From: Ruslan Trofymenko ruslan.trofymenko@linaro.org

This sub-command serves for getting the partition index from partition name. Also it can be used to test the existence of specified partition.

Signed-off-by: Ruslan Trofymenko ruslan.trofymenko@linaro.org Signed-off-by: Igor Opaniuk igor.opaniuk@linaro.org Reviewed-by: Alistair Strachan astrachan@google.com Reviewed-by: Sam Protsenko semen.protsenko@linaro.org Reviewed-by: Simon Glass sjg@chromium.org ---

Changes in v3: None Changes in v2: None

cmd/part.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/cmd/part.c b/cmd/part.c index bfb6488..653e13c 100644 --- a/cmd/part.c +++ b/cmd/part.c @@ -24,6 +24,7 @@ enum cmd_part_info { CMD_PART_INFO_START = 0, CMD_PART_INFO_SIZE, + CMD_PART_INFO_NUMBER };

static int do_part_uuid(int argc, char * const argv[]) @@ -149,6 +150,9 @@ static int do_part_info(int argc, char * const argv[], enum cmd_part_info param) case CMD_PART_INFO_SIZE: snprintf(buf, sizeof(buf), LBAF, info.size); break; + case CMD_PART_INFO_NUMBER: + snprintf(buf, sizeof(buf), "%d", part); + break; default: printf("** Unknown cmd_part_info value: %d\n", param); return 1; @@ -172,6 +176,11 @@ static int do_part_size(int argc, char * const argv[]) return do_part_info(argc, argv, CMD_PART_INFO_SIZE); }

+static int do_part_number(int argc, char * const argv[]) +{ + return do_part_info(argc, argv, CMD_PART_INFO_NUMBER); +} + static int do_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { if (argc < 2) @@ -185,6 +194,8 @@ static int do_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) return do_part_start(argc - 2, argv + 2); else if (!strcmp(argv[1], "size")) return do_part_size(argc - 2, argv + 2); + else if (!strcmp(argv[1], "number")) + return do_part_number(argc - 2, argv + 2);

return CMD_RET_USAGE; } @@ -206,5 +217,8 @@ U_BOOT_CMD( " part can be either partition number or partition name\n" "part size <interface> <dev> <part> <varname>\n" " - set environment variable to the size of the partition (in blocks)\n" - " part can be either partition number or partition name" + " part can be either partition number or partition name\n" + "part number <interface> <dev> <part> <varname>\n" + " - set environment variable to the partition number using the partition name\n" + " part must be specified as partition name" );

From: Ruslan Trofymenko ruslan.trofymenko@linaro.org

This patch determines the A/B-specific bootloader message structure that is the basis for implementation of recovery and A/B update functions. A/B metadata is stored in this structure and used to decide which slot should we use to boot the device. Also some basic functions for A/B metadata manipulation are implemented (like slot selection).

The patch was extracted from commits [1], [2] with some coding style fixes.

[1] https://android-review.googlesource.com/c/platform/external/u-boot/+/729878/... [2] https://android-review.googlesource.com/c/platform/external/u-boot/+/729880/...

Signed-off-by: Ruslan Trofymenko ruslan.trofymenko@linaro.org Signed-off-by: Igor Opaniuk igor.opaniuk@linaro.org Reviewed-by: Sam Protsenko semen.protsenko@linaro.org ---

Changes in v3: * Add multiple sanity checks * Fix mix. minor code formatting issues

Changes in v2: * Function return codes are clarified * Some types and constants are renamed (for compactness) * android_bootloader_message.h is renamed to android_bl_msg.h * 'debug' calls are changed to 'log_debug' * Order of headers is changed * android_bl_msg.h was synced with AOSP master counterpart

common/Kconfig | 10 ++ common/Makefile | 1 + common/android_ab.c | 290 +++++++++++++++++++++++++++++++++++++++++++++++ include/android_ab.h | 34 ++++++ include/android_bl_msg.h | 169 +++++++++++++++++++++++++++ 5 files changed, 504 insertions(+) create mode 100644 common/android_ab.c create mode 100644 include/android_ab.h create mode 100644 include/android_bl_msg.h

diff --git a/common/Kconfig b/common/Kconfig index 0a14bde..fc08e31 100644 --- a/common/Kconfig +++ b/common/Kconfig @@ -767,6 +767,16 @@ config UPDATE_TFTP_MSEC_MAX default 100 depends on UPDATE_TFTP

+config ANDROID_AB + bool "Android A/B updates" + default n + help + If enabled, adds support for the new Android A/B update model. This + allows the bootloader to select which slot to boot from based on the + information provided by userspace via the Android boot_ctrl HAL. This + allows a bootloader to try a new version of the system but roll back + to previous version if the new one didn't boot all the way. + endmenu

menu "Blob list" diff --git a/common/Makefile b/common/Makefile index ad390d0..dfa348c 100644 --- a/common/Makefile +++ b/common/Makefile @@ -106,6 +106,7 @@ endif endif

obj-y += image.o +obj-$(CONFIG_ANDROID_AB) += android_ab.o obj-$(CONFIG_ANDROID_BOOT_IMAGE) += image-android.o obj-$(CONFIG_$(SPL_TPL_)OF_LIBFDT) += image-fdt.o obj-$(CONFIG_$(SPL_TPL_)FIT) += image-fit.o diff --git a/common/android_ab.c b/common/android_ab.c new file mode 100644 index 0000000..3a6a52c --- /dev/null +++ b/common/android_ab.c @@ -0,0 +1,290 @@ +// SPDX-License-Identifier: BSD-2-Clause +/* + * Copyright (C) 2017 The Android Open Source Project + */ + +#include <android_ab.h> +#include <android_bl_msg.h> +#include <common.h> +#include <memalign.h> +#include <u-boot/crc.h> + +/** + * Compute the CRC-32 of the bootloader control struct. + * + * Only the bytes up to the crc32_le field are considered for the CRC-32 + * calculation. + */ +static uint32_t ab_control_compute_crc(struct andr_bl_control *abc) +{ + return crc32(0, (void *)abc, offsetof(typeof(*abc), crc32_le)); +} + +/** + * Initialize andr_bl_control to the default value. + * + * It allows us to boot all slots in order from the first one. This value + * should be used when the bootloader message is corrupted, but not when + * a valid message indicates that all slots are unbootable. + */ +static int ab_control_default(struct andr_bl_control *abc) +{ + int i; + const struct andr_slot_metadata metadata = { + .priority = 15, + .tries_remaining = 7, + .successful_boot = 0, + .verity_corrupted = 0, + .reserved = 0 + }; + + if (!abc) + return -EINVAL; + + memcpy(abc->slot_suffix, "a\0\0\0", 4); + abc->magic = ANDROID_BOOT_CTRL_MAGIC; + abc->version = ANDROID_BOOT_CTRL_VERSION; + abc->nb_slot = ANDROID_NUM_SLOTS; + memset(abc->reserved0, 0, sizeof(abc->reserved0)); + for (i = 0; i < abc->nb_slot; ++i) + abc->slot_info[i] = metadata; + + memset(abc->reserved1, 0, sizeof(abc->reserved1)); + abc->crc32_le = ab_control_compute_crc(abc); + + return 0; +} + +/** + * Load the boot_control struct from disk into newly allocated memory. + * + * This function allocates and returns an integer number of disk blocks, + * based on the block size of the passed device to help performing a + * read-modify-write operation on the boot_control struct. + * The boot_control struct offset (2 KiB) must be a multiple of the device + * block size, for simplicity. + * + * @param[in] dev_desc Device where to read the boot_control struct from + * @param[in] part_info Partition in 'dev_desc' where to read from, normally + * the "misc" partition should be used + * @param[out] pointer to pointer to andr_bl_control data + * @return 0 on success and a negative on error + */ +static int ab_control_create_from_disk(struct blk_desc *dev_desc, + const disk_partition_t *part_info, + struct andr_bl_control **abc) +{ + ulong abc_offset, abc_blocks; + + abc_offset = offsetof(struct andr_bl_msg_ab, slot_suffix); + if (abc_offset % part_info->blksz) { + printf("ANDROID: Boot control block not block aligned.\n"); + return -EINVAL; + } + abc_offset /= part_info->blksz; + + abc_blocks = DIV_ROUND_UP(sizeof(struct andr_bl_control), + part_info->blksz); + if (abc_offset + abc_blocks > part_info->size) { + printf("ANDROID: boot control partition too small. Need at"); + printf(" least %lu blocks but have %lu blocks.\n", + abc_offset + abc_blocks, part_info->size); + return -EINVAL; + } + *abc = malloc_cache_aligned(abc_blocks * part_info->blksz); + if (!*abc) + return -ENOMEM; + + if (blk_dread(dev_desc, part_info->start + abc_offset, abc_blocks, + *abc) != abc_blocks) { + printf("ANDROID: Could not read from boot control partition\n"); + free(*abc); + return -EIO; + } + + log_debug("ANDROID: Loaded ABC, %lu blocks\n", abc_blocks); + + return 0; +} + +/** + * Store the loaded boot_control block. + * + * Store back to the same location it was read from with + * ab_control_create_from_misc(). + * + * @param[in] dev_desc Device where we should write the boot_control struct + * @param[in] part_info Partition on the 'dev_desc' where to write + * @param[in] abc Pointer to the boot control struct and the extra bytes after + * it up to the nearest block boundary + * @return 0 on success and a negative on error + */ +static int ab_control_store(struct blk_desc *dev_desc, + const disk_partition_t *part_info, + struct andr_bl_control *abc) +{ + ulong abc_offset, abc_blocks; + + abc_offset = offsetof(struct andr_bl_msg_ab, slot_suffix) / + part_info->blksz; + abc_blocks = DIV_ROUND_UP(sizeof(struct andr_bl_control), + part_info->blksz); + if (blk_dwrite(dev_desc, part_info->start + abc_offset, abc_blocks, + abc) != abc_blocks) { + printf("ANDROID: Could not write back the misc partition\n"); + return -EIO; + } + + return 0; +} + +/** + * Compare two slots. + * + * The function determines slot which is should we boot from among the two. + * + * @param[in] a The first bootable slot metadata + * @param[in] b The second bootable slot metadata + * @return Negative if the slot "a" is better, positive of the slot "b" is + * better or 0 if they are equally good. + */ +static int ab_compare_slots(const struct andr_slot_metadata *a, + const struct andr_slot_metadata *b) +{ + /* Higher priority is better */ + if (a->priority != b->priority) + return b->priority - a->priority; + + /* Higher successful_boot value is better, in case of same priority */ + if (a->successful_boot != b->successful_boot) + return b->successful_boot - a->successful_boot; + + /* Higher tries_remaining is better to ensure round-robin */ + if (a->tries_remaining != b->tries_remaining) + return b->tries_remaining - a->tries_remaining; + + return 0; +} + +int ab_select_slot(struct blk_desc *dev_desc, disk_partition_t *part_info) +{ + struct andr_bl_control *abc = NULL; + u32 crc32_le; + int slot, i, ret; + bool store_needed = false; + char slot_suffix[4]; + + ret = ab_control_create_from_disk(dev_desc, part_info, &abc); + if (ret < 0) { + /* + * This condition represents an actual problem with the code or + * the board setup, like an invalid partition information. + * Signal a repair mode and do not try to boot from either slot. + */ + return ret; + } + + crc32_le = ab_control_compute_crc(abc); + if (abc->crc32_le != crc32_le) { + printf("ANDROID: Invalid CRC-32 (expected %.8x, found %.8x), ", + crc32_le, abc->crc32_le); + printf("re-initializing A/B metadata.\n"); + + ret = ab_control_default(abc); + if (ret < 0) { + free(abc); + return -ENODATA; + } + store_needed = true; + } + + if (abc->magic != ANDROID_BOOT_CTRL_MAGIC) { + printf("ANDROID: Unknown A/B metadata: %.8x\n", abc->magic); + free(abc); + return -ENODATA; + } + + if (abc->version > ANDROID_BOOT_CTRL_VERSION) { + printf("ANDROID: Unsupported A/B metadata version: %.8x\n", + abc->version); + free(abc); + return -ENODATA; + } + + /* + * At this point a valid boot control metadata is stored in abc, + * followed by other reserved data in the same block. We select a with + * the higher priority slot that + * - is not marked as corrupted and + * - either has tries_remaining > 0 or successful_boot is true. + * If the selected slot has a false successful_boot, we also decrement + * the tries_remaining until it eventually becomes unbootable because + * tries_remaining reaches 0. This mechanism produces a bootloader + * induced rollback, typically right after a failed update. + */ + + /* Safety check: limit the number of slots. */ + if (abc->nb_slot > ARRAY_SIZE(abc->slot_info)) { + abc->nb_slot = ARRAY_SIZE(abc->slot_info); + store_needed = true; + } + + slot = -1; + for (i = 0; i < abc->nb_slot; ++i) { + if (abc->slot_info[i].verity_corrupted || + !abc->slot_info[i].tries_remaining) { + log_debug("ANDROID: unbootable slot %d tries: %d, ", + i, abc->slot_info[i].tries_remaining); + log_debug("corrupt: %d\n", + abc->slot_info[i].verity_corrupted); + continue; + } + log_debug("ANDROID: bootable slot %d pri: %d, tries: %d, ", + i, abc->slot_info[i].priority, + abc->slot_info[i].tries_remaining); + log_debug("corrupt: %d, successful: %d\n", + abc->slot_info[i].verity_corrupted, + abc->slot_info[i].successful_boot); + + if (slot < 0 || + ab_compare_slots(&abc->slot_info[i], + &abc->slot_info[slot]) < 0) { + slot = i; + } + } + + if (slot >= 0 && !abc->slot_info[slot].successful_boot) { + printf("ANDROID: Attempting slot %c, tries remaining %d\n", + ANDROID_BOOT_SLOT_NAME(slot), + abc->slot_info[slot].tries_remaining); + abc->slot_info[slot].tries_remaining--; + store_needed = true; + } + + if (slot >= 0) { + /* + * Legacy user-space requires this field to be set in the BCB. + * Newer releases load this slot suffix from the command line + * or the device tree. + */ + memset(slot_suffix, 0, sizeof(slot_suffix)); + slot_suffix[0] = ANDROID_BOOT_SLOT_NAME(slot); + if (memcmp(abc->slot_suffix, slot_suffix, + sizeof(slot_suffix))) { + memcpy(abc->slot_suffix, slot_suffix, + sizeof(slot_suffix)); + store_needed = true; + } + } + + if (store_needed) { + abc->crc32_le = ab_control_compute_crc(abc); + ab_control_store(dev_desc, part_info, abc); + } + free(abc); + + if (slot < 0) + return -EINVAL; + + return slot; +} diff --git a/include/android_ab.h b/include/android_ab.h new file mode 100644 index 0000000..c1b901d --- /dev/null +++ b/include/android_ab.h @@ -0,0 +1,34 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (C) 2017 The Android Open Source Project + */ + +#ifndef __ANDROID_AB_H +#define __ANDROID_AB_H + +#include <common.h> + +/* Android standard boot slot names are 'a', 'b', 'c', ... */ +#define ANDROID_BOOT_SLOT_NAME(slot_num) ('a' + (slot_num)) + +/* Number of slots */ +#define ANDROID_NUM_SLOTS 2 + +/** + * Select the slot where to boot from. + * + * On Android devices with more than one boot slot (multiple copies of the + * kernel and system images) selects which slot should be used to boot from and + * registers the boot attempt. This is used in by the new A/B update model where + * one slot is updated in the background while running from the other slot. If + * the selected slot did not successfully boot in the past, a boot attempt is + * registered before returning from this function so it isn't selected + * indefinitely. + * + * @param[in] dev_desc Place to store the device description pointer + * @param[in] part_info Place to store the partition information + * @return The slot number (>= 0) on success, or a negative on error + */ +int ab_select_slot(struct blk_desc *dev_desc, disk_partition_t *part_info); + +#endif /* __ANDROID_AB_H */ diff --git a/include/android_bl_msg.h b/include/android_bl_msg.h new file mode 100644 index 0000000..f37e01a --- /dev/null +++ b/include/android_bl_msg.h @@ -0,0 +1,169 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * This file was taken from the AOSP Project. + * Repository: https://android.googlesource.com/platform/bootable/recovery/ + * File: bootloader_message/include/bootloader_message/bootloader_message.h + * Commit: 8b309f6970ab3b7c53cc529c51a2cb44e1c7a7e1 + * + * Copyright (C) 2008 The Android Open Source Project + */ + +#ifndef __ANDROID_BL_MSG_H +#define __ANDROID_BL_MSG_H + +/* + * compiler.h defines the types that otherwise are included from stdint.h and + * stddef.h + */ +#include <compiler.h> +#include <linux/sizes.h> + +/* + * Spaces used by misc partition are as below: + * 0 - 2K Bootloader Message + * 2K - 16K Used by Vendor's bootloader (the 2K - 4K range may be optionally + * used as bootloader_message_ab struct) + * 16K - 64K Used by uncrypt and recovery to store wipe_package for A/B + * devices + * Note that these offsets are admitted by bootloader, recovery and uncrypt, so + * they are not configurable without changing all of them. + */ +#define ANDROID_MISC_BM_OFFSET 0 +#define ANDROID_MISC_WIPE_OFFSET SZ_16K + +/** + * Bootloader Message (2-KiB). + * + * This structure describes the content of a block in flash + * that is used for recovery and the bootloader to talk to + * each other. + * + * The command field is updated by linux when it wants to + * reboot into recovery or to update radio or bootloader firmware. + * It is also updated by the bootloader when firmware update + * is complete (to boot into recovery for any final cleanup) + * + * The status field is written by the bootloader after the + * completion of an "update-radio" or "update-hboot" command. + * + * The recovery field is only written by linux and used + * for the system to send a message to recovery or the + * other way around. + * + * The stage field is written by packages which restart themselves + * multiple times, so that the UI can reflect which invocation of the + * package it is. If the value is of the format "#/#" (eg, "1/3"), + * the UI will add a simple indicator of that status. + * + * We used to have slot_suffix field for A/B boot control metadata in + * this struct, which gets unintentionally cleared by recovery or + * uncrypt. Move it into struct bootloader_message_ab to avoid the + * issue. + */ +struct andr_bl_msg { + char command[32]; + char status[32]; + char recovery[768]; + + /* + * The 'recovery' field used to be 1024 bytes. It has only ever + * been used to store the recovery command line, so 768 bytes + * should be plenty. We carve off the last 256 bytes to store the + * stage string (for multistage packages) and possible future + * expansion. + */ + char stage[32]; + + /* + * The 'reserved' field used to be 224 bytes when it was initially + * carved off from the 1024-byte recovery field. Bump it up to + * 1184-byte so that the entire bootloader_message struct rounds up + * to 2048-byte. + */ + char reserved[1184]; +}; + +/** + * The A/B-specific bootloader message structure (4-KiB). + * + * We separate A/B boot control metadata from the regular bootloader + * message struct and keep it here. Everything that's A/B-specific + * stays after struct bootloader_message, which should be managed by + * the A/B-bootloader or boot control HAL. + * + * The slot_suffix field is used for A/B implementations where the + * bootloader does not set the androidboot.ro.boot.slot_suffix kernel + * commandline parameter. This is used by fs_mgr to mount /system and + * other partitions with the slotselect flag set in fstab. A/B + * implementations are free to use all 32 bytes and may store private + * data past the first NUL-byte in this field. It is encouraged, but + * not mandatory, to use 'struct bootloader_control' described below. + * + * The update_channel field is used to store the Omaha update channel + * if update_engine is compiled with Omaha support. + */ +struct andr_bl_msg_ab { + struct andr_bl_msg message; + char slot_suffix[32]; + char update_channel[128]; + + /* Round up the entire struct to 4096-byte */ + char reserved[1888]; +}; + +#define ANDROID_BOOT_CTRL_MAGIC 0x42414342 /* Bootloader Control AB */ +#define ANDROID_BOOT_CTRL_VERSION 1 + +struct andr_slot_metadata { + /* + * Slot priority with 15 meaning highest priority, 1 lowest + * priority and 0 the slot is unbootable + */ + u8 priority : 4; + /* Number of times left attempting to boot this slot */ + u8 tries_remaining : 3; + /* 1 if this slot has booted successfully, 0 otherwise */ + u8 successful_boot : 1; + /* + * 1 if this slot is corrupted from a dm-verity corruption, + * 0 otherwise + */ + u8 verity_corrupted : 1; + /* Reserved for further use */ + u8 reserved : 7; +} __packed; + +/** + * Bootloader Control AB. + * + * This struct can be used to manage A/B metadata. It is designed to + * be put in the 'slot_suffix' field of the 'bootloader_message' + * structure described above. It is encouraged to use the + * 'bootloader_control' structure to store the A/B metadata, but not + * mandatory. + */ +struct andr_bl_control { + /* NULL terminated active slot suffix */ + char slot_suffix[4]; + /* Bootloader Control AB magic number (see BOOT_CTRL_MAGIC) */ + u32 magic; + /* Version of struct being used (see BOOT_CTRL_VERSION) */ + u8 version; + /* Number of slots being managed */ + u8 nb_slot : 3; + /* Number of times left attempting to boot recovery */ + u8 recovery_tries_remaining : 3; + /* Ensure 4-bytes alignment for slot_info field */ + u8 reserved0[2]; + /* Per-slot information. Up to 4 slots */ + struct andr_slot_metadata slot_info[4]; + /* Reserved for further use */ + u8 reserved1[8]; + /* + * CRC32 of all 28 bytes preceding this field (little endian + * format) + */ + u32 crc32_le; +} __packed; + +#endif /* __ANDROID_BL_MSG_H */

From: Ruslan Trofymenko ruslan.trofymenko@linaro.org

For A/B system update support the Android boot process requires to send 'androidboot.slot_suffix' parameter as a command line argument. This patch implementes 'ab_select' command which allows us to obtain current slot by processing the A/B metadata.

The patch was extracted from commit [1] with one modification: the separator for specifying the name of metadata partition was changed from ';' to '#', because ';' is used for commands separation.

[1] https://android-review.googlesource.com/c/platform/external/u-boot/+/729880/...

Signed-off-by: Ruslan Trofymenko ruslan.trofymenko@linaro.org Signed-off-by: Igor Opaniuk igor.opaniuk@linaro.org Reviewed-by: Alistair Strachan astrachan@google.com Reviewed-by: Sam Protsenko semen.protsenko@linaro.org --- Changes in v3: None Changes in v2: * 'android_ab_select' command is renamed to 'ab_select' command * command is moved to the separate 'Android support commands' menu

cmd/Kconfig | 15 +++++++++++++++ cmd/Makefile | 1 + cmd/ab_select.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 68 insertions(+) create mode 100644 cmd/ab_select.c

diff --git a/cmd/Kconfig b/cmd/Kconfig index 3ea42e4..290a570 100644 --- a/cmd/Kconfig +++ b/cmd/Kconfig @@ -1123,6 +1123,21 @@ config CMD_SETEXPR

endmenu

+menu "Android support commands" + +config CMD_AB_SELECT + bool "ab_select" + default n + depends on ANDROID_AB + help + On Android devices with more than one boot slot (multiple copies of + the kernel and system images) this provides a command to select which + slot should be used to boot from and register the boot attempt. This + is used by the new A/B update model where one slot is updated in the + background while running from the other slot. + +endmenu + if NET

menuconfig CMD_NET diff --git a/cmd/Makefile b/cmd/Makefile index 15ae4d2..ea03eb0 100644 --- a/cmd/Makefile +++ b/cmd/Makefile @@ -12,6 +12,7 @@ obj-y += version.o

# command obj-$(CONFIG_CMD_AES) += aes.o +obj-$(CONFIG_CMD_AB_SELECT) += ab_select.o obj-$(CONFIG_CMD_ADC) += adc.o obj-$(CONFIG_CMD_ARMFLASH) += armflash.o obj-y += blk_common.o diff --git a/cmd/ab_select.c b/cmd/ab_select.c new file mode 100644 index 0000000..2a9e524 --- /dev/null +++ b/cmd/ab_select.c @@ -0,0 +1,52 @@ +// SPDX-License-Identifier: BSD-2-Clause +/* + * Copyright (C) 2017 The Android Open Source Project + */ + +#include <android_ab.h> +#include <command.h> + +static int do_ab_select(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + int ret; + struct blk_desc *dev_desc; + disk_partition_t part_info; + char slot[2]; + + if (argc != 4) + return CMD_RET_USAGE; + + /* Lookup the "misc" partition from argv[2] and argv[3] */ + if (part_get_info_by_dev_and_name_or_num(argv[2], argv[3], + &dev_desc, &part_info) < 0) { + return CMD_RET_FAILURE; + } + + ret = ab_select_slot(dev_desc, &part_info); + if (ret < 0) { + printf("Android boot failed, error %d.\n", ret); + return CMD_RET_FAILURE; + } + + /* Android standard slot names are 'a', 'b', ... */ + slot[0] = ANDROID_BOOT_SLOT_NAME(ret); + slot[1] = '\0'; + env_set(argv[1], slot); + printf("ANDROID: Booting slot: %s\n", slot); + return CMD_RET_SUCCESS; +} + +U_BOOT_CMD(ab_select, 4, 0, do_ab_select, + "Select the slot used to boot from and register the boot attempt.", + "<slot_var_name> <interface> <dev[:part|#part_name]>\n" + " - Load the slot metadata from the partition 'part' on\n" + " device type 'interface' instance 'dev' and store the active\n" + " slot in the 'slot_var_name' variable. This also updates the\n" + " Android slot metadata with a boot attempt, which can cause\n" + " successive calls to this function to return a different result\n" + " if the returned slot runs out of boot attempts.\n" + " - If 'part_name' is passed, preceded with a # instead of :, the\n" + " partition name whose label is 'part_name' will be looked up in\n" + " the partition table. This is commonly the "misc" partition.\n" +);

From: Ruslan Trofymenko ruslan.trofymenko@linaro.org

Add sandbox test for 'ab_select' command.

Test: ./test/py/test.py --bd sandbox --build -k test_ab

Signed-off-by: Ruslan Trofymenko ruslan.trofymenko@linaro.org Signed-off-by: Igor Opaniuk igor.opaniuk@linaro.org Reviewed-by: Alistair Strachan astrachan@google.com Reviewed-by: Sam Protsenko semen.protsenko@linaro.org Reviewed-by: Simon Glass sjg@chromium.org ---

Changes in v3: None

Changes in v2: * Changes related to command renaming (android_ab_select->ab_select). * Assertion condition was clarified. Full command output is controlled.

configs/sandbox_defconfig | 2 ++ test/py/tests/test_ab.py | 74 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) create mode 100644 test/py/tests/test_ab.py

diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig index 193e418..31c18ad 100644 --- a/configs/sandbox_defconfig +++ b/configs/sandbox_defconfig @@ -20,6 +20,7 @@ CONFIG_PRE_CON_BUF_ADDR=0x100000 CONFIG_LOG_MAX_LEVEL=6 CONFIG_LOG_ERROR_RETURN=y CONFIG_DISPLAY_BOARDINFO_LATE=y +CONFIG_ANDROID_AB=y CONFIG_CMD_CPU=y CONFIG_CMD_LICENSE=y CONFIG_CMD_BOOTZ=y @@ -48,6 +49,7 @@ CONFIG_CMD_SF=y CONFIG_CMD_SPI=y CONFIG_CMD_USB=y CONFIG_CMD_AXI=y +CONFIG_CMD_AB_SELECT=y CONFIG_CMD_TFTPPUT=y CONFIG_CMD_TFTPSRV=y CONFIG_CMD_RARP=y diff --git a/test/py/tests/test_ab.py b/test/py/tests/test_ab.py new file mode 100644 index 0000000..b90ca87 --- /dev/null +++ b/test/py/tests/test_ab.py @@ -0,0 +1,74 @@ +# SPDX-License-Identifier: GPL-2.0 +# (C) Copyright 2018 Texas Instruments, <www.ti.com> + +# Test A/B update commands. + +import os +import pytest +import u_boot_utils + +class ABTestDiskImage(object): + """Disk Image used by the A/B tests.""" + + def __init__(self, u_boot_console): + """Initialize a new ABTestDiskImage object. + + Args: + u_boot_console: A U-Boot console. + + Returns: + Nothing. + """ + + filename = 'test_ab_disk_image.bin' + + persistent = u_boot_console.config.persistent_data_dir + '/' + filename + self.path = u_boot_console.config.result_dir + '/' + filename + + with u_boot_utils.persistent_file_helper(u_boot_console.log, persistent): + if os.path.exists(persistent): + u_boot_console.log.action('Disk image file ' + persistent + + ' already exists') + else: + u_boot_console.log.action('Generating ' + persistent) + fd = os.open(persistent, os.O_RDWR | os.O_CREAT) + os.ftruncate(fd, 524288) + os.close(fd) + cmd = ('sgdisk', persistent) + u_boot_utils.run_and_log(u_boot_console, cmd) + + cmd = ('sgdisk', '--new=1:64:512', '-c 1:misc', persistent) + u_boot_utils.run_and_log(u_boot_console, cmd) + cmd = ('sgdisk', '-l', persistent) + u_boot_utils.run_and_log(u_boot_console, cmd) + + cmd = ('cp', persistent, self.path) + u_boot_utils.run_and_log(u_boot_console, cmd) + +di = None +@pytest.fixture(scope='function') +def ab_disk_image(u_boot_console): + global di + if not di: + di = ABTestDiskImage(u_boot_console) + return di + +@pytest.mark.boardspec('sandbox') +@pytest.mark.buildconfigspec('android_ab') +@pytest.mark.buildconfigspec('cmd_ab_select') +@pytest.mark.requiredtool('sgdisk') +def test_ab(ab_disk_image, u_boot_console): + """Test the 'ab_select' command.""" + + u_boot_console.run_command('host bind 0 ' + ab_disk_image.path) + + output = u_boot_console.run_command('ab_select slot_name host 0#misc') + assert 're-initializing A/B metadata' in output + assert 'Attempting slot a, tries remaining 7' in output + output = u_boot_console.run_command('printenv slot_name') + assert 'slot_name=a' in output + + output = u_boot_console.run_command('ab_select slot_name host 0:1') + assert 'Attempting slot b, tries remaining 7' in output + output = u_boot_console.run_command('printenv slot_name') + assert 'slot_name=b' in output

From: Ruslan Trofymenko ruslan.trofymenko@linaro.org

Add support for A/B boot process on AM57xx based boards:

1. Define 'slot_suffix' variable (using 'ab_select' command) 2. Extend 'emmc_android_boot' boot command (add commands for A/B boot process)

'ab_select' command is used to decide which slot should be used for booting up. A/B metadata resides in 'misc' partition.

To activate the A/B boot process, the following config options must be set:

CONFIG_ANDROID_AB=y CONFIG_CMD_AB_SELECT=y

For successful A/B boot, the corresponding A/B infrastructure must be involved on Android side [1] (including mounting system as root), and disk must be partitioned accordingly.

When A/B boot is enabled, there are some known limitations currently exist (not related to A/B patches, need to be implemented later):

1. The 'Verified Boot' sequence is not supported 2. dev path to system partition (system_a or system_b) is passed via 'bootargs' as 'root=' argument like 'root=/dev/mmcblk1p12', but further we'll need to rework it with respect to dm-verity requirements [2]

In case when A/B partitions are not present in system (and A/B boot is enabled), boot up process will be terminated and next message will be shown:

"boot_a(b) partition not found"

[1] https://source.android.com/devices/tech/ota/ab [2] https://source.android.com/devices/tech/ota/ab/ab_implement#kernel

Signed-off-by: Ruslan Trofymenko ruslan.trofymenko@linaro.org Signed-off-by: Igor Opaniuk igor.opaniuk@linaro.org Reviewed-by: Alistair Strachan astrachan@google.com Reviewed-by: Sam Protsenko semen.protsenko@linaro.org ---

Changes in v3: None

Changes in v2: * Add changes related to command renaming (android_ab_select -> ab_select). * Slotted sections (e.g. system_a and system_b) are added to the default sections if CONFIG_CMD_AB_SELECT flag is defined * Rebased on top of master * system partitions sizes increased to 1024 MiB (to be consistent with recent changes to boot.h file)

include/environment/ti/boot.h | 58 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 52 insertions(+), 6 deletions(-)

diff --git a/include/environment/ti/boot.h b/include/environment/ti/boot.h index 05bdbbc..bc05bca 100644 --- a/include/environment/ti/boot.h +++ b/include/environment/ti/boot.h @@ -23,6 +23,18 @@ #define VBMETA_PART "" #endif

+#if defined(CONFIG_CMD_AB_SELECT) +#define COMMON_PARTS \ + "name=boot_a,size=10M,uuid=${uuid_gpt_boot_a};" \ + "name=boot_b,size=10M,uuid=${uuid_gpt_boot_b};" \ + "name=system_a,size=1024M,uuid=${uuid_gpt_system_a};" \ + "name=system_b,size=1024M,uuid=${uuid_gpt_system_b};" +#else +#define COMMON_PARTS \ + "name=boot,size=10M,uuid=${uuid_gpt_boot};" \ + "name=system,size=1024M,uuid=${uuid_gpt_system};" +#endif + #ifndef PARTS_DEFAULT /* Define the default GPT table for eMMC */ #define PARTS_DEFAULT \ @@ -38,8 +50,7 @@ "name=uboot-env,start=2432K,size=256K,uuid=${uuid_gpt_reserved};" \ "name=misc,size=128K,uuid=${uuid_gpt_misc};" \ "name=recovery,size=40M,uuid=${uuid_gpt_recovery};" \ - "name=boot,size=10M,uuid=${uuid_gpt_boot};" \ - "name=system,size=1024M,uuid=${uuid_gpt_system};" \ + COMMON_PARTS \ "name=vendor,size=256M,uuid=${uuid_gpt_vendor};" \ VBMETA_PART \ "name=userdata,size=-,uuid=${uuid_gpt_userdata}" @@ -58,6 +69,35 @@ #define AVB_VERIFY_CMD "" #endif

+#define CONTROL_PARTITION "misc" + +#if defined(CONFIG_CMD_AB_SELECT) +#define AB_SELECT \ + "if part number mmc 1 " CONTROL_PARTITION " control_part_number; " \ + "then " \ + "echo " CONTROL_PARTITION \ + " partition number:${control_part_number};" \ + "ab_select slot_name mmc ${mmcdev}:${control_part_number};" \ + "else " \ + "echo " CONTROL_PARTITION " partition not found;" \ + "exit;" \ + "fi;" \ + "setenv slot_suffix _${slot_name};" \ + "if part number mmc ${mmcdev} system${slot_suffix} " \ + "system_part_number; then " \ + "setenv bootargs_ab " \ + "ro root=/dev/mmcblk${mmcdev}p${system_part_number} " \ + "rootwait init=/init skip_initramfs " \ + "androidboot.slot_suffix=${slot_suffix};" \ + "echo A/B cmdline addition: ${bootargs_ab};" \ + "setenv bootargs ${bootargs} ${bootargs_ab};" \ + "else " \ + "echo system${slot_suffix} partition not found;" \ + "fi;" +#else +#define AB_SELECT "" +#endif + #define DEFAULT_COMMON_BOOT_TI_ARGS \ "console=" CONSOLEDEV ",115200n8\0" \ "fdtfile=undefined\0" \ @@ -86,10 +126,16 @@ "mmc dev $mmcdev; " \ "mmc rescan; " \ AVB_VERIFY_CHECK \ - "part start mmc ${mmcdev} boot boot_start; " \ - "part size mmc ${mmcdev} boot boot_size; " \ - "mmc read ${loadaddr} ${boot_start} ${boot_size}; " \ - "bootm ${loadaddr}#${fdtfile};\0 " + AB_SELECT \ + "if part start mmc ${mmcdev} boot${slot_suffix} boot_start; " \ + "then " \ + "part size mmc ${mmcdev} boot${slot_suffix} " \ + "boot_size; " \ + "mmc read ${loadaddr} ${boot_start} ${boot_size}; " \ + "bootm ${loadaddr}#${fdtfile}; " \ + "else " \ + "echo boot${slot_suffix} partition not found; " \ + "fi;\0"

#ifdef CONFIG_OMAP54XX