blob: 702183979775bcf978863691a8844bdadb95d1aa [file] [log] [blame]
Alex Deymofb00d822016-11-08 15:46:07 -08001/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
David Anderson8108e252019-08-28 15:24:07 -070017#include <libboot_control/libboot_control.h>
18
Alex Deymofb00d822016-11-08 15:46:07 -080019#include <endian.h>
20#include <errno.h>
21#include <fcntl.h>
22#include <string.h>
23
24#include <string>
25
26#include <android-base/file.h>
27#include <android-base/logging.h>
28#include <android-base/properties.h>
29#include <android-base/stringprintf.h>
30#include <android-base/unique_fd.h>
Alex Deymofb00d822016-11-08 15:46:07 -080031
32#include <bootloader_message/bootloader_message.h>
33
David Anderson8108e252019-08-28 15:24:07 -070034namespace android {
35namespace bootable {
Alex Deymofb00d822016-11-08 15:46:07 -080036
David Anderson46f38e42019-08-29 15:09:22 -070037using ::android::hardware::boot::V1_1::MergeStatus;
38
Alex Deymofb00d822016-11-08 15:46:07 -080039// The number of boot attempts that should be made from a new slot before
40// rolling back to the previous slot.
41constexpr unsigned int kDefaultBootAttempts = 7;
42static_assert(kDefaultBootAttempts < 8, "tries_remaining field only has 3 bits");
43
44constexpr unsigned int kMaxNumSlots =
45 sizeof(bootloader_control::slot_info) / sizeof(bootloader_control::slot_info[0]);
46constexpr const char* kSlotSuffixes[kMaxNumSlots] = { "_a", "_b", "_c", "_d" };
47constexpr off_t kBootloaderControlOffset = offsetof(bootloader_message_ab, slot_suffix);
48
49static uint32_t CRC32(const uint8_t* buf, size_t size) {
50 static uint32_t crc_table[256];
51
52 // Compute the CRC-32 table only once.
53 if (!crc_table[1]) {
54 for (uint32_t i = 0; i < 256; ++i) {
55 uint32_t crc = i;
56 for (uint32_t j = 0; j < 8; ++j) {
57 uint32_t mask = -(crc & 1);
58 crc = (crc >> 1) ^ (0xEDB88320 & mask);
59 }
60 crc_table[i] = crc;
61 }
62 }
63
64 uint32_t ret = -1;
65 for (size_t i = 0; i < size; ++i) {
66 ret = (ret >> 8) ^ crc_table[(ret ^ buf[i]) & 0xFF];
67 }
68
69 return ~ret;
70}
71
72// Return the little-endian representation of the CRC-32 of the first fields
73// in |boot_ctrl| up to the crc32_le field.
74uint32_t BootloaderControlLECRC(const bootloader_control* boot_ctrl) {
75 return htole32(
76 CRC32(reinterpret_cast<const uint8_t*>(boot_ctrl), offsetof(bootloader_control, crc32_le)));
77}
78
David Anderson8108e252019-08-28 15:24:07 -070079bool LoadBootloaderControl(const std::string& misc_device, bootloader_control* buffer) {
80 android::base::unique_fd fd(open(misc_device.c_str(), O_RDONLY));
Alex Deymofb00d822016-11-08 15:46:07 -080081 if (fd.get() == -1) {
82 PLOG(ERROR) << "failed to open " << misc_device;
83 return false;
84 }
85 if (lseek(fd, kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
86 PLOG(ERROR) << "failed to lseek " << misc_device;
87 return false;
88 }
89 if (!android::base::ReadFully(fd.get(), buffer, sizeof(bootloader_control))) {
90 PLOG(ERROR) << "failed to read " << misc_device;
91 return false;
92 }
93 return true;
94}
95
David Anderson8108e252019-08-28 15:24:07 -070096bool UpdateAndSaveBootloaderControl(const std::string& misc_device, bootloader_control* buffer) {
Alex Deymofb00d822016-11-08 15:46:07 -080097 buffer->crc32_le = BootloaderControlLECRC(buffer);
David Anderson8108e252019-08-28 15:24:07 -070098 android::base::unique_fd fd(open(misc_device.c_str(), O_WRONLY | O_SYNC));
Alex Deymofb00d822016-11-08 15:46:07 -080099 if (fd.get() == -1) {
100 PLOG(ERROR) << "failed to open " << misc_device;
101 return false;
102 }
103 if (lseek(fd.get(), kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
104 PLOG(ERROR) << "failed to lseek " << misc_device;
105 return false;
106 }
107 if (!android::base::WriteFully(fd.get(), buffer, sizeof(bootloader_control))) {
108 PLOG(ERROR) << "failed to write " << misc_device;
109 return false;
110 }
111 return true;
112}
113
David Anderson8108e252019-08-28 15:24:07 -0700114void InitDefaultBootloaderControl(BootControl* control, bootloader_control* boot_ctrl) {
Alex Deymofb00d822016-11-08 15:46:07 -0800115 memset(boot_ctrl, 0, sizeof(*boot_ctrl));
116
David Anderson8108e252019-08-28 15:24:07 -0700117 unsigned int current_slot = control->GetCurrentSlot();
118 if (current_slot < kMaxNumSlots) {
119 strlcpy(boot_ctrl->slot_suffix, kSlotSuffixes[current_slot], sizeof(boot_ctrl->slot_suffix));
Alex Deymofb00d822016-11-08 15:46:07 -0800120 }
121 boot_ctrl->magic = BOOT_CTRL_MAGIC;
122 boot_ctrl->version = BOOT_CTRL_VERSION;
123
124 // Figure out the number of slots by checking if the partitions exist,
125 // otherwise assume the maximum supported by the header.
126 boot_ctrl->nb_slot = kMaxNumSlots;
David Anderson8108e252019-08-28 15:24:07 -0700127 std::string base_path = control->misc_device();
Alex Deymofb00d822016-11-08 15:46:07 -0800128 size_t last_path_sep = base_path.rfind('/');
129 if (last_path_sep != std::string::npos) {
130 // We test the existence of the "boot" partition on each possible slot,
131 // which is a partition required by Android Bootloader Requirements.
132 base_path = base_path.substr(0, last_path_sep + 1) + "boot";
133 int last_existing_slot = -1;
134 int first_missing_slot = -1;
135 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
136 std::string partition_path = base_path + kSlotSuffixes[slot];
137 struct stat part_stat;
138 int err = stat(partition_path.c_str(), &part_stat);
139 if (!err) {
140 last_existing_slot = slot;
141 LOG(INFO) << "Found slot: " << kSlotSuffixes[slot];
142 } else if (err < 0 && errno == ENOENT && first_missing_slot == -1) {
143 first_missing_slot = slot;
144 }
145 }
146 // We only declare that we found the actual number of slots if we found all
147 // the boot partitions up to the number of slots, and no boot partition
148 // after that. Not finding any of the boot partitions implies a problem so
149 // we just leave the number of slots in the maximum value.
150 if ((last_existing_slot != -1 && last_existing_slot + 1 == first_missing_slot) ||
151 (first_missing_slot == -1 && last_existing_slot + 1 == kMaxNumSlots)) {
152 boot_ctrl->nb_slot = last_existing_slot + 1;
153 LOG(INFO) << "Found a system with " << last_existing_slot + 1 << " slots.";
154 }
155 }
156
157 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
158 slot_metadata entry = {};
159
160 if (slot < boot_ctrl->nb_slot) {
161 entry.priority = 7;
162 entry.tries_remaining = kDefaultBootAttempts;
163 entry.successful_boot = 0;
164 } else {
165 entry.priority = 0; // Unbootable
166 }
167
168 // When the boot_control stored on disk is invalid, we assume that the
169 // current slot is successful. The bootloader should repair this situation
170 // before booting and write a valid boot_control slot, so if we reach this
171 // stage it means that the misc partition was corrupted since boot.
David Anderson8108e252019-08-28 15:24:07 -0700172 if (current_slot == slot) {
Alex Deymofb00d822016-11-08 15:46:07 -0800173 entry.successful_boot = 1;
174 }
175
176 boot_ctrl->slot_info[slot] = entry;
177 }
178 boot_ctrl->recovery_tries_remaining = 0;
179
180 boot_ctrl->crc32_le = BootloaderControlLECRC(boot_ctrl);
181}
182
183// Return the index of the slot suffix passed or -1 if not a valid slot suffix.
184int SlotSuffixToIndex(const char* suffix) {
185 for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
186 if (!strcmp(kSlotSuffixes[slot], suffix)) return slot;
187 }
188 return -1;
189}
190
191// Initialize the boot_control_private struct with the information from
192// the bootloader_message buffer stored in |boot_ctrl|. Returns whether the
193// initialization succeeded.
David Anderson8108e252019-08-28 15:24:07 -0700194bool BootControl::Init() {
195 if (initialized_) return true;
Alex Deymofb00d822016-11-08 15:46:07 -0800196
197 // Initialize the current_slot from the read-only property. If the property
198 // was not set (from either the command line or the device tree), we can later
199 // initialize it from the bootloader_control struct.
200 std::string suffix_prop = android::base::GetProperty("ro.boot.slot_suffix", "");
David Anderson643ddd92019-08-30 12:35:02 -0700201 if (suffix_prop.empty()) {
202 LOG(ERROR) << "Slot suffix property is not set";
203 return false;
204 }
David Anderson8108e252019-08-28 15:24:07 -0700205 current_slot_ = SlotSuffixToIndex(suffix_prop.c_str());
Alex Deymofb00d822016-11-08 15:46:07 -0800206
207 std::string err;
208 std::string device = get_bootloader_message_blk_device(&err);
David Andersonb18f1532019-09-04 18:10:16 -0700209 if (device.empty()) {
210 LOG(ERROR) << "Could not find bootloader message block device: " << err;
211 return false;
212 }
Alex Deymofb00d822016-11-08 15:46:07 -0800213
214 bootloader_control boot_ctrl;
David Andersonb18f1532019-09-04 18:10:16 -0700215 if (!LoadBootloaderControl(device.c_str(), &boot_ctrl)) {
216 LOG(ERROR) << "Failed to load bootloader control block";
217 return false;
218 }
Alex Deymofb00d822016-11-08 15:46:07 -0800219
220 // Note that since there isn't a module unload function this memory is leaked.
George Burgess IV1b03fc52019-10-23 12:09:07 -0700221 // We use `device` below sometimes, so it's not moved out of here.
222 misc_device_ = device;
David Anderson8108e252019-08-28 15:24:07 -0700223 initialized_ = true;
Alex Deymofb00d822016-11-08 15:46:07 -0800224
225 // Validate the loaded data, otherwise we will destroy it and re-initialize it
226 // with the current information.
227 uint32_t computed_crc32 = BootloaderControlLECRC(&boot_ctrl);
228 if (boot_ctrl.crc32_le != computed_crc32) {
229 LOG(WARNING) << "Invalid boot control found, expected CRC-32 0x" << std::hex << computed_crc32
230 << " but found 0x" << std::hex << boot_ctrl.crc32_le << ". Re-initializing.";
David Anderson8108e252019-08-28 15:24:07 -0700231 InitDefaultBootloaderControl(this, &boot_ctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800232 UpdateAndSaveBootloaderControl(device.c_str(), &boot_ctrl);
233 }
234
David Andersoncf8427a2019-11-04 14:08:11 -0800235 if (!InitMiscVirtualAbMessageIfNeeded()) {
236 return false;
237 }
238
David Anderson8108e252019-08-28 15:24:07 -0700239 num_slots_ = boot_ctrl.nb_slot;
Alex Deymofb00d822016-11-08 15:46:07 -0800240 return true;
241}
242
David Anderson8108e252019-08-28 15:24:07 -0700243unsigned int BootControl::GetNumberSlots() {
244 return num_slots_;
Alex Deymofb00d822016-11-08 15:46:07 -0800245}
246
David Anderson8108e252019-08-28 15:24:07 -0700247unsigned int BootControl::GetCurrentSlot() {
248 return current_slot_;
Alex Deymofb00d822016-11-08 15:46:07 -0800249}
250
David Anderson8108e252019-08-28 15:24:07 -0700251bool BootControl::MarkBootSuccessful() {
Alex Deymofb00d822016-11-08 15:46:07 -0800252 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700253 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800254
David Anderson8108e252019-08-28 15:24:07 -0700255 bootctrl.slot_info[current_slot_].successful_boot = 1;
Alex Deymofb00d822016-11-08 15:46:07 -0800256 // tries_remaining == 0 means that the slot is not bootable anymore, make
257 // sure we mark the current slot as bootable if it succeeds in the last
258 // attempt.
David Anderson8108e252019-08-28 15:24:07 -0700259 bootctrl.slot_info[current_slot_].tries_remaining = 1;
260 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800261}
262
David Anderson8108e252019-08-28 15:24:07 -0700263bool BootControl::SetActiveBootSlot(unsigned int slot) {
264 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800265 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700266 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800267 }
268
269 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700270 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800271
272 // Set every other slot with a lower priority than the new "active" slot.
273 const unsigned int kActivePriority = 15;
274 const unsigned int kActiveTries = 6;
David Anderson8108e252019-08-28 15:24:07 -0700275 for (unsigned int i = 0; i < num_slots_; ++i) {
Alex Deymofb00d822016-11-08 15:46:07 -0800276 if (i != slot) {
277 if (bootctrl.slot_info[i].priority >= kActivePriority)
278 bootctrl.slot_info[i].priority = kActivePriority - 1;
279 }
280 }
281
282 // Note that setting a slot as active doesn't change the successful bit.
283 // The successful bit will only be changed by setSlotAsUnbootable().
284 bootctrl.slot_info[slot].priority = kActivePriority;
285 bootctrl.slot_info[slot].tries_remaining = kActiveTries;
286
287 // Setting the current slot as active is a way to revert the operation that
288 // set *another* slot as active at the end of an updater. This is commonly
289 // used to cancel the pending update. We should only reset the verity_corrpted
290 // bit when attempting a new slot, otherwise the verity bit on the current
291 // slot would be flip.
David Anderson8108e252019-08-28 15:24:07 -0700292 if (slot != current_slot_) bootctrl.slot_info[slot].verity_corrupted = 0;
Alex Deymofb00d822016-11-08 15:46:07 -0800293
David Anderson8108e252019-08-28 15:24:07 -0700294 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800295}
296
David Anderson8108e252019-08-28 15:24:07 -0700297bool BootControl::SetSlotAsUnbootable(unsigned int slot) {
298 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800299 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700300 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800301 }
302
303 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700304 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800305
306 // The only way to mark a slot as unbootable, regardless of the priority is to
307 // set the tries_remaining to 0.
308 bootctrl.slot_info[slot].successful_boot = 0;
309 bootctrl.slot_info[slot].tries_remaining = 0;
David Anderson8108e252019-08-28 15:24:07 -0700310 return UpdateAndSaveBootloaderControl(misc_device_, &bootctrl);
Alex Deymofb00d822016-11-08 15:46:07 -0800311}
312
David Anderson8108e252019-08-28 15:24:07 -0700313bool BootControl::IsSlotBootable(unsigned int slot) {
314 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800315 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700316 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800317 }
318
319 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700320 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800321
David Anderson8108e252019-08-28 15:24:07 -0700322 return bootctrl.slot_info[slot].tries_remaining != 0;
Alex Deymofb00d822016-11-08 15:46:07 -0800323}
324
David Anderson8108e252019-08-28 15:24:07 -0700325bool BootControl::IsSlotMarkedSuccessful(unsigned int slot) {
326 if (slot >= kMaxNumSlots || slot >= num_slots_) {
Alex Deymofb00d822016-11-08 15:46:07 -0800327 // Invalid slot number.
David Anderson8108e252019-08-28 15:24:07 -0700328 return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800329 }
330
331 bootloader_control bootctrl;
David Anderson8108e252019-08-28 15:24:07 -0700332 if (!LoadBootloaderControl(misc_device_, &bootctrl)) return false;
Alex Deymofb00d822016-11-08 15:46:07 -0800333
334 return bootctrl.slot_info[slot].successful_boot && bootctrl.slot_info[slot].tries_remaining;
335}
336
David Anderson46f38e42019-08-29 15:09:22 -0700337bool BootControl::IsValidSlot(unsigned int slot) {
338 return slot < kMaxNumSlots && slot < num_slots_;
339}
340
341bool BootControl::SetSnapshotMergeStatus(MergeStatus status) {
David Andersoncf8427a2019-11-04 14:08:11 -0800342 return SetMiscVirtualAbMergeStatus(current_slot_, status);
David Anderson46f38e42019-08-29 15:09:22 -0700343}
344
345MergeStatus BootControl::GetSnapshotMergeStatus() {
David Andersoncf8427a2019-11-04 14:08:11 -0800346 MergeStatus status;
347 if (!GetMiscVirtualAbMergeStatus(current_slot_, &status)) {
348 return MergeStatus::UNKNOWN;
349 }
350 return status;
David Anderson46f38e42019-08-29 15:09:22 -0700351}
352
David Anderson8108e252019-08-28 15:24:07 -0700353const char* BootControl::GetSuffix(unsigned int slot) {
354 if (slot >= kMaxNumSlots || slot >= num_slots_) {
355 return nullptr;
Alex Deymofb00d822016-11-08 15:46:07 -0800356 }
357 return kSlotSuffixes[slot];
358}
359
David Andersoncf8427a2019-11-04 14:08:11 -0800360bool InitMiscVirtualAbMessageIfNeeded() {
361 std::string err;
362 misc_virtual_ab_message message;
363 if (!ReadMiscVirtualAbMessage(&message, &err)) {
364 LOG(ERROR) << "Could not read merge status: " << err;
365 return false;
366 }
367
368 if (message.version == MISC_VIRTUAL_AB_MESSAGE_VERSION) {
369 // Already initialized.
370 return true;
371 }
372
373 message = {};
374 message.version = MISC_VIRTUAL_AB_MESSAGE_VERSION;
375 if (!WriteMiscVirtualAbMessage(message, &err)) {
376 LOG(ERROR) << "Could not write merge status: " << err;
377 return false;
378 }
379 return true;
380}
381
382bool SetMiscVirtualAbMergeStatus(unsigned int current_slot,
383 android::hardware::boot::V1_1::MergeStatus status) {
384 std::string err;
385 misc_virtual_ab_message message;
386
387 if (!ReadMiscVirtualAbMessage(&message, &err)) {
388 LOG(ERROR) << "Could not read merge status: " << err;
389 return false;
390 }
391
392 message.merge_status = static_cast<uint8_t>(status);
393 message.source_slot = current_slot;
394 if (!WriteMiscVirtualAbMessage(message, &err)) {
395 LOG(ERROR) << "Could not write merge status: " << err;
396 return false;
397 }
398 return true;
399}
400
401bool GetMiscVirtualAbMergeStatus(unsigned int current_slot,
402 android::hardware::boot::V1_1::MergeStatus* status) {
403 std::string err;
404 misc_virtual_ab_message message;
405
406 if (!ReadMiscVirtualAbMessage(&message, &err)) {
407 LOG(ERROR) << "Could not read merge status: " << err;
408 return false;
409 }
410
411 // If the slot reverted after having created a snapshot, then the snapshot will
412 // be thrown away at boot. Thus we don't count this as being in a snapshotted
413 // state.
414 *status = static_cast<MergeStatus>(message.merge_status);
415 if (*status == MergeStatus::SNAPSHOTTED && current_slot == message.source_slot) {
416 *status = MergeStatus::NONE;
417 }
418 return true;
419}
420
David Anderson8108e252019-08-28 15:24:07 -0700421} // namespace bootable
422} // namespace android