Android A/B Bootloader support

The new "boot_android" command simply executes the Android Bootloader flow. This receives the location (interface, dev, partition) of the Android "misc" partition which is then used to lookup and infer the kernel and system images that should be booted from the passed slot.

Test: Booted a rpi3 build with Android Things.

Signed-off-by Alex Deymo <[email protected]>

---
 README             |   6 +++
 cmd/Kconfig        |  10 +++++
 cmd/Makefile       |   1 +
 cmd/boot_android.c | 126

+++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 143 insertions(+) create mode 100644 cmd/boot_android.c

README +2 -0

index 384cc6aabb..5f62e14d94 100644
@@ -1484,6 +1484,12 @@ The following options need to be configured:
 		sending again an USB request to the device.
 
 - Android Bootloader support:
+		CONFIG_CMD_BOOT_ANDROID
+		This enables the command "boot_android" which

executes the

README +1 -0

+		Android Bootloader flow. Enabling

CONFIG_CMD_FASTBOOT is

README +1 -0

+		recommended to support the Android Fastboot protocol

as part

README +2 -0

+		of the bootloader.
+
 		CONFIG_ANDROID_BOOTLOADER
 		This enables support for the Android bootloader

flow. Android devices can boot in normal mode, recovery mode or bootloader diff --git a/cmd/Kconfig b/cmd/Kconfig index 87a445d269..c4c22464b1 100644

cmd/Kconfig +0 -0

@@ -431,6 +431,16 @@ config CMD_LOAD_ANDROID
 	  define the size and kernel address on the header, which

are used by this command.

cmd/Kconfig +6 -0

+config CMD_BOOT_ANDROID
+	bool "boot_android"
+	default n
+	depends on ANDROID_BOOTLOADER
+	help
+	  Performs the Android Bootloader boot flow, loading the

appropriate

cmd/Kconfig +1 -0

+	  Android image (normal kernel, recovery kernel or

"bootloader" mode)

cmd/Kconfig +1 -0

+	  and booting it. The boot mode is determined by the

contents of the

cmd/Kconfig +2 -0

+	  Android Bootloader Message.
+
 config CMD_FLASH
 	bool "flinfo, erase, protect"
 	default y

cmd/Makefile +1 -0

index 2f75dab040..348cf75386 100644
@@ -22,6 +22,7 @@ obj-$(CONFIG_CMD_BDI) += bdinfo.o
 obj-$(CONFIG_CMD_BEDBUG) += bedbug.o
 obj-$(CONFIG_CMD_BLOCK_CACHE) += blkcache.o
 obj-$(CONFIG_CMD_BMP) += bmp.o
+obj-$(CONFIG_CMD_BOOT_ANDROID) += boot_android.o
 obj-$(CONFIG_CMD_BOOTEFI) += bootefi.o
 obj-$(CONFIG_CMD_BOOTMENU) += bootmenu.o
 obj-$(CONFIG_CMD_BOOTLDR) += bootldr.o

cmd/boot_android.c new file +12 -0

new file mode 100644
index 0000000000..067d9c7637
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <android_bootloader.h>
+#include <common.h>
+#include <command.h>
+
+/**
+ * part_get_info_by_dev_and_name - Parse a device number and

partition name
+ * string in the form of "device_num;partition_name", for example "0;misc".
+ * If the partition is found, sets dev_desc and part_info accordingly with the
+ * information of the partition with the given partition_name.
+ *
+ * @dev_iface: Device interface.
+ * @dev_part_str: Input string argument, like "0;misc".
+ * @dev_desc: Place to put the device description
pointer.
+ * @part_info: Place to put the partition information.
+ * @return 0 on success, or -1 on error
+ */

cmd/boot_android.c new file +26 -0

+static int part_get_info_by_dev_and_name(const char *dev_iface,
+					 const char *dev_part_str,
+					 struct blk_desc **dev_desc,
+					 disk_partition_t *part_info)
+{
+	char *ep;
+	const char *part_str;
+	int dev_num;
+
+	part_str = strchr(dev_part_str, ';');
+	if (!part_str)
+		return -1;
+
+	dev_num = simple_strtoul(dev_part_str, &ep, 16);
+	if (ep != part_str) {
+		/* Not all the first part before the ; was parsed. */
+		return -1;
+	}
+	part_str++;
+
+	*dev_desc = blk_get_dev(dev_iface, dev_num);
+	if (!*dev_desc) {
+		printf("Could not find %s %d\n", dev_iface, dev_num);
+		return -1;
+	}
+	if (part_get_info_by_name(*dev_desc, part_str, part_info) <

0) {

cmd/boot_android.c new file +1 -0

+		printf("Could not find \"%s\" partition\n",

part_str);

cmd/boot_android.c new file +23 -0

+		return -1;
+	}
+	return 0;
+}
+
+static int do_boot_android(cmd_tbl_t *cmdtp, int flag, int argc,
+			   char * const argv[])
+{
+	unsigned long load_address;
+	int ret = CMD_RET_SUCCESS;
+	char *addr_arg_endp, *addr_str;
+	struct blk_desc *dev_desc;
+	disk_partition_t part_info;
+	const char *misc_part_iface;
+	const char *misc_part_desc;
+
+	if (argc < 4)
+		return CMD_RET_USAGE;
+	if (argc > 5)
+		return CMD_RET_USAGE;
+
+	if (argc >= 5) {
+		load_address = simple_strtoul(argv[4],

&addr_arg_endp, 16);

cmd/boot_android.c new file +1 -0

+		if (addr_arg_endp == argv[4] || *addr_arg_endp !=

'\0')

cmd/boot_android.c new file +5 -0

+			return CMD_RET_USAGE;
+	} else {
+		addr_str = getenv("loadaddr");
+		if (addr_str)
+			load_address = simple_strtoul(addr_str,

NULL, 16);

cmd/boot_android.c new file +9 -0

+		else
+			load_address = CONFIG_SYS_LOAD_ADDR;
+	}
+
+	/* Lookup the "misc" partition from argv[1] and argv[2] */
+	misc_part_iface = argv[1];
+	misc_part_desc = argv[2];
+	/* Split the part_name if passed as "$dev_num;part_name". */
+	if (part_get_info_by_dev_and_name(misc_part_iface,

misc_part_desc,

cmd/boot_android.c new file +1 -0

+					  &dev_desc, &part_info) <

0) {

cmd/boot_android.c new file +1 -0

+		/* Couldn't lookup by name from mmc, try looking up

the

cmd/boot_android.c new file +3 -0

+		 * partition description directly.
+		 */
+		if (blk_get_device_part_str(misc_part_iface,

misc_part_desc,

cmd/boot_android.c new file +1 -0

+					    &dev_desc, &part_info,

1) < 0) {

cmd/boot_android.c new file +7 -0

+			printf("Couldn't find partition %s %s\n",
+			       misc_part_iface, misc_part_desc);
+			return CMD_RET_FAILURE;
+		}
+	}
+
+	ret = android_bootloader_boot_flow(dev_desc, &part_info,

argv[3],

cmd/boot_android.c new file +12 -0

+					   load_address);
+	if (ret < 0) {
+		printf("Android boot failed, error %d.\n", ret);
+		return CMD_RET_FAILURE;
+	}
+	return CMD_RET_SUCCESS;
+}
+
+U_BOOT_CMD(
+	boot_android, 5, 0, do_boot_android,
+	"Execute the Android Bootloader flow.",
+	"<interface> <dev[:part|;part_name]> <slot>

[<kernel_addr>]\n"

cmd/boot_android.c new file +1 -0

+	"    - Load the Boot Control Block (BCB) from the partition

'part' on\n"

cmd/boot_android.c new file +1 -0

+	"      device type 'interface' instance 'dev' to determine

the boot\n"

cmd/boot_android.c new file +2 -0

+	"      mode, and load and execute the appropriate kernel.\n"
+	"      In normal and recovery mode, the kernel will be

loaded from\n"

cmd/boot_android.c new file +1 -0

+	"      the corresponding \"boot\" partition. In bootloader

mode, the\n"

cmd/boot_android.c new file +1 -0

+	"      command defined in the \"fastbootcmd\" variable will

be\n"

cmd/boot_android.c new file +2 -0

+	"      executed.\n"
+	"      On Android devices with multiple slots, the pass

'slot' is\n"

cmd/boot_android.c new file +1 -0

+	"      used to load the appropriate kernel. The standard

slot names\n"

cmd/boot_android.c new file +2 -0

+	"      are 'a' and 'b'.\n"
+	"    - If 'part_name' is passed, preceded with a ; instead

of :, the\n"

cmd/boot_android.c new file +1 -0

+	"      partition name whose label is 'part_name' will be

looked up in\n"

cmd/boot_android.c new file +1 -0

+	"      the partition table. This is commonly the \"misc\"

partition.\n" +);

An Android Bootloader must comply with certain boot modes and change the kernel command line accordingly. This patch introduces the Android boot mode concept which determines whether the device should boot to one of the following:
* recovery: which should boot to the recovery image,
* bootloader: which should boot to the "bootloader" (fastboot) and
* normal: which should boot to the system image.

The boot mode is determined in part by the Boot Control Block (BCB) which is stored at the beginning of the "misc" partition. The BCB is defined in the "bootloader_message.h" file in AOSP, now copied here as android_bootloader_message.h with minor modifications.

This patch implements the basic boot flow that loads and boots an Android kernel image assuming an A/B device which implies that it uses boot as recovery (BOARD_USES_RECOVERY_AS_BOOT in the BoardConfig.mk). This means that the recovery image shares the same kernel with the normal boot system image, but stores the recovery image as a ramdisk which is not used in normal mode.

Among the limitations, this patch doesn't implement the A/B slot selection, it only boots from the provided slot.

Test: Booted a rpi3 with this flow.

Signed-off-by Alex Deymo <[email protected]>

---
 README                               |  19 +-
 common/Kconfig                       |  19 ++
 common/Makefile                      |   1 +
 common/android_bootloader.c          | 350 +++++++++++++++++++++++++++++++++++
 include/android_bootloader.h         |  48 +++++
 include/android_bootloader_message.h | 174 +++++++++++++++++
 6 files changed, 607 insertions(+), 4 deletions(-)
 create mode 100644 common/android_bootloader.c
 create mode 100644 include/android_bootloader.h
 create mode 100644 include/android_bootloader_messa.ge.h

README +1 -4

+
 - USB Device Android Fastboot support:
                CONFIG_USB_FUNCTION_FASTBOOT
                This enables the USB part of the fastboot gadget

@@ -1494,10 +1509,6 @@ The following options need to be configured:
                used on Android devices.
                See doc/README.android-fastboot for more information.
 
-               CONFIG_ANDROID_BOOT_IMAGE
-               This enables support for booting images which use the Android
-               image format header.
-
                CONFIG_FASTBOOT_BUF_ADDR
                The fastboot protocol requires a large memory buffer for
                downloads. Define this to the starting RAM address to use for

common/Kconfig +19 -0

index 8f73c8f757..47e2ffa3d6 100644
@@ -393,6 +393,25 @@ config DISPLAY_BOARDINFO
          when U-Boot starts up. The board function checkboard() is called
          to do this.
 
+config ANDROID_BOOTLOADER
+       bool "Support for Android Bootloader boot flow"
+       default n
+       depends on ANDROID_BOOT_IMAGE
+       help
+         If enabled, adds support to boot an Android device following the
+         Android Bootloader boot flow. This flow requires an Android Bootloader
+         to handle the Android Bootloader Message stored in the Boot Control
+         Block (BCB), normally in the "misc" partition of an Android device.
+         The BCB is used to determine the boot mode of the device (normal mode,
+         recovery mode or bootloader mode) and, if enabled, the slot to boot
+         from in devices with multiple boot slots (A/B devices).
+
+config ANDROID_BOOT_IMAGE
+       bool "Enable support for Android Boot Images"
+       help
+         This enables support for booting images which use the Android
+         image format header.
+
 menu "Start-up hooks"
 
 config ARCH_EARLY_INIT_R

common/Makefile +1 -0

index 86225f1564..9de0a77063 100644
@@ -147,6 +147,7 @@ endif
 obj-$(CONFIG_CMD_IDE) += ide.o
 obj-y += image.o
 obj-$(CONFIG_ANDROID_BOOT_IMAGE) += image-android.o
+obj-$(CONFIG_ANDROID_BOOTLOADER) += android_bootloader.o
 obj-$(CONFIG_$(SPL_)OF_LIBFDT) += image-fdt.o
 obj-$(CONFIG_$(SPL_)FIT) += image-fit.o
 obj-$(CONFIG_$(SPL_)FIT_SIGNATURE) += image-sig.o

common/android_bootloader.c new file +2 -0

new file mode 100644
index 0000000000..6656311ee3
@@ -0,0 +1,350 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project

common/android_bootloader.c new file +25 -0

+       return 0;
+}
+
+static int android_bootloader_message_write(
+       struct blk_desc *dev_desc,
+       const disk_partition_t *part_info,
+       struct android_bootloader_message *message)
+{
+       ulong message_blocks = sizeof(struct android_bootloader_message) /
+           part_info->blksz;
+       if (message_blocks > part_info->size) {
+               printf("misc partition too small.\n");
+               return -1;
+       }
+
+       if (blk_dwrite(dev_desc, part_info->start, message_blocks, message) !=
+           message_blocks) {
+               printf("Could not write to misc partition\n");
+               return -1;
+       }
+       debug("ANDROID: Wrote new BCB, %lu blocks.\n", message_blocks);
+       return 0;
+}
+
+static enum android_boot_mode android_bootloader_load_and_clear_mode(

common/android_bootloader.c new file +39 -0

+       bootloader_str = (char *)CONFIG_FASTBOOT_BUF_ADDR;
+       if (!strcmp("reboot-bootloader", bootloader_str)) {
+               bootloader_str[0] = '\0';
+               return ANDROID_BOOT_MODE_BOOTLOADER;
+       }
+#endif
+
+       /* Check and update the BCB message if needed. */
+       if (android_bootloader_message_load(dev_desc, misc_part_info, &bcb) <
+           0) {
+               printf("WARNING: Unable to load the BCB.\n");
+               return ANDROID_BOOT_MODE_NORMAL;
+       }
+
+       if (!strcmp("bootonce-bootloader", bcb.command)) {
+               /* Erase the message in the BCB since this value should be used
+                * only once.
+                */
+               memset(bcb.command, 0, sizeof(bcb.command));
+               android_bootloader_message_write(dev_desc, misc_part_info,
+                                                &bcb);
+               return ANDROID_BOOT_MODE_BOOTLOADER;
+       }
+
+       if (!strcmp("boot-recovery", bcb.command))
+               return ANDROID_BOOT_MODE_RECOVERY;
+
+       return ANDROID_BOOT_MODE_NORMAL;
+}
+
+/**
+ * Return the reboot reason string for the passed boot mode.
+ *
+ * @param mode The Android Boot mode.
+ * @return a pointer to the reboot reason string for mode.
+ */
+static const char *android_boot_mode_str(enum android_boot_mode mode)
+{
+       switch (mode) {

common/android_bootloader.c new file +54 -0

+static int android_part_get_info_by_name_suffix(struct blk_desc *dev_desc,
+                                               const char *base_name,
+                                               const char *slot_suffix,
+                                               disk_partition_t *part_info)
+{
+       char *part_name;
+       int part_num;
+       size_t part_name_len;
+
+       part_name_len = strlen(base_name) + 1;
+       if (slot_suffix)
+               part_name_len += strlen(slot_suffix);
+       part_name = malloc(part_name_len);
+       if (!part_name)
+               return -1;
+       strcpy(part_name, base_name);
+       if (slot_suffix)
+               strcat(part_name, slot_suffix);
+
+       part_num = part_get_info_by_name(dev_desc, part_name, part_info);
+       if (part_num < 0) {
+               debug("ANDROID: Could not find partition \"%s\"\n", part_name);
+               part_num = -1;
+       }
+
+       free(part_name);
+       return part_num;
+}
+
+static int android_bootloader_boot_bootloader(void)
+{
+       const char *fastboot_cmd = getenv("fastbootcmd");
+
+       if (fastboot_cmd)
+               return run_command(fastboot_cmd, CMD_FLAG_ENV);
+       return -1;
+}
+
+static int android_bootloader_boot_kernel(unsigned long kernel_address)
+{
+       char kernel_addr_str[12];
+       char *fdt_addr = getenv("fdt_addr");
+       char *bootm_args[] = { "bootm", kernel_addr_str, "-", fdt_addr, NULL };
+
+       sprintf(kernel_addr_str, "0x%lx", kernel_address);
+
+       printf("Booting kernel at %s with fdt at %s...\n\n\n",
+              kernel_addr_str, fdt_addr);
+       do_bootm(NULL, 0, 4, bootm_args);
+
+       return -1;
+}
+
+static char *strjoin(const char **chunks, char separator)

common/android_bootloader.c new file +8 -0

+               if (ret)
+                       ret[0] = '\0';
+               return ret;
+       }
+
+       ret = malloc(joined_len);
+       current = ret;
+       if (!ret)

common/android_bootloader.c new file +142 -0

+ * @return a newly allocated string
+ */
+static char *android_assemble_cmdline(const char *slot_suffix,
+                                     const char *extra_args)
+{
+       const char *cmdline_chunks[16];
+       const char **current_chunk = cmdline_chunks;
+       char *env_cmdline, *cmdline, *rootdev_input;
+       char *allocated_suffix = NULL;
+       char *allocated_rootdev = NULL;
+       unsigned long rootdev_len;
+
+       env_cmdline = getenv("bootargs");
+       if (env_cmdline)
+               *(current_chunk++) = env_cmdline;
+
+       /* The |slot_suffix| needs to be passed to the kernel to know what
+        * slot to boot from.
+        */
+       if (slot_suffix) {
+               allocated_suffix = malloc(strlen(ANDROID_ARG_SLOT_SUFFIX) +
+                                         strlen(slot_suffix));
+               strcpy(allocated_suffix, ANDROID_ARG_SLOT_SUFFIX);
+               strcat(allocated_suffix, slot_suffix);
+               *(current_chunk++) = allocated_suffix;
+       }
+
+       rootdev_input = getenv("android_rootdev");
+       if (rootdev_input) {
+               rootdev_len = strlen(ANDROID_ARG_ROOT) + CONFIG_SYS_CBSIZE + 1;
+               allocated_rootdev = malloc(rootdev_len);
+               strcpy(allocated_rootdev, ANDROID_ARG_ROOT);
+               cli_simple_process_macros(rootdev_input,
+                                         allocated_rootdev +
+                                         strlen(ANDROID_ARG_ROOT));
+               /* Make sure that the string is null-terminated since the
+                * previous could not copy to the end of the input string if it
+                * is too big.
+                */
+               allocated_rootdev[rootdev_len - 1] = '\0';
+               *(current_chunk++) = allocated_rootdev;
+       }
+
+       if (extra_args)
+               *(current_chunk++) = extra_args;
+
+       *(current_chunk++) = NULL;
+       cmdline = strjoin(cmdline_chunks, ' ');
+       free(allocated_suffix);
+       free(allocated_rootdev);
+       return cmdline;
+}
+
+int android_bootloader_boot_flow(struct blk_desc *dev_desc,
+                                const disk_partition_t *misc_part_info,
+                                const char *slot,
+                                unsigned long kernel_address)
+{
+       enum android_boot_mode mode;
+       disk_partition_t boot_part_info;
+       disk_partition_t system_part_info;
+       int boot_part_num, system_part_num;
+       int ret;
+       char *command_line;
+       char slot_suffix[3];
+       const char *mode_cmdline = NULL;
+
+       /* Determine the boot mode and clear its value for the next boot if
+        * needed.
+        */
+       mode = android_bootloader_load_and_clear_mode(dev_desc, misc_part_info);
+       printf("ANDROID: reboot reason: \"%s\"\n", android_boot_mode_str(mode));
+
+       switch (mode) {
+       case ANDROID_BOOT_MODE_NORMAL:
+               /* In normal mode, we load the kernel from "boot" but append
+                * "skip_initramfs" to the cmdline to make it ignore the
+                * recovery initramfs in the boot partition.
+                */
+               mode_cmdline = "skip_initramfs";
+               break;
+       case ANDROID_BOOT_MODE_RECOVERY:
+               /* In recovery mode we still boot the kernel from "boot" but
+                * don't skip the initramfs so it boots to recovery.
+                */
+               break;
+       case ANDROID_BOOT_MODE_BOOTLOADER:
+               /* Bootloader mode enters fastboot. If this operation fails we
+                * simply return since we can't recover from this situation by
+                * switching to another slot.
+                */
+               return android_bootloader_boot_bootloader();
+       }
+
+       slot_suffix[0] = '\0';
+       if (slot && slot[0]) {
+               slot_suffix[0] = '_';
+               slot_suffix[1] = slot[0];
+               slot_suffix[2] = '\0';
+       }
+
+       /* Load the kernel from the desired "boot" partition. */
+       boot_part_num =
+           android_part_get_info_by_name_suffix(dev_desc,
+                                                ANDROID_PARTITION_BOOT,
+                                                slot_suffix, &boot_part_info);
+       if (boot_part_num < 0)
+               return -1;
+       debug("ANDROID: Loading kernel from \"%s\", partition %d.\n",
+             boot_part_info.name, boot_part_num);
+
+       system_part_num =
+           android_part_get_info_by_name_suffix(dev_desc,
+                                                ANDROID_PARTITION_SYSTEM,
+                                                slot_suffix,
+                                                &system_part_info);
+       if (system_part_num < 0)
+               return -1;
+       debug("ANDROID: Using system image from \"%s\", partition %d.\n",
+             system_part_info.name, system_part_num);
+
+       ret = android_image_load(dev_desc, &boot_part_info, kernel_address,
+                                -1UL);
+       if (ret < 0)
+               return ret;
+
+       /* Set Android root variables. */
+       setenv_ulong("android_root_devnum", dev_desc->devnum);
+       setenv_ulong("android_root_partnum", system_part_num);
+       setenv("android_slotsufix", slot_suffix);
+
+       /* Assemble the command line */
+       command_line = android_assemble_cmdline(slot_suffix, mode_cmdline);
+       setenv("bootargs", command_line);
+
+       debug("ANDROID: bootargs: \"%s\"\n", command_line);
+
+       android_bootloader_boot_kernel(kernel_address);
+
+       /* TODO: If the kernel doesn't boot mark the selected slot as bad. */
+       return -1;
+}

include/android_bootloader.h new file +0 -0

new file mode 100644
index 0000000000..ddf6d76f64

include/android_bootloader.h new file +23 -0

+
+enum android_boot_mode {
+       ANDROID_BOOT_MODE_NORMAL = 0,
+
+       /* "recovery" mode is triggered by the "reboot recovery" command or
+        * equivalent adb/fastboot command. It can also be triggered by writing
+        * "boot-recovery" in the BCB message. This mode should boot the
+        * recovery kernel.
+        */
+       ANDROID_BOOT_MODE_RECOVERY,
+
+       /* "bootloader" mode is triggered by the "reboot bootloader" command or
+        * equivalent adb/fastboot command. It can also be triggered by writing
+        * "bootonce-bootloader" in the BCB message. This mode should boot into
+        * fastboot.
+        */
+       ANDROID_BOOT_MODE_BOOTLOADER,
+};
+
+/** android_bootloader_boot_flow - Execute the Android Bootloader Flow.
+ * Performs the Android Bootloader boot flow, loading the appropriate Android
+ * image (normal kernel, recovery kernel or "bootloader" mode) and booting it.
+ * The boot mode is determined by the contents of the Android Bootloader

include/android_bootloader.h new file +5 -0

+                                const disk_partition_t *misc_part_info,
+                                const char *slot,
+                                unsigned long kernel_address);
+
+#endif  /* __ANDROID_BOOTLOADER_H */

include/android_bootloader_message.h new file +75 -0

new file mode 100644
index 0000000000..2c2142dc6f
@@ -0,0 +1,174 @@
+/*
+ * This is from the Android Project,
+ * Repository: https://android.googlesource.com/platform/bootable/recovery/
+ * File: bootloader_message/include/bootloader_message/bootloader_message.h
+ * Commit: 8b309f6970ab3b7c53cc529c51a2cb44e1c7a7e1
+ *
+ * Copyright (C) 2008 The Android Open Source Project
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#ifndef __ANDROID_BOOTLOADER_MESSAGE_H
+#define __ANDROID_BOOTLOADER_MESSAGE_H
+
+/* compiler.h defines the types that otherwise are included from stdint.h and
+ * stddef.h
+ */
+#include <compiler.h>
+
+/* Spaces used by misc partition are as below:
+ * 0   - 2K     Bootloader Message
+ * 2K  - 16K    Used by Vendor's bootloader (the 2K - 4K range may be optionally used
+ *              as bootloader_message_ab struct)
+ * 16K - 64K    Used by uncrypt and recovery to store wipe_package for A/B devices
+ * Note that these offsets are admitted by bootloader,recovery and uncrypt, so they
+ * are not configurable without changing all of them.
+ */
+static const size_t ANDROID_BOOTLOADER_MESSAGE_OFFSET_IN_MISC = 0;
+static const size_t ANDROID_WIPE_PACKAGE_OFFSET_IN_MISC = 16 * 1024;
+
+/* Bootloader Message (2-KiB)
+ *
+ * This structure describes the content of a block in flash
+ * that is used for recovery and the bootloader to talk to
+ * each other.
+ *
+ * The command field is updated by linux when it wants to
+ * reboot into recovery or to update radio or bootloader firmware.
+ * It is also updated by the bootloader when firmware update
+ * is complete (to boot into recovery for any final cleanup)
+ *
+ * The status field is written by the bootloader after the
+ * completion of an "update-radio" or "update-hboot" command.
+ *
+ * The recovery field is only written by linux and used
+ * for the system to send a message to recovery or the
+ * other way around.
+ *
+ * The stage field is written by packages which restart themselves
+ * multiple times, so that the UI can reflect which invocation of the
+ * package it is.  If the value is of the format "#/#" (eg, "1/3"),
+ * the UI will add a simple indicator of that status.
+ *
+ * We used to have slot_suffix field for A/B boot control metadata in
+ * this struct, which gets unintentionally cleared by recovery or
+ * uncrypt. Move it into struct bootloader_message_ab to avoid the
+ * issue.
+ */
+struct android_bootloader_message {
+    char command[32];
+    char status[32];
+    char recovery[768];
+
+    /* The 'recovery' field used to be 1024 bytes.  It has only ever
+     * been used to store the recovery command line, so 768 bytes
+     * should be plenty.  We carve off the last 256 bytes to store the
+     * stage string (for multistage packages) and possible future
+     * expansion. */
+    char stage[32];
+
+    /* The 'reserved' field used to be 224 bytes when it was initially
+     * carved off from the 1024-byte recovery field. Bump it up to
+     * 1184-byte so that the entire bootloader_message struct rounds up
+     * to 2048-byte. */
+    char reserved[1184];

include/android_bootloader_message.h new file +28 -0

+
+/**
+ * The A/B-specific bootloader message structure (4-KiB).
+ *
+ * We separate A/B boot control metadata from the regular bootloader
+ * message struct and keep it here. Everything that's A/B-specific
+ * stays after struct bootloader_message, which should be managed by
+ * the A/B-bootloader or boot control HAL.
+ *
+ * The slot_suffix field is used for A/B implementations where the
+ * bootloader does not set the androidboot.ro.boot.slot_suffix kernel
+ * commandline parameter. This is used by fs_mgr to mount /system and
+ * other partitions with the slotselect flag set in fstab. A/B
+ * implementations are free to use all 32 bytes and may store private
+ * data past the first NUL-byte in this field. It is encouraged, but
+ * not mandatory, to use 'struct bootloader_control' described below.
+ */
+struct android_bootloader_message_ab {
+    struct android_bootloader_message message;
+    char slot_suffix[32];
+
+    /* Round up the entire struct to 4096-byte. */
+    char reserved[2016];
+};
+
+/**
+ * Be cautious about the struct size change, in case we put anything post
+ * bootloader_message_ab struct (b/29159185).

include/android_bootloader_message.h new file +51 -1

+    /* Slot priority with 15 meaning highest priority, 1 lowest
+     * priority and 0 the slot is unbootable. */
+    uint8_t priority : 4;
+    /* Number of times left attempting to boot this slot. */
+    uint8_t tries_remaining : 3;
+    /* 1 if this slot has booted successfully, 0 otherwise. */
+    uint8_t successful_boot : 1;
+    /* 1 if this slot is corrupted from a dm-verity corruption, 0 */
+    /* otherwise. */
+    uint8_t verity_corrupted : 1;
+    /* Reserved for further use. */
+    uint8_t reserved : 7;
+} __attribute__((packed));
+
+/* Bootloader Control AB
+ *
+ * This struct can be used to manage A/B metadata. It is designed to
+ * be put in the 'slot_suffix' field of the 'bootloader_message'
+ * structure described above. It is encouraged to use the
+ * 'bootloader_control' structure to store the A/B metadata, but not
+ * mandatory.
+ */
+struct android_bootloader_control {
+    /* NUL terminated active slot suffix. */
+    char slot_suffix[4];
+    /* Bootloader Control AB magic number (see BOOT_CTRL_MAGIC). */
+    uint32_t magic;
+    /* Version of struct being used (see BOOT_CTRL_VERSION). */
+    uint8_t version;
+    /* Number of slots being managed. */
+    uint8_t nb_slot : 3;
+    /* Number of times left attempting to boot recovery. */
+    uint8_t recovery_tries_remaining : 3;
+    /* Ensure 4-bytes alignment for slot_info field. */
+    uint8_t reserved0[2];
+    /* Per-slot information.  Up to 4 slots. */
+    struct android_slot_metadata slot_info[4];
+    /* Reserved for further use. */
+    uint8_t reserved1[8];
+    /* CRC32 of all 28 bytes preceding this field (little endian
+     * format). */
+    uint32_t crc32_le;
+} __attribute__((packed));
+
+#if (__STDC_VERSION__ >= 201112L) || defined(__cplusplus)
+static_assert(sizeof(struct android_bootloader_control) ==
+              sizeof(((struct android_bootloader_message_ab *)0)->slot_suffix),
+              "struct bootloader_control has wrong size");
+#endif
+
+#endif  /* __ANDROID_BOOTLOADER_MESSAGE_H */
--

2.12.2.564.g063fe858b8-goog

Similar to what blk_get_device_part_str() does, this patch makes part_get_info_by_name() return the partition number in case of a match. This is useful when the partition number is needed and not just the descriptor.

Signed-off-by Alex Deymo <[email protected]>

---
 common/fb_mmc.c | 6 +++---
 disk/part.c     | 2 +-
 include/part.h  | 3 ++-
 3 files changed, 6 insertions(+), 5 deletions(-)

Similar to what blk_get_device_part_str() does, this patch makes part_get_info_by_name() return the partition number in case of a match. This is useful when the partition number is needed and not just the descriptor.

Signed-off-by Alex Deymo <[email protected]>

Reviewed-by Simon Glass <[email protected]>

Android kernel images include a header that specifies addresses and kernel size. This patch adds a command to load these images from storage without specifying the size or address of them, and parsing them from the header instead.

---
 cmd/Kconfig        |  9 +++++++++
 cmd/Makefile       |  1 +
 cmd/load_android.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 cmd/load_android.c

This patch implements the logic needed to load an Android boot image from storage, since the size and kernel address in Android images is defined in its header.

Signed-off-by Alex Deymo <[email protected]>

---
 common/image-android.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 include/image.h        | 19 +++++++++++++++++++
 2 files changed, 70 insertions(+)

common/image-android.c +1 -0

index c668407817..f040f5b400 100644
@@ -8,6 +8,7 @@
 #include <image.h>
 #include <android_image.h>
 #include <malloc.h>
+#include <mapmem.h>
 #include <errno.h>
 
 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR      0x10008000

common/image-android.c +28 -0

+       }
+       if (!blk_read) {
+               blk_cnt = (android_image_get_end(buf) - (ulong)buf +
+                          part_info->blksz - 1) / part_info->blksz;
+               if (blk_cnt * part_info->blksz > max_size) {
+                       debug("Android Image too big (%lu bytes, max %lu)\n",
+                             android_image_get_end(buf) - (ulong)buf,
+                             max_size);
+                       blk_read = -1;
+               } else {
+                       debug("Loading Android Image (%lu blocks) to 0x%lx... ",
+                             blk_cnt, load_address);
+                       blk_read = blk_dread(dev_desc, part_info->start,
+                                            blk_cnt, buf);
+               }
+       }
+
+       unmap_sysmem(buf);
+       if (blk_read < 0)
+               return blk_read;
+
+       debug("%lu blocks read: %s\n",
+             blk_read, (blk_read == blk_cnt) ? "OK" : "ERROR");
+       if (blk_read != blk_cnt)
+               return -1;
+       return blk_read;
+}
+
 #if !defined(CONFIG_SPL_BUILD)
 /**
  * android_print_contents - prints out the contents of the Android format image

include/image.h +0 -0

index 2372518960..de448a9a01 100644

include/image.h +6 -1

+ */
+long android_image_load(struct blk_desc *dev_desc,
+                       const disk_partition_t *part_info,
+                       unsigned long load_address,
+                       unsigned long max_size);
+
 #endif /* CONFIG_ANDROID_BOOT_IMAGE */
 
 /**
--

2.12.2.564.g063fe858b8-goog

Update the Android image header format to the latest version published in AOSP. The original code moved to a new repository, so this patch also updates the reference to that path.

Signed-off-by Alex Deymo <[email protected]>

---
 common/image-android.c  |  9 +++++++++
 include/android_image.h | 24 +++++++++++++++++++-----
 2 files changed, 28 insertions(+), 5 deletions(-)

Update the Android image header format to the latest version published in AOSP. The original code moved to a new repository, so this patch also updates the reference to that path.

Signed-off-by Alex Deymo <[email protected]>

Reviewed-by Simon Glass <[email protected]>

An "Android Bootloader" has a lot of requirements about how it should behave which Android partners must implement. In particular, the new A/B updates [1] added more requirements and flows to the bootloader which are not common, on top of the existing flows.

For example, a few uncommon requirements include:
* Lookup in the BCB (boot control block) whether a "recovery" message is stored. This is used by the recovery environment when applying a multi-stage update in the legacy update model (recovery reboots to recovery again) and for interrumpted factory-reset (a reboot during the factory reset should continue to reboot into factory reset until it is done).
* A new "repair" mode. In the A/B model, when none of the slots is bootable, the device would boot into repair mode, which is often the same as "bootloader" mode (fastboot).
* Recovery as root: In newer version of AOSP, it is possible to mount the system image as / without an initramfs, which then frees up the initramfs in the "boot" partition to hold the "recovery" initramfs. This is the default for new devices and required for the A/B setup.

This patchset updates the Android-related headers and introduces new commands to boot a recent Android build. This work is based on the bootloader used in the Raspberry Pi in Android Things and extensively tested there.

[1] https://source.android.com/devices/tech/ota/ab_updates.html

Alex Deymo (6):
image: Update include/android_image.h
image: Implement a function to load Android Images.
cmd: Add 'load_android' command to load Android images.
disk: Return the partition number in part_get_info_by_name() Initial support for the Android Bootloader flow
cmd: Add "boot_android" command.

  README                               |  25 ++-
  cmd/Kconfig                          |  19 ++
  cmd/Makefile                         |   2 +
  cmd/boot_android.c                   | 126 +++++++++++++
  cmd/load_android.c                   |  56 ++++++
  common/Kconfig                       |  19 ++
  common/Makefile                      |   1 +
  common/android_bootloader.c          | 350 +++++++++++++++++++++++++++++++++++
  common/fb_mmc.c                      |   6 +-
  common/image-android.c               |  60 ++++++
  disk/part.c                          |   2 +-
  include/android_bootloader.h         |  48 +++++
  include/android_bootloader_message.h | 174 +++++++++++++++++
  include/android_image.h              |  24 ++-
  include/image.h                      |  19 ++
  include/part.h                       |   3 +-
  16 files changed, 920 insertions(+), 14 deletions(-)

create mode 100644 cmd/boot_android.c
create mode 100644 cmd/load_android.c
create mode 100644 common/android_bootloader.c create mode 100644 include/android_bootloader.h create mode 100644 include/android_bootloader_message.h