1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright 2014 Broadcom Corporation.
11 #include <fastboot-internal.h>
13 #include <image-sparse.h>
19 #include <linux/compat.h>
20 #include <android_image.h>
22 #define BOOT_PARTITION_NAME "boot"
24 struct fb_mmc_sparse {
25 struct blk_desc *dev_desc;
28 static int raw_part_get_info_by_name(struct blk_desc *dev_desc,
30 struct disk_partition *info)
32 /* strlen("fastboot_raw_partition_") + PART_NAME_LEN + 1 */
33 char env_desc_name[23 + PART_NAME_LEN + 1];
36 const char **parg = argv;
38 /* check for raw partition descriptor */
39 strcpy(env_desc_name, "fastboot_raw_partition_");
40 strlcat(env_desc_name, name, sizeof(env_desc_name));
41 raw_part_desc = strdup(env_get(env_desc_name));
42 if (raw_part_desc == NULL)
46 * parse partition descriptor
48 * <lba_start> <lba_size> [mmcpart <num>]
50 for (; parg < argv + sizeof(argv) / sizeof(*argv); ++parg) {
51 *parg = strsep(&raw_part_desc, " ");
53 pr_err("Invalid number of arguments.\n");
58 info->start = simple_strtoul(argv[0], NULL, 0);
59 info->size = simple_strtoul(argv[1], NULL, 0);
60 info->blksz = dev_desc->blksz;
61 strlcpy((char *)info->name, name, PART_NAME_LEN);
64 if (strcmp(strsep(&raw_part_desc, " "), "mmcpart") == 0) {
65 ulong mmcpart = simple_strtoul(raw_part_desc, NULL, 0);
66 int ret = blk_dselect_hwpart(dev_desc, mmcpart);
76 static int do_get_part_info(struct blk_desc **dev_desc, const char *name,
77 struct disk_partition *info)
81 /* First try partition names on the default device */
82 *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
84 ret = part_get_info_by_name(*dev_desc, name, info);
88 /* Then try raw partitions */
89 ret = raw_part_get_info_by_name(*dev_desc, name, info);
94 /* Then try dev.hwpart:part */
95 ret = part_get_info_by_dev_and_name_or_num("mmc", name, dev_desc,
100 static int part_get_info_by_name_or_alias(struct blk_desc **dev_desc,
102 struct disk_partition *info)
104 /* strlen("fastboot_partition_alias_") + PART_NAME_LEN + 1 */
105 char env_alias_name[25 + PART_NAME_LEN + 1];
106 char *aliased_part_name;
108 /* check for alias */
109 strlcpy(env_alias_name, "fastboot_partition_alias_", sizeof(env_alias_name));
110 strlcat(env_alias_name, name, sizeof(env_alias_name));
111 aliased_part_name = env_get(env_alias_name);
112 if (aliased_part_name)
113 name = aliased_part_name;
115 return do_get_part_info(dev_desc, name, info);
119 * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE
121 * @block_dev: Pointer to block device
122 * @start: First block to write/erase
123 * @blkcnt: Count of blocks
124 * @buffer: Pointer to data buffer for write or NULL for erase
126 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start,
127 lbaint_t blkcnt, const void *buffer)
129 lbaint_t blk = start;
130 lbaint_t blks_written;
135 for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) {
136 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE);
138 if (fastboot_progress_callback)
139 fastboot_progress_callback("writing");
140 blks_written = blk_dwrite(block_dev, blk, cur_blkcnt,
141 buffer + (i * block_dev->blksz));
143 if (fastboot_progress_callback)
144 fastboot_progress_callback("erasing");
145 blks_written = blk_derase(block_dev, blk, cur_blkcnt);
148 blks += blks_written;
153 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info,
154 lbaint_t blk, lbaint_t blkcnt, const void *buffer)
156 struct fb_mmc_sparse *sparse = info->priv;
157 struct blk_desc *dev_desc = sparse->dev_desc;
159 return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer);
162 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info,
163 lbaint_t blk, lbaint_t blkcnt)
168 static void write_raw_image(struct blk_desc *dev_desc,
169 struct disk_partition *info, const char *part_name,
170 void *buffer, u32 download_bytes, char *response)
175 /* determine number of blocks to write */
176 blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1));
177 blkcnt = lldiv(blkcnt, info->blksz);
179 if (blkcnt > info->size) {
180 pr_err("too large for partition: '%s'\n", part_name);
181 fastboot_fail("too large for partition", response);
185 puts("Flashing Raw Image\n");
187 blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer);
189 if (blks != blkcnt) {
190 pr_err("failed writing to device %d\n", dev_desc->devnum);
191 fastboot_fail("failed writing to device", response);
195 printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz,
197 fastboot_okay(NULL, response);
200 #if defined(CONFIG_FASTBOOT_MMC_BOOT_SUPPORT) || \
201 defined(CONFIG_FASTBOOT_MMC_USER_SUPPORT)
202 static int fb_mmc_erase_mmc_hwpart(struct blk_desc *dev_desc)
206 debug("Start Erasing mmc hwpart[%u]...\n", dev_desc->hwpart);
208 blks = fb_mmc_blk_write(dev_desc, 0, dev_desc->lba, NULL);
210 if (blks != dev_desc->lba) {
211 pr_err("Failed to erase mmc hwpart[%u]\n", dev_desc->hwpart);
215 printf("........ erased %lu bytes from mmc hwpart[%u]\n",
216 dev_desc->lba * dev_desc->blksz, dev_desc->hwpart);
222 #ifdef CONFIG_FASTBOOT_MMC_BOOT_SUPPORT
223 static void fb_mmc_boot_ops(struct blk_desc *dev_desc, void *buffer,
224 int hwpart, u32 buff_sz, char *response)
230 // To operate on EMMC_BOOT1/2 (mmc0boot0/1) we first change the hwpart
231 if (blk_dselect_hwpart(dev_desc, hwpart)) {
232 pr_err("Failed to select hwpart\n");
233 fastboot_fail("Failed to select hwpart", response);
237 if (buffer) { /* flash */
239 /* determine number of blocks to write */
240 blksz = dev_desc->blksz;
241 blkcnt = ((buff_sz + (blksz - 1)) & ~(blksz - 1));
242 blkcnt = lldiv(blkcnt, blksz);
244 if (blkcnt > dev_desc->lba) {
245 pr_err("Image size too large\n");
246 fastboot_fail("Image size too large", response);
250 debug("Start Flashing Image to EMMC_BOOT%d...\n", hwpart);
252 blks = fb_mmc_blk_write(dev_desc, 0, blkcnt, buffer);
254 if (blks != blkcnt) {
255 pr_err("Failed to write EMMC_BOOT%d\n", hwpart);
256 fastboot_fail("Failed to write EMMC_BOOT part",
261 printf("........ wrote %lu bytes to EMMC_BOOT%d\n",
262 blkcnt * blksz, hwpart);
264 if (fb_mmc_erase_mmc_hwpart(dev_desc)) {
265 pr_err("Failed to erase EMMC_BOOT%d\n", hwpart);
266 fastboot_fail("Failed to erase EMMC_BOOT part",
272 fastboot_okay(NULL, response);
276 #ifdef CONFIG_ANDROID_BOOT_IMAGE
278 * Read Android boot image header from boot partition.
280 * @param[in] dev_desc MMC device descriptor
281 * @param[in] info Boot partition info
282 * @param[out] hdr Where to store read boot image header
284 * Return: Boot image header sectors count or 0 on error
286 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc,
287 struct disk_partition *info,
288 struct andr_boot_img_hdr_v0 *hdr,
291 ulong sector_size; /* boot partition sector size */
292 lbaint_t hdr_sectors; /* boot image header sectors count */
295 /* Calculate boot image sectors count */
296 sector_size = info->blksz;
297 hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_boot_img_hdr_v0), sector_size);
298 if (hdr_sectors == 0) {
299 pr_err("invalid number of boot sectors: 0\n");
300 fastboot_fail("invalid number of boot sectors: 0", response);
304 /* Read the boot image header */
305 res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr);
306 if (res != hdr_sectors) {
307 pr_err("cannot read header from boot partition\n");
308 fastboot_fail("cannot read header from boot partition",
313 /* Check boot header magic string */
314 if (!is_android_boot_image_header(hdr)) {
315 pr_err("bad boot image magic\n");
316 fastboot_fail("boot partition not initialized", response);
324 * Write downloaded zImage to boot partition and repack it properly.
326 * @param dev_desc MMC device descriptor
327 * @param download_buffer Address to fastboot buffer with zImage in it
328 * @param download_bytes Size of fastboot buffer, in bytes
330 * Return: 0 on success or -1 on error
332 static int fb_mmc_update_zimage(struct blk_desc *dev_desc,
333 void *download_buffer,
337 uintptr_t hdr_addr; /* boot image header address */
338 struct andr_boot_img_hdr_v0 *hdr; /* boot image header */
339 lbaint_t hdr_sectors; /* boot image header sectors */
341 u32 ramdisk_sector_start;
343 u32 kernel_sector_start;
345 u32 sectors_per_page;
346 struct disk_partition info;
349 puts("Flashing zImage\n");
351 /* Get boot partition info */
352 res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info);
354 pr_err("cannot find boot partition\n");
355 fastboot_fail("cannot find boot partition", response);
359 /* Put boot image header in fastboot buffer after downloaded zImage */
360 hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE);
361 hdr = (struct andr_boot_img_hdr_v0 *)hdr_addr;
363 /* Read boot image header */
364 hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response);
365 if (hdr_sectors == 0) {
366 pr_err("unable to read boot image header\n");
367 fastboot_fail("unable to read boot image header", response);
371 /* Check if boot image header version is 2 or less */
372 if (hdr->header_version > 2) {
373 pr_err("zImage flashing supported only for boot images v2 and less\n");
374 fastboot_fail("zImage flashing supported only for boot images v2 and less",
379 /* Check if boot image has second stage in it (we don't support it) */
380 if (hdr->second_size > 0) {
381 pr_err("moving second stage is not supported yet\n");
382 fastboot_fail("moving second stage is not supported yet",
387 /* Extract ramdisk location */
388 sectors_per_page = hdr->page_size / info.blksz;
389 ramdisk_sector_start = info.start + sectors_per_page;
390 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
392 ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) *
395 /* Read ramdisk and put it in fastboot buffer after boot image header */
396 ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz);
397 res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors,
399 if (res != ramdisk_sectors) {
400 pr_err("cannot read ramdisk from boot partition\n");
401 fastboot_fail("cannot read ramdisk from boot partition",
406 /* Write new kernel size to boot image header */
407 hdr->kernel_size = download_bytes;
408 res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr);
410 pr_err("cannot writeback boot image header\n");
411 fastboot_fail("cannot write back boot image header", response);
415 /* Write the new downloaded kernel */
416 kernel_sector_start = info.start + sectors_per_page;
417 kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
419 res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors,
422 pr_err("cannot write new kernel\n");
423 fastboot_fail("cannot write new kernel", response);
427 /* Write the saved ramdisk back */
428 ramdisk_sector_start = info.start + sectors_per_page;
429 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
431 res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors,
434 pr_err("cannot write back original ramdisk\n");
435 fastboot_fail("cannot write back original ramdisk", response);
439 puts("........ zImage was updated in boot partition\n");
440 fastboot_okay(NULL, response);
446 * fastboot_mmc_get_part_info() - Lookup eMMC partion by name
448 * @part_name: Named partition to lookup
449 * @dev_desc: Pointer to returned blk_desc pointer
450 * @part_info: Pointer to returned struct disk_partition
451 * @response: Pointer to fastboot response buffer
453 int fastboot_mmc_get_part_info(const char *part_name,
454 struct blk_desc **dev_desc,
455 struct disk_partition *part_info, char *response)
459 if (!part_name || !strcmp(part_name, "")) {
460 fastboot_fail("partition not given", response);
464 ret = part_get_info_by_name_or_alias(dev_desc, part_name, part_info);
469 fastboot_fail("invalid partition or device", response);
472 fastboot_fail("no such device", response);
475 fastboot_fail("no such partition", response);
477 case -EPROTONOSUPPORT:
478 fastboot_fail("unknown partition table type", response);
481 fastboot_fail("unanticipated error", response);
489 static struct blk_desc *fastboot_mmc_get_dev(char *response)
491 struct blk_desc *ret = blk_get_dev("mmc",
492 CONFIG_FASTBOOT_FLASH_MMC_DEV);
494 if (!ret || ret->type == DEV_TYPE_UNKNOWN) {
495 pr_err("invalid mmc device\n");
496 fastboot_fail("invalid mmc device", response);
503 * fastboot_mmc_flash_write() - Write image to eMMC for fastboot
505 * @cmd: Named partition to write image to
506 * @download_buffer: Pointer to image data
507 * @download_bytes: Size of image data
508 * @response: Pointer to fastboot response buffer
510 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer,
511 u32 download_bytes, char *response)
513 struct blk_desc *dev_desc;
514 struct disk_partition info = {0};
516 #ifdef CONFIG_FASTBOOT_MMC_BOOT_SUPPORT
517 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
518 dev_desc = fastboot_mmc_get_dev(response);
520 fb_mmc_boot_ops(dev_desc, download_buffer, 1,
521 download_bytes, response);
524 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT2_NAME) == 0) {
525 dev_desc = fastboot_mmc_get_dev(response);
527 fb_mmc_boot_ops(dev_desc, download_buffer, 2,
528 download_bytes, response);
533 #if CONFIG_IS_ENABLED(EFI_PARTITION)
534 if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) {
535 dev_desc = fastboot_mmc_get_dev(response);
539 printf("%s: updating MBR, Primary and Backup GPT(s)\n",
541 if (is_valid_gpt_buf(dev_desc, download_buffer)) {
542 printf("%s: invalid GPT - refusing to write to flash\n",
544 fastboot_fail("invalid GPT partition", response);
547 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) {
548 printf("%s: writing GPT partitions failed\n", __func__);
549 fastboot_fail("writing GPT partitions failed",
554 printf("........ success\n");
555 fastboot_okay(NULL, response);
560 #if CONFIG_IS_ENABLED(DOS_PARTITION)
561 if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) {
562 dev_desc = fastboot_mmc_get_dev(response);
566 printf("%s: updating MBR\n", __func__);
567 if (is_valid_dos_buf(download_buffer)) {
568 printf("%s: invalid MBR - refusing to write to flash\n",
570 fastboot_fail("invalid MBR partition", response);
573 if (write_mbr_sector(dev_desc, download_buffer)) {
574 printf("%s: writing MBR partition failed\n", __func__);
575 fastboot_fail("writing MBR partition failed",
580 printf("........ success\n");
581 fastboot_okay(NULL, response);
586 #ifdef CONFIG_ANDROID_BOOT_IMAGE
587 if (strncasecmp(cmd, "zimage", 6) == 0) {
588 dev_desc = fastboot_mmc_get_dev(response);
590 fb_mmc_update_zimage(dev_desc, download_buffer,
591 download_bytes, response);
596 #if IS_ENABLED(CONFIG_FASTBOOT_MMC_USER_SUPPORT)
597 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
598 dev_desc = fastboot_mmc_get_dev(response);
602 strlcpy((char *)&info.name, cmd, sizeof(info.name));
603 info.size = dev_desc->lba;
604 info.blksz = dev_desc->blksz;
609 fastboot_mmc_get_part_info(cmd, &dev_desc, &info, response) < 0)
612 if (is_sparse_image(download_buffer)) {
613 struct fb_mmc_sparse sparse_priv;
614 struct sparse_storage sparse;
617 sparse_priv.dev_desc = dev_desc;
619 sparse.blksz = info.blksz;
620 sparse.start = info.start;
621 sparse.size = info.size;
622 sparse.write = fb_mmc_sparse_write;
623 sparse.reserve = fb_mmc_sparse_reserve;
624 sparse.mssg = fastboot_fail;
626 printf("Flashing sparse image at offset " LBAFU "\n",
629 sparse.priv = &sparse_priv;
630 err = write_sparse_image(&sparse, cmd, download_buffer,
633 fastboot_okay(NULL, response);
635 write_raw_image(dev_desc, &info, cmd, download_buffer,
636 download_bytes, response);
641 * fastboot_mmc_flash_erase() - Erase eMMC for fastboot
643 * @cmd: Named partition to erase
644 * @response: Pointer to fastboot response buffer
646 void fastboot_mmc_erase(const char *cmd, char *response)
648 struct blk_desc *dev_desc;
649 struct disk_partition info;
650 lbaint_t blks, blks_start, blks_size, grp_size;
651 struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV);
653 #ifdef CONFIG_FASTBOOT_MMC_BOOT_SUPPORT
654 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
655 /* erase EMMC boot1 */
656 dev_desc = fastboot_mmc_get_dev(response);
658 fb_mmc_boot_ops(dev_desc, NULL, 1, 0, response);
661 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT2_NAME) == 0) {
662 /* erase EMMC boot2 */
663 dev_desc = fastboot_mmc_get_dev(response);
665 fb_mmc_boot_ops(dev_desc, NULL, 2, 0, response);
670 #ifdef CONFIG_FASTBOOT_MMC_USER_SUPPORT
671 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
672 /* erase EMMC userdata */
673 dev_desc = fastboot_mmc_get_dev(response);
677 if (fb_mmc_erase_mmc_hwpart(dev_desc))
678 fastboot_fail("Failed to erase EMMC_USER", response);
680 fastboot_okay(NULL, response);
685 if (fastboot_mmc_get_part_info(cmd, &dev_desc, &info, response) < 0)
688 /* Align blocks to erase group size to avoid erasing other partitions */
689 grp_size = mmc->erase_grp_size;
690 blks_start = (info.start + grp_size - 1) & ~(grp_size - 1);
691 if (info.size >= grp_size)
692 blks_size = (info.size - (blks_start - info.start)) &
697 printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n",
698 blks_start, blks_start + blks_size);
700 blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL);
702 if (blks != blks_size) {
703 pr_err("failed erasing from device %d\n", dev_desc->devnum);
704 fastboot_fail("failed erasing from device", response);
708 printf("........ erased " LBAFU " bytes from '%s'\n",
709 blks_size * info.blksz, cmd);
710 fastboot_okay(NULL, response);