dev: Pointer to block device
  55  * @start: First block to write/erase
  56  * @blkcnt: Count of blocks
  57  * @buffer: Pointer to data buffer for write or NULL for erase
  58  */
  59 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start,
  60                                  lbaint_t blkcnt, const void *buffer)
  61 {
  62         lbaint_t blk = start;
  63         lbaint_t blks_written;
  64         lbaint_t cur_blkcnt;
  65         lbaint_t blks = 0;
  66         int i;
  67
  68         for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) {
  69                 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE);
  70                 if (buffer) {
  71                         if (fastboot_progress_callback)
  72                                 fastboot_progress_callback("writing");
  73                         blks_written = blk_dwrite(block_dev, blk, cur_blkcnt,
  74                                                   buffer + (i * block_dev->blksz));
  75                 } else {
  76                         if (fastboot_progress_callback)
  77                                 fastboot_progress_callback("erasing");
  78                         blks_written = blk_derase(block_dev, blk, cur_blkcnt);
  79                 }
  80                 blk += blks_written;
  81                 blks += blks_written;
  82         }
  83         return blks;
  84 }
  85
  86 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info,
  87                 lbaint_t blk, lbaint_t blkcnt, const void *buffer)
  88 {
  89         struct fb_mmc_sparse *sparse = info->priv;
  90         struct blk_desc *dev_desc = sparse->dev_desc;
  91
  92         return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer);
  93 }
  94
  95 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info,
  96                 lbaint_t blk, lbaint_t blkcnt)
  97 {
  98         return blkcnt;
  99 }
 100
 101 static void write_raw_image(struct blk_desc *dev_desc, disk_partition_t *info,
 102                 const char *part_name, void *buffer,
 103                 u32 download_bytes, char *response)
 104 {
 105         lbaint_t blkcnt;
 106         lbaint_t blks;
 107
 108         /* determine number of blocks to write */
 109         blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1));
 110         blkcnt = lldiv(blkcnt, info->blksz);
 111
 112         if (blkcnt > info->size) {
 113                 pr_err("too large for partition: '%s'\n", part_name);
 114                 fastboot_fail("too large for partition", response);
 115                 return;
 116         }
 117
 118         puts("Flashing Raw Image\n");
 119
 120         blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer);
 121
 122         if (blks != blkcnt) {
 123                 pr_err("failed writing to device %d\n", dev_desc->devnum);
 124                 fastboot_fail("failed writing to device", response);
 125                 return;
 126         }
 127
 128         printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz,
 129                part_name);
 130         fastboot_okay(NULL, response);
 131 }
 132
 133 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 134 static int fb_mmc_erase_mmc_hwpart(struct blk_desc *dev_desc)
 135 {
 136         lbaint_t blks;
 137
 138         debug("Start Erasing mmc hwpart[%u]...\n", dev_desc->hwpart);
 139
 140         blks = fb_mmc_blk_write(dev_desc, 0, dev_desc->lba, NULL);
 141
 142         if (blks != dev_desc->lba) {
 143                 pr_err("Failed to erase mmc hwpart[%u]\n", dev_desc->hwpart);
 144                 return 1;
 145         }
 146
 147         printf("........ erased %lu bytes from mmc hwpart[%u]\n",
 148                dev_desc->lba * dev_desc->blksz, dev_desc->hwpart);
 149
 150         return 0;
 151 }
 152
 153 static void fb_mmc_boot1_ops(struct blk_desc *dev_desc, void *buffer,
 154                              u32 buff_sz, char *response)
 155 {
 156         lbaint_t blkcnt;
 157         lbaint_t blks;
 158         unsigned long blksz;
 159
 160         // To operate on EMMC_BOOT1 (mmc0boot0), we first change the hwpart
 161         if (blk_dselect_hwpart(dev_desc, 1)) {
 162                 pr_err("Failed to select hwpart\n");
 163                 fastboot_fail("Failed to select hwpart", response);
 164                 return;
 165         }
 166
 167         if (buffer) { /* flash */
 168
 169                 /* determine number of blocks to write */
 170                 blksz = dev_desc->blksz;
 171                 blkcnt = ((buff_sz + (blksz - 1)) & ~(blksz - 1));
 172                 blkcnt = lldiv(blkcnt, blksz);
 173
 174                 if (blkcnt > dev_desc->lba) {
 175                         pr_err("Image size too large\n");
 176                         fastboot_fail("Image size too large", response);
 177                         return;
 178                 }
 179
 180                 debug("Start Flashing Image to EMMC_BOOT1...\n");
 181
 182                 blks = fb_mmc_blk_write(dev_desc, 0, blkcnt, buffer);
 183
 184                 if (blks != blkcnt) {
 185                         pr_err("Failed to write EMMC_BOOT1\n");
 186                         fastboot_fail("Failed to write EMMC_BOOT1", response);
 187                         return;
 188                 }
 189
 190                 printf("........ wrote %lu bytes to EMMC_BOOT1\n",
 191                        blkcnt * blksz);
 192         } else { /* erase */
 193                 if (fb_mmc_erase_mmc_hwpart(dev_desc)) {
 194                         fastboot_fail("Failed to erase EMMC_BOOT1", response);
 195                         return;
 196                 }
 197         }
 198
 199         fastboot_okay(NULL, response);
 200 }
 201 #endif
 202
 203 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 204 /**
 205  * Read Android boot image header from boot partition.
 206  *
 207  * @param[in] dev_desc MMC device descriptor
 208  * @param[in] info Boot partition info
 209  * @param[out] hdr Where to store read boot image header
 210  *
 211  * @return Boot image header sectors count or 0 on error
 212  */
 213 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc,
 214                                        disk_partition_t *info,
 215                                        struct andr_img_hdr *hdr,
 216                                        char *response)
 217 {
 218         ulong sector_size;              /* boot partition sector size */
 219         lbaint_t hdr_sectors;           /* boot image header sectors count */
 220         int res;
 221
 222         /* Calculate boot image sectors count */
 223         sector_size = info->blksz;
 224         hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_img_hdr), sector_size);
 225         if (hdr_sectors == 0) {
 226                 pr_err("invalid number of boot sectors: 0\n");
 227                 fastboot_fail("invalid number of boot sectors: 0", response);
 228                 return 0;
 229         }
 230
 231         /* Read the boot image header */
 232         res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr);
 233         if (res != hdr_sectors) {
 234                 pr_err("cannot read header from boot partition\n");
 235                 fastboot_fail("cannot read header from boot partition",
 236                               response);
 237                 return 0;
 238         }
 239
 240         /* Check boot header magic string */
 241         res = android_image_check_header(hdr);
 242         if (res != 0) {
 243                 pr_err("bad boot image magic\n");
 244                 fastboot_fail("boot partition not initialized", response);
 245                 return 0;
 246         }
 247
 248         return hdr_sectors;
 249 }
 250
 251 /**
 252  * Write downloaded zImage to boot partition and repack it properly.
 253  *
 254  * @param dev_desc MMC device descriptor
 255  * @param download_buffer Address to fastboot buffer with zImage in it
 256  * @param download_bytes Size of fastboot buffer, in bytes
 257  *
 258  * @return 0 on success or -1 on error
 259  */
 260 static int fb_mmc_update_zimage(struct blk_desc *dev_desc,
 261                                 void *download_buffer,
 262                                 u32 download_bytes,
 263                                 char *response)
 264 {
 265         uintptr_t hdr_addr;                     /* boot image header address */
 266         struct andr_img_hdr *hdr;               /* boot image header */
 267         lbaint_t hdr_sectors;                   /* boot image header sectors */
 268         u8 *ramdisk_buffer;
 269         u32 ramdisk_sector_start;
 270         u32 ramdisk_sectors;
 271         u32 kernel_sector_start;
 272         u32 kernel_sectors;
 273         u32 sectors_per_page;
 274         disk_partition_t info;
 275         int res;
 276
 277         puts("Flashing zImage\n");
 278
 279         /* Get boot partition info */
 280         res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info);
 281         if (res < 0) {
 282                 pr_err("cannot find boot partition\n");
 283                 fastboot_fail("cannot find boot partition", response);
 284                 return -1;
 285         }
 286
 287         /* Put boot image header in fastboot buffer after downloaded zImage */
 288         hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE);
 289         hdr = (struct andr_img_hdr *)hdr_addr;
 290
 291         /* Read boot image header */
 292         hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response);
 293         if (hdr_sectors == 0) {
 294                 pr_err("unable to read boot image header\n");
 295                 fastboot_fail("unable to read boot image header", response);
 296                 return -1;
 297         }
 298
 299         /* Check if boot image has second stage in it (we don't support it) */
 300         if (hdr->second_size > 0) {
 301                 pr_err("moving second stage is not supported yet\n");
 302                 fastboot_fail("moving second stage is not supported yet",
 303                               response);
 304                 return -1;
 305         }
 306
 307         /* Extract ramdisk location */
 308         sectors_per_page = hdr->page_size / info.blksz;
 309         ramdisk_sector_start = info.start + sectors_per_page;
 310         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 311                                              sectors_per_page;
 312         ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) *
 313                                        sectors_per_page;
 314
 315         /* Read ramdisk and put it in fastboot buffer after boot image header */
 316         ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz);
 317         res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 318                         ramdisk_buffer);
 319         if (res != ramdisk_sectors) {
 320                 pr_err("cannot read ramdisk from boot partition\n");
 321                 fastboot_fail("cannot read ramdisk from boot partition",
 322                               response);
 323                 return -1;
 324         }
 325
 326         /* Write new kernel size to boot image header */
 327         hdr->kernel_size = download_bytes;
 328         res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr);
 329         if (res == 0) {
 330                 pr_err("cannot writeback boot image header\n");
 331                 fastboot_fail("cannot write back boot image header", response);
 332                 return -1;
 333         }
 334
 335         /* Write the new downloaded kernel */
 336         kernel_sector_start = info.start + sectors_per_page;
 337         kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 338                                       sectors_per_page;
 339         res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors,
 340                          download_buffer);
 341         if (res == 0) {
 342                 pr_err("cannot write new kernel\n");
 343                 fastboot_fail("cannot write new kernel", response);
 344                 return -1;
 345         }
 346
 347         /* Write the saved ramdisk back */
 348         ramdisk_sector_start = info.start + sectors_per_page;
 349         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 350                                              sectors_per_page;
 351         res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 352                          ramdisk_buffer);
 353         if (res == 0) {
 354                 pr_err("cannot write back original ramdisk\n");
 355                 fastboot_fail("cannot write back original ramdisk", response);
 356                 return -1;
 357         }
 358
 359         puts("........ zImage was updated in boot partition\n");
 360         fastboot_okay(NULL, response);
 361         return 0;
 362 }
 363 #endif
 364
 365 /**
 366  * fastboot_mmc_get_part_info() - Lookup eMMC partion by name
 367  *
 368  * @part_name: Named partition to lookup
 369  * @dev_desc: Pointer to returned blk_desc pointer
 370  * @part_info: Pointer to returned disk_partition_t
 371  * @response: Pointer to fastboot response buffer
 372  */
 373 int fastboot_mmc_get_part_info(const char *part_name,
 374                                struct blk_desc **dev_desc,
 375                                disk_partition_t *part_info, char *response)
 376 {
 377         int r;
 378
 379         *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 380         if (!*dev_desc) {
 381                 fastboot_fail("block device not found", response);
 382                 return -ENOENT;
 383         }
 384         if (!part_name || !strcmp(part_name, "")) {
 385                 fastboot_fail("partition not given", response);
 386                 return -ENOENT;
 387         }
 388
 389         r = part_get_info_by_name_or_alias(*dev_desc, part_name, part_info);
 390         if (r < 0) {
 391                 fastboot_fail("partition not found", response);
 392                 return r;
 393         }
 394
 395         return r;
 396 }
 397
 398 /**
 399  * fastboot_mmc_flash_write() - Write image to eMMC for fastboot
 400  *
 401  * @cmd: Named partition to write image to
 402  * @download_buffer: Pointer to image data
 403  * @download_bytes: Size of image data
 404  * @response: Pointer to fastboot response buffer
 405  */
 406 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer,
 407                               u32 download_bytes, char *response)
 408 {
 409         struct blk_desc *dev_desc;
 410         disk_partition_t info;
 411
 412         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 413         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 414                 pr_err("invalid mmc device\n");
 415                 fastboot_fail("invalid mmc device", response);
 416                 return;
 417         }
 418
 419 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 420         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 421                 fb_mmc_boot1_ops(dev_desc, download_buffer,
 422                                  download_bytes, response);
 423                 return;
 424         }
 425 #endif
 426
 427 #if CONFIG_IS_ENABLED(EFI_PARTITION)
 428 #ifndef CONFIG_FASTBOOT_MMC_USER_NAME
 429         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) {
 430 #else
 431         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0 ||
 432             strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 433 #endif
 434                 printf("%s: updating MBR, Primary and Backup GPT(s)\n",
 435                        __func__);
 436                 if (is_valid_gpt_buf(dev_desc, download_buffer)) {
 437                         printf("%s: invalid GPT - refusing to write to flash\n",
 438                                __func__);
 439                         fastboot_fail("invalid GPT partition", response);
 440                         return;
 441                 }
 442                 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) {
 443                         printf("%s: writing GPT partitions failed\n", __func__);
 444                         fastboot_fail("writing GPT partitions failed",
 445                                       response);
 446                         return;
 447                 }
 448                 printf("........ success\n");
 449                 fastboot_okay(NULL, response);
 450                 return;
 451         }
 452 #endif
 453
 454 #if CONFIG_IS_ENABLED(DOS_PARTITION)
 455         if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) {
 456                 printf("%s: updating MBR\n", __func__);
 457                 if (is_valid_dos_buf(download_buffer)) {
 458                         printf("%s: invalid MBR - refusing to write to flash\n",
 459                                __func__);
 460                         fastboot_fail("invalid MBR partition", response);
 461                         return;
 462                 }
 463                 if (write_mbr_partition(dev_desc, download_buffer)) {
 464                         printf("%s: writing MBR partition failed\n", __func__);
 465                         fastboot_fail("writing MBR partition failed",
 466                                       response);
 467                         return;
 468                 }
 469                 printf("........ success\n");
 470                 fastboot_okay(NULL, response);
 471                 return;
 472         }
 473 #endif
 474
 475 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 476         if (strncasecmp(cmd, "zimage", 6) == 0) {
 477                 fb_mmc_update_zimage(dev_desc, download_buffer,
 478                                      download_bytes, response);
 479                 return;
 480         }
 481 #endif
 482
 483         if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) {
 484                 pr_err("cannot find partition: '%s'\n", cmd);
 485                 fastboot_fail("cannot find partition", response);
 486                 return;
 487         }
 488
 489         if (is_sparse_image(download_buffer)) {
 490                 struct fb_mmc_sparse sparse_priv;
 491                 struct sparse_storage sparse;
 492                 int err;
 493
 494                 sparse_priv.dev_desc = dev_desc;
 495
 496                 sparse.blksz = info.blksz;
 497                 sparse.start = info.start;
 498                 sparse.size = info.size;
 499                 sparse.write = fb_mmc_sparse_write;
 500                 sparse.reserve = fb_mmc_sparse_reserve;
 501                 sparse.mssg = fastboot_fail;
 502
 503                 printf("Flashing sparse image at offset " LBAFU "\n",
 504                        sparse.start);
 505
 506                 sparse.priv = &sparse_priv;
 507                 err = write_sparse_image(&sparse, cmd, download_buffer,
 508                                          response);
 509                 if (!err)
 510                         fastboot_okay(NULL, response);
 511         } else {
 512                 write_raw_image(dev_desc, &info, cmd, download_buffer,
 513                                 download_bytes, response);
 514         }
 515 }
 516
 517 /**
 518  * fastboot_mmc_flash_erase() - Erase eMMC for fastboot
 519  *
 520  * @cmd: Named partition to erase
 521  * @response: Pointer to fastboot response buffer
 522  */
 523 void fastboot_mmc_erase(const char *cmd, char *response)
 524 {
 525         int ret;
 526         struct blk_desc *dev_desc;
 527         disk_partition_t info;
 528         lbaint_t blks, blks_start, blks_size, grp_size;
 529         struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV);
 530
 531         if (mmc == NULL) {
 532                 pr_err("invalid mmc device\n");
 533                 fastboot_fail("invalid mmc device", response);
 534                 return;
 535         }
 536
 537         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 538         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 539                 pr_err("invalid mmc device\n");
 540                 fastboot_fail("invalid mmc device", response);
 541                 return;
 542         }
 543
 544 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 545         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 546                 /* erase EMMC boot1 */
 547                 fb_mmc_boot1_ops(dev_desc, NULL, 0, response);
 548                 return;
 549         }
 550 #endif
 551
 552 #ifdef CONFIG_FASTBOOT_MMC_USER_NAME
 553         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 554                 /* erase EMMC userdata */
 555                 if (fb_mmc_erase_mmc_hwpart(dev_desc))
 556                         fastboot_fail("Failed to erase EMMC_USER", response);
 557                 else
 558                         fastboot_okay(NULL, response);
 559                 return;
 560         }
 561 #endif
 562
 563         ret = part_get_info_by_name_or_alias(dev_desc, cmd, &info);
 564         if (ret < 0) {
 565                 pr_err("cannot find partition: '%s'\n", cmd);
 566                 fastboot_fail("cannot find partition", response);
 567                 return;
 568         }
 569
 570         /* Align blocks to erase group size to avoid erasing other partitions */
 571         grp_size = mmc->erase_grp_size;
 572         blks_start = (info.start + grp_size - 1) & ~(grp_size - 1);
 573         if (info.size >= grp_size)
 574                 blks_size = (info.size - (blks_start - info.start)) &
 575                                 (~(grp_size - 1));
 576         else
 577                 blks_size = 0;
 578
 579         printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n",
 580                blks_start, blks_start + blks_size);
 581
 582         blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL);
 583
 584         if (blks != blks_size) {
 585                 pr_err("failed erasing from device %d\n", dev_desc->devnum);
 586                 fastboot_fail("failed erasing from device", response);
 587                 return;
 588         }
 589
 590         printf("........ erased " LBAFU " bytes from '%s'\n",
 591                blks_size * info.blksz, cmd);
 592         fastboot_okay(NULL, response);
 593 }