Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2008 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef _BOOTLOADER_MESSAGE_H |
| 18 | #define _BOOTLOADER_MESSAGE_H |
| 19 | |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 20 | #include <assert.h> |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 21 | #include <stddef.h> |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 22 | #include <stdint.h> |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 23 | |
| 24 | // Spaces used by misc partition are as below: |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 25 | // 0 - 2K For bootloader_message |
| 26 | // 2K - 16K Used by Vendor's bootloader (the 2K - 4K range may be optionally used |
| 27 | // as bootloader_message_ab struct) |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 28 | // 16K - 64K Used by uncrypt and recovery to store wipe_package for A/B devices |
| 29 | // Note that these offsets are admitted by bootloader,recovery and uncrypt, so they |
| 30 | // are not configurable without changing all of them. |
| 31 | static const size_t BOOTLOADER_MESSAGE_OFFSET_IN_MISC = 0; |
| 32 | static const size_t WIPE_PACKAGE_OFFSET_IN_MISC = 16 * 1024; |
| 33 | |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 34 | /* Bootloader Message (2-KiB) |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 35 | * |
| 36 | * This structure describes the content of a block in flash |
| 37 | * that is used for recovery and the bootloader to talk to |
| 38 | * each other. |
| 39 | * |
| 40 | * The command field is updated by linux when it wants to |
| 41 | * reboot into recovery or to update radio or bootloader firmware. |
| 42 | * It is also updated by the bootloader when firmware update |
| 43 | * is complete (to boot into recovery for any final cleanup) |
| 44 | * |
Tao Bao | c033639 | 2016-12-13 22:29:49 -0800 | [diff] [blame] | 45 | * The status field was used by the bootloader after the completion |
| 46 | * of an "update-radio" or "update-hboot" command, which has been |
| 47 | * deprecated since Froyo. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 48 | * |
| 49 | * The recovery field is only written by linux and used |
| 50 | * for the system to send a message to recovery or the |
| 51 | * other way around. |
| 52 | * |
| 53 | * The stage field is written by packages which restart themselves |
| 54 | * multiple times, so that the UI can reflect which invocation of the |
| 55 | * package it is. If the value is of the format "#/#" (eg, "1/3"), |
| 56 | * the UI will add a simple indicator of that status. |
| 57 | * |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 58 | * We used to have slot_suffix field for A/B boot control metadata in |
| 59 | * this struct, which gets unintentionally cleared by recovery or |
| 60 | * uncrypt. Move it into struct bootloader_message_ab to avoid the |
| 61 | * issue. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 62 | */ |
| 63 | struct bootloader_message { |
| 64 | char command[32]; |
| 65 | char status[32]; |
| 66 | char recovery[768]; |
| 67 | |
| 68 | // The 'recovery' field used to be 1024 bytes. It has only ever |
| 69 | // been used to store the recovery command line, so 768 bytes |
| 70 | // should be plenty. We carve off the last 256 bytes to store the |
| 71 | // stage string (for multistage packages) and possible future |
| 72 | // expansion. |
| 73 | char stage[32]; |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 74 | |
| 75 | // The 'reserved' field used to be 224 bytes when it was initially |
| 76 | // carved off from the 1024-byte recovery field. Bump it up to |
| 77 | // 1184-byte so that the entire bootloader_message struct rounds up |
| 78 | // to 2048-byte. |
| 79 | char reserved[1184]; |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 80 | }; |
| 81 | |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 82 | /** |
| 83 | * We must be cautious when changing the bootloader_message struct size, |
| 84 | * because A/B-specific fields may end up with different offsets. |
| 85 | */ |
| 86 | #if (__STDC_VERSION__ >= 201112L) || defined(__cplusplus) |
| 87 | static_assert(sizeof(struct bootloader_message) == 2048, |
| 88 | "struct bootloader_message size changes, which may break A/B devices"); |
| 89 | #endif |
| 90 | |
| 91 | /** |
| 92 | * The A/B-specific bootloader message structure (4-KiB). |
| 93 | * |
| 94 | * We separate A/B boot control metadata from the regular bootloader |
| 95 | * message struct and keep it here. Everything that's A/B-specific |
| 96 | * stays after struct bootloader_message, which should be managed by |
| 97 | * the A/B-bootloader or boot control HAL. |
| 98 | * |
| 99 | * The slot_suffix field is used for A/B implementations where the |
| 100 | * bootloader does not set the androidboot.ro.boot.slot_suffix kernel |
| 101 | * commandline parameter. This is used by fs_mgr to mount /system and |
| 102 | * other partitions with the slotselect flag set in fstab. A/B |
| 103 | * implementations are free to use all 32 bytes and may store private |
| 104 | * data past the first NUL-byte in this field. It is encouraged, but |
| 105 | * not mandatory, to use 'struct bootloader_control' described below. |
Sen Jiang | 7191bf0 | 2018-01-22 15:01:48 -0800 | [diff] [blame] | 106 | * |
| 107 | * The update_channel field is used to store the Omaha update channel |
| 108 | * if update_engine is compiled with Omaha support. |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 109 | */ |
| 110 | struct bootloader_message_ab { |
| 111 | struct bootloader_message message; |
| 112 | char slot_suffix[32]; |
Sen Jiang | 7191bf0 | 2018-01-22 15:01:48 -0800 | [diff] [blame] | 113 | char update_channel[128]; |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 114 | |
| 115 | // Round up the entire struct to 4096-byte. |
Sen Jiang | 7191bf0 | 2018-01-22 15:01:48 -0800 | [diff] [blame] | 116 | char reserved[1888]; |
Yabin Cui | 9b15ba8 | 2016-06-30 14:36:59 -0700 | [diff] [blame] | 117 | }; |
| 118 | |
| 119 | /** |
| 120 | * Be cautious about the struct size change, in case we put anything post |
| 121 | * bootloader_message_ab struct (b/29159185). |
| 122 | */ |
| 123 | #if (__STDC_VERSION__ >= 201112L) || defined(__cplusplus) |
| 124 | static_assert(sizeof(struct bootloader_message_ab) == 4096, |
| 125 | "struct bootloader_message_ab size changes"); |
| 126 | #endif |
| 127 | |
| 128 | #define BOOT_CTRL_MAGIC 0x42414342 /* Bootloader Control AB */ |
| 129 | #define BOOT_CTRL_VERSION 1 |
| 130 | |
| 131 | struct slot_metadata { |
| 132 | // Slot priority with 15 meaning highest priority, 1 lowest |
| 133 | // priority and 0 the slot is unbootable. |
| 134 | uint8_t priority : 4; |
| 135 | // Number of times left attempting to boot this slot. |
| 136 | uint8_t tries_remaining : 3; |
| 137 | // 1 if this slot has booted successfully, 0 otherwise. |
| 138 | uint8_t successful_boot : 1; |
| 139 | // 1 if this slot is corrupted from a dm-verity corruption, 0 |
| 140 | // otherwise. |
| 141 | uint8_t verity_corrupted : 1; |
| 142 | // Reserved for further use. |
| 143 | uint8_t reserved : 7; |
| 144 | } __attribute__((packed)); |
| 145 | |
| 146 | /* Bootloader Control AB |
| 147 | * |
| 148 | * This struct can be used to manage A/B metadata. It is designed to |
| 149 | * be put in the 'slot_suffix' field of the 'bootloader_message' |
| 150 | * structure described above. It is encouraged to use the |
| 151 | * 'bootloader_control' structure to store the A/B metadata, but not |
| 152 | * mandatory. |
| 153 | */ |
| 154 | struct bootloader_control { |
| 155 | // NUL terminated active slot suffix. |
| 156 | char slot_suffix[4]; |
| 157 | // Bootloader Control AB magic number (see BOOT_CTRL_MAGIC). |
| 158 | uint32_t magic; |
| 159 | // Version of struct being used (see BOOT_CTRL_VERSION). |
| 160 | uint8_t version; |
| 161 | // Number of slots being managed. |
| 162 | uint8_t nb_slot : 3; |
| 163 | // Number of times left attempting to boot recovery. |
| 164 | uint8_t recovery_tries_remaining : 3; |
| 165 | // Ensure 4-bytes alignment for slot_info field. |
| 166 | uint8_t reserved0[2]; |
| 167 | // Per-slot information. Up to 4 slots. |
| 168 | struct slot_metadata slot_info[4]; |
| 169 | // Reserved for further use. |
| 170 | uint8_t reserved1[8]; |
| 171 | // CRC32 of all 28 bytes preceding this field (little endian |
| 172 | // format). |
| 173 | uint32_t crc32_le; |
| 174 | } __attribute__((packed)); |
| 175 | |
| 176 | #if (__STDC_VERSION__ >= 201112L) || defined(__cplusplus) |
| 177 | static_assert(sizeof(struct bootloader_control) == |
| 178 | sizeof(((struct bootloader_message_ab *)0)->slot_suffix), |
| 179 | "struct bootloader_control has wrong size"); |
| 180 | #endif |
| 181 | |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 182 | #ifdef __cplusplus |
| 183 | |
| 184 | #include <string> |
| 185 | #include <vector> |
| 186 | |
Alex Deymo | fb00d82 | 2016-11-08 15:46:07 -0800 | [diff] [blame] | 187 | // Return the block device name for the bootloader message partition and waits |
| 188 | // for the device for up to 10 seconds. In case of error returns the empty |
| 189 | // string. |
| 190 | std::string get_bootloader_message_blk_device(std::string* err); |
| 191 | |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 192 | // Read bootloader message into boot. Error message will be set in err. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 193 | bool read_bootloader_message(bootloader_message* boot, std::string* err); |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 194 | |
| 195 | // Read bootloader message from the specified misc device into boot. |
| 196 | bool read_bootloader_message_from(bootloader_message* boot, const std::string& misc_blk_device, |
| 197 | std::string* err); |
| 198 | |
| 199 | // Write bootloader message to BCB. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 200 | bool write_bootloader_message(const bootloader_message& boot, std::string* err); |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 201 | |
| 202 | // Write bootloader message to the specified BCB device. |
| 203 | bool write_bootloader_message_to(const bootloader_message& boot, |
| 204 | const std::string& misc_blk_device, std::string* err); |
| 205 | |
Tao Bao | 2292db8 | 2016-12-13 21:53:31 -0800 | [diff] [blame] | 206 | // Write bootloader message (boots into recovery with the options) to BCB. Will |
| 207 | // set the command and recovery fields, and reset the rest. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 208 | bool write_bootloader_message(const std::vector<std::string>& options, std::string* err); |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 209 | |
Yifan Hong | c784ce5 | 2019-05-01 13:13:58 -0700 | [diff] [blame^] | 210 | // Write bootloader message (boots into recovery with the options) to the specific BCB device. Will |
| 211 | // set the command and recovery fields, and reset the rest. |
| 212 | bool write_bootloader_message_to(const std::vector<std::string>& options, |
| 213 | const std::string& misc_blk_device, std::string* err); |
| 214 | |
Tao Bao | 2292db8 | 2016-12-13 21:53:31 -0800 | [diff] [blame] | 215 | // Update bootloader message (boots into recovery with the options) to BCB. Will |
| 216 | // only update the command and recovery fields. |
| 217 | bool update_bootloader_message(const std::vector<std::string>& options, std::string* err); |
| 218 | |
Tianjie Xu | a88cc54 | 2017-10-25 13:16:54 -0700 | [diff] [blame] | 219 | // Update bootloader message (boots into recovery with the |options|) in |boot|. Will only update |
| 220 | // the command and recovery fields. |
| 221 | bool update_bootloader_message_in_struct(bootloader_message* boot, |
| 222 | const std::vector<std::string>& options); |
| 223 | |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 224 | // Clear BCB. |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 225 | bool clear_bootloader_message(std::string* err); |
| 226 | |
Vineela Tummalapalli | cba7fa8 | 2016-10-28 19:44:40 -0700 | [diff] [blame] | 227 | // Writes the reboot-bootloader reboot reason to the bootloader_message. |
| 228 | bool write_reboot_bootloader(std::string* err); |
| 229 | |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 230 | // Read the wipe package from BCB (from offset WIPE_PACKAGE_OFFSET_IN_MISC). |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 231 | bool read_wipe_package(std::string* package_data, size_t size, std::string* err); |
Tao Bao | bedf5fc | 2016-11-18 12:01:26 -0800 | [diff] [blame] | 232 | |
| 233 | // Write the wipe package into BCB (to offset WIPE_PACKAGE_OFFSET_IN_MISC). |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 234 | bool write_wipe_package(const std::string& package_data, std::string* err); |
| 235 | |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 236 | #else |
| 237 | |
| 238 | #include <stdbool.h> |
| 239 | |
| 240 | // C Interface. |
| 241 | bool write_bootloader_message(const char* options); |
Vineela Tummalapalli | cba7fa8 | 2016-10-28 19:44:40 -0700 | [diff] [blame] | 242 | bool write_reboot_bootloader(void); |
Yabin Cui | 2f272c0 | 2016-06-24 18:22:02 -0700 | [diff] [blame] | 243 | |
| 244 | #endif // ifdef __cplusplus |
| 245 | |
| 246 | #endif // _BOOTLOADER_MESSAGE_H |