Pass androidboot.vbmeta.device option on the kernel cmdline.
With these changes, avbtool and libavb will set this new option to the
partition GUID of the 'vbmeta' partition for the booted slot. This can
be used by an AVB-specific error handler to clear the 'vbmeta'
partition in question thereby forcing the bootloader to fall back to
another slot. Here's the debug output when manually tested with my toy
UEFI bootloader and a custom hacked up dm-verity error handler:
[ 0.000000] Kernel command line: rootfstype=ext4 init=/init console=ttyS0,115200 androidboot.console=ttyS0 androidboot.hardware=uefi_x86_64 enforcing=0 androidboot.selinux=permissive androidboot.debuggable=1 buildvariant=eng dm="1 vroot none ro 1,0 2080496 verity 1 PARTUUID=c2531a08-1ff2-4c3e-9d9d-a50e5abd02c8 PARTUUID=c2531a08-1ff2-4c3e-9d9d-a50e5abd02c8 4096 4096 260062 260062 sha1 e4806bc79e0d292901d10087d6e98dc70d8acca1 43f92ecfd184583d79f6ae8618559ca9b24c51d8 1 ignore_zero_blocks" root=0xfd00 androidboot.vbmeta.device=PARTUUID=b0868553-57db-4047-94fc-3673070128e2 androidboot.slot_suffix=_a androidboot.vbmeta.device_state=unlocked androidboot.vbmeta.hash_alg=sha256 androidboot.vbmeta.size=3264 androidboot.vbmeta.digest=739a4c9ad3e034ac483614ced4083a2caad246387ce7fed8bd8eb92a2d08486e
[...]
[ 1.215488] device-mapper: init: attempting early device configuration.
[ 1.216648] device-mapper: init: adding target '0 2080496 verity 1 PARTUUID=c2531a08-1ff2-4c3e-9d9d-a50e5abd02c8 PARTUUID=c2531a08-1ff2-4c3e-9d9d-a50e5abd02c8 4096 4096 260062 260062 sha1 e4806bc79e0d292901d10087d6e98dc70d8acca1 43f92ecfd184583d79f6ae8618559ca9b24c51d8 1 ignore_zero_blocks'
[ 1.221667] device-mapper: init: dm-0 is ready
[ 1.230688] device-mapper: verity: 8:6: data block 0 is corrupted
[ 1.231567] device-mapper: verity-avb: AVB error handler called!
[ 1.238727] device-mapper: verity-avb: invalidate_vbmeta: found AVB0 vbmeta partition
[ 1.241937] device-mapper: verity-avb: invalidate_vbmeta: completed.
[ 1.244188] EXT4-fs (dm-0): unable to read superblock
[...]
where invalidate_vbmeta() replaces the AVB0 magic with AVE0 to signal
the error. On the reboot, the bootloader immediately selects slot '_b'
because 'vbmeta_a' fails to validate
UEFI AVB-based boot loader
../../../../external/avb/libavb/avb_vbmeta_image.c:388: ERROR: Magic is incorrect.
../../../../external/avb/libavb/avb_slot_verify.c:331: ERROR: vbmeta_a: Error verifying vbmeta image: invalid vbmeta header
../../../../external/avb/libavb_ab/avb_ab_flow.c:268: ERROR: Error verifying slot _a with result ERROR_INVALID_METADATA - setting unbootable.
[...]
[ 0.000000] Kernel command line: rootfstype=ext4 init=/init console=ttyS0,115200 androidboot.console=ttyS0 androidboot.hardware=uefi_x86_64 enforcing=0 androidboot.selinux=permissive androidboot.debuggable=1 buildvariant=eng dm="1 vroot none ro 1,0 2080496 verity 1 PARTUUID=62b098aa-dcf3-494f-8656-2aad5d0963a2 PARTUUID=62b098aa-dcf3-494f-8656-2aad5d0963a2 4096 4096 260062 260062 sha1 e4806bc79e0d292901d10087d6e98dc70d8acca1 43f92ecfd184583d79f6ae8618559ca9b24c51d8 1 ignore_zero_blocks" root=0xfd00 androidboot.vbmeta.device=PARTUUID=c386b78f-39cd-4cb8-9fc9-ab1023de5beb androidboot.slot_suffix=_b androidboot.vbmeta.device_state=unlocked androidboot.vbmeta.hash_alg=sha256 androidboot.vbmeta.size=3264 androidboot.vbmeta.digest=739a4c9ad3e034ac483614ced4083a2caad246387ce7fed8bd8eb92a2d08486e
[...]
# bootctl get-current-slot
1
as expected.
The AVB error handler featured above will be in a separate CL since
it's against the Linux kernel.
Bug: 31622239
Test: Updated unit tests and unit tests pass.
Test: Manually tested on UEFI based bootloader, see above.
Change-Id: I57e0b7876f02b2484188a2624420085ced3fbdbc
diff --git a/avbtool b/avbtool
index 3d56213..16d557b 100755
--- a/avbtool
+++ b/avbtool
@@ -1791,6 +1791,7 @@
c += ' 1' # number of optional args
c += ' ignore_zero_blocks'
c += '" root=0xfd00'
+ c += ' androidboot.vbmeta.device=PARTUUID=$(ANDROID_VBMETA_PARTUUID)'
# Now that we have the command-line, generate the descriptor.
desc = AvbKernelCmdlineDescriptor()