Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | /* |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 18 | * update_verifier verifies the integrity of the partitions after an A/B OTA update. It gets invoked |
| 19 | * by init, and will only perform the verification if it's the first boot post an A/B OTA update |
| 20 | * (https://source.android.com/devices/tech/ota/ab/#after_reboot). |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 21 | * |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 22 | * update_verifier relies on device-mapper-verity (dm-verity) to capture any corruption on the |
| 23 | * partitions being verified (https://source.android.com/security/verifiedboot). The verification |
| 24 | * will be skipped, if dm-verity is not enabled on the device. |
| 25 | * |
| 26 | * Upon detecting verification failures, the device will be rebooted, although the trigger of the |
| 27 | * reboot depends on the dm-verity mode. |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 28 | * enforcing mode: dm-verity reboots the device |
| 29 | * eio mode: dm-verity fails the read and update_verifier reboots the device |
| 30 | * other mode: not supported and update_verifier reboots the device |
| 31 | * |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 32 | * All these reboots prevent the device from booting into a known corrupt state. If the device |
| 33 | * continuously fails to boot into the new slot, the bootloader should mark the slot as unbootable |
| 34 | * and trigger a fallback to the old slot. |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 35 | * |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 36 | * The current slot will be marked as having booted successfully if the verifier reaches the end |
| 37 | * after the verification. |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 38 | */ |
| 39 | |
Tao Bao | 83b0780 | 2017-04-26 14:30:56 -0700 | [diff] [blame] | 40 | #include "update_verifier/update_verifier.h" |
| 41 | |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 42 | #include <dirent.h> |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 43 | #include <errno.h> |
| 44 | #include <fcntl.h> |
Tao Bao | c89c394 | 2019-03-13 15:30:13 -0700 | [diff] [blame] | 45 | #include <stdint.h> |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 46 | #include <stdio.h> |
Tao Bao | c89c394 | 2019-03-13 15:30:13 -0700 | [diff] [blame] | 47 | #include <stdlib.h> |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 48 | #include <string.h> |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 49 | #include <unistd.h> |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 50 | |
Tianjie Xu | 8fa8f0b | 2017-04-27 11:47:35 -0700 | [diff] [blame] | 51 | #include <algorithm> |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 52 | #include <future> |
Tao Bao | c89c394 | 2019-03-13 15:30:13 -0700 | [diff] [blame] | 53 | #include <thread> |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 54 | |
| 55 | #include <android-base/file.h> |
Tianjie Xu | 7b0ad9c | 2016-08-05 18:00:04 -0700 | [diff] [blame] | 56 | #include <android-base/logging.h> |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 57 | #include <android-base/parseint.h> |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 58 | #include <android-base/properties.h> |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 59 | #include <android-base/strings.h> |
| 60 | #include <android-base/unique_fd.h> |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 61 | #include <android/hardware/boot/1.0/IBootControl.h> |
Tao Bao | c89c394 | 2019-03-13 15:30:13 -0700 | [diff] [blame] | 62 | #include <android/os/IVold.h> |
Daniel Rosenberg | 15f22bd | 2019-01-22 19:57:28 -0800 | [diff] [blame] | 63 | #include <binder/BinderService.h> |
| 64 | #include <binder/Status.h> |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 65 | #include <cutils/android_reboot.h> |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 66 | |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 67 | #include "care_map.pb.h" |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 68 | |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 69 | using android::sp; |
| 70 | using android::hardware::boot::V1_0::IBootControl; |
| 71 | using android::hardware::boot::V1_0::BoolResult; |
| 72 | using android::hardware::boot::V1_0::CommandResult; |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 73 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 74 | constexpr const char* kDefaultCareMapPrefix = "/data/ota_package/care_map"; |
| 75 | |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 76 | // Find directories in format of "/sys/block/dm-X". |
| 77 | static int dm_name_filter(const dirent* de) { |
| 78 | if (android::base::StartsWith(de->d_name, "dm-")) { |
| 79 | return 1; |
| 80 | } |
| 81 | return 0; |
| 82 | } |
| 83 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 84 | UpdateVerifier::UpdateVerifier() |
| 85 | : care_map_prefix_(kDefaultCareMapPrefix), |
| 86 | property_reader_([](const std::string& id) { return android::base::GetProperty(id, ""); }) {} |
| 87 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 88 | // Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices. |
| 89 | // We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target |
| 90 | // partition's integrity. |
| 91 | std::map<std::string, std::string> UpdateVerifier::FindDmPartitions() { |
Tao Bao | 83b0780 | 2017-04-26 14:30:56 -0700 | [diff] [blame] | 92 | static constexpr auto DM_PATH_PREFIX = "/sys/block/"; |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 93 | dirent** namelist; |
| 94 | int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort); |
| 95 | if (n == -1) { |
| 96 | PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX; |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 97 | return {}; |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 98 | } |
| 99 | if (n == 0) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 100 | LOG(ERROR) << "No dm block device found."; |
| 101 | return {}; |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 102 | } |
| 103 | |
Tao Bao | 83b0780 | 2017-04-26 14:30:56 -0700 | [diff] [blame] | 104 | static constexpr auto DM_PATH_SUFFIX = "/dm/name"; |
| 105 | static constexpr auto DEV_PATH = "/dev/block/"; |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 106 | std::map<std::string, std::string> dm_block_devices; |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 107 | while (n--) { |
| 108 | std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX; |
| 109 | std::string content; |
| 110 | if (!android::base::ReadFileToString(path, &content)) { |
| 111 | PLOG(WARNING) << "Failed to read " << path; |
David Zeuthen | 8ed9738 | 2017-05-08 13:41:28 -0400 | [diff] [blame] | 112 | } else { |
| 113 | std::string dm_block_name = android::base::Trim(content); |
David Zeuthen | 8ed9738 | 2017-05-08 13:41:28 -0400 | [diff] [blame] | 114 | // AVB is using 'vroot' for the root block device but we're expecting 'system'. |
| 115 | if (dm_block_name == "vroot") { |
| 116 | dm_block_name = "system"; |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 117 | } |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 118 | |
| 119 | dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name)); |
Tianjie Xu | b0ac872 | 2017-01-18 18:41:53 -0800 | [diff] [blame] | 120 | } |
| 121 | free(namelist[n]); |
| 122 | } |
| 123 | free(namelist); |
| 124 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 125 | return dm_block_devices; |
| 126 | } |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 127 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 128 | bool UpdateVerifier::ReadBlocks(const std::string partition_name, |
| 129 | const std::string& dm_block_device, const RangeSet& ranges) { |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 130 | // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for |
| 131 | // the last group). |
| 132 | size_t thread_num = std::thread::hardware_concurrency() ?: 4; |
| 133 | std::vector<RangeSet> groups = ranges.Split(thread_num); |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 134 | |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 135 | std::vector<std::future<bool>> threads; |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 136 | for (const auto& group : groups) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 137 | auto thread_func = [&group, &dm_block_device, &partition_name]() { |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 138 | android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY))); |
| 139 | if (fd.get() == -1) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 140 | PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name; |
Tianjie Xu | 8fa8f0b | 2017-04-27 11:47:35 -0700 | [diff] [blame] | 141 | return false; |
| 142 | } |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 143 | |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 144 | static constexpr size_t kBlockSize = 4096; |
| 145 | std::vector<uint8_t> buf(1024 * kBlockSize); |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 146 | |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 147 | size_t block_count = 0; |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 148 | for (const auto& [range_start, range_end] : group) { |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 149 | if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) { |
| 150 | PLOG(ERROR) << "lseek to " << range_start << " failed"; |
| 151 | return false; |
| 152 | } |
| 153 | |
| 154 | size_t remain = (range_end - range_start) * kBlockSize; |
| 155 | while (remain > 0) { |
| 156 | size_t to_read = std::min(remain, 1024 * kBlockSize); |
| 157 | if (!android::base::ReadFully(fd.get(), buf.data(), to_read)) { |
| 158 | PLOG(ERROR) << "Failed to read blocks " << range_start << " to " << range_end; |
| 159 | return false; |
| 160 | } |
| 161 | remain -= to_read; |
| 162 | } |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 163 | block_count += (range_end - range_start); |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 164 | } |
Tao Bao | 160514b | 2017-11-04 00:08:08 -0700 | [diff] [blame] | 165 | LOG(INFO) << "Finished reading " << block_count << " blocks on " << dm_block_device; |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 166 | return true; |
| 167 | }; |
| 168 | |
| 169 | threads.emplace_back(std::async(std::launch::async, thread_func)); |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 170 | } |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 171 | |
Wei Wang | 5226f47 | 2017-08-02 10:27:31 -0700 | [diff] [blame] | 172 | bool ret = true; |
| 173 | for (auto& t : threads) { |
| 174 | ret = t.get() && ret; |
| 175 | } |
| 176 | LOG(INFO) << "Finished reading blocks on " << dm_block_device << " with " << thread_num |
| 177 | << " threads."; |
| 178 | return ret; |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 179 | } |
| 180 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 181 | bool UpdateVerifier::VerifyPartitions() { |
| 182 | auto dm_block_devices = FindDmPartitions(); |
| 183 | if (dm_block_devices.empty()) { |
| 184 | LOG(ERROR) << "No dm-enabled block device is found."; |
Tao Bao | 5a1dee0 | 2017-07-21 15:15:31 -0700 | [diff] [blame] | 185 | return false; |
| 186 | } |
| 187 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 188 | for (const auto& [partition_name, ranges] : partition_map_) { |
| 189 | if (dm_block_devices.find(partition_name) == dm_block_devices.end()) { |
| 190 | LOG(ERROR) << "Failed to find dm block device for " << partition_name; |
| 191 | return false; |
Tao Bao | 5a1dee0 | 2017-07-21 15:15:31 -0700 | [diff] [blame] | 192 | } |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 193 | |
| 194 | if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) { |
Tao Bao | 5a1dee0 | 2017-07-21 15:15:31 -0700 | [diff] [blame] | 195 | return false; |
| 196 | } |
| 197 | } |
| 198 | |
| 199 | return true; |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 200 | } |
| 201 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 202 | bool UpdateVerifier::ParseCareMapPlainText(const std::string& content) { |
| 203 | // care_map file has up to six lines, where every two lines make a pair. Within each pair, the |
| 204 | // first line has the partition name (e.g. "system"), while the second line holds the ranges of |
| 205 | // all the blocks to verify. |
| 206 | auto lines = android::base::Split(android::base::Trim(content), "\n"); |
| 207 | if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) { |
| 208 | LOG(WARNING) << "Invalid lines in care_map: found " << lines.size() |
| 209 | << " lines, expecting 2 or 4 or 6 lines."; |
| 210 | return false; |
| 211 | } |
| 212 | |
| 213 | for (size_t i = 0; i < lines.size(); i += 2) { |
| 214 | const std::string& partition_name = lines[i]; |
| 215 | const std::string& range_str = lines[i + 1]; |
| 216 | // We're seeing an N care_map.txt. Skip the verification since it's not compatible with O |
| 217 | // update_verifier (the last few metadata blocks can't be read via device mapper). |
| 218 | if (android::base::StartsWith(partition_name, "/dev/block/")) { |
| 219 | LOG(WARNING) << "Found legacy care_map.txt; skipped."; |
| 220 | return false; |
| 221 | } |
| 222 | |
| 223 | // For block range string, first integer 'count' equals 2 * total number of valid ranges, |
| 224 | // followed by 'count' number comma separated integers. Every two integers reprensent a |
| 225 | // block range with the first number included in range but second number not included. |
| 226 | // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150). |
| 227 | RangeSet ranges = RangeSet::Parse(range_str); |
| 228 | if (!ranges) { |
| 229 | LOG(WARNING) << "Error parsing RangeSet string " << range_str; |
| 230 | return false; |
| 231 | } |
| 232 | |
| 233 | partition_map_.emplace(partition_name, ranges); |
| 234 | } |
| 235 | |
| 236 | return true; |
| 237 | } |
| 238 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 239 | bool UpdateVerifier::ParseCareMap() { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 240 | partition_map_.clear(); |
| 241 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 242 | std::string care_map_name = care_map_prefix_ + ".pb"; |
| 243 | if (access(care_map_name.c_str(), R_OK) == -1) { |
| 244 | LOG(WARNING) << care_map_name |
| 245 | << " doesn't exist, falling back to read the care_map in plain text format."; |
| 246 | care_map_name = care_map_prefix_ + ".txt"; |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 247 | } |
| 248 | |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 249 | android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY))); |
| 250 | // If the device is flashed before the current boot, it may not have care_map.txt in |
| 251 | // /data/ota_package. To allow the device to continue booting in this situation, we should |
| 252 | // print a warning and skip the block verification. |
| 253 | if (care_map_fd.get() == -1) { |
| 254 | PLOG(WARNING) << "Failed to open " << care_map_name; |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 255 | return false; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 256 | } |
| 257 | |
| 258 | std::string file_content; |
| 259 | if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 260 | PLOG(WARNING) << "Failed to read " << care_map_name; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 261 | return false; |
| 262 | } |
| 263 | |
| 264 | if (file_content.empty()) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 265 | LOG(WARNING) << "Unexpected empty care map"; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 266 | return false; |
| 267 | } |
| 268 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 269 | if (android::base::EndsWith(care_map_name, ".txt")) { |
| 270 | return ParseCareMapPlainText(file_content); |
| 271 | } |
| 272 | |
| 273 | recovery_update_verifier::CareMap care_map; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 274 | if (!care_map.ParseFromString(file_content)) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 275 | LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format."; |
| 276 | return false; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 277 | } |
| 278 | |
| 279 | for (const auto& partition : care_map.partitions()) { |
| 280 | if (partition.name().empty()) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 281 | LOG(WARNING) << "Unexpected empty partition name."; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 282 | return false; |
| 283 | } |
| 284 | if (partition.ranges().empty()) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 285 | LOG(WARNING) << "Unexpected block ranges for partition " << partition.name(); |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 286 | return false; |
| 287 | } |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 288 | RangeSet ranges = RangeSet::Parse(partition.ranges()); |
| 289 | if (!ranges) { |
| 290 | LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges(); |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 291 | return false; |
| 292 | } |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 293 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 294 | // Continues to check other partitions if there is a fingerprint mismatch. |
| 295 | if (partition.id().empty() || partition.id() == "unknown") { |
| 296 | LOG(WARNING) << "Skip reading partition " << partition.name() |
| 297 | << ": property_id is not provided to get fingerprint."; |
| 298 | continue; |
| 299 | } |
| 300 | |
| 301 | std::string fingerprint = property_reader_(partition.id()); |
| 302 | if (fingerprint != partition.fingerprint()) { |
| 303 | LOG(WARNING) << "Skip reading partition " << partition.name() << ": fingerprint " |
| 304 | << fingerprint << " doesn't match the expected value " |
| 305 | << partition.fingerprint(); |
| 306 | continue; |
| 307 | } |
| 308 | |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 309 | partition_map_.emplace(partition.name(), ranges); |
| 310 | } |
| 311 | |
| 312 | if (partition_map_.empty()) { |
| 313 | LOG(WARNING) << "No partition to verify"; |
| 314 | return false; |
Tianjie Xu | 4d9e62d | 2018-05-11 10:41:44 -0700 | [diff] [blame] | 315 | } |
| 316 | |
| 317 | return true; |
| 318 | } |
| 319 | |
Tianjie Xu | 9eed65e | 2018-09-14 12:52:02 -0700 | [diff] [blame] | 320 | void UpdateVerifier::set_care_map_prefix(const std::string& prefix) { |
| 321 | care_map_prefix_ = prefix; |
| 322 | } |
| 323 | |
| 324 | void UpdateVerifier::set_property_reader( |
| 325 | const std::function<std::string(const std::string&)>& property_reader) { |
| 326 | property_reader_ = property_reader; |
| 327 | } |
| 328 | |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 329 | static int reboot_device() { |
| 330 | if (android_reboot(ANDROID_RB_RESTART2, 0, nullptr) == -1) { |
| 331 | LOG(ERROR) << "Failed to reboot."; |
| 332 | return -1; |
| 333 | } |
| 334 | while (true) pause(); |
| 335 | } |
| 336 | |
Tao Bao | 83b0780 | 2017-04-26 14:30:56 -0700 | [diff] [blame] | 337 | int update_verifier(int argc, char** argv) { |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 338 | for (int i = 1; i < argc; i++) { |
Tianjie Xu | 7b0ad9c | 2016-08-05 18:00:04 -0700 | [diff] [blame] | 339 | LOG(INFO) << "Started with arg " << i << ": " << argv[i]; |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 340 | } |
| 341 | |
Chris Phoenix | 0157c78 | 2017-01-20 11:34:00 -0800 | [diff] [blame] | 342 | sp<IBootControl> module = IBootControl::getService(); |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 343 | if (module == nullptr) { |
Tianjie Xu | 7b0ad9c | 2016-08-05 18:00:04 -0700 | [diff] [blame] | 344 | LOG(ERROR) << "Error getting bootctrl module."; |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 345 | return reboot_device(); |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 346 | } |
| 347 | |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 348 | uint32_t current_slot = module->getCurrentSlot(); |
| 349 | BoolResult is_successful = module->isSlotMarkedSuccessful(current_slot); |
| 350 | LOG(INFO) << "Booting slot " << current_slot << ": isSlotMarkedSuccessful=" |
| 351 | << static_cast<int32_t>(is_successful); |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 352 | |
Connor O'Brien | ad43d2d | 2016-11-21 12:47:33 -0800 | [diff] [blame] | 353 | if (is_successful == BoolResult::FALSE) { |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 354 | // The current slot has not booted successfully. |
Tao Bao | db57f0d | 2017-03-10 14:21:25 -0800 | [diff] [blame] | 355 | |
David Zeuthen | 1a0929c | 2017-08-07 18:47:27 -0400 | [diff] [blame] | 356 | bool skip_verification = false; |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 357 | std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", ""); |
| 358 | if (verity_mode.empty()) { |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 359 | // Skip the verification if ro.boot.veritymode property is not set. This could be a result |
| 360 | // that device doesn't support dm-verity, or has disabled that. |
| 361 | LOG(WARNING) << "dm-verity not enabled; marking without verification."; |
David Zeuthen | 1a0929c | 2017-08-07 18:47:27 -0400 | [diff] [blame] | 362 | skip_verification = true; |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 363 | } else if (android::base::EqualsIgnoreCase(verity_mode, "eio")) { |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 364 | // We shouldn't see verity in EIO mode if the current slot hasn't booted successfully before. |
| 365 | // Continue the verification until we fail to read some blocks. |
| 366 | LOG(WARNING) << "Found dm-verity in EIO mode."; |
David Zeuthen | 1a0929c | 2017-08-07 18:47:27 -0400 | [diff] [blame] | 367 | } else if (android::base::EqualsIgnoreCase(verity_mode, "disabled")) { |
| 368 | LOG(WARNING) << "dm-verity in disabled mode; marking without verification."; |
| 369 | skip_verification = true; |
Tao Bao | 4f8d217 | 2017-01-13 15:36:32 -0800 | [diff] [blame] | 370 | } else if (verity_mode != "enforcing") { |
Tao Bao | 1cc0351 | 2018-04-18 17:10:49 -0700 | [diff] [blame] | 371 | LOG(ERROR) << "Unexpected dm-verity mode: " << verity_mode << ", expecting enforcing."; |
Tianjie Xu | 3958a95 | 2017-03-01 15:31:25 -0800 | [diff] [blame] | 372 | return reboot_device(); |
| 373 | } |
| 374 | |
David Zeuthen | 1a0929c | 2017-08-07 18:47:27 -0400 | [diff] [blame] | 375 | if (!skip_verification) { |
Tianjie Xu | 446b64b | 2018-09-19 15:45:28 -0700 | [diff] [blame] | 376 | UpdateVerifier verifier; |
| 377 | if (!verifier.ParseCareMap()) { |
| 378 | LOG(WARNING) << "Failed to parse the care map file, skipping verification"; |
| 379 | } else if (!verifier.VerifyPartitions()) { |
David Zeuthen | 1a0929c | 2017-08-07 18:47:27 -0400 | [diff] [blame] | 380 | LOG(ERROR) << "Failed to verify all blocks in care map file."; |
| 381 | return reboot_device(); |
| 382 | } |
Tianjie Xu | d007cf2 | 2016-02-29 16:08:06 -0800 | [diff] [blame] | 383 | } |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 384 | |
Daniel Rosenberg | 15f22bd | 2019-01-22 19:57:28 -0800 | [diff] [blame] | 385 | bool supports_checkpoint = false; |
| 386 | auto sm = android::defaultServiceManager(); |
| 387 | android::sp<android::IBinder> binder = sm->getService(android::String16("vold")); |
| 388 | if (binder) { |
| 389 | auto vold = android::interface_cast<android::os::IVold>(binder); |
| 390 | android::binder::Status status = vold->supportsCheckpoint(&supports_checkpoint); |
| 391 | if (!status.isOk()) { |
| 392 | LOG(ERROR) << "Failed to check if checkpoints supported. Continuing"; |
| 393 | } |
| 394 | } else { |
| 395 | LOG(ERROR) << "Failed to obtain vold Binder. Continuing"; |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 396 | } |
Daniel Rosenberg | 15f22bd | 2019-01-22 19:57:28 -0800 | [diff] [blame] | 397 | |
| 398 | if (!supports_checkpoint) { |
| 399 | CommandResult cr; |
| 400 | module->markBootSuccessful([&cr](CommandResult result) { cr = result; }); |
| 401 | if (!cr.success) { |
| 402 | LOG(ERROR) << "Error marking booted successfully: " << cr.errMsg; |
| 403 | return reboot_device(); |
| 404 | } |
| 405 | LOG(INFO) << "Marked slot " << current_slot << " as booted successfully."; |
| 406 | } else { |
| 407 | LOG(INFO) << "Deferred marking slot " << current_slot << " as booted successfully."; |
| 408 | } |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 409 | } |
| 410 | |
Tianjie Xu | 7b0ad9c | 2016-08-05 18:00:04 -0700 | [diff] [blame] | 411 | LOG(INFO) << "Leaving update_verifier."; |
Tao Bao | 7197ee0 | 2015-12-05 21:21:27 -0800 | [diff] [blame] | 412 | return 0; |
| 413 | } |