android_ab.c 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361
  1. // SPDX-License-Identifier: BSD-2-Clause
  2. /*
  3. * Copyright (C) 2017 The Android Open Source Project
  4. */
  5. #include <common.h>
  6. #include <android_ab.h>
  7. #include <android_bootloader_message.h>
  8. #include <blk.h>
  9. #include <log.h>
  10. #include <malloc.h>
  11. #include <part.h>
  12. #include <memalign.h>
  13. #include <linux/err.h>
  14. #include <u-boot/crc.h>
  15. #include <u-boot/crc.h>
  16. /**
  17. * Compute the CRC-32 of the bootloader control struct.
  18. *
  19. * Only the bytes up to the crc32_le field are considered for the CRC-32
  20. * calculation.
  21. *
  22. * @param[in] abc bootloader control block
  23. *
  24. * Return: crc32 sum
  25. */
  26. static uint32_t ab_control_compute_crc(struct bootloader_control *abc)
  27. {
  28. return crc32(0, (void *)abc, offsetof(typeof(*abc), crc32_le));
  29. }
  30. /**
  31. * Initialize bootloader_control to the default value.
  32. *
  33. * It allows us to boot all slots in order from the first one. This value
  34. * should be used when the bootloader message is corrupted, but not when
  35. * a valid message indicates that all slots are unbootable.
  36. *
  37. * @param[in] abc bootloader control block
  38. *
  39. * Return: 0 on success and a negative on error
  40. */
  41. static int ab_control_default(struct bootloader_control *abc)
  42. {
  43. int i;
  44. const struct slot_metadata metadata = {
  45. .priority = 15,
  46. .tries_remaining = 7,
  47. .successful_boot = 0,
  48. .verity_corrupted = 0,
  49. .reserved = 0
  50. };
  51. if (!abc)
  52. return -EFAULT;
  53. memcpy(abc->slot_suffix, "a\0\0\0", 4);
  54. abc->magic = BOOT_CTRL_MAGIC;
  55. abc->version = BOOT_CTRL_VERSION;
  56. abc->nb_slot = NUM_SLOTS;
  57. memset(abc->reserved0, 0, sizeof(abc->reserved0));
  58. for (i = 0; i < abc->nb_slot; ++i)
  59. abc->slot_info[i] = metadata;
  60. memset(abc->reserved1, 0, sizeof(abc->reserved1));
  61. abc->crc32_le = ab_control_compute_crc(abc);
  62. return 0;
  63. }
  64. /**
  65. * Load the boot_control struct from disk into newly allocated memory.
  66. *
  67. * This function allocates and returns an integer number of disk blocks,
  68. * based on the block size of the passed device to help performing a
  69. * read-modify-write operation on the boot_control struct.
  70. * The boot_control struct offset (2 KiB) must be a multiple of the device
  71. * block size, for simplicity.
  72. *
  73. * @param[in] dev_desc Device where to read the boot_control struct from
  74. * @param[in] part_info Partition in 'dev_desc' where to read from, normally
  75. * the "misc" partition should be used
  76. * @param[out] pointer to pointer to bootloader_control data
  77. * Return: 0 on success and a negative on error
  78. */
  79. static int ab_control_create_from_disk(struct blk_desc *dev_desc,
  80. const struct disk_partition *part_info,
  81. struct bootloader_control **abc,
  82. ulong offset)
  83. {
  84. ulong abc_offset, abc_blocks, ret;
  85. abc_offset = offset +
  86. offsetof(struct bootloader_message_ab, slot_suffix);
  87. if (abc_offset % part_info->blksz) {
  88. log_err("ANDROID: Boot control block not block aligned.\n");
  89. return -EINVAL;
  90. }
  91. abc_offset /= part_info->blksz;
  92. abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
  93. part_info->blksz);
  94. if (abc_offset + abc_blocks > part_info->size) {
  95. log_err("ANDROID: boot control partition too small. Need at");
  96. log_err(" least %lu blocks but have %lu blocks.\n",
  97. abc_offset + abc_blocks, part_info->size);
  98. return -EINVAL;
  99. }
  100. *abc = malloc_cache_aligned(abc_blocks * part_info->blksz);
  101. if (!*abc)
  102. return -ENOMEM;
  103. ret = blk_dread(dev_desc, part_info->start + abc_offset, abc_blocks,
  104. *abc);
  105. if (IS_ERR_VALUE(ret)) {
  106. log_err("ANDROID: Could not read from boot ctrl partition\n");
  107. free(*abc);
  108. return -EIO;
  109. }
  110. log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks);
  111. return 0;
  112. }
  113. /**
  114. * Store the loaded boot_control block.
  115. *
  116. * Store back to the same location it was read from with
  117. * ab_control_create_from_misc().
  118. *
  119. * @param[in] dev_desc Device where we should write the boot_control struct
  120. * @param[in] part_info Partition on the 'dev_desc' where to write
  121. * @param[in] abc Pointer to the boot control struct and the extra bytes after
  122. * it up to the nearest block boundary
  123. * Return: 0 on success and a negative on error
  124. */
  125. static int ab_control_store(struct blk_desc *dev_desc,
  126. const struct disk_partition *part_info,
  127. struct bootloader_control *abc, ulong offset)
  128. {
  129. ulong abc_offset, abc_blocks, ret;
  130. abc_offset = offset +
  131. offsetof(struct bootloader_message_ab, slot_suffix) /
  132. part_info->blksz;
  133. abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
  134. part_info->blksz);
  135. ret = blk_dwrite(dev_desc, part_info->start + abc_offset, abc_blocks,
  136. abc);
  137. if (IS_ERR_VALUE(ret)) {
  138. log_err("ANDROID: Could not write back the misc partition\n");
  139. return -EIO;
  140. }
  141. return 0;
  142. }
  143. /**
  144. * Compare two slots.
  145. *
  146. * The function determines slot which is should we boot from among the two.
  147. *
  148. * @param[in] a The first bootable slot metadata
  149. * @param[in] b The second bootable slot metadata
  150. * Return: Negative if the slot "a" is better, positive of the slot "b" is
  151. * better or 0 if they are equally good.
  152. */
  153. static int ab_compare_slots(const struct slot_metadata *a,
  154. const struct slot_metadata *b)
  155. {
  156. /* Higher priority is better */
  157. if (a->priority != b->priority)
  158. return b->priority - a->priority;
  159. /* Higher successful_boot value is better, in case of same priority */
  160. if (a->successful_boot != b->successful_boot)
  161. return b->successful_boot - a->successful_boot;
  162. /* Higher tries_remaining is better to ensure round-robin */
  163. if (a->tries_remaining != b->tries_remaining)
  164. return b->tries_remaining - a->tries_remaining;
  165. return 0;
  166. }
  167. int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info,
  168. bool dec_tries)
  169. {
  170. struct bootloader_control *abc = NULL;
  171. u32 crc32_le;
  172. int slot, i, ret;
  173. bool store_needed = false;
  174. char slot_suffix[4];
  175. #if ANDROID_AB_BACKUP_OFFSET
  176. struct bootloader_control *backup_abc = NULL;
  177. #endif
  178. ret = ab_control_create_from_disk(dev_desc, part_info, &abc, 0);
  179. if (ret < 0) {
  180. /*
  181. * This condition represents an actual problem with the code or
  182. * the board setup, like an invalid partition information.
  183. * Signal a repair mode and do not try to boot from either slot.
  184. */
  185. return ret;
  186. }
  187. #if ANDROID_AB_BACKUP_OFFSET
  188. ret = ab_control_create_from_disk(dev_desc, part_info, &backup_abc,
  189. ANDROID_AB_BACKUP_OFFSET);
  190. if (ret < 0) {
  191. free(abc);
  192. return ret;
  193. }
  194. #endif
  195. crc32_le = ab_control_compute_crc(abc);
  196. if (abc->crc32_le != crc32_le) {
  197. log_err("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x),",
  198. crc32_le, abc->crc32_le);
  199. #if ANDROID_AB_BACKUP_OFFSET
  200. crc32_le = ab_control_compute_crc(backup_abc);
  201. if (backup_abc->crc32_le != crc32_le) {
  202. log_err("ANDROID: Invalid backup CRC-32 ")
  203. log_err("expected %.8x, found %.8x),",
  204. crc32_le, backup_abc->crc32_le);
  205. #endif
  206. log_err("re-initializing A/B metadata.\n");
  207. ret = ab_control_default(abc);
  208. if (ret < 0) {
  209. #if ANDROID_AB_BACKUP_OFFSET
  210. free(backup_abc);
  211. #endif
  212. free(abc);
  213. return -ENODATA;
  214. }
  215. #if ANDROID_AB_BACKUP_OFFSET
  216. } else {
  217. /*
  218. * Backup is valid. Copy it to the primary
  219. */
  220. memcpy(abc, backup_abc, sizeof(*abc));
  221. }
  222. #endif
  223. store_needed = true;
  224. }
  225. if (abc->magic != BOOT_CTRL_MAGIC) {
  226. log_err("ANDROID: Unknown A/B metadata: %.8x\n", abc->magic);
  227. #if ANDROID_AB_BACKUP_OFFSET
  228. free(backup_abc);
  229. #endif
  230. free(abc);
  231. return -ENODATA;
  232. }
  233. if (abc->version > BOOT_CTRL_VERSION) {
  234. log_err("ANDROID: Unsupported A/B metadata version: %.8x\n",
  235. abc->version);
  236. #if ANDROID_AB_BACKUP_OFFSET
  237. free(backup_abc);
  238. #endif
  239. free(abc);
  240. return -ENODATA;
  241. }
  242. /*
  243. * At this point a valid boot control metadata is stored in abc,
  244. * followed by other reserved data in the same block. We select a with
  245. * the higher priority slot that
  246. * - is not marked as corrupted and
  247. * - either has tries_remaining > 0 or successful_boot is true.
  248. * If the selected slot has a false successful_boot, we also decrement
  249. * the tries_remaining until it eventually becomes unbootable because
  250. * tries_remaining reaches 0. This mechanism produces a bootloader
  251. * induced rollback, typically right after a failed update.
  252. */
  253. /* Safety check: limit the number of slots. */
  254. if (abc->nb_slot > ARRAY_SIZE(abc->slot_info)) {
  255. abc->nb_slot = ARRAY_SIZE(abc->slot_info);
  256. store_needed = true;
  257. }
  258. slot = -1;
  259. for (i = 0; i < abc->nb_slot; ++i) {
  260. if (abc->slot_info[i].verity_corrupted ||
  261. !abc->slot_info[i].tries_remaining) {
  262. log_debug("ANDROID: unbootable slot %d tries: %d, ",
  263. i, abc->slot_info[i].tries_remaining);
  264. log_debug("corrupt: %d\n",
  265. abc->slot_info[i].verity_corrupted);
  266. continue;
  267. }
  268. log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ",
  269. i, abc->slot_info[i].priority,
  270. abc->slot_info[i].tries_remaining);
  271. log_debug("corrupt: %d, successful: %d\n",
  272. abc->slot_info[i].verity_corrupted,
  273. abc->slot_info[i].successful_boot);
  274. if (slot < 0 ||
  275. ab_compare_slots(&abc->slot_info[i],
  276. &abc->slot_info[slot]) < 0) {
  277. slot = i;
  278. }
  279. }
  280. if (slot >= 0 && !abc->slot_info[slot].successful_boot) {
  281. log_err("ANDROID: Attempting slot %c, tries remaining %d\n",
  282. BOOT_SLOT_NAME(slot),
  283. abc->slot_info[slot].tries_remaining);
  284. if (dec_tries) {
  285. abc->slot_info[slot].tries_remaining--;
  286. store_needed = true;
  287. }
  288. }
  289. if (slot >= 0) {
  290. /*
  291. * Legacy user-space requires this field to be set in the BCB.
  292. * Newer releases load this slot suffix from the command line
  293. * or the device tree.
  294. */
  295. memset(slot_suffix, 0, sizeof(slot_suffix));
  296. slot_suffix[0] = BOOT_SLOT_NAME(slot);
  297. if (memcmp(abc->slot_suffix, slot_suffix,
  298. sizeof(slot_suffix))) {
  299. memcpy(abc->slot_suffix, slot_suffix,
  300. sizeof(slot_suffix));
  301. store_needed = true;
  302. }
  303. }
  304. if (store_needed) {
  305. abc->crc32_le = ab_control_compute_crc(abc);
  306. ab_control_store(dev_desc, part_info, abc, 0);
  307. }
  308. #if ANDROID_AB_BACKUP_OFFSET
  309. /*
  310. * If the backup doesn't match the primary, write the primary
  311. * to the backup offset
  312. */
  313. if (memcmp(backup_abc, abc, sizeof(*abc)) != 0) {
  314. ab_control_store(dev_desc, part_info, abc,
  315. ANDROID_AB_BACKUP_OFFSET);
  316. }
  317. free(backup_abc);
  318. #endif
  319. free(abc);
  320. if (slot < 0)
  321. return -EINVAL;
  322. return slot;
  323. }