blob: 2d7b392666563d5c1ab96cbdc539c28fc391500f [file] [log] [blame]
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +03001// SPDX-License-Identifier: BSD-2-Clause
2/*
3 * Copyright (C) 2017 The Android Open Source Project
4 */
5#include <common.h>
6#include <android_ab.h>
7#include <android_bootloader_message.h>
Simon Glasse6f6f9e2020-05-10 11:39:58 -06008#include <blk.h>
Simon Glassf7ae49f2020-05-10 11:40:05 -06009#include <log.h>
Simon Glass336d4612020-02-03 07:36:16 -070010#include <malloc.h>
Simon Glasse6f6f9e2020-05-10 11:39:58 -060011#include <part.h>
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030012#include <memalign.h>
Simon Glasse6f6f9e2020-05-10 11:39:58 -060013#include <linux/err.h>
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030014#include <u-boot/crc.h>
Simon Glass3db71102019-11-14 12:57:16 -070015#include <u-boot/crc.h>
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030016
17/**
18 * Compute the CRC-32 of the bootloader control struct.
19 *
20 * Only the bytes up to the crc32_le field are considered for the CRC-32
21 * calculation.
22 *
23 * @param[in] abc bootloader control block
24 *
Heinrich Schuchardt185f8122022-01-19 18:05:50 +010025 * Return: crc32 sum
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030026 */
27static uint32_t ab_control_compute_crc(struct bootloader_control *abc)
28{
29 return crc32(0, (void *)abc, offsetof(typeof(*abc), crc32_le));
30}
31
32/**
33 * Initialize bootloader_control to the default value.
34 *
35 * It allows us to boot all slots in order from the first one. This value
36 * should be used when the bootloader message is corrupted, but not when
37 * a valid message indicates that all slots are unbootable.
38 *
39 * @param[in] abc bootloader control block
40 *
Heinrich Schuchardt185f8122022-01-19 18:05:50 +010041 * Return: 0 on success and a negative on error
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030042 */
43static int ab_control_default(struct bootloader_control *abc)
44{
45 int i;
46 const struct slot_metadata metadata = {
47 .priority = 15,
48 .tries_remaining = 7,
49 .successful_boot = 0,
50 .verity_corrupted = 0,
51 .reserved = 0
52 };
53
54 if (!abc)
55 return -EFAULT;
56
57 memcpy(abc->slot_suffix, "a\0\0\0", 4);
58 abc->magic = BOOT_CTRL_MAGIC;
59 abc->version = BOOT_CTRL_VERSION;
60 abc->nb_slot = NUM_SLOTS;
61 memset(abc->reserved0, 0, sizeof(abc->reserved0));
62 for (i = 0; i < abc->nb_slot; ++i)
63 abc->slot_info[i] = metadata;
64
65 memset(abc->reserved1, 0, sizeof(abc->reserved1));
66 abc->crc32_le = ab_control_compute_crc(abc);
67
68 return 0;
69}
70
71/**
72 * Load the boot_control struct from disk into newly allocated memory.
73 *
74 * This function allocates and returns an integer number of disk blocks,
75 * based on the block size of the passed device to help performing a
76 * read-modify-write operation on the boot_control struct.
77 * The boot_control struct offset (2 KiB) must be a multiple of the device
78 * block size, for simplicity.
79 *
80 * @param[in] dev_desc Device where to read the boot_control struct from
81 * @param[in] part_info Partition in 'dev_desc' where to read from, normally
82 * the "misc" partition should be used
83 * @param[out] pointer to pointer to bootloader_control data
Heinrich Schuchardt185f8122022-01-19 18:05:50 +010084 * Return: 0 on success and a negative on error
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030085 */
86static int ab_control_create_from_disk(struct blk_desc *dev_desc,
Simon Glass05289792020-05-10 11:39:57 -060087 const struct disk_partition *part_info,
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +030088 struct bootloader_control **abc)
89{
90 ulong abc_offset, abc_blocks, ret;
91
92 abc_offset = offsetof(struct bootloader_message_ab, slot_suffix);
93 if (abc_offset % part_info->blksz) {
94 log_err("ANDROID: Boot control block not block aligned.\n");
95 return -EINVAL;
96 }
97 abc_offset /= part_info->blksz;
98
99 abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
100 part_info->blksz);
101 if (abc_offset + abc_blocks > part_info->size) {
102 log_err("ANDROID: boot control partition too small. Need at");
103 log_err(" least %lu blocks but have %lu blocks.\n",
104 abc_offset + abc_blocks, part_info->size);
105 return -EINVAL;
106 }
107 *abc = malloc_cache_aligned(abc_blocks * part_info->blksz);
108 if (!*abc)
109 return -ENOMEM;
110
111 ret = blk_dread(dev_desc, part_info->start + abc_offset, abc_blocks,
112 *abc);
113 if (IS_ERR_VALUE(ret)) {
114 log_err("ANDROID: Could not read from boot ctrl partition\n");
115 free(*abc);
116 return -EIO;
117 }
118
119 log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks);
120
121 return 0;
122}
123
124/**
125 * Store the loaded boot_control block.
126 *
127 * Store back to the same location it was read from with
128 * ab_control_create_from_misc().
129 *
130 * @param[in] dev_desc Device where we should write the boot_control struct
131 * @param[in] part_info Partition on the 'dev_desc' where to write
132 * @param[in] abc Pointer to the boot control struct and the extra bytes after
133 * it up to the nearest block boundary
Heinrich Schuchardt185f8122022-01-19 18:05:50 +0100134 * Return: 0 on success and a negative on error
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +0300135 */
136static int ab_control_store(struct blk_desc *dev_desc,
Simon Glass05289792020-05-10 11:39:57 -0600137 const struct disk_partition *part_info,
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +0300138 struct bootloader_control *abc)
139{
140 ulong abc_offset, abc_blocks, ret;
141
142 abc_offset = offsetof(struct bootloader_message_ab, slot_suffix) /
143 part_info->blksz;
144 abc_blocks = DIV_ROUND_UP(sizeof(struct bootloader_control),
145 part_info->blksz);
146 ret = blk_dwrite(dev_desc, part_info->start + abc_offset, abc_blocks,
147 abc);
148 if (IS_ERR_VALUE(ret)) {
149 log_err("ANDROID: Could not write back the misc partition\n");
150 return -EIO;
151 }
152
153 return 0;
154}
155
156/**
157 * Compare two slots.
158 *
159 * The function determines slot which is should we boot from among the two.
160 *
161 * @param[in] a The first bootable slot metadata
162 * @param[in] b The second bootable slot metadata
Heinrich Schuchardt185f8122022-01-19 18:05:50 +0100163 * Return: Negative if the slot "a" is better, positive of the slot "b" is
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +0300164 * better or 0 if they are equally good.
165 */
166static int ab_compare_slots(const struct slot_metadata *a,
167 const struct slot_metadata *b)
168{
169 /* Higher priority is better */
170 if (a->priority != b->priority)
171 return b->priority - a->priority;
172
173 /* Higher successful_boot value is better, in case of same priority */
174 if (a->successful_boot != b->successful_boot)
175 return b->successful_boot - a->successful_boot;
176
177 /* Higher tries_remaining is better to ensure round-robin */
178 if (a->tries_remaining != b->tries_remaining)
179 return b->tries_remaining - a->tries_remaining;
180
181 return 0;
182}
183
Simon Glass05289792020-05-10 11:39:57 -0600184int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info)
Ruslan Trofymenkod65e8da2019-07-05 15:37:32 +0300185{
186 struct bootloader_control *abc = NULL;
187 u32 crc32_le;
188 int slot, i, ret;
189 bool store_needed = false;
190 char slot_suffix[4];
191
192 ret = ab_control_create_from_disk(dev_desc, part_info, &abc);
193 if (ret < 0) {
194 /*
195 * This condition represents an actual problem with the code or
196 * the board setup, like an invalid partition information.
197 * Signal a repair mode and do not try to boot from either slot.
198 */
199 return ret;
200 }
201
202 crc32_le = ab_control_compute_crc(abc);
203 if (abc->crc32_le != crc32_le) {
204 log_err("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x),",
205 crc32_le, abc->crc32_le);
206 log_err("re-initializing A/B metadata.\n");
207
208 ret = ab_control_default(abc);
209 if (ret < 0) {
210 free(abc);
211 return -ENODATA;
212 }
213 store_needed = true;
214 }
215
216 if (abc->magic != BOOT_CTRL_MAGIC) {
217 log_err("ANDROID: Unknown A/B metadata: %.8x\n", abc->magic);
218 free(abc);
219 return -ENODATA;
220 }
221
222 if (abc->version > BOOT_CTRL_VERSION) {
223 log_err("ANDROID: Unsupported A/B metadata version: %.8x\n",
224 abc->version);
225 free(abc);
226 return -ENODATA;
227 }
228
229 /*
230 * At this point a valid boot control metadata is stored in abc,
231 * followed by other reserved data in the same block. We select a with
232 * the higher priority slot that
233 * - is not marked as corrupted and
234 * - either has tries_remaining > 0 or successful_boot is true.
235 * If the selected slot has a false successful_boot, we also decrement
236 * the tries_remaining until it eventually becomes unbootable because
237 * tries_remaining reaches 0. This mechanism produces a bootloader
238 * induced rollback, typically right after a failed update.
239 */
240
241 /* Safety check: limit the number of slots. */
242 if (abc->nb_slot > ARRAY_SIZE(abc->slot_info)) {
243 abc->nb_slot = ARRAY_SIZE(abc->slot_info);
244 store_needed = true;
245 }
246
247 slot = -1;
248 for (i = 0; i < abc->nb_slot; ++i) {
249 if (abc->slot_info[i].verity_corrupted ||
250 !abc->slot_info[i].tries_remaining) {
251 log_debug("ANDROID: unbootable slot %d tries: %d, ",
252 i, abc->slot_info[i].tries_remaining);
253 log_debug("corrupt: %d\n",
254 abc->slot_info[i].verity_corrupted);
255 continue;
256 }
257 log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ",
258 i, abc->slot_info[i].priority,
259 abc->slot_info[i].tries_remaining);
260 log_debug("corrupt: %d, successful: %d\n",
261 abc->slot_info[i].verity_corrupted,
262 abc->slot_info[i].successful_boot);
263
264 if (slot < 0 ||
265 ab_compare_slots(&abc->slot_info[i],
266 &abc->slot_info[slot]) < 0) {
267 slot = i;
268 }
269 }
270
271 if (slot >= 0 && !abc->slot_info[slot].successful_boot) {
272 log_err("ANDROID: Attempting slot %c, tries remaining %d\n",
273 BOOT_SLOT_NAME(slot),
274 abc->slot_info[slot].tries_remaining);
275 abc->slot_info[slot].tries_remaining--;
276 store_needed = true;
277 }
278
279 if (slot >= 0) {
280 /*
281 * Legacy user-space requires this field to be set in the BCB.
282 * Newer releases load this slot suffix from the command line
283 * or the device tree.
284 */
285 memset(slot_suffix, 0, sizeof(slot_suffix));
286 slot_suffix[0] = BOOT_SLOT_NAME(slot);
287 if (memcmp(abc->slot_suffix, slot_suffix,
288 sizeof(slot_suffix))) {
289 memcpy(abc->slot_suffix, slot_suffix,
290 sizeof(slot_suffix));
291 store_needed = true;
292 }
293 }
294
295 if (store_needed) {
296 abc->crc32_le = ab_control_compute_crc(abc);
297 ab_control_store(dev_desc, part_info, abc);
298 }
299 free(abc);
300
301 if (slot < 0)
302 return -EINVAL;
303
304 return slot;
305}