1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright 2014 Broadcom Corporation.
11 #include <fastboot-internal.h>
14 #include <image-sparse.h>
20 #include <linux/compat.h>
21 #include <android_image.h>
23 #define FASTBOOT_MAX_BLK_WRITE 16384
25 #define BOOT_PARTITION_NAME "boot"
27 struct fb_mmc_sparse {
28 struct blk_desc *dev_desc;
31 static int part_get_info_by_name_or_alias(struct blk_desc *dev_desc,
32 const char *name, struct disk_partition *info)
36 ret = part_get_info_by_name(dev_desc, name, info);
38 /* strlen("fastboot_partition_alias_") + PART_NAME_LEN + 1 */
39 char env_alias_name[25 + PART_NAME_LEN + 1];
40 char *aliased_part_name;
43 strcpy(env_alias_name, "fastboot_partition_alias_");
44 strncat(env_alias_name, name, PART_NAME_LEN);
45 aliased_part_name = env_get(env_alias_name);
46 if (aliased_part_name != NULL)
47 ret = part_get_info_by_name(dev_desc,
48 aliased_part_name, info);
53 static int raw_part_get_info_by_name(struct blk_desc *dev_desc,
54 const char *name, struct disk_partition *info, int *mmcpart)
56 /* strlen("fastboot_raw_partition_") + PART_NAME_LEN + 1 */
57 char env_desc_name[23 + PART_NAME_LEN + 1];
60 const char **parg = argv;
62 /* check for raw partition descriptor */
63 strcpy(env_desc_name, "fastboot_raw_partition_");
64 strncat(env_desc_name, name, PART_NAME_LEN);
65 raw_part_desc = strdup(env_get(env_desc_name));
66 if (raw_part_desc == NULL)
70 * parse partition descriptor
72 * <lba_start> <lba_size> [mmcpart <num>]
74 for (; parg < argv + sizeof(argv) / sizeof(*argv); ++parg) {
75 *parg = strsep(&raw_part_desc, " ");
77 pr_err("Invalid number of arguments.\n");
82 info->start = simple_strtoul(argv[0], NULL, 0);
83 info->size = simple_strtoul(argv[1], NULL, 0);
84 info->blksz = dev_desc->blksz;
85 strncpy((char *)info->name, name, PART_NAME_LEN);
88 if (strcmp(strsep(&raw_part_desc, " "), "mmcpart") == 0)
89 *mmcpart = simple_strtoul(raw_part_desc, NULL, 0);
96 * fb_mmc_blk_write() - Write/erase MMC in chunks of FASTBOOT_MAX_BLK_WRITE
98 * @block_dev: Pointer to block device
99 * @start: First block to write/erase
100 * @blkcnt: Count of blocks
101 * @buffer: Pointer to data buffer for write or NULL for erase
103 static lbaint_t fb_mmc_blk_write(struct blk_desc *block_dev, lbaint_t start,
104 lbaint_t blkcnt, const void *buffer)
106 lbaint_t blk = start;
107 lbaint_t blks_written;
112 for (i = 0; i < blkcnt; i += FASTBOOT_MAX_BLK_WRITE) {
113 cur_blkcnt = min((int)blkcnt - i, FASTBOOT_MAX_BLK_WRITE);
115 if (fastboot_progress_callback)
116 fastboot_progress_callback("writing");
117 blks_written = blk_dwrite(block_dev, blk, cur_blkcnt,
118 buffer + (i * block_dev->blksz));
120 if (fastboot_progress_callback)
121 fastboot_progress_callback("erasing");
122 blks_written = blk_derase(block_dev, blk, cur_blkcnt);
125 blks += blks_written;
130 static lbaint_t fb_mmc_sparse_write(struct sparse_storage *info,
131 lbaint_t blk, lbaint_t blkcnt, const void *buffer)
133 struct fb_mmc_sparse *sparse = info->priv;
134 struct blk_desc *dev_desc = sparse->dev_desc;
136 return fb_mmc_blk_write(dev_desc, blk, blkcnt, buffer);
139 static lbaint_t fb_mmc_sparse_reserve(struct sparse_storage *info,
140 lbaint_t blk, lbaint_t blkcnt)
145 static void write_raw_image(struct blk_desc *dev_desc,
146 struct disk_partition *info, const char *part_name,
147 void *buffer, u32 download_bytes, char *response)
152 /* determine number of blocks to write */
153 blkcnt = ((download_bytes + (info->blksz - 1)) & ~(info->blksz - 1));
154 blkcnt = lldiv(blkcnt, info->blksz);
156 if (blkcnt > info->size) {
157 pr_err("too large for partition: '%s'\n", part_name);
158 fastboot_fail("too large for partition", response);
162 puts("Flashing Raw Image\n");
164 blks = fb_mmc_blk_write(dev_desc, info->start, blkcnt, buffer);
166 if (blks != blkcnt) {
167 pr_err("failed writing to device %d\n", dev_desc->devnum);
168 fastboot_fail("failed writing to device", response);
172 printf("........ wrote " LBAFU " bytes to '%s'\n", blkcnt * info->blksz,
174 fastboot_okay(NULL, response);
177 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
178 static int fb_mmc_erase_mmc_hwpart(struct blk_desc *dev_desc)
182 debug("Start Erasing mmc hwpart[%u]...\n", dev_desc->hwpart);
184 blks = fb_mmc_blk_write(dev_desc, 0, dev_desc->lba, NULL);
186 if (blks != dev_desc->lba) {
187 pr_err("Failed to erase mmc hwpart[%u]\n", dev_desc->hwpart);
191 printf("........ erased %lu bytes from mmc hwpart[%u]\n",
192 dev_desc->lba * dev_desc->blksz, dev_desc->hwpart);
197 static void fb_mmc_boot1_ops(struct blk_desc *dev_desc, void *buffer,
198 u32 buff_sz, char *response)
204 // To operate on EMMC_BOOT1 (mmc0boot0), we first change the hwpart
205 if (blk_dselect_hwpart(dev_desc, 1)) {
206 pr_err("Failed to select hwpart\n");
207 fastboot_fail("Failed to select hwpart", response);
211 if (buffer) { /* flash */
213 /* determine number of blocks to write */
214 blksz = dev_desc->blksz;
215 blkcnt = ((buff_sz + (blksz - 1)) & ~(blksz - 1));
216 blkcnt = lldiv(blkcnt, blksz);
218 if (blkcnt > dev_desc->lba) {
219 pr_err("Image size too large\n");
220 fastboot_fail("Image size too large", response);
224 debug("Start Flashing Image to EMMC_BOOT1...\n");
226 blks = fb_mmc_blk_write(dev_desc, 0, blkcnt, buffer);
228 if (blks != blkcnt) {
229 pr_err("Failed to write EMMC_BOOT1\n");
230 fastboot_fail("Failed to write EMMC_BOOT1", response);
234 printf("........ wrote %lu bytes to EMMC_BOOT1\n",
237 if (fb_mmc_erase_mmc_hwpart(dev_desc)) {
238 fastboot_fail("Failed to erase EMMC_BOOT1", response);
243 fastboot_okay(NULL, response);
247 #ifdef CONFIG_ANDROID_BOOT_IMAGE
249 * Read Android boot image header from boot partition.
251 * @param[in] dev_desc MMC device descriptor
252 * @param[in] info Boot partition info
253 * @param[out] hdr Where to store read boot image header
255 * @return Boot image header sectors count or 0 on error
257 static lbaint_t fb_mmc_get_boot_header(struct blk_desc *dev_desc,
258 struct disk_partition *info,
259 struct andr_img_hdr *hdr,
262 ulong sector_size; /* boot partition sector size */
263 lbaint_t hdr_sectors; /* boot image header sectors count */
266 /* Calculate boot image sectors count */
267 sector_size = info->blksz;
268 hdr_sectors = DIV_ROUND_UP(sizeof(struct andr_img_hdr), sector_size);
269 if (hdr_sectors == 0) {
270 pr_err("invalid number of boot sectors: 0\n");
271 fastboot_fail("invalid number of boot sectors: 0", response);
275 /* Read the boot image header */
276 res = blk_dread(dev_desc, info->start, hdr_sectors, (void *)hdr);
277 if (res != hdr_sectors) {
278 pr_err("cannot read header from boot partition\n");
279 fastboot_fail("cannot read header from boot partition",
284 /* Check boot header magic string */
285 res = android_image_check_header(hdr);
287 pr_err("bad boot image magic\n");
288 fastboot_fail("boot partition not initialized", response);
296 * Write downloaded zImage to boot partition and repack it properly.
298 * @param dev_desc MMC device descriptor
299 * @param download_buffer Address to fastboot buffer with zImage in it
300 * @param download_bytes Size of fastboot buffer, in bytes
302 * @return 0 on success or -1 on error
304 static int fb_mmc_update_zimage(struct blk_desc *dev_desc,
305 void *download_buffer,
309 uintptr_t hdr_addr; /* boot image header address */
310 struct andr_img_hdr *hdr; /* boot image header */
311 lbaint_t hdr_sectors; /* boot image header sectors */
313 u32 ramdisk_sector_start;
315 u32 kernel_sector_start;
317 u32 sectors_per_page;
318 struct disk_partition info;
321 puts("Flashing zImage\n");
323 /* Get boot partition info */
324 res = part_get_info_by_name(dev_desc, BOOT_PARTITION_NAME, &info);
326 pr_err("cannot find boot partition\n");
327 fastboot_fail("cannot find boot partition", response);
331 /* Put boot image header in fastboot buffer after downloaded zImage */
332 hdr_addr = (uintptr_t)download_buffer + ALIGN(download_bytes, PAGE_SIZE);
333 hdr = (struct andr_img_hdr *)hdr_addr;
335 /* Read boot image header */
336 hdr_sectors = fb_mmc_get_boot_header(dev_desc, &info, hdr, response);
337 if (hdr_sectors == 0) {
338 pr_err("unable to read boot image header\n");
339 fastboot_fail("unable to read boot image header", response);
343 /* Check if boot image has second stage in it (we don't support it) */
344 if (hdr->second_size > 0) {
345 pr_err("moving second stage is not supported yet\n");
346 fastboot_fail("moving second stage is not supported yet",
351 /* Extract ramdisk location */
352 sectors_per_page = hdr->page_size / info.blksz;
353 ramdisk_sector_start = info.start + sectors_per_page;
354 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
356 ramdisk_sectors = DIV_ROUND_UP(hdr->ramdisk_size, hdr->page_size) *
359 /* Read ramdisk and put it in fastboot buffer after boot image header */
360 ramdisk_buffer = (u8 *)hdr + (hdr_sectors * info.blksz);
361 res = blk_dread(dev_desc, ramdisk_sector_start, ramdisk_sectors,
363 if (res != ramdisk_sectors) {
364 pr_err("cannot read ramdisk from boot partition\n");
365 fastboot_fail("cannot read ramdisk from boot partition",
370 /* Write new kernel size to boot image header */
371 hdr->kernel_size = download_bytes;
372 res = blk_dwrite(dev_desc, info.start, hdr_sectors, (void *)hdr);
374 pr_err("cannot writeback boot image header\n");
375 fastboot_fail("cannot write back boot image header", response);
379 /* Write the new downloaded kernel */
380 kernel_sector_start = info.start + sectors_per_page;
381 kernel_sectors = DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
383 res = blk_dwrite(dev_desc, kernel_sector_start, kernel_sectors,
386 pr_err("cannot write new kernel\n");
387 fastboot_fail("cannot write new kernel", response);
391 /* Write the saved ramdisk back */
392 ramdisk_sector_start = info.start + sectors_per_page;
393 ramdisk_sector_start += DIV_ROUND_UP(hdr->kernel_size, hdr->page_size) *
395 res = blk_dwrite(dev_desc, ramdisk_sector_start, ramdisk_sectors,
398 pr_err("cannot write back original ramdisk\n");
399 fastboot_fail("cannot write back original ramdisk", response);
403 puts("........ zImage was updated in boot partition\n");
404 fastboot_okay(NULL, response);
410 * fastboot_mmc_get_part_info() - Lookup eMMC partion by name
412 * @part_name: Named partition to lookup
413 * @dev_desc: Pointer to returned blk_desc pointer
414 * @part_info: Pointer to returned struct disk_partition
415 * @response: Pointer to fastboot response buffer
417 int fastboot_mmc_get_part_info(const char *part_name,
418 struct blk_desc **dev_desc,
419 struct disk_partition *part_info, char *response)
424 *dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
426 fastboot_fail("block device not found", response);
429 if (!part_name || !strcmp(part_name, "")) {
430 fastboot_fail("partition not given", response);
434 if (raw_part_get_info_by_name(*dev_desc, part_name, part_info, &mmcpart) < 0) {
435 r = part_get_info_by_name_or_alias(*dev_desc, part_name, part_info);
437 fastboot_fail("partition not found", response);
446 * fastboot_mmc_flash_write() - Write image to eMMC for fastboot
448 * @cmd: Named partition to write image to
449 * @download_buffer: Pointer to image data
450 * @download_bytes: Size of image data
451 * @response: Pointer to fastboot response buffer
453 void fastboot_mmc_flash_write(const char *cmd, void *download_buffer,
454 u32 download_bytes, char *response)
456 struct blk_desc *dev_desc;
457 struct disk_partition info;
460 dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
461 if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
462 pr_err("invalid mmc device\n");
463 fastboot_fail("invalid mmc device", response);
467 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
468 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
469 fb_mmc_boot1_ops(dev_desc, download_buffer,
470 download_bytes, response);
475 #if CONFIG_IS_ENABLED(EFI_PARTITION)
476 #ifndef CONFIG_FASTBOOT_MMC_USER_NAME
477 if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0) {
479 if (strcmp(cmd, CONFIG_FASTBOOT_GPT_NAME) == 0 ||
480 strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
482 printf("%s: updating MBR, Primary and Backup GPT(s)\n",
484 if (is_valid_gpt_buf(dev_desc, download_buffer)) {
485 printf("%s: invalid GPT - refusing to write to flash\n",
487 fastboot_fail("invalid GPT partition", response);
490 if (write_mbr_and_gpt_partitions(dev_desc, download_buffer)) {
491 printf("%s: writing GPT partitions failed\n", __func__);
492 fastboot_fail("writing GPT partitions failed",
496 printf("........ success\n");
497 fastboot_okay(NULL, response);
502 #if CONFIG_IS_ENABLED(DOS_PARTITION)
503 if (strcmp(cmd, CONFIG_FASTBOOT_MBR_NAME) == 0) {
504 printf("%s: updating MBR\n", __func__);
505 if (is_valid_dos_buf(download_buffer)) {
506 printf("%s: invalid MBR - refusing to write to flash\n",
508 fastboot_fail("invalid MBR partition", response);
511 if (write_mbr_partition(dev_desc, download_buffer)) {
512 printf("%s: writing MBR partition failed\n", __func__);
513 fastboot_fail("writing MBR partition failed",
517 printf("........ success\n");
518 fastboot_okay(NULL, response);
523 #ifdef CONFIG_ANDROID_BOOT_IMAGE
524 if (strncasecmp(cmd, "zimage", 6) == 0) {
525 fb_mmc_update_zimage(dev_desc, download_buffer,
526 download_bytes, response);
531 if (raw_part_get_info_by_name(dev_desc, cmd, &info, &mmcpart) == 0) {
532 if (blk_dselect_hwpart(dev_desc, mmcpart)) {
533 pr_err("Failed to select hwpart\n");
534 fastboot_fail("Failed to select hwpart", response);
537 } else if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) {
538 pr_err("cannot find partition: '%s'\n", cmd);
539 fastboot_fail("cannot find partition", response);
543 if (is_sparse_image(download_buffer)) {
544 struct fb_mmc_sparse sparse_priv;
545 struct sparse_storage sparse;
548 sparse_priv.dev_desc = dev_desc;
550 sparse.blksz = info.blksz;
551 sparse.start = info.start;
552 sparse.size = info.size;
553 sparse.write = fb_mmc_sparse_write;
554 sparse.reserve = fb_mmc_sparse_reserve;
555 sparse.mssg = fastboot_fail;
557 printf("Flashing sparse image at offset " LBAFU "\n",
560 sparse.priv = &sparse_priv;
561 err = write_sparse_image(&sparse, cmd, download_buffer,
564 fastboot_okay(NULL, response);
566 write_raw_image(dev_desc, &info, cmd, download_buffer,
567 download_bytes, response);
572 * fastboot_mmc_flash_erase() - Erase eMMC for fastboot
574 * @cmd: Named partition to erase
575 * @response: Pointer to fastboot response buffer
577 void fastboot_mmc_erase(const char *cmd, char *response)
579 struct blk_desc *dev_desc;
580 struct disk_partition info;
581 lbaint_t blks, blks_start, blks_size, grp_size;
582 struct mmc *mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV);
586 pr_err("invalid mmc device\n");
587 fastboot_fail("invalid mmc device", response);
591 dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
592 if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
593 pr_err("invalid mmc device\n");
594 fastboot_fail("invalid mmc device", response);
598 #ifdef CONFIG_FASTBOOT_MMC_BOOT1_SUPPORT
599 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_BOOT1_NAME) == 0) {
600 /* erase EMMC boot1 */
601 fb_mmc_boot1_ops(dev_desc, NULL, 0, response);
606 #ifdef CONFIG_FASTBOOT_MMC_USER_NAME
607 if (strcmp(cmd, CONFIG_FASTBOOT_MMC_USER_NAME) == 0) {
608 /* erase EMMC userdata */
609 if (fb_mmc_erase_mmc_hwpart(dev_desc))
610 fastboot_fail("Failed to erase EMMC_USER", response);
612 fastboot_okay(NULL, response);
617 if (raw_part_get_info_by_name(dev_desc, cmd, &info, &mmcpart) == 0) {
618 if (blk_dselect_hwpart(dev_desc, mmcpart)) {
619 pr_err("Failed to select hwpart\n");
620 fastboot_fail("Failed to select hwpart", response);
623 } else if (part_get_info_by_name_or_alias(dev_desc, cmd, &info) < 0) {
624 pr_err("cannot find partition: '%s'\n", cmd);
625 fastboot_fail("cannot find partition", response);
629 /* Align blocks to erase group size to avoid erasing other partitions */
630 grp_size = mmc->erase_grp_size;
631 blks_start = (info.start + grp_size - 1) & ~(grp_size - 1);
632 if (info.size >= grp_size)
633 blks_size = (info.size - (blks_start - info.start)) &
638 printf("Erasing blocks " LBAFU " to " LBAFU " due to alignment\n",
639 blks_start, blks_start + blks_size);
641 blks = fb_mmc_blk_write(dev_desc, blks_start, blks_size, NULL);
643 if (blks != blks_size) {
644 pr_err("failed erasing from device %d\n", dev_desc->devnum);
645 fastboot_fail("failed erasing from device", response);
649 printf("........ erased " LBAFU " bytes from '%s'\n",
650 blks_size * info.blksz, cmd);
651 fastboot_okay(NULL, response);