android_ab.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301
  1. // SPDX-License-Identifier: BSD-2-Clause
  2. /*
  3. * Copyright (C) 2017 The Android Open Source Project
  4. */
  5. #include <common.h>
  6. #include <android_ab.h>
  7. #include <android_bootloader_message.h>
  8. #include <linux/err.h>
  9. #include <memalign.h>
  10. #include <u-boot/crc.h>
  11. #include <u-boot/crc.h>
  12. /**
  13. * Compute the CRC-32 of the bootloader control struct.
  14. *
  15. * Only the bytes up to the crc32_le field are considered for the CRC-32
  16. * calculation.
  17. *
  18. * @param[in] abc bootloader control block
  19. *
  20. * @return crc32 sum
  21. */
  22. static uint32_t ab_control_compute_crc(struct bootloader_control *abc)
  23. {
  24. return crc32(0, (void *)abc, offsetof(typeof(*abc), crc32_le));
  25. }
  26. /**
  27. * Initialize bootloader_control to the default value.
  28. *
  29. * It allows us to boot all slots in order from the first one. This value
  30. * should be used when the bootloader message is corrupted, but not when
  31. * a valid message indicates that all slots are unbootable.
  32. *
  33. * @param[in] abc bootloader control block
  34. *
  35. * @return 0 on success and a negative on error
  36. */
  37. static int ab_control_default(struct bootloader_control *abc)
  38. {
  39. int i;
  40. const struct slot_metadata metadata = {
  41. .priority = 15,
  42. .tries_remaining = 7,
  43. .successful_boot = 0,
  44. .verity_corrupted = 0,
  45. .reserved = 0
  46. };
  47. if (!abc)
  48. return -EFAULT;
  49. memcpy(abc->slot_suffix, "a\0\0\0", 4);
  50. abc->magic = BOOT_CTRL_MAGIC;
  51. abc->version = BOOT_CTRL_VERSION;
  52. abc->nb_slot = NUM_SLOTS;
  53. memset(abc->reserved0, 0, sizeof(abc->reserved0));
  54. for (i = 0; i < abc->nb_slot; ++i)
  55. abc->slot_info[i] = metadata;
  56. memset(abc->reserved1, 0, sizeof(abc->reserved1));
  57. abc->crc32_le = ab_control_compute_crc(abc);
  58. return 0;
  59. }
  60. /**
  61. * Load the boot_control struct from disk into newly allocated memory.
  62. *
  63. * This function allocates and returns an integer number of disk blocks,
  64. * based on the block size of the passed device to help performing a
  65. * read-modify-write operation on the boot_control struct.
  66. * The boot_control struct offset (2 KiB) must be a multiple of the device
  67. * block size, for simplicity.
  68. *
  69. * @param[in] dev_desc Device where to read the boot_control struct from
  70. * @param[in] part_info Partition in 'dev_desc' where to read from, normally
  71. * the "misc" partition should be used
  72. * @param[out] pointer to pointer to bootloader_control data
  73. * @return 0 on success and a negative on error
  74. */
  75. static int ab_control_create_from_disk(struct blk_desc *dev_desc,
  76. const disk_partition_t *part_info,
  77. struct bootloader_control **abc)
  78. {
  79. ulong abc_offset, abc_blocks, ret;
  80. abc_offset = offsetof(struct bootloader_message_ab, slot_suffix);
  81. if (abc_offset % part_info->blksz) {
  82. log_err("ANDROID: Boot control block not block aligned.\n");
  83. return -EINVAL;
  84. }
  85. abc_offset /= part_info->blksz;
  86. abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
  87. part_info->blksz);
  88. if (abc_offset + abc_blocks > part_info->size) {
  89. log_err("ANDROID: boot control partition too small. Need at");
  90. log_err(" least %lu blocks but have %lu blocks.\n",
  91. abc_offset + abc_blocks, part_info->size);
  92. return -EINVAL;
  93. }
  94. *abc = malloc_cache_aligned(abc_blocks * part_info->blksz);
  95. if (!*abc)
  96. return -ENOMEM;
  97. ret = blk_dread(dev_desc, part_info->start + abc_offset, abc_blocks,
  98. *abc);
  99. if (IS_ERR_VALUE(ret)) {
  100. log_err("ANDROID: Could not read from boot ctrl partition\n");
  101. free(*abc);
  102. return -EIO;
  103. }
  104. log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks);
  105. return 0;
  106. }
  107. /**
  108. * Store the loaded boot_control block.
  109. *
  110. * Store back to the same location it was read from with
  111. * ab_control_create_from_misc().
  112. *
  113. * @param[in] dev_desc Device where we should write the boot_control struct
  114. * @param[in] part_info Partition on the 'dev_desc' where to write
  115. * @param[in] abc Pointer to the boot control struct and the extra bytes after
  116. * it up to the nearest block boundary
  117. * @return 0 on success and a negative on error
  118. */
  119. static int ab_control_store(struct blk_desc *dev_desc,
  120. const disk_partition_t *part_info,
  121. struct bootloader_control *abc)
  122. {
  123. ulong abc_offset, abc_blocks, ret;
  124. abc_offset = offsetof(struct bootloader_message_ab, slot_suffix) /
  125. part_info->blksz;
  126. abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
  127. part_info->blksz);
  128. ret = blk_dwrite(dev_desc, part_info->start + abc_offset, abc_blocks,
  129. abc);
  130. if (IS_ERR_VALUE(ret)) {
  131. log_err("ANDROID: Could not write back the misc partition\n");
  132. return -EIO;
  133. }
  134. return 0;
  135. }
  136. /**
  137. * Compare two slots.
  138. *
  139. * The function determines slot which is should we boot from among the two.
  140. *
  141. * @param[in] a The first bootable slot metadata
  142. * @param[in] b The second bootable slot metadata
  143. * @return Negative if the slot "a" is better, positive of the slot "b" is
  144. * better or 0 if they are equally good.
  145. */
  146. static int ab_compare_slots(const struct slot_metadata *a,
  147. const struct slot_metadata *b)
  148. {
  149. /* Higher priority is better */
  150. if (a->priority != b->priority)
  151. return b->priority - a->priority;
  152. /* Higher successful_boot value is better, in case of same priority */
  153. if (a->successful_boot != b->successful_boot)
  154. return b->successful_boot - a->successful_boot;
  155. /* Higher tries_remaining is better to ensure round-robin */
  156. if (a->tries_remaining != b->tries_remaining)
  157. return b->tries_remaining - a->tries_remaining;
  158. return 0;
  159. }
  160. int ab_select_slot(struct blk_desc *dev_desc, disk_partition_t *part_info)
  161. {
  162. struct bootloader_control *abc = NULL;
  163. u32 crc32_le;
  164. int slot, i, ret;
  165. bool store_needed = false;
  166. char slot_suffix[4];
  167. ret = ab_control_create_from_disk(dev_desc, part_info, &abc);
  168. if (ret < 0) {
  169. /*
  170. * This condition represents an actual problem with the code or
  171. * the board setup, like an invalid partition information.
  172. * Signal a repair mode and do not try to boot from either slot.
  173. */
  174. return ret;
  175. }
  176. crc32_le = ab_control_compute_crc(abc);
  177. if (abc->crc32_le != crc32_le) {
  178. log_err("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x),",
  179. crc32_le, abc->crc32_le);
  180. log_err("re-initializing A/B metadata.\n");
  181. ret = ab_control_default(abc);
  182. if (ret < 0) {
  183. free(abc);
  184. return -ENODATA;
  185. }
  186. store_needed = true;
  187. }
  188. if (abc->magic != BOOT_CTRL_MAGIC) {
  189. log_err("ANDROID: Unknown A/B metadata: %.8x\n", abc->magic);
  190. free(abc);
  191. return -ENODATA;
  192. }
  193. if (abc->version > BOOT_CTRL_VERSION) {
  194. log_err("ANDROID: Unsupported A/B metadata version: %.8x\n",
  195. abc->version);
  196. free(abc);
  197. return -ENODATA;
  198. }
  199. /*
  200. * At this point a valid boot control metadata is stored in abc,
  201. * followed by other reserved data in the same block. We select a with
  202. * the higher priority slot that
  203. * - is not marked as corrupted and
  204. * - either has tries_remaining > 0 or successful_boot is true.
  205. * If the selected slot has a false successful_boot, we also decrement
  206. * the tries_remaining until it eventually becomes unbootable because
  207. * tries_remaining reaches 0. This mechanism produces a bootloader
  208. * induced rollback, typically right after a failed update.
  209. */
  210. /* Safety check: limit the number of slots. */
  211. if (abc->nb_slot > ARRAY_SIZE(abc->slot_info)) {
  212. abc->nb_slot = ARRAY_SIZE(abc->slot_info);
  213. store_needed = true;
  214. }
  215. slot = -1;
  216. for (i = 0; i < abc->nb_slot; ++i) {
  217. if (abc->slot_info[i].verity_corrupted ||
  218. !abc->slot_info[i].tries_remaining) {
  219. log_debug("ANDROID: unbootable slot %d tries: %d, ",
  220. i, abc->slot_info[i].tries_remaining);
  221. log_debug("corrupt: %d\n",
  222. abc->slot_info[i].verity_corrupted);
  223. continue;
  224. }
  225. log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ",
  226. i, abc->slot_info[i].priority,
  227. abc->slot_info[i].tries_remaining);
  228. log_debug("corrupt: %d, successful: %d\n",
  229. abc->slot_info[i].verity_corrupted,
  230. abc->slot_info[i].successful_boot);
  231. if (slot < 0 ||
  232. ab_compare_slots(&abc->slot_info[i],
  233. &abc->slot_info[slot]) < 0) {
  234. slot = i;
  235. }
  236. }
  237. if (slot >= 0 && !abc->slot_info[slot].successful_boot) {
  238. log_err("ANDROID: Attempting slot %c, tries remaining %d\n",
  239. BOOT_SLOT_NAME(slot),
  240. abc->slot_info[slot].tries_remaining);
  241. abc->slot_info[slot].tries_remaining--;
  242. store_needed = true;
  243. }
  244. if (slot >= 0) {
  245. /*
  246. * Legacy user-space requires this field to be set in the BCB.
  247. * Newer releases load this slot suffix from the command line
  248. * or the device tree.
  249. */
  250. memset(slot_suffix, 0, sizeof(slot_suffix));
  251. slot_suffix[0] = BOOT_SLOT_NAME(slot);
  252. if (memcmp(abc->slot_suffix, slot_suffix,
  253. sizeof(slot_suffix))) {
  254. memcpy(abc->slot_suffix, slot_suffix,
  255. sizeof(slot_suffix));
  256. store_needed = true;
  257. }
  258. }
  259. if (store_needed) {
  260. abc->crc32_le = ab_control_compute_crc(abc);
  261. ab_control_store(dev_desc, part_info, abc);
  262. }
  263. free(abc);
  264. if (slot < 0)
  265. return -EINVAL;
  266. return slot;
  267. }