]>
git.ipfire.org Git - thirdparty/u-boot.git/blob - common/android_ab.c
1 // SPDX-License-Identifier: BSD-2-Clause
3 * Copyright (C) 2017 The Android Open Source Project
6 #include <android_ab.h>
7 #include <android_bootloader_message.h>
10 #include <u-boot/crc.h>
13 * Compute the CRC-32 of the bootloader control struct.
15 * Only the bytes up to the crc32_le field are considered for the CRC-32
18 * @param[in] abc bootloader control block
22 static uint32_t ab_control_compute_crc(struct bootloader_control
*abc
)
24 return crc32(0, (void *)abc
, offsetof(typeof(*abc
), crc32_le
));
28 * Initialize bootloader_control to the default value.
30 * It allows us to boot all slots in order from the first one. This value
31 * should be used when the bootloader message is corrupted, but not when
32 * a valid message indicates that all slots are unbootable.
34 * @param[in] abc bootloader control block
36 * @return 0 on success and a negative on error
38 static int ab_control_default(struct bootloader_control
*abc
)
41 const struct slot_metadata metadata
= {
45 .verity_corrupted
= 0,
52 memcpy(abc
->slot_suffix
, "a\0\0\0", 4);
53 abc
->magic
= BOOT_CTRL_MAGIC
;
54 abc
->version
= BOOT_CTRL_VERSION
;
55 abc
->nb_slot
= NUM_SLOTS
;
56 memset(abc
->reserved0
, 0, sizeof(abc
->reserved0
));
57 for (i
= 0; i
< abc
->nb_slot
; ++i
)
58 abc
->slot_info
[i
] = metadata
;
60 memset(abc
->reserved1
, 0, sizeof(abc
->reserved1
));
61 abc
->crc32_le
= ab_control_compute_crc(abc
);
67 * Load the boot_control struct from disk into newly allocated memory.
69 * This function allocates and returns an integer number of disk blocks,
70 * based on the block size of the passed device to help performing a
71 * read-modify-write operation on the boot_control struct.
72 * The boot_control struct offset (2 KiB) must be a multiple of the device
73 * block size, for simplicity.
75 * @param[in] dev_desc Device where to read the boot_control struct from
76 * @param[in] part_info Partition in 'dev_desc' where to read from, normally
77 * the "misc" partition should be used
78 * @param[out] pointer to pointer to bootloader_control data
79 * @return 0 on success and a negative on error
81 static int ab_control_create_from_disk(struct blk_desc
*dev_desc
,
82 const disk_partition_t
*part_info
,
83 struct bootloader_control
**abc
)
85 ulong abc_offset
, abc_blocks
, ret
;
87 abc_offset
= offsetof(struct bootloader_message_ab
, slot_suffix
);
88 if (abc_offset
% part_info
->blksz
) {
89 log_err("ANDROID: Boot control block not block aligned.\n");
92 abc_offset
/= part_info
->blksz
;
94 abc_blocks
= DIV_ROUND_UP(sizeof(struct bootloader_control
),
96 if (abc_offset
+ abc_blocks
> part_info
->size
) {
97 log_err("ANDROID: boot control partition too small. Need at");
98 log_err(" least %lu blocks but have %lu blocks.\n",
99 abc_offset
+ abc_blocks
, part_info
->size
);
102 *abc
= malloc_cache_aligned(abc_blocks
* part_info
->blksz
);
106 ret
= blk_dread(dev_desc
, part_info
->start
+ abc_offset
, abc_blocks
,
108 if (IS_ERR_VALUE(ret
)) {
109 log_err("ANDROID: Could not read from boot ctrl partition\n");
114 log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks
);
120 * Store the loaded boot_control block.
122 * Store back to the same location it was read from with
123 * ab_control_create_from_misc().
125 * @param[in] dev_desc Device where we should write the boot_control struct
126 * @param[in] part_info Partition on the 'dev_desc' where to write
127 * @param[in] abc Pointer to the boot control struct and the extra bytes after
128 * it up to the nearest block boundary
129 * @return 0 on success and a negative on error
131 static int ab_control_store(struct blk_desc
*dev_desc
,
132 const disk_partition_t
*part_info
,
133 struct bootloader_control
*abc
)
135 ulong abc_offset
, abc_blocks
, ret
;
137 abc_offset
= offsetof(struct bootloader_message_ab
, slot_suffix
) /
139 abc_blocks
= DIV_ROUND_UP(sizeof(struct bootloader_control
),
141 ret
= blk_dwrite(dev_desc
, part_info
->start
+ abc_offset
, abc_blocks
,
143 if (IS_ERR_VALUE(ret
)) {
144 log_err("ANDROID: Could not write back the misc partition\n");
154 * The function determines slot which is should we boot from among the two.
156 * @param[in] a The first bootable slot metadata
157 * @param[in] b The second bootable slot metadata
158 * @return Negative if the slot "a" is better, positive of the slot "b" is
159 * better or 0 if they are equally good.
161 static int ab_compare_slots(const struct slot_metadata
*a
,
162 const struct slot_metadata
*b
)
164 /* Higher priority is better */
165 if (a
->priority
!= b
->priority
)
166 return b
->priority
- a
->priority
;
168 /* Higher successful_boot value is better, in case of same priority */
169 if (a
->successful_boot
!= b
->successful_boot
)
170 return b
->successful_boot
- a
->successful_boot
;
172 /* Higher tries_remaining is better to ensure round-robin */
173 if (a
->tries_remaining
!= b
->tries_remaining
)
174 return b
->tries_remaining
- a
->tries_remaining
;
179 int ab_select_slot(struct blk_desc
*dev_desc
, disk_partition_t
*part_info
)
181 struct bootloader_control
*abc
= NULL
;
184 bool store_needed
= false;
187 ret
= ab_control_create_from_disk(dev_desc
, part_info
, &abc
);
190 * This condition represents an actual problem with the code or
191 * the board setup, like an invalid partition information.
192 * Signal a repair mode and do not try to boot from either slot.
197 crc32_le
= ab_control_compute_crc(abc
);
198 if (abc
->crc32_le
!= crc32_le
) {
199 log_err("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x),",
200 crc32_le
, abc
->crc32_le
);
201 log_err("re-initializing A/B metadata.\n");
203 ret
= ab_control_default(abc
);
211 if (abc
->magic
!= BOOT_CTRL_MAGIC
) {
212 log_err("ANDROID: Unknown A/B metadata: %.8x\n", abc
->magic
);
217 if (abc
->version
> BOOT_CTRL_VERSION
) {
218 log_err("ANDROID: Unsupported A/B metadata version: %.8x\n",
225 * At this point a valid boot control metadata is stored in abc,
226 * followed by other reserved data in the same block. We select a with
227 * the higher priority slot that
228 * - is not marked as corrupted and
229 * - either has tries_remaining > 0 or successful_boot is true.
230 * If the selected slot has a false successful_boot, we also decrement
231 * the tries_remaining until it eventually becomes unbootable because
232 * tries_remaining reaches 0. This mechanism produces a bootloader
233 * induced rollback, typically right after a failed update.
236 /* Safety check: limit the number of slots. */
237 if (abc
->nb_slot
> ARRAY_SIZE(abc
->slot_info
)) {
238 abc
->nb_slot
= ARRAY_SIZE(abc
->slot_info
);
243 for (i
= 0; i
< abc
->nb_slot
; ++i
) {
244 if (abc
->slot_info
[i
].verity_corrupted
||
245 !abc
->slot_info
[i
].tries_remaining
) {
246 log_debug("ANDROID: unbootable slot %d tries: %d, ",
247 i
, abc
->slot_info
[i
].tries_remaining
);
248 log_debug("corrupt: %d\n",
249 abc
->slot_info
[i
].verity_corrupted
);
252 log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ",
253 i
, abc
->slot_info
[i
].priority
,
254 abc
->slot_info
[i
].tries_remaining
);
255 log_debug("corrupt: %d, successful: %d\n",
256 abc
->slot_info
[i
].verity_corrupted
,
257 abc
->slot_info
[i
].successful_boot
);
260 ab_compare_slots(&abc
->slot_info
[i
],
261 &abc
->slot_info
[slot
]) < 0) {
266 if (slot
>= 0 && !abc
->slot_info
[slot
].successful_boot
) {
267 log_err("ANDROID: Attempting slot %c, tries remaining %d\n",
268 BOOT_SLOT_NAME(slot
),
269 abc
->slot_info
[slot
].tries_remaining
);
270 abc
->slot_info
[slot
].tries_remaining
--;
276 * Legacy user-space requires this field to be set in the BCB.
277 * Newer releases load this slot suffix from the command line
278 * or the device tree.
280 memset(slot_suffix
, 0, sizeof(slot_suffix
));
281 slot_suffix
[0] = BOOT_SLOT_NAME(slot
);
282 if (memcmp(abc
->slot_suffix
, slot_suffix
,
283 sizeof(slot_suffix
))) {
284 memcpy(abc
->slot_suffix
, slot_suffix
,
285 sizeof(slot_suffix
));
291 abc
->crc32_le
= ab_control_compute_crc(abc
);
292 ab_control_store(dev_desc
, part_info
, abc
);