Commit | Line | Data |
---|---|---|
d65e8da9 RT |
1 | // SPDX-License-Identifier: BSD-2-Clause |
2 | /* | |
3 | * Copyright (C) 2017 The Android Open Source Project | |
4 | */ | |
5 | #include <common.h> | |
6 | #include <android_ab.h> | |
7 | #include <android_bootloader_message.h> | |
e6f6f9e6 | 8 | #include <blk.h> |
f7ae49fc | 9 | #include <log.h> |
336d4615 | 10 | #include <malloc.h> |
e6f6f9e6 | 11 | #include <part.h> |
d65e8da9 | 12 | #include <memalign.h> |
e6f6f9e6 | 13 | #include <linux/err.h> |
d65e8da9 RT |
14 | #include <u-boot/crc.h> |
15 | ||
16 | /** | |
17 | * Compute the CRC-32 of the bootloader control struct. | |
18 | * | |
19 | * Only the bytes up to the crc32_le field are considered for the CRC-32 | |
20 | * calculation. | |
21 | * | |
22 | * @param[in] abc bootloader control block | |
23 | * | |
185f812c | 24 | * Return: crc32 sum |
d65e8da9 RT |
25 | */ |
26 | static uint32_t ab_control_compute_crc(struct bootloader_control *abc) | |
27 | { | |
28 | return crc32(0, (void *)abc, offsetof(typeof(*abc), crc32_le)); | |
29 | } | |
30 | ||
31 | /** | |
32 | * Initialize bootloader_control to the default value. | |
33 | * | |
34 | * It allows us to boot all slots in order from the first one. This value | |
35 | * should be used when the bootloader message is corrupted, but not when | |
36 | * a valid message indicates that all slots are unbootable. | |
37 | * | |
38 | * @param[in] abc bootloader control block | |
39 | * | |
185f812c | 40 | * Return: 0 on success and a negative on error |
d65e8da9 RT |
41 | */ |
42 | static int ab_control_default(struct bootloader_control *abc) | |
43 | { | |
44 | int i; | |
45 | const struct slot_metadata metadata = { | |
46 | .priority = 15, | |
47 | .tries_remaining = 7, | |
48 | .successful_boot = 0, | |
49 | .verity_corrupted = 0, | |
50 | .reserved = 0 | |
51 | }; | |
52 | ||
53 | if (!abc) | |
54 | return -EFAULT; | |
55 | ||
56 | memcpy(abc->slot_suffix, "a\0\0\0", 4); | |
57 | abc->magic = BOOT_CTRL_MAGIC; | |
58 | abc->version = BOOT_CTRL_VERSION; | |
59 | abc->nb_slot = NUM_SLOTS; | |
60 | memset(abc->reserved0, 0, sizeof(abc->reserved0)); | |
61 | for (i = 0; i < abc->nb_slot; ++i) | |
62 | abc->slot_info[i] = metadata; | |
63 | ||
64 | memset(abc->reserved1, 0, sizeof(abc->reserved1)); | |
65 | abc->crc32_le = ab_control_compute_crc(abc); | |
66 | ||
67 | return 0; | |
68 | } | |
69 | ||
70 | /** | |
71 | * Load the boot_control struct from disk into newly allocated memory. | |
72 | * | |
73 | * This function allocates and returns an integer number of disk blocks, | |
74 | * based on the block size of the passed device to help performing a | |
75 | * read-modify-write operation on the boot_control struct. | |
76 | * The boot_control struct offset (2 KiB) must be a multiple of the device | |
77 | * block size, for simplicity. | |
78 | * | |
79 | * @param[in] dev_desc Device where to read the boot_control struct from | |
80 | * @param[in] part_info Partition in 'dev_desc' where to read from, normally | |
81 | * the "misc" partition should be used | |
82 | * @param[out] pointer to pointer to bootloader_control data | |
185f812c | 83 | * Return: 0 on success and a negative on error |
d65e8da9 RT |
84 | */ |
85 | static int ab_control_create_from_disk(struct blk_desc *dev_desc, | |
0528979f | 86 | const struct disk_partition *part_info, |
3430f24b JW |
87 | struct bootloader_control **abc, |
88 | ulong offset) | |
d65e8da9 RT |
89 | { |
90 | ulong abc_offset, abc_blocks, ret; | |
91 | ||
3430f24b JW |
92 | abc_offset = offset + |
93 | offsetof(struct bootloader_message_ab, slot_suffix); | |
d65e8da9 RT |
94 | if (abc_offset % part_info->blksz) { |
95 | log_err("ANDROID: Boot control block not block aligned.\n"); | |
96 | return -EINVAL; | |
97 | } | |
98 | abc_offset /= part_info->blksz; | |
99 | ||
100 | abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control), | |
101 | part_info->blksz); | |
102 | if (abc_offset + abc_blocks > part_info->size) { | |
103 | log_err("ANDROID: boot control partition too small. Need at"); | |
104 | log_err(" least %lu blocks but have %lu blocks.\n", | |
105 | abc_offset + abc_blocks, part_info->size); | |
106 | return -EINVAL; | |
107 | } | |
108 | *abc = malloc_cache_aligned(abc_blocks * part_info->blksz); | |
109 | if (!*abc) | |
110 | return -ENOMEM; | |
111 | ||
112 | ret = blk_dread(dev_desc, part_info->start + abc_offset, abc_blocks, | |
113 | *abc); | |
114 | if (IS_ERR_VALUE(ret)) { | |
115 | log_err("ANDROID: Could not read from boot ctrl partition\n"); | |
116 | free(*abc); | |
117 | return -EIO; | |
118 | } | |
119 | ||
120 | log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks); | |
121 | ||
122 | return 0; | |
123 | } | |
124 | ||
125 | /** | |
126 | * Store the loaded boot_control block. | |
127 | * | |
128 | * Store back to the same location it was read from with | |
129 | * ab_control_create_from_misc(). | |
130 | * | |
131 | * @param[in] dev_desc Device where we should write the boot_control struct | |
132 | * @param[in] part_info Partition on the 'dev_desc' where to write | |
133 | * @param[in] abc Pointer to the boot control struct and the extra bytes after | |
134 | * it up to the nearest block boundary | |
185f812c | 135 | * Return: 0 on success and a negative on error |
d65e8da9 RT |
136 | */ |
137 | static int ab_control_store(struct blk_desc *dev_desc, | |
0528979f | 138 | const struct disk_partition *part_info, |
3430f24b | 139 | struct bootloader_control *abc, ulong offset) |
d65e8da9 RT |
140 | { |
141 | ulong abc_offset, abc_blocks, ret; | |
142 | ||
3430f24b JW |
143 | abc_offset = offset + |
144 | offsetof(struct bootloader_message_ab, slot_suffix) / | |
d65e8da9 RT |
145 | part_info->blksz; |
146 | abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control), | |
147 | part_info->blksz); | |
148 | ret = blk_dwrite(dev_desc, part_info->start + abc_offset, abc_blocks, | |
149 | abc); | |
150 | if (IS_ERR_VALUE(ret)) { | |
151 | log_err("ANDROID: Could not write back the misc partition\n"); | |
152 | return -EIO; | |
153 | } | |
154 | ||
155 | return 0; | |
156 | } | |
157 | ||
158 | /** | |
159 | * Compare two slots. | |
160 | * | |
161 | * The function determines slot which is should we boot from among the two. | |
162 | * | |
163 | * @param[in] a The first bootable slot metadata | |
164 | * @param[in] b The second bootable slot metadata | |
185f812c | 165 | * Return: Negative if the slot "a" is better, positive of the slot "b" is |
d65e8da9 RT |
166 | * better or 0 if they are equally good. |
167 | */ | |
168 | static int ab_compare_slots(const struct slot_metadata *a, | |
169 | const struct slot_metadata *b) | |
170 | { | |
171 | /* Higher priority is better */ | |
172 | if (a->priority != b->priority) | |
173 | return b->priority - a->priority; | |
174 | ||
175 | /* Higher successful_boot value is better, in case of same priority */ | |
176 | if (a->successful_boot != b->successful_boot) | |
177 | return b->successful_boot - a->successful_boot; | |
178 | ||
179 | /* Higher tries_remaining is better to ensure round-robin */ | |
180 | if (a->tries_remaining != b->tries_remaining) | |
181 | return b->tries_remaining - a->tries_remaining; | |
182 | ||
183 | return 0; | |
184 | } | |
185 | ||
22cdb3f0 JW |
186 | int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info, |
187 | bool dec_tries) | |
d65e8da9 RT |
188 | { |
189 | struct bootloader_control *abc = NULL; | |
190 | u32 crc32_le; | |
191 | int slot, i, ret; | |
192 | bool store_needed = false; | |
193 | char slot_suffix[4]; | |
3430f24b JW |
194 | #if ANDROID_AB_BACKUP_OFFSET |
195 | struct bootloader_control *backup_abc = NULL; | |
196 | #endif | |
d65e8da9 | 197 | |
3430f24b | 198 | ret = ab_control_create_from_disk(dev_desc, part_info, &abc, 0); |
d65e8da9 RT |
199 | if (ret < 0) { |
200 | /* | |
201 | * This condition represents an actual problem with the code or | |
202 | * the board setup, like an invalid partition information. | |
203 | * Signal a repair mode and do not try to boot from either slot. | |
204 | */ | |
205 | return ret; | |
206 | } | |
207 | ||
3430f24b JW |
208 | #if ANDROID_AB_BACKUP_OFFSET |
209 | ret = ab_control_create_from_disk(dev_desc, part_info, &backup_abc, | |
210 | ANDROID_AB_BACKUP_OFFSET); | |
211 | if (ret < 0) { | |
212 | free(abc); | |
213 | return ret; | |
214 | } | |
215 | #endif | |
216 | ||
d65e8da9 RT |
217 | crc32_le = ab_control_compute_crc(abc); |
218 | if (abc->crc32_le != crc32_le) { | |
219 | log_err("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x),", | |
220 | crc32_le, abc->crc32_le); | |
3430f24b JW |
221 | #if ANDROID_AB_BACKUP_OFFSET |
222 | crc32_le = ab_control_compute_crc(backup_abc); | |
223 | if (backup_abc->crc32_le != crc32_le) { | |
224 | log_err("ANDROID: Invalid backup CRC-32 ") | |
225 | log_err("expected %.8x, found %.8x),", | |
226 | crc32_le, backup_abc->crc32_le); | |
227 | #endif | |
228 | ||
229 | log_err("re-initializing A/B metadata.\n"); | |
230 | ||
231 | ret = ab_control_default(abc); | |
232 | if (ret < 0) { | |
233 | #if ANDROID_AB_BACKUP_OFFSET | |
234 | free(backup_abc); | |
235 | #endif | |
236 | free(abc); | |
237 | return -ENODATA; | |
238 | } | |
239 | #if ANDROID_AB_BACKUP_OFFSET | |
240 | } else { | |
241 | /* | |
242 | * Backup is valid. Copy it to the primary | |
243 | */ | |
244 | memcpy(abc, backup_abc, sizeof(*abc)); | |
d65e8da9 | 245 | } |
3430f24b | 246 | #endif |
d65e8da9 RT |
247 | store_needed = true; |
248 | } | |
249 | ||
250 | if (abc->magic != BOOT_CTRL_MAGIC) { | |
251 | log_err("ANDROID: Unknown A/B metadata: %.8x\n", abc->magic); | |
3430f24b JW |
252 | #if ANDROID_AB_BACKUP_OFFSET |
253 | free(backup_abc); | |
254 | #endif | |
d65e8da9 RT |
255 | free(abc); |
256 | return -ENODATA; | |
257 | } | |
258 | ||
259 | if (abc->version > BOOT_CTRL_VERSION) { | |
260 | log_err("ANDROID: Unsupported A/B metadata version: %.8x\n", | |
261 | abc->version); | |
3430f24b JW |
262 | #if ANDROID_AB_BACKUP_OFFSET |
263 | free(backup_abc); | |
264 | #endif | |
d65e8da9 RT |
265 | free(abc); |
266 | return -ENODATA; | |
267 | } | |
268 | ||
269 | /* | |
270 | * At this point a valid boot control metadata is stored in abc, | |
271 | * followed by other reserved data in the same block. We select a with | |
272 | * the higher priority slot that | |
273 | * - is not marked as corrupted and | |
274 | * - either has tries_remaining > 0 or successful_boot is true. | |
275 | * If the selected slot has a false successful_boot, we also decrement | |
276 | * the tries_remaining until it eventually becomes unbootable because | |
277 | * tries_remaining reaches 0. This mechanism produces a bootloader | |
278 | * induced rollback, typically right after a failed update. | |
279 | */ | |
280 | ||
281 | /* Safety check: limit the number of slots. */ | |
282 | if (abc->nb_slot > ARRAY_SIZE(abc->slot_info)) { | |
283 | abc->nb_slot = ARRAY_SIZE(abc->slot_info); | |
284 | store_needed = true; | |
285 | } | |
286 | ||
287 | slot = -1; | |
288 | for (i = 0; i < abc->nb_slot; ++i) { | |
289 | if (abc->slot_info[i].verity_corrupted || | |
290 | !abc->slot_info[i].tries_remaining) { | |
291 | log_debug("ANDROID: unbootable slot %d tries: %d, ", | |
292 | i, abc->slot_info[i].tries_remaining); | |
293 | log_debug("corrupt: %d\n", | |
294 | abc->slot_info[i].verity_corrupted); | |
295 | continue; | |
296 | } | |
297 | log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ", | |
298 | i, abc->slot_info[i].priority, | |
299 | abc->slot_info[i].tries_remaining); | |
300 | log_debug("corrupt: %d, successful: %d\n", | |
301 | abc->slot_info[i].verity_corrupted, | |
302 | abc->slot_info[i].successful_boot); | |
303 | ||
304 | if (slot < 0 || | |
305 | ab_compare_slots(&abc->slot_info[i], | |
306 | &abc->slot_info[slot]) < 0) { | |
307 | slot = i; | |
308 | } | |
309 | } | |
310 | ||
311 | if (slot >= 0 && !abc->slot_info[slot].successful_boot) { | |
312 | log_err("ANDROID: Attempting slot %c, tries remaining %d\n", | |
313 | BOOT_SLOT_NAME(slot), | |
314 | abc->slot_info[slot].tries_remaining); | |
22cdb3f0 JW |
315 | if (dec_tries) { |
316 | abc->slot_info[slot].tries_remaining--; | |
317 | store_needed = true; | |
318 | } | |
d65e8da9 RT |
319 | } |
320 | ||
321 | if (slot >= 0) { | |
322 | /* | |
323 | * Legacy user-space requires this field to be set in the BCB. | |
324 | * Newer releases load this slot suffix from the command line | |
325 | * or the device tree. | |
326 | */ | |
327 | memset(slot_suffix, 0, sizeof(slot_suffix)); | |
328 | slot_suffix[0] = BOOT_SLOT_NAME(slot); | |
329 | if (memcmp(abc->slot_suffix, slot_suffix, | |
330 | sizeof(slot_suffix))) { | |
331 | memcpy(abc->slot_suffix, slot_suffix, | |
332 | sizeof(slot_suffix)); | |
333 | store_needed = true; | |
334 | } | |
335 | } | |
336 | ||
337 | if (store_needed) { | |
338 | abc->crc32_le = ab_control_compute_crc(abc); | |
3430f24b | 339 | ab_control_store(dev_desc, part_info, abc, 0); |
d65e8da9 | 340 | } |
3430f24b JW |
341 | |
342 | #if ANDROID_AB_BACKUP_OFFSET | |
343 | /* | |
344 | * If the backup doesn't match the primary, write the primary | |
345 | * to the backup offset | |
346 | */ | |
347 | if (memcmp(backup_abc, abc, sizeof(*abc)) != 0) { | |
348 | ab_control_store(dev_desc, part_info, abc, | |
349 | ANDROID_AB_BACKUP_OFFSET); | |
350 | } | |
351 | free(backup_abc); | |
352 | #endif | |
353 | ||
d65e8da9 RT |
354 | free(abc); |
355 | ||
356 | if (slot < 0) | |
357 | return -EINVAL; | |
358 | ||
359 | return slot; | |
360 | } |