Boot control HAL based on the A/B headers. (fb00d82f) · Commits · e / os / android_bootable_recovery

Android.mk

+1 −0

Original line number	Diff line number	Diff line
		@@ -160,6 +160,7 @@ include $(BUILD_STATIC_LIBRARY)

		include \
		$(LOCAL_PATH)/applypatch/Android.mk \
		$(LOCAL_PATH)/boot_control/Android.mk \
		$(LOCAL_PATH)/bootloader_message/Android.mk \
		$(LOCAL_PATH)/edify/Android.mk \
		$(LOCAL_PATH)/minadbd/Android.mk \

boot_control/Android.mk

0 → 100644

+34 −0

Original line number	Diff line number	Diff line
		#
		# Copyright (C) 2017 The Android Open Source Project
		#
		# Licensed under the Apache License, Version 2.0 (the "License");
		# you may not use this file except in compliance with the License.
		# You may obtain a copy of the License at
		#
		# http://www.apache.org/licenses/LICENSE-2.0
		#
		# Unless required by applicable law or agreed to in writing, software
		# distributed under the License is distributed on an "AS IS" BASIS,
		# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		# See the License for the specific language governing permissions and
		# limitations under the License.
		#

		LOCAL_PATH := $(my-dir)

		include $(CLEAR_VARS)
		LOCAL_MODULE := bootctrl.bcb
		LOCAL_MODULE_RELATIVE_PATH := hw
		LOCAL_SRC_FILES := boot_control.cpp
		LOCAL_CFLAGS := \
		-D_FILE_OFFSET_BITS=64 \
		-Werror \
		-Wall \
		-Wextra \
		-Wno-unused-parameter
		LOCAL_SHARED_LIBRARIES := liblog
		LOCAL_STATIC_LIBRARIES := libbootloader_message libfs_mgr libbase
		LOCAL_POST_INSTALL_CMD := \
		$(hide) mkdir -p $(TARGET_OUT_SHARED_LIBRARIES)/hw && \
		ln -sf bootctrl.bcb.so $(TARGET_OUT_SHARED_LIBRARIES)/hw/bootctrl.default.so
		include $(BUILD_SHARED_LIBRARY)

boot_control/boot_control.cpp

0 → 100644

+401 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2015 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <endian.h>
		#include <errno.h>
		#include <fcntl.h>
		#include <string.h>

		#include <string>

		#include <android-base/file.h>
		#include <android-base/logging.h>
		#include <android-base/properties.h>
		#include <android-base/stringprintf.h>
		#include <android-base/unique_fd.h>
		#include <hardware/boot_control.h>
		#include <hardware/hardware.h>

		#include <bootloader_message/bootloader_message.h>

		struct boot_control_private_t {
		// The base struct needs to be first in the list.
		boot_control_module_t base;

		// Whether this struct was initialized with data from the bootloader message
		// that doesn't change until next reboot.
		bool initialized;

		// The path to the misc_device as reported in the fstab.
		const char* misc_device;

		// The number of slots present on the device.
		unsigned int num_slots;

		// The slot where we are running from.
		unsigned int current_slot;
		};

		namespace {

		// The number of boot attempts that should be made from a new slot before
		// rolling back to the previous slot.
		constexpr unsigned int kDefaultBootAttempts = 7;
		static_assert(kDefaultBootAttempts < 8, "tries_remaining field only has 3 bits");

		constexpr unsigned int kMaxNumSlots =
		sizeof(bootloader_control::slot_info) / sizeof(bootloader_control::slot_info[0]);
		constexpr const char* kSlotSuffixes[kMaxNumSlots] = { "_a", "_b", "_c", "_d" };
		constexpr off_t kBootloaderControlOffset = offsetof(bootloader_message_ab, slot_suffix);

		static uint32_t CRC32(const uint8_t* buf, size_t size) {
		static uint32_t crc_table[256];

		// Compute the CRC-32 table only once.
		if (!crc_table[1]) {
		for (uint32_t i = 0; i < 256; ++i) {
		uint32_t crc = i;
		for (uint32_t j = 0; j < 8; ++j) {
		uint32_t mask = -(crc & 1);
		crc = (crc >> 1) ^ (0xEDB88320 & mask);
		}
		crc_table[i] = crc;
		}
		}

		uint32_t ret = -1;
		for (size_t i = 0; i < size; ++i) {
		ret = (ret >> 8) ^ crc_table[(ret ^ buf[i]) & 0xFF];
		}

		return ~ret;
		}

		// Return the little-endian representation of the CRC-32 of the first fields
		// in \|boot_ctrl\| up to the crc32_le field.
		uint32_t BootloaderControlLECRC(const bootloader_control* boot_ctrl) {
		return htole32(
		CRC32(reinterpret_cast<const uint8_t*>(boot_ctrl), offsetof(bootloader_control, crc32_le)));
		}

		bool LoadBootloaderControl(const char* misc_device, bootloader_control* buffer) {
		android::base::unique_fd fd(open(misc_device, O_RDONLY));
		if (fd.get() == -1) {
		PLOG(ERROR) << "failed to open " << misc_device;
		return false;
		}
		if (lseek(fd, kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
		PLOG(ERROR) << "failed to lseek " << misc_device;
		return false;
		}
		if (!android::base::ReadFully(fd.get(), buffer, sizeof(bootloader_control))) {
		PLOG(ERROR) << "failed to read " << misc_device;
		return false;
		}
		return true;
		}

		bool UpdateAndSaveBootloaderControl(const char* misc_device, bootloader_control* buffer) {
		buffer->crc32_le = BootloaderControlLECRC(buffer);
		android::base::unique_fd fd(open(misc_device, O_WRONLY \| O_SYNC));
		if (fd.get() == -1) {
		PLOG(ERROR) << "failed to open " << misc_device;
		return false;
		}
		if (lseek(fd.get(), kBootloaderControlOffset, SEEK_SET) != kBootloaderControlOffset) {
		PLOG(ERROR) << "failed to lseek " << misc_device;
		return false;
		}
		if (!android::base::WriteFully(fd.get(), buffer, sizeof(bootloader_control))) {
		PLOG(ERROR) << "failed to write " << misc_device;
		return false;
		}
		return true;
		}

		void InitDefaultBootloaderControl(const boot_control_private_t* module,
		bootloader_control* boot_ctrl) {
		memset(boot_ctrl, 0, sizeof(*boot_ctrl));

		if (module->current_slot < kMaxNumSlots) {
		strlcpy(boot_ctrl->slot_suffix, kSlotSuffixes[module->current_slot],
		sizeof(boot_ctrl->slot_suffix));
		}
		boot_ctrl->magic = BOOT_CTRL_MAGIC;
		boot_ctrl->version = BOOT_CTRL_VERSION;

		// Figure out the number of slots by checking if the partitions exist,
		// otherwise assume the maximum supported by the header.
		boot_ctrl->nb_slot = kMaxNumSlots;
		std::string base_path = module->misc_device;
		size_t last_path_sep = base_path.rfind('/');
		if (last_path_sep != std::string::npos) {
		// We test the existence of the "boot" partition on each possible slot,
		// which is a partition required by Android Bootloader Requirements.
		base_path = base_path.substr(0, last_path_sep + 1) + "boot";
		int last_existing_slot = -1;
		int first_missing_slot = -1;
		for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
		std::string partition_path = base_path + kSlotSuffixes[slot];
		struct stat part_stat;
		int err = stat(partition_path.c_str(), &part_stat);
		if (!err) {
		last_existing_slot = slot;
		LOG(INFO) << "Found slot: " << kSlotSuffixes[slot];
		} else if (err < 0 && errno == ENOENT && first_missing_slot == -1) {
		first_missing_slot = slot;
		}
		}
		// We only declare that we found the actual number of slots if we found all
		// the boot partitions up to the number of slots, and no boot partition
		// after that. Not finding any of the boot partitions implies a problem so
		// we just leave the number of slots in the maximum value.
		if ((last_existing_slot != -1 && last_existing_slot + 1 == first_missing_slot) \|\|
		(first_missing_slot == -1 && last_existing_slot + 1 == kMaxNumSlots)) {
		boot_ctrl->nb_slot = last_existing_slot + 1;
		LOG(INFO) << "Found a system with " << last_existing_slot + 1 << " slots.";
		}
		}

		for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
		slot_metadata entry = {};

		if (slot < boot_ctrl->nb_slot) {
		entry.priority = 7;
		entry.tries_remaining = kDefaultBootAttempts;
		entry.successful_boot = 0;
		} else {
		entry.priority = 0; // Unbootable
		}

		// When the boot_control stored on disk is invalid, we assume that the
		// current slot is successful. The bootloader should repair this situation
		// before booting and write a valid boot_control slot, so if we reach this
		// stage it means that the misc partition was corrupted since boot.
		if (module->current_slot == slot) {
		entry.successful_boot = 1;
		}

		boot_ctrl->slot_info[slot] = entry;
		}
		boot_ctrl->recovery_tries_remaining = 0;

		boot_ctrl->crc32_le = BootloaderControlLECRC(boot_ctrl);
		}

		// Return the index of the slot suffix passed or -1 if not a valid slot suffix.
		int SlotSuffixToIndex(const char* suffix) {
		for (unsigned int slot = 0; slot < kMaxNumSlots; ++slot) {
		if (!strcmp(kSlotSuffixes[slot], suffix)) return slot;
		}
		return -1;
		}

		// Initialize the boot_control_private struct with the information from
		// the bootloader_message buffer stored in \|boot_ctrl\|. Returns whether the
		// initialization succeeded.
		bool BootControl_lazyInitialization(boot_control_private_t* module) {
		if (module->initialized) return true;

		// Initialize the current_slot from the read-only property. If the property
		// was not set (from either the command line or the device tree), we can later
		// initialize it from the bootloader_control struct.
		std::string suffix_prop = android::base::GetProperty("ro.boot.slot_suffix", "");
		module->current_slot = SlotSuffixToIndex(suffix_prop.c_str());

		std::string err;
		std::string device = get_bootloader_message_blk_device(&err);
		if (device.empty()) return false;

		bootloader_control boot_ctrl;
		if (!LoadBootloaderControl(device.c_str(), &boot_ctrl)) return false;

		// Note that since there isn't a module unload function this memory is leaked.
		module->misc_device = strdup(device.c_str());
		module->initialized = true;

		// Validate the loaded data, otherwise we will destroy it and re-initialize it
		// with the current information.
		uint32_t computed_crc32 = BootloaderControlLECRC(&boot_ctrl);
		if (boot_ctrl.crc32_le != computed_crc32) {
		LOG(WARNING) << "Invalid boot control found, expected CRC-32 0x" << std::hex << computed_crc32
		<< " but found 0x" << std::hex << boot_ctrl.crc32_le << ". Re-initializing.";
		InitDefaultBootloaderControl(module, &boot_ctrl);
		UpdateAndSaveBootloaderControl(device.c_str(), &boot_ctrl);
		}

		module->num_slots = boot_ctrl.nb_slot;
		return true;
		}

		void BootControl_init(boot_control_module_t* module) {
		BootControl_lazyInitialization(reinterpret_cast<boot_control_private_t*>(module));
		}

		unsigned int BootControl_getNumberSlots(boot_control_module_t* module) {
		return reinterpret_cast<boot_control_private_t*>(module)->num_slots;
		}

		unsigned int BootControl_getCurrentSlot(boot_control_module_t* module) {
		return reinterpret_cast<boot_control_private_t*>(module)->current_slot;
		}

		int BootControl_markBootSuccessful(boot_control_module_t* module) {
		boot_control_private_t* const bootctrl_module = reinterpret_cast<boot_control_private_t*>(module);

		bootloader_control bootctrl;
		if (!LoadBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;

		bootctrl.slot_info[bootctrl_module->current_slot].successful_boot = 1;
		// tries_remaining == 0 means that the slot is not bootable anymore, make
		// sure we mark the current slot as bootable if it succeeds in the last
		// attempt.
		bootctrl.slot_info[bootctrl_module->current_slot].tries_remaining = 1;
		if (!UpdateAndSaveBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;
		return 0;
		}

		int BootControl_setActiveBootSlot(boot_control_module_t* module, unsigned int slot) {
		boot_control_private_t* const bootctrl_module = reinterpret_cast<boot_control_private_t*>(module);

		if (slot >= kMaxNumSlots \|\| slot >= bootctrl_module->num_slots) {
		// Invalid slot number.
		return -1;
		}

		bootloader_control bootctrl;
		if (!LoadBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;

		// Set every other slot with a lower priority than the new "active" slot.
		const unsigned int kActivePriority = 15;
		const unsigned int kActiveTries = 6;
		for (unsigned int i = 0; i < bootctrl_module->num_slots; ++i) {
		if (i != slot) {
		if (bootctrl.slot_info[i].priority >= kActivePriority)
		bootctrl.slot_info[i].priority = kActivePriority - 1;
		}
		}

		// Note that setting a slot as active doesn't change the successful bit.
		// The successful bit will only be changed by setSlotAsUnbootable().
		bootctrl.slot_info[slot].priority = kActivePriority;
		bootctrl.slot_info[slot].tries_remaining = kActiveTries;

		// Setting the current slot as active is a way to revert the operation that
		// set another slot as active at the end of an updater. This is commonly
		// used to cancel the pending update. We should only reset the verity_corrpted
		// bit when attempting a new slot, otherwise the verity bit on the current
		// slot would be flip.
		if (slot != bootctrl_module->current_slot) bootctrl.slot_info[slot].verity_corrupted = 0;

		if (!UpdateAndSaveBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;
		return 0;
		}

		int BootControl_setSlotAsUnbootable(struct boot_control_module* module, unsigned int slot) {
		boot_control_private_t* const bootctrl_module = reinterpret_cast<boot_control_private_t*>(module);

		if (slot >= kMaxNumSlots \|\| slot >= bootctrl_module->num_slots) {
		// Invalid slot number.
		return -1;
		}

		bootloader_control bootctrl;
		if (!LoadBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;

		// The only way to mark a slot as unbootable, regardless of the priority is to
		// set the tries_remaining to 0.
		bootctrl.slot_info[slot].successful_boot = 0;
		bootctrl.slot_info[slot].tries_remaining = 0;
		if (!UpdateAndSaveBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;
		return 0;
		}

		int BootControl_isSlotBootable(struct boot_control_module* module, unsigned int slot) {
		boot_control_private_t* const bootctrl_module = reinterpret_cast<boot_control_private_t*>(module);

		if (slot >= kMaxNumSlots \|\| slot >= bootctrl_module->num_slots) {
		// Invalid slot number.
		return -1;
		}

		bootloader_control bootctrl;
		if (!LoadBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;

		return bootctrl.slot_info[slot].tries_remaining;
		}

		int BootControl_isSlotMarkedSuccessful(struct boot_control_module* module, unsigned int slot) {
		boot_control_private_t* const bootctrl_module = reinterpret_cast<boot_control_private_t*>(module);

		if (slot >= kMaxNumSlots \|\| slot >= bootctrl_module->num_slots) {
		// Invalid slot number.
		return -1;
		}

		bootloader_control bootctrl;
		if (!LoadBootloaderControl(bootctrl_module->misc_device, &bootctrl)) return -1;

		return bootctrl.slot_info[slot].successful_boot && bootctrl.slot_info[slot].tries_remaining;
		}

		const char* BootControl_getSuffix(boot_control_module_t* module, unsigned int slot) {
		if (slot >= kMaxNumSlots \|\| slot >= reinterpret_cast<boot_control_private_t*>(module)->num_slots) {
		return NULL;
		}
		return kSlotSuffixes[slot];
		}

		static int BootControl_open(const hw_module_t* module __unused, const char* id __unused,
		hw_device_t** device __unused) {
		/* Nothing to do currently. */
		return 0;
		}

		struct hw_module_methods_t BootControl_methods = {
		.open = BootControl_open,
		};

		} // namespace

		boot_control_private_t HAL_MODULE_INFO_SYM = {
		.base =
		{
		.common =
		{
		.tag = HARDWARE_MODULE_TAG,
		.module_api_version = BOOT_CONTROL_MODULE_API_VERSION_0_1,
		.hal_api_version = HARDWARE_HAL_API_VERSION,
		.id = BOOT_CONTROL_HARDWARE_MODULE_ID,
		.name = "AOSP reference bootctrl HAL",
		.author = "The Android Open Source Project",
		.methods = &BootControl_methods,
		},
		.init = BootControl_init,
		.getNumberSlots = BootControl_getNumberSlots,
		.getCurrentSlot = BootControl_getCurrentSlot,
		.markBootSuccessful = BootControl_markBootSuccessful,
		.setActiveBootSlot = BootControl_setActiveBootSlot,
		.setSlotAsUnbootable = BootControl_setSlotAsUnbootable,
		.isSlotBootable = BootControl_isSlotBootable,
		.getSuffix = BootControl_getSuffix,
		.isSlotMarkedSuccessful = BootControl_isSlotMarkedSuccessful,
		},
		.initialized = false,
		.misc_device = nullptr,
		.num_slots = 0,
		.current_slot = 0,
		};

bootloader_message/bootloader_message.cpp

+7 −0

Original line number	Diff line number	Diff line
		@@ -117,6 +117,13 @@ static bool write_misc_partition(const void* p, size_t size, const std::string&
		return true;
		}

		std::string get_bootloader_message_blk_device(std::string* err) {
		std::string misc_blk_device = get_misc_blk_device(err);
		if (misc_blk_device.empty()) return "";
		if (!wait_for_device(misc_blk_device, err)) return "";
		return misc_blk_device;
		}

		bool read_bootloader_message_from(bootloader_message* boot, const std::string& misc_blk_device,
		std::string* err) {
		return read_misc_partition(boot, sizeof(*boot), misc_blk_device,

bootloader_message/include/bootloader_message/bootloader_message.h

+5 −0

Original line number	Diff line number	Diff line
		@@ -180,6 +180,11 @@ static_assert(sizeof(struct bootloader_control) ==
		#include <string>
		#include <vector>

		// Return the block device name for the bootloader message partition and waits
		// for the device for up to 10 seconds. In case of error returns the empty
		// string.
		std::string get_bootloader_message_blk_device(std::string* err);

		// Read bootloader message into boot. Error message will be set in err.
		bool read_bootloader_message(bootloader_message* boot, std::string* err);