drivers/fastboot/fb_mmc.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright 2014 Broadcom Corporation.
   4  */
   5
   6 #include <config.h>
   7 #include <common.h>
   8 #include <blk.h>
   9 #include <env.h>
  10 #include <fastboot.h>
  11 #include <fastboot-internal.h>
  12 #include <fb_mmc.h>
  13 #include <flash.h>
  14 #include <image-sparse.h>
  15 #include <image.h>
  16 #include <log.h>
  17 #include <part.h>
  18 #include <mmc.h>
  19 #include <div64.h>
  20 #include <linux/compat.h>
  21 #include <android_image.h>
  22
  23 #define FASTBOOT_MAX_BLK_WRITE 16384
  24
  25 #define BOOT_PARTITION_NAME "boot"
  26
  27 struct fb_mmc_sparse {
  28         struct blk_desc *dev_desc;
  29 };
  30
  31 static int part_get_info_by_name_or_alias(struct blk_desc *dev_desc,
  32                 const char *name, struct disk_partition *info)
  33 {
  34         int ret;
  35
  36         ret = part_get_info_by_name(dev_desc, name, info);
  37         if (ret < 0) {
  38                 /* strlen("fastboot_partition_alias_") + PART_NAME_LEN + 1 */
  39                 char env_alias_name[25 + PART_NAME_LEN + 1];
  40                 char *aliased_part_name;
  41
  42                 /* check for alias */
  43                 strcpy(env_alias_name, "fastboot_partition_alias_");
  44                 strncat(env_alias_name, name, PART_NAME_LEN);
  45                 aliased_part_name = env_get(env_alias_name);
  46                 if (aliased_part_name != NULL)
  47                         ret = part_get_info_by_name(dev_desc,
  48                                         aliased_part_name, info);
  49         }
  50         return ret;
  51 }
  52
  53 /**
  54  * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE
  55  *
  56  * @block_dev: Pointer to block device
  57  * @start: First block to write/erase
  58  * @blkcnt: Count of blocks
  59  * @buffer: Pointer to data buffer for write or NULL for erase
  60  */
  61 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start,
  62                                  lbaint_t blkcnt, const void *buffer)
  63 {
  64         lbaint_t blk = start;
  65         lbaint_t blks_written;
  66         lbaint_t cur_blkcnt;
  67         lbaint_t blks = 0;
  68         int i;
  69
  70         for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) {
  71                 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE);
  72                 if (buffer) {
  73                         if (fastboot_progress_callback)
  74                                 fastboot_progress_callback("writing");
  75                         blks_written = blk_dwrite(block_dev, blk, cur_blkcnt,
  76                                                   buffer + (i * block_dev->blksz));
  77                 } else {
  78                         if (fastboot_progress_callback)
  79                                 fastboot_progress_callback("erasing");
  80                         blks_written = blk_derase(block_dev, blk, cur_blkcnt);
  81                 }
  82                 blk += blks_written;
  83                 blks += blks_written;
  84         }
  85         return blks;
  86 }
  87
  88 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info,
  89                 lbaint_t blk, lbaint_t blkcnt, const void *buffer)
  90 {
  91         struct fb_mmc_sparse *sparse = info->priv;
  92         struct blk_desc *dev_desc = sparse->dev_desc;
  93
  94         return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer);
  95 }
  96
  97 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info,
  98                 lbaint_t blk, lbaint_t blkcnt)
  99 {
 100         return blkcnt;
 101 }
 102
 103 static void write_raw_image(struct blk_desc *dev_desc,
 104                             struct disk_partition *info, const char *part_name,
 105                             void *buffer, u32 download_bytes, char *response)
 106 {
 107         lbaint_t blkcnt;
 108         lbaint_t blks;
 109
 110         /* determine number of blocks to write */
 111         blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1));
 112         blkcnt = lldiv(blkcnt, info->blksz);
 113
 114         if (blkcnt > info->size) {
 115                 pr_err("too large for partition: '%s'\n", part_name);
 116                 fastboot_fail("too large for partition", response);
 117                 return;
 118         }
 119
 120         puts("Flashing Raw Image\n");
 121
 122         blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer);
 123
 124         if (blks != blkcnt) {
 125                 pr_err("failed writing to device %d\n", dev_desc->devnum);
 126                 fastboot_fail("failed writing to device", response);
 127                 return;
 128         }
 129
 130         printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz,
 131                part_name);
 132         fastboot_okay(NULL, response);
 133 }
 134
 135 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 136 static int fb_mmc_erase_mmc_hwpart(struct blk_desc *dev_desc)
 137 {
 138         lbaint_t blks;
 139
 140         debug("Start Erasing mmc hwpart[%u]...\n", dev_desc->hwpart);
 141
 142         blks = fb_mmc_blk_write(dev_desc, 0, dev_desc->lba, NULL);
 143
 144         if (blks != dev_desc->lba) {
 145                 pr_err("Failed to erase mmc hwpart[%u]\n", dev_desc->hwpart);
 146                 return 1;
 147         }
 148
 149         printf("........ erased %lu bytes from mmc hwpart[%u]\n",
 150                dev_desc->lba * dev_desc->blksz, dev_desc->hwpart);
 151
 152         return 0;
 153 }
 154
 155 static void fb_mmc_boot1_ops(struct blk_desc *dev_desc, void *buffer,
 156                              u32 buff_sz, char *response)
 157 {
 158         lbaint_t blkcnt;
 159         lbaint_t blks;
 160         unsigned long blksz;
 161
 162         // To operate on EMMC_BOOT1 (mmc0boot0), we first change the hwpart
 163         if (blk_dselect_hwpart(dev_desc, 1)) {
 164                 pr_err("Failed to select hwpart\n");
 165                 fastboot_fail("Failed to select hwpart", response);
 166                 return;
 167         }
 168
 169         if (buffer) { /* flash */
 170
 171                 /* determine number of blocks to write */
 172                 blksz = dev_desc->blksz;
 173                 blkcnt = ((buff_sz + (blksz - 1)) & ~(blksz - 1));
 174                 blkcnt = lldiv(blkcnt, blksz);
 175
 176                 if (blkcnt > dev_desc->lba) {
 177                         pr_err("Image size too large\n");
 178                         fastboot_fail("Image size too large", response);
 179                         return;
 180                 }
 181
 182                 debug("Start Flashing Image to EMMC_BOOT1...\n");
 183
 184                 blks = fb_mmc_blk_write(dev_desc, 0, blkcnt, buffer);
 185
 186                 if (blks != blkcnt) {
 187                         pr_err("Failed to write EMMC_BOOT1\n");
 188                         fastboot_fail("Failed to write EMMC_BOOT1", response);
 189                         return;
 190                 }
 191
 192                 printf("........ wrote %lu bytes to EMMC_BOOT1\n",
 193                        blkcnt * blksz);
 194         } else { /* erase */
 195                 if (fb_mmc_erase_mmc_hwpart(dev_desc)) {
 196                         fastboot_fail("Failed to erase EMMC_BOOT1", response);
 197                         return;
 198                 }
 199         }
 200
 201         fastboot_okay(NULL, response);
 202 }
 203 #endif
 204
 205 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 206 /**
 207  * Read Android boot image header from boot partition.
 208  *
 209  * @param[in] dev_desc MMC device descriptor
 210  * @param[in] info Boot partition info
 211  * @param[out] hdr Where to store read boot image header
 212  *
 213  * @return Boot image header sectors count or 0 on error
 214  */
 215 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc,
 216                                        struct disk_partition *info,
 217                                        struct andr_img_hdr *hdr,
 218                                        char *response)
 219 {
 220         ulong sector_size;              /* boot partition sector size */
 221         lbaint_t hdr_sectors;           /* boot image header sectors count */
 222         int res;
 223
 224         /* Calculate boot image sectors count */
 225         sector_size = info->blksz;
 226         hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_img_hdr), sector_size);
 227         if (hdr_sectors == 0) {
 228                 pr_err("invalid number of boot sectors: 0\n");
 229                 fastboot_fail("invalid number of boot sectors: 0", response);
 230                 return 0;
 231         }
 232
 233         /* Read the boot image header */
 234         res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr);
 235         if (res != hdr_sectors) {
 236                 pr_err("cannot read header from boot partition\n");
 237                 fastboot_fail("cannot read header from boot partition",
 238                               response);
 239                 return 0;
 240         }
 241
 242         /* Check boot header magic string */
 243         res = android_image_check_header(hdr);
 244         if (res != 0) {
 245                 pr_err("bad boot image magic\n");
 246                 fastboot_fail("boot partition not initialized", response);
 247                 return 0;
 248         }
 249
 250         return hdr_sectors;
 251 }
 252
 253 /**
 254  * Write downloaded zImage to boot partition and repack it properly.
 255  *
 256  * @param dev_desc MMC device descriptor
 257  * @param download_buffer Address to fastboot buffer with zImage in it
 258  * @param download_bytes Size of fastboot buffer, in bytes
 259  *
 260  * @return 0 on success or -1 on error
 261  */
 262 static int fb_mmc_update_zimage(struct blk_desc *dev_desc,
 263                                 void *download_buffer,
 264                                 u32 download_bytes,
 265                                 char *response)
 266 {
 267         uintptr_t hdr_addr;                     /* boot image header address */
 268         struct andr_img_hdr *hdr;               /* boot image header */
 269         lbaint_t hdr_sectors;                   /* boot image header sectors */
 270         u8 *ramdisk_buffer;
 271         u32 ramdisk_sector_start;
 272         u32 ramdisk_sectors;
 273         u32 kernel_sector_start;
 274         u32 kernel_sectors;
 275         u32 sectors_per_page;
 276         struct disk_partition info;
 277         int res;
 278
 279         puts("Flashing zImage\n");
 280
 281         /* Get boot partition info */
 282         res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info);
 283         if (res < 0) {
 284                 pr_err("cannot find boot partition\n");
 285                 fastboot_fail("cannot find boot partition", response);
 286                 return -1;
 287         }
 288
 289         /* Put boot image header in fastboot buffer after downloaded zImage */
 290         hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE);
 291         hdr = (struct andr_img_hdr *)hdr_addr;
 292
 293         /* Read boot image header */
 294         hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response);
 295         if (hdr_sectors == 0) {
 296                 pr_err("unable to read boot image header\n");
 297                 fastboot_fail("unable to read boot image header", response);
 298                 return -1;
 299         }
 300
 301         /* Check if boot image has second stage in it (we don't support it) */
 302         if (hdr->second_size > 0) {
 303                 pr_err("moving second stage is not supported yet\n");
 304                 fastboot_fail("moving second stage is not supported yet",
 305                               response);
 306                 return -1;
 307         }
 308
 309         /* Extract ramdisk location */
 310         sectors_per_page = hdr->page_size / info.blksz;
 311         ramdisk_sector_start = info.start + sectors_per_page;
 312         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 313                                              sectors_per_page;
 314         ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) *
 315                                        sectors_per_page;
 316
 317         /* Read ramdisk and put it in fastboot buffer after boot image header */
 318         ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz);
 319         res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 320                         ramdisk_buffer);
 321         if (res != ramdisk_sectors) {
 322                 pr_err("cannot read ramdisk from boot partition\n");
 323                 fastboot_fail("cannot read ramdisk from boot partition",
 324                               response);
 325                 return -1;
 326         }
 327
 328         /* Write new kernel size to boot image header */
 329         hdr->kernel_size = download_bytes;
 330         res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr);
 331         if (res == 0) {
 332                 pr_err("cannot writeback boot image header\n");
 333                 fastboot_fail("cannot write back boot image header", response);
 334                 return -1;
 335         }
 336
 337         /* Write the new downloaded kernel */
 338         kernel_sector_start = info.start + sectors_per_page;
 339         kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 340                                       sectors_per_page;
 341         res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors,
 342                          download_buffer);
 343         if (res == 0) {
 344                 pr_err("cannot write new kernel\n");
 345                 fastboot_fail("cannot write new kernel", response);
 346                 return -1;
 347         }
 348
 349         /* Write the saved ramdisk back */
 350         ramdisk_sector_start = info.start + sectors_per_page;
 351         ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
 352                                              sectors_per_page;
 353         res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors,
 354                          ramdisk_buffer);
 355         if (res == 0) {
 356                 pr_err("cannot write back original ramdisk\n");
 357                 fastboot_fail("cannot write back original ramdisk", response);
 358                 return -1;
 359         }
 360
 361         puts("........ zImage was updated in boot partition\n");
 362         fastboot_okay(NULL, response);
 363         return 0;
 364 }
 365 #endif
 366
 367 /**
 368  * fastboot_mmc_get_part_info() - Lookup eMMC partion by name
 369  *
 370  * @part_name: Named partition to lookup
 371  * @dev_desc: Pointer to returned blk_desc pointer
 372  * @part_info: Pointer to returned struct disk_partition
 373  * @response: Pointer to fastboot response buffer
 374  */
 375 int fastboot_mmc_get_part_info(const char *part_name,
 376                                struct blk_desc **dev_desc,
 377                                struct disk_partition *part_info, char *response)
 378 {
 379         int r;
 380
 381         *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 382         if (!*dev_desc) {
 383                 fastboot_fail("block device not found", response);
 384                 return -ENOENT;
 385         }
 386         if (!part_name || !strcmp(part_name, "")) {
 387                 fastboot_fail("partition not given", response);
 388                 return -ENOENT;
 389         }
 390
 391         r = part_get_info_by_name_or_alias(*dev_desc, part_name, part_info);
 392         if (r < 0) {
 393                 fastboot_fail("partition not found", response);
 394                 return r;
 395         }
 396
 397         return r;
 398 }
 399
 400 /**
 401  * fastboot_mmc_flash_write() - Write image to eMMC for fastboot
 402  *
 403  * @cmd: Named partition to write image to
 404  * @download_buffer: Pointer to image data
 405  * @download_bytes: Size of image data
 406  * @response: Pointer to fastboot response buffer
 407  */
 408 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer,
 409                               u32 download_bytes, char *response)
 410 {
 411         struct blk_desc *dev_desc;
 412         struct disk_partition info;
 413
 414         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 415         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 416                 pr_err("invalid mmc device\n");
 417                 fastboot_fail("invalid mmc device", response);
 418                 return;
 419         }
 420
 421 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 422         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 423                 fb_mmc_boot1_ops(dev_desc, download_buffer,
 424                                  download_bytes, response);
 425                 return;
 426         }
 427 #endif
 428
 429 #if CONFIG_IS_ENABLED(EFI_PARTITION)
 430 #ifndef CONFIG_FASTBOOT_MMC_USER_NAME
 431         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) {
 432 #else
 433         if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0 ||
 434             strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 435 #endif
 436                 printf("%s: updating MBR, Primary and Backup GPT(s)\n",
 437                        __func__);
 438                 if (is_valid_gpt_buf(dev_desc, download_buffer)) {
 439                         printf("%s: invalid GPT - refusing to write to flash\n",
 440                                __func__);
 441                         fastboot_fail("invalid GPT partition", response);
 442                         return;
 443                 }
 444                 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) {
 445                         printf("%s: writing GPT partitions failed\n", __func__);
 446                         fastboot_fail("writing GPT partitions failed",
 447                                       response);
 448                         return;
 449                 }
 450                 printf("........ success\n");
 451                 fastboot_okay(NULL, response);
 452                 return;
 453         }
 454 #endif
 455
 456 #if CONFIG_IS_ENABLED(DOS_PARTITION)
 457         if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) {
 458                 printf("%s: updating MBR\n", __func__);
 459                 if (is_valid_dos_buf(download_buffer)) {
 460                         printf("%s: invalid MBR - refusing to write to flash\n",
 461                                __func__);
 462                         fastboot_fail("invalid MBR partition", response);
 463                         return;
 464                 }
 465                 if (write_mbr_partition(dev_desc, download_buffer)) {
 466                         printf("%s: writing MBR partition failed\n", __func__);
 467                         fastboot_fail("writing MBR partition failed",
 468                                       response);
 469                         return;
 470                 }
 471                 printf("........ success\n");
 472                 fastboot_okay(NULL, response);
 473                 return;
 474         }
 475 #endif
 476
 477 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 478         if (strncasecmp(cmd, "zimage", 6) == 0) {
 479                 fb_mmc_update_zimage(dev_desc, download_buffer,
 480                                      download_bytes, response);
 481                 return;
 482         }
 483 #endif
 484
 485         if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) {
 486                 pr_err("cannot find partition: '%s'\n", cmd);
 487                 fastboot_fail("cannot find partition", response);
 488                 return;
 489         }
 490
 491         if (is_sparse_image(download_buffer)) {
 492                 struct fb_mmc_sparse sparse_priv;
 493                 struct sparse_storage sparse;
 494                 int err;
 495
 496                 sparse_priv.dev_desc = dev_desc;
 497
 498                 sparse.blksz = info.blksz;
 499                 sparse.start = info.start;
 500                 sparse.size = info.size;
 501                 sparse.write = fb_mmc_sparse_write;
 502                 sparse.reserve = fb_mmc_sparse_reserve;
 503                 sparse.mssg = fastboot_fail;
 504
 505                 printf("Flashing sparse image at offset " LBAFU "\n",
 506                        sparse.start);
 507
 508                 sparse.priv = &sparse_priv;
 509                 err = write_sparse_image(&sparse, cmd, download_buffer,
 510                                          response);
 511                 if (!err)
 512                         fastboot_okay(NULL, response);
 513         } else {
 514                 write_raw_image(dev_desc, &info, cmd, download_buffer,
 515                                 download_bytes, response);
 516         }
 517 }
 518
 519 /**
 520  * fastboot_mmc_flash_erase() - Erase eMMC for fastboot
 521  *
 522  * @cmd: Named partition to erase
 523  * @response: Pointer to fastboot response buffer
 524  */
 525 void fastboot_mmc_erase(const char *cmd, char *response)
 526 {
 527         int ret;
 528         struct blk_desc *dev_desc;
 529         struct disk_partition info;
 530         lbaint_t blks, blks_start, blks_size, grp_size;
 531         struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV);
 532
 533         if (mmc == NULL) {
 534                 pr_err("invalid mmc device\n");
 535                 fastboot_fail("invalid mmc device", response);
 536                 return;
 537         }
 538
 539         dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 540         if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 541                 pr_err("invalid mmc device\n");
 542                 fastboot_fail("invalid mmc device", response);
 543                 return;
 544         }
 545
 546 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
 547         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
 548                 /* erase EMMC boot1 */
 549                 fb_mmc_boot1_ops(dev_desc, NULL, 0, response);
 550                 return;
 551         }
 552 #endif
 553
 554 #ifdef CONFIG_FASTBOOT_MMC_USER_NAME
 555         if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
 556                 /* erase EMMC userdata */
 557                 if (fb_mmc_erase_mmc_hwpart(dev_desc))
 558                         fastboot_fail("Failed to erase EMMC_USER", response);
 559                 else
 560                         fastboot_okay(NULL, response);
 561                 return;
 562         }
 563 #endif
 564
 565         ret = part_get_info_by_name_or_alias(dev_desc, cmd, &info);
 566         if (ret < 0) {
 567                 pr_err("cannot find partition: '%s'\n", cmd);
 568                 fastboot_fail("cannot find partition", response);
 569                 return;
 570         }
 571
 572         /* Align blocks to erase group size to avoid erasing other partitions */
 573         grp_size = mmc->erase_grp_size;
 574         blks_start = (info.start + grp_size - 1) & ~(grp_size - 1);
 575         if (info.size >= grp_size)
 576                 blks_size = (info.size - (blks_start - info.start)) &
 577                                 (~(grp_size - 1));
 578         else
 579                 blks_size = 0;
 580
 581         printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n",
 582                blks_start, blks_start + blks_size);
 583
 584         blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL);
 585
 586         if (blks != blks_size) {
 587                 pr_err("failed erasing from device %d\n", dev_desc->devnum);
 588                 fastboot_fail("failed erasing from device", response);
 589                 return;
 590         }
 591
 592         printf("........ erased " LBAFU " bytes from '%s'\n",
 593                blks_size * info.blksz, cmd);
 594         fastboot_okay(NULL, response);
 595 }