blob: fa7dc47eff09584b917cf363ec6a401122ee8ec1 [file] [log] [blame]
Alex Deymofb00d822016-11-08 15:46:07 -08001/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
David Anderson8108e252019-08-28 15:24:07 -070017#include <libboot_control/libboot_control.h>
18
Alex Deymofb00d822016-11-08 15:46:07 -080019#include <endian.h>
20#include <errno.h>
21#include <fcntl.h>
22#include <string.h>
23
24#include <string>
25
26#include <android-base/file.h>
27#include <android-base/logging.h>
28#include <android-base/properties.h>
29#include <android-base/stringprintf.h>
30#include <android-base/unique_fd.h>
Alex Deymofb00d822016-11-08 15:46:07 -080031
32#include <bootloader_message/bootloader_message.h>
33
David Anderson8108e252019-08-28 15:24:07 -070034namespace android {
35namespace bootable {
Alex Deymofb00d822016-11-08 15:46:07 -080036
37// The number of boot attempts that should be made from a new slot before
38// rolling back to the previous slot.
39constexpr unsigned int kDefaultBootAttempts = 7;
40static_assert(kDefaultBootAttempts < 8, "tries_remaining field only has 3 bits");
41
42constexpr unsigned int kMaxNumSlots =
43 sizeof(bootloader_control::slot_info) / sizeof(bootloader_control::slot_info[0]);
44constexpr const char* kSlotSuffixes[kMaxNumSlots] = { "_a", "_b", "_c", "_d" };
45constexpr off_t kBootloaderControlOffset = offsetof(bootloader_message_ab, slot_suffix);
46
47static uint32_t CRC32(const uint8_t* buf, size_t size) {
48 static uint32_t crc_table[256];
49
50 // Compute the CRC-32 table only once.
51 if (!crc_table[1]) {
52 for (uint32_t i = 0; i < 256; ++i) {
53 uint32_t crc = i;
54 for (uint32_t j = 0; j < 8; ++j) {
55 uint32_t mask = -(crc & 1);
56 crc = (crc >> 1) ^ (0xEDB88320 & mask);
57 }
58 crc_table[i] = crc;
59 }
60 }
61
62 uint32_t ret = -1;
63 for (size_t i = 0; i < size; ++i) {
64 ret = (ret >> 8) ^ crc_table[(ret ^ buf[i]) & 0xFF];
65 }
66
67 return ~ret;
68}
69
70// Return the little-endian representation of the CRC-32 of the first fields
71// in |boot_ctrl| up to the crc32_le field.
72uint32_t BootloaderControlLECRC(const bootloader_control* boot_ctrl) {
73 return htole32(
74 CRC32(reinterpret_cast<const uint8_t*>(boot_ctrl), offsetof(bootloader_control, crc32_le)));
75}
76
David Anderson8108e252019-08-28 15:24:07 -070077bool LoadBootloaderControl(const std::string& misc_device, bootloader_control* buffer) {
78 android::base::unique_fd fd(open(misc_device.c_str(), O_RDONLY));
Alex Deymofb00d822016-11-08 15:46:07 -080079 if (fd.get() == -1) {
80 PLOG(ERROR) << "failed to open " << misc_device;
81 return false;
82 }
83 if (lseek(fd, kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
84 PLOG(ERROR) << "failed to lseek " << misc_device;
85 return false;
86 }
87 if (!android::base::ReadFully(fd.get(), buffer, sizeof(bootloader_control))) {
88 PLOG(ERROR) << "failed to read " << misc_device;
89 return false;
90 }
91 return true;
92}
93
David Anderson8108e252019-08-28 15:24:07 -070094bool UpdateAndSaveBootloaderControl(const std::string& misc_device, bootloader_control* buffer) {
Alex Deymofb00d822016-11-08 15:46:07 -080095 buffer->crc32_le = BootloaderControlLECRC(buffer);
David Anderson8108e252019-08-28 15:24:07 -070096 android::base::unique_fd fd(open(misc_device.c_str(), O_WRONLY | O_SYNC));
Alex Deymofb00d822016-11-08 15:46:07 -080097 if (fd.get() == -1) {
98 PLOG(ERROR) << "failed to open " << misc_device;
99 return false;
100 }
101 if (lseek(fd.get(), kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
102 PLOG(ERROR) << "failed to lseek " << misc_device;
103 return false;
104 }
105 if (!android::base::WriteFully(fd.get(), buffer, sizeof(bootloader_control))) {
106 PLOG(ERROR) << "failed to write " << misc_device;
107 return false;
108 }
109 return true;
110}
111
David Anderson8108e252019-08-28 15:24:07 -0700112void InitDefaultBootloaderControl(BootControl* control, bootloader_control* boot_ctrl) {
Alex Deymofb00d822016-11-08 15:46:07 -0800113 memset(boot_ctrl, 0, sizeof(*boot_ctrl));
114
David Anderson8108e252019-08-28 15:24:07 -0700115 unsigned int current_slot = control->GetCurrentSlot();
116 if (current_slot < kMaxNumSlots) {
117 strlcpy(boot_ctrl->slot_suffix, kSlotSuffixes[current_slot], sizeof(boot_ctrl->slot_suffix));
Alex Deymofb00d822016-11-08 15:46:07 -0800118 }
119 boot_ctrl->magic = BOOT_CTRL_MAGIC;
120 boot_ctrl->version = BOOT_CTRL_VERSION;
121
122 // Figure out the number of slots by checking if the partitions exist,
123 // otherwise assume the maximum supported by the header.
124 boot_ctrl->nb_slot = kMaxNumSlots;
David Anderson8108e252019-08-28 15:24:07 -0700125 std::string base_path = control->misc_device();
Alex Deymofb00d822016-11-08 15:46:07 -0800126 size_t last_path_sep = base_path.rfind('/');
127 if (last_path_sep != std::string::npos) {
128 // We test the existence of the "boot" partition on each possible slot,
129 // which is a partition required by Android Bootloader Requirements.
130 base_path = base_path.substr(0, last_path_sep + 1) + "boot";
131 int last_existing_slot = -1;
132 int first_missing_slot = -1;
133 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
134 std::string partition_path = base_path + kSlotSuffixes[slot];
135 struct stat part_stat;
136 int err = stat(partition_path.c_str(), &part_stat);
137 if (!err) {
138 last_existing_slot = slot;
139 LOG(INFO) << "Found slot: " << kSlotSuffixes[slot];
140 } else if (err < 0 && errno == ENOENT && first_missing_slot == -1) {
141 first_missing_slot = slot;
142 }
143 }
144 // We only declare that we found the actual number of slots if we found all
145 // the boot partitions up to the number of slots, and no boot partition
146 // after that. Not finding any of the boot partitions implies a problem so
147 // we just leave the number of slots in the maximum value.
148 if ((last_existing_slot != -1 && last_existing_slot + 1 == first_missing_slot) ||
149 (first_missing_slot == -1 && last_existing_slot + 1 == kMaxNumSlots)) {
150 boot_ctrl->nb_slot = last_existing_slot + 1;
151 LOG(INFO) << "Found a system with " << last_existing_slot + 1 << " slots.";
152 }
153 }
154
155 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
156 slot_metadata entry = {};
157
158 if (slot < boot_ctrl->nb_slot) {
159 entry.priority = 7;
160 entry.tries_remaining = kDefaultBootAttempts;
161 entry.successful_boot = 0;
162 } else {
163 entry.priority = 0; // Unbootable
164 }
165
166 // When the boot_control stored on disk is invalid, we assume that the
167 // current slot is successful. The bootloader should repair this situation
168 // before booting and write a valid boot_control slot, so if we reach this
169 // stage it means that the misc partition was corrupted since boot.
David Anderson8108e252019-08-28 15:24:07 -0700170 if (current_slot == slot) {
Alex Deymofb00d822016-11-08 15:46:07 -0800171 entry.successful_boot = 1;
172 }
173
174 boot_ctrl->slot_info[slot] = entry;
175 }
176 boot_ctrl->recovery_tries_remaining = 0;
177
178 boot_ctrl->crc32_le = BootloaderControlLECRC(boot_ctrl);
179}
180
181// Return the index of the slot suffix passed or -1 if not a valid slot suffix.
182int SlotSuffixToIndex(const char* suffix) {
183 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
184 if (!strcmp(kSlotSuffixes[slot], suffix)) return slot;
185 }
186 return -1;
187}
188
189// Initialize the boot_control_private struct with the information from
190// the bootloader_message buffer stored in |boot_ctrl|. Returns whether the
191// initialization succeeded.
David Anderson8108e252019-08-28 15:24:07 -0700192bool BootControl::Init() {
193 if (initialized_) return true;
Alex Deymofb00d822016-11-08 15:46:07 -0800194
195 // Initialize the current_slot from the read-only property. If the property
196 // was not set (from either the command line or the device tree), we can later
197 // initialize it from the bootloader_control struct.
198 std::string suffix_prop = android::base::GetProperty("ro.boot.slot_suffix", "");
David Anderson643ddd92019-08-30 12:35:02 -0700199 if (suffix_prop.empty()) {
200 LOG(ERROR) << "Slot suffix property is not set";
201 return false;
202 }
David Anderson8108e252019-08-28 15:24:07 -0700203 current_slot_ = SlotSuffixToIndex(suffix_prop.c_str());
Alex Deymofb00d822016-11-08 15:46:07 -0800204
205 std::string err;
206 std::string device = get_bootloader_message_blk_device(&err);
207 if (device.empty()) return false;
208
209 bootloader_control boot_ctrl;
210 if (!LoadBootloaderControl(device.c_str(), &boot_ctrl)) return false;
211
212 // Note that since there isn't a module unload function this memory is leaked.
David Anderson8108e252019-08-28 15:24:07 -0700213 misc_device_ = strdup(device.c_str());
214 initialized_ = true;
Alex Deymofb00d822016-11-08 15:46:07 -0800215
216 // Validate the loaded data, otherwise we will destroy it and re-initialize it
217 // with the current information.
218 uint32_t computed_crc32 = BootloaderControlLECRC(&boot_ctrl);
219 if (boot_ctrl.crc32_le != computed_crc32) {
220 LOG(WARNING) << "Invalid boot control found, expected CRC-32 0x" << std::hex << computed_crc32
221 << " but found 0x" << std::hex << boot_ctrl.crc32_le << ". Re-initializing.";
David Anderson8108e252019-08-28 15:24:07 -0700222 InitDefaultBootloaderControl(this, &boot_ctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800223 UpdateAndSaveBootloaderControl(device.c_str(), &boot_ctrl);
224 }
225
David Anderson8108e252019-08-28 15:24:07 -0700226 num_slots_ = boot_ctrl.nb_slot;
Alex Deymofb00d822016-11-08 15:46:07 -0800227 return true;
228}
229
David Anderson8108e252019-08-28 15:24:07 -0700230unsigned int BootControl::GetNumberSlots() {
231 return num_slots_;
Alex Deymofb00d822016-11-08 15:46:07 -0800232}
233
David Anderson8108e252019-08-28 15:24:07 -0700234unsigned int BootControl::GetCurrentSlot() {
235 return current_slot_;
Alex Deymofb00d822016-11-08 15:46:07 -0800236}
237
David Anderson8108e252019-08-28 15:24:07 -0700238bool BootControl::MarkBootSuccessful() {
Alex Deymofb00d822016-11-08 15:46:07 -0800239 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700240 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800241
David Anderson8108e252019-08-28 15:24:07 -0700242 bootctrl.slot_info[current_slot_].successful_boot = 1;
Alex Deymofb00d822016-11-08 15:46:07 -0800243 // tries_remaining == 0 means that the slot is not bootable anymore, make
244 // sure we mark the current slot as bootable if it succeeds in the last
245 // attempt.
David Anderson8108e252019-08-28 15:24:07 -0700246 bootctrl.slot_info[current_slot_].tries_remaining = 1;
247 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800248}
249
David Anderson8108e252019-08-28 15:24:07 -0700250bool BootControl::SetActiveBootSlot(unsigned int slot) {
251 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800252 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700253 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800254 }
255
256 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700257 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800258
259 // Set every other slot with a lower priority than the new "active" slot.
260 const unsigned int kActivePriority = 15;
261 const unsigned int kActiveTries = 6;
David Anderson8108e252019-08-28 15:24:07 -0700262 for (unsigned int i = 0; i < num_slots_; ++i) {
Alex Deymofb00d822016-11-08 15:46:07 -0800263 if (i != slot) {
264 if (bootctrl.slot_info[i].priority >= kActivePriority)
265 bootctrl.slot_info[i].priority = kActivePriority - 1;
266 }
267 }
268
269 // Note that setting a slot as active doesn't change the successful bit.
270 // The successful bit will only be changed by setSlotAsUnbootable().
271 bootctrl.slot_info[slot].priority = kActivePriority;
272 bootctrl.slot_info[slot].tries_remaining = kActiveTries;
273
274 // Setting the current slot as active is a way to revert the operation that
275 // set *another* slot as active at the end of an updater. This is commonly
276 // used to cancel the pending update. We should only reset the verity_corrpted
277 // bit when attempting a new slot, otherwise the verity bit on the current
278 // slot would be flip.
David Anderson8108e252019-08-28 15:24:07 -0700279 if (slot != current_slot_) bootctrl.slot_info[slot].verity_corrupted = 0;
Alex Deymofb00d822016-11-08 15:46:07 -0800280
David Anderson8108e252019-08-28 15:24:07 -0700281 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800282}
283
David Anderson8108e252019-08-28 15:24:07 -0700284bool BootControl::SetSlotAsUnbootable(unsigned int slot) {
285 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800286 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700287 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800288 }
289
290 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700291 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800292
293 // The only way to mark a slot as unbootable, regardless of the priority is to
294 // set the tries_remaining to 0.
295 bootctrl.slot_info[slot].successful_boot = 0;
296 bootctrl.slot_info[slot].tries_remaining = 0;
David Anderson8108e252019-08-28 15:24:07 -0700297 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800298}
299
David Anderson8108e252019-08-28 15:24:07 -0700300bool BootControl::IsSlotBootable(unsigned int slot) {
301 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800302 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700303 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800304 }
305
306 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700307 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800308
David Anderson8108e252019-08-28 15:24:07 -0700309 return bootctrl.slot_info[slot].tries_remaining != 0;
Alex Deymofb00d822016-11-08 15:46:07 -0800310}
311
David Anderson8108e252019-08-28 15:24:07 -0700312bool BootControl::IsSlotMarkedSuccessful(unsigned int slot) {
313 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800314 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700315 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800316 }
317
318 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700319 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800320
321 return bootctrl.slot_info[slot].successful_boot && bootctrl.slot_info[slot].tries_remaining;
322}
323
David Anderson8108e252019-08-28 15:24:07 -0700324const char* BootControl::GetSuffix(unsigned int slot) {
325 if (slot >= kMaxNumSlots || slot >= num_slots_) {
326 return nullptr;
Alex Deymofb00d822016-11-08 15:46:07 -0800327 }
328 return kSlotSuffixes[slot];
329}
330
David Anderson8108e252019-08-28 15:24:07 -0700331} // namespace bootable
332} // namespace android