delta_performer.cc revision 6714084915ea7b66accf933344b0d4cd042dff3d
1// 2// Copyright (C) 2012 The Android Open Source Project 3// 4// Licensed under the Apache License, Version 2.0 (the "License"); 5// you may not use this file except in compliance with the License. 6// You may obtain a copy of the License at 7// 8// http://www.apache.org/licenses/LICENSE-2.0 9// 10// Unless required by applicable law or agreed to in writing, software 11// distributed under the License is distributed on an "AS IS" BASIS, 12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13// See the License for the specific language governing permissions and 14// limitations under the License. 15// 16 17#include "update_engine/payload_consumer/delta_performer.h" 18 19#include <endian.h> 20#include <errno.h> 21#include <linux/fs.h> 22 23#include <algorithm> 24#include <cstring> 25#include <memory> 26#include <string> 27#include <vector> 28 29#include <applypatch/imgpatch.h> 30#include <base/files/file_util.h> 31#include <base/format_macros.h> 32#include <base/strings/string_number_conversions.h> 33#include <base/strings/string_util.h> 34#include <base/strings/stringprintf.h> 35#include <brillo/data_encoding.h> 36#include <brillo/make_unique_ptr.h> 37#include <google/protobuf/repeated_field.h> 38 39#include "update_engine/common/constants.h" 40#include "update_engine/common/hardware_interface.h" 41#include "update_engine/common/prefs_interface.h" 42#include "update_engine/common/subprocess.h" 43#include "update_engine/common/terminator.h" 44#include "update_engine/payload_consumer/bzip_extent_writer.h" 45#include "update_engine/payload_consumer/download_action.h" 46#include "update_engine/payload_consumer/extent_writer.h" 47#if USE_MTD 48#include "update_engine/payload_consumer/mtd_file_descriptor.h" 49#endif 50#include "update_engine/payload_consumer/payload_constants.h" 51#include "update_engine/payload_consumer/payload_verifier.h" 52#include "update_engine/payload_consumer/xz_extent_writer.h" 53 54using google::protobuf::RepeatedPtrField; 55using std::min; 56using std::string; 57using std::vector; 58 59namespace chromeos_update_engine { 60 61const uint64_t DeltaPerformer::kDeltaVersionOffset = sizeof(kDeltaMagic); 62const uint64_t DeltaPerformer::kDeltaVersionSize = 8; 63const uint64_t DeltaPerformer::kDeltaManifestSizeOffset = 64 kDeltaVersionOffset + kDeltaVersionSize; 65const uint64_t DeltaPerformer::kDeltaManifestSizeSize = 8; 66const uint64_t DeltaPerformer::kDeltaMetadataSignatureSizeSize = 4; 67const uint64_t DeltaPerformer::kMaxPayloadHeaderSize = 24; 68const uint64_t DeltaPerformer::kSupportedMajorPayloadVersion = 2; 69const uint32_t DeltaPerformer::kSupportedMinorPayloadVersion = 3; 70 71const unsigned DeltaPerformer::kProgressLogMaxChunks = 10; 72const unsigned DeltaPerformer::kProgressLogTimeoutSeconds = 30; 73const unsigned DeltaPerformer::kProgressDownloadWeight = 50; 74const unsigned DeltaPerformer::kProgressOperationsWeight = 50; 75 76namespace { 77const int kUpdateStateOperationInvalid = -1; 78const int kMaxResumedUpdateFailures = 10; 79#if USE_MTD 80const int kUbiVolumeAttachTimeout = 5 * 60; 81#endif 82 83FileDescriptorPtr CreateFileDescriptor(const char* path) { 84 FileDescriptorPtr ret; 85#if USE_MTD 86 if (strstr(path, "/dev/ubi") == path) { 87 if (!UbiFileDescriptor::IsUbi(path)) { 88 // The volume might not have been attached at boot time. 89 int volume_no; 90 if (utils::SplitPartitionName(path, nullptr, &volume_no)) { 91 utils::TryAttachingUbiVolume(volume_no, kUbiVolumeAttachTimeout); 92 } 93 } 94 if (UbiFileDescriptor::IsUbi(path)) { 95 LOG(INFO) << path << " is a UBI device."; 96 ret.reset(new UbiFileDescriptor); 97 } 98 } else if (MtdFileDescriptor::IsMtd(path)) { 99 LOG(INFO) << path << " is an MTD device."; 100 ret.reset(new MtdFileDescriptor); 101 } else { 102 LOG(INFO) << path << " is not an MTD nor a UBI device."; 103#endif 104 ret.reset(new EintrSafeFileDescriptor); 105#if USE_MTD 106 } 107#endif 108 return ret; 109} 110 111// Opens path for read/write. On success returns an open FileDescriptor 112// and sets *err to 0. On failure, sets *err to errno and returns nullptr. 113FileDescriptorPtr OpenFile(const char* path, int mode, int* err) { 114 // Try to mark the block device read-only based on the mode. Ignore any 115 // failure since this won't work when passing regular files. 116 utils::SetBlockDeviceReadOnly(path, (mode & O_ACCMODE) == O_RDONLY); 117 118 FileDescriptorPtr fd = CreateFileDescriptor(path); 119#if USE_MTD 120 // On NAND devices, we can either read, or write, but not both. So here we 121 // use O_WRONLY. 122 if (UbiFileDescriptor::IsUbi(path) || MtdFileDescriptor::IsMtd(path)) { 123 mode = O_WRONLY; 124 } 125#endif 126 if (!fd->Open(path, mode, 000)) { 127 *err = errno; 128 PLOG(ERROR) << "Unable to open file " << path; 129 return nullptr; 130 } 131 *err = 0; 132 return fd; 133} 134 135// Discard the tail of the block device referenced by |fd|, from the offset 136// |data_size| until the end of the block device. Returns whether the data was 137// discarded. 138bool DiscardPartitionTail(FileDescriptorPtr fd, uint64_t data_size) { 139 uint64_t part_size = fd->BlockDevSize(); 140 if (!part_size || part_size <= data_size) 141 return false; 142 143 const vector<int> requests = { 144 BLKSECDISCARD, 145 BLKDISCARD, 146#ifdef BLKZEROOUT 147 BLKZEROOUT, 148#endif 149 }; 150 for (int request : requests) { 151 int error = 0; 152 if (fd->BlkIoctl(request, data_size, part_size - data_size, &error) && 153 error == 0) { 154 return true; 155 } 156 LOG(WARNING) << "Error discarding the last " 157 << (part_size - data_size) / 1024 << " KiB using ioctl(" 158 << request << ")"; 159 } 160 return false; 161} 162 163} // namespace 164 165 166// Computes the ratio of |part| and |total|, scaled to |norm|, using integer 167// arithmetic. 168static uint64_t IntRatio(uint64_t part, uint64_t total, uint64_t norm) { 169 return part * norm / total; 170} 171 172void DeltaPerformer::LogProgress(const char* message_prefix) { 173 // Format operations total count and percentage. 174 string total_operations_str("?"); 175 string completed_percentage_str(""); 176 if (num_total_operations_) { 177 total_operations_str = std::to_string(num_total_operations_); 178 // Upcasting to 64-bit to avoid overflow, back to size_t for formatting. 179 completed_percentage_str = 180 base::StringPrintf(" (%" PRIu64 "%%)", 181 IntRatio(next_operation_num_, num_total_operations_, 182 100)); 183 } 184 185 // Format download total count and percentage. 186 size_t payload_size = install_plan_->payload_size; 187 string payload_size_str("?"); 188 string downloaded_percentage_str(""); 189 if (payload_size) { 190 payload_size_str = std::to_string(payload_size); 191 // Upcasting to 64-bit to avoid overflow, back to size_t for formatting. 192 downloaded_percentage_str = 193 base::StringPrintf(" (%" PRIu64 "%%)", 194 IntRatio(total_bytes_received_, payload_size, 100)); 195 } 196 197 LOG(INFO) << (message_prefix ? message_prefix : "") << next_operation_num_ 198 << "/" << total_operations_str << " operations" 199 << completed_percentage_str << ", " << total_bytes_received_ 200 << "/" << payload_size_str << " bytes downloaded" 201 << downloaded_percentage_str << ", overall progress " 202 << overall_progress_ << "%"; 203} 204 205void DeltaPerformer::UpdateOverallProgress(bool force_log, 206 const char* message_prefix) { 207 // Compute our download and overall progress. 208 unsigned new_overall_progress = 0; 209 static_assert(kProgressDownloadWeight + kProgressOperationsWeight == 100, 210 "Progress weights don't add up"); 211 // Only consider download progress if its total size is known; otherwise 212 // adjust the operations weight to compensate for the absence of download 213 // progress. Also, make sure to cap the download portion at 214 // kProgressDownloadWeight, in case we end up downloading more than we 215 // initially expected (this indicates a problem, but could generally happen). 216 // TODO(garnold) the correction of operations weight when we do not have the 217 // total payload size, as well as the conditional guard below, should both be 218 // eliminated once we ensure that the payload_size in the install plan is 219 // always given and is non-zero. This currently isn't the case during unit 220 // tests (see chromium-os:37969). 221 size_t payload_size = install_plan_->payload_size; 222 unsigned actual_operations_weight = kProgressOperationsWeight; 223 if (payload_size) 224 new_overall_progress += min( 225 static_cast<unsigned>(IntRatio(total_bytes_received_, payload_size, 226 kProgressDownloadWeight)), 227 kProgressDownloadWeight); 228 else 229 actual_operations_weight += kProgressDownloadWeight; 230 231 // Only add completed operations if their total number is known; we definitely 232 // expect an update to have at least one operation, so the expectation is that 233 // this will eventually reach |actual_operations_weight|. 234 if (num_total_operations_) 235 new_overall_progress += IntRatio(next_operation_num_, num_total_operations_, 236 actual_operations_weight); 237 238 // Progress ratio cannot recede, unless our assumptions about the total 239 // payload size, total number of operations, or the monotonicity of progress 240 // is breached. 241 if (new_overall_progress < overall_progress_) { 242 LOG(WARNING) << "progress counter receded from " << overall_progress_ 243 << "% down to " << new_overall_progress << "%; this is a bug"; 244 force_log = true; 245 } 246 overall_progress_ = new_overall_progress; 247 248 // Update chunk index, log as needed: if forced by called, or we completed a 249 // progress chunk, or a timeout has expired. 250 base::Time curr_time = base::Time::Now(); 251 unsigned curr_progress_chunk = 252 overall_progress_ * kProgressLogMaxChunks / 100; 253 if (force_log || curr_progress_chunk > last_progress_chunk_ || 254 curr_time > forced_progress_log_time_) { 255 forced_progress_log_time_ = curr_time + forced_progress_log_wait_; 256 LogProgress(message_prefix); 257 } 258 last_progress_chunk_ = curr_progress_chunk; 259} 260 261 262size_t DeltaPerformer::CopyDataToBuffer(const char** bytes_p, size_t* count_p, 263 size_t max) { 264 const size_t count = *count_p; 265 if (!count) 266 return 0; // Special case shortcut. 267 size_t read_len = min(count, max - buffer_.size()); 268 const char* bytes_start = *bytes_p; 269 const char* bytes_end = bytes_start + read_len; 270 buffer_.insert(buffer_.end(), bytes_start, bytes_end); 271 *bytes_p = bytes_end; 272 *count_p = count - read_len; 273 return read_len; 274} 275 276 277bool DeltaPerformer::HandleOpResult(bool op_result, const char* op_type_name, 278 ErrorCode* error) { 279 if (op_result) 280 return true; 281 282 size_t partition_first_op_num = 283 current_partition_ ? acc_num_operations_[current_partition_ - 1] : 0; 284 LOG(ERROR) << "Failed to perform " << op_type_name << " operation " 285 << next_operation_num_ << ", which is the operation " 286 << next_operation_num_ - partition_first_op_num 287 << " in partition \"" 288 << partitions_[current_partition_].partition_name() << "\""; 289 *error = ErrorCode::kDownloadOperationExecutionError; 290 return false; 291} 292 293int DeltaPerformer::Close() { 294 int err = -CloseCurrentPartition(); 295 LOG_IF(ERROR, !payload_hash_calculator_.Finalize() || 296 !signed_hash_calculator_.Finalize()) 297 << "Unable to finalize the hash."; 298 if (!buffer_.empty()) { 299 LOG(INFO) << "Discarding " << buffer_.size() << " unused downloaded bytes"; 300 if (err >= 0) 301 err = 1; 302 } 303 return -err; 304} 305 306int DeltaPerformer::CloseCurrentPartition() { 307 int err = 0; 308 if (source_fd_ && !source_fd_->Close()) { 309 err = errno; 310 PLOG(ERROR) << "Error closing source partition"; 311 if (!err) 312 err = 1; 313 } 314 source_fd_.reset(); 315 source_path_.clear(); 316 317 if (target_fd_ && !target_fd_->Close()) { 318 err = errno; 319 PLOG(ERROR) << "Error closing target partition"; 320 if (!err) 321 err = 1; 322 } 323 target_fd_.reset(); 324 target_path_.clear(); 325 return -err; 326} 327 328bool DeltaPerformer::OpenCurrentPartition() { 329 if (current_partition_ >= partitions_.size()) 330 return false; 331 332 const PartitionUpdate& partition = partitions_[current_partition_]; 333 // Open source fds if we have a delta payload with minor version >= 2. 334 if (install_plan_->payload_type == InstallPayloadType::kDelta && 335 GetMinorVersion() != kInPlaceMinorPayloadVersion) { 336 source_path_ = install_plan_->partitions[current_partition_].source_path; 337 int err; 338 source_fd_ = OpenFile(source_path_.c_str(), O_RDONLY, &err); 339 if (!source_fd_) { 340 LOG(ERROR) << "Unable to open source partition " 341 << partition.partition_name() << " on slot " 342 << BootControlInterface::SlotName(install_plan_->source_slot) 343 << ", file " << source_path_; 344 return false; 345 } 346 } 347 348 target_path_ = install_plan_->partitions[current_partition_].target_path; 349 int err; 350 target_fd_ = OpenFile(target_path_.c_str(), O_RDWR, &err); 351 if (!target_fd_) { 352 LOG(ERROR) << "Unable to open target partition " 353 << partition.partition_name() << " on slot " 354 << BootControlInterface::SlotName(install_plan_->target_slot) 355 << ", file " << target_path_; 356 return false; 357 } 358 359 LOG(INFO) << "Applying " << partition.operations().size() 360 << " operations to partition \"" << partition.partition_name() 361 << "\""; 362 363 // Discard the end of the partition, but ignore failures. 364 DiscardPartitionTail( 365 target_fd_, install_plan_->partitions[current_partition_].target_size); 366 367 return true; 368} 369 370namespace { 371 372void LogPartitionInfoHash(const PartitionInfo& info, const string& tag) { 373 string sha256 = brillo::data_encoding::Base64Encode(info.hash()); 374 LOG(INFO) << "PartitionInfo " << tag << " sha256: " << sha256 375 << " size: " << info.size(); 376} 377 378void LogPartitionInfo(const vector<PartitionUpdate>& partitions) { 379 for (const PartitionUpdate& partition : partitions) { 380 LogPartitionInfoHash(partition.old_partition_info(), 381 "old " + partition.partition_name()); 382 LogPartitionInfoHash(partition.new_partition_info(), 383 "new " + partition.partition_name()); 384 } 385} 386 387} // namespace 388 389bool DeltaPerformer::GetMetadataSignatureSizeOffset( 390 uint64_t* out_offset) const { 391 if (GetMajorVersion() == kBrilloMajorPayloadVersion) { 392 *out_offset = kDeltaManifestSizeOffset + kDeltaManifestSizeSize; 393 return true; 394 } 395 return false; 396} 397 398bool DeltaPerformer::GetManifestOffset(uint64_t* out_offset) const { 399 // Actual manifest begins right after the manifest size field or 400 // metadata signature size field if major version >= 2. 401 if (major_payload_version_ == kChromeOSMajorPayloadVersion) { 402 *out_offset = kDeltaManifestSizeOffset + kDeltaManifestSizeSize; 403 return true; 404 } 405 if (major_payload_version_ == kBrilloMajorPayloadVersion) { 406 *out_offset = kDeltaManifestSizeOffset + kDeltaManifestSizeSize + 407 kDeltaMetadataSignatureSizeSize; 408 return true; 409 } 410 LOG(ERROR) << "Unknown major payload version: " << major_payload_version_; 411 return false; 412} 413 414uint64_t DeltaPerformer::GetMetadataSize() const { 415 return metadata_size_; 416} 417 418uint64_t DeltaPerformer::GetMajorVersion() const { 419 return major_payload_version_; 420} 421 422uint32_t DeltaPerformer::GetMinorVersion() const { 423 if (manifest_.has_minor_version()) { 424 return manifest_.minor_version(); 425 } else { 426 return install_plan_->payload_type == InstallPayloadType::kDelta 427 ? kSupportedMinorPayloadVersion 428 : kFullPayloadMinorVersion; 429 } 430} 431 432bool DeltaPerformer::GetManifest(DeltaArchiveManifest* out_manifest_p) const { 433 if (!manifest_parsed_) 434 return false; 435 *out_manifest_p = manifest_; 436 return true; 437} 438 439bool DeltaPerformer::IsHeaderParsed() const { 440 return metadata_size_ != 0; 441} 442 443DeltaPerformer::MetadataParseResult DeltaPerformer::ParsePayloadMetadata( 444 const brillo::Blob& payload, ErrorCode* error) { 445 *error = ErrorCode::kSuccess; 446 uint64_t manifest_offset; 447 448 if (!IsHeaderParsed()) { 449 // Ensure we have data to cover the major payload version. 450 if (payload.size() < kDeltaManifestSizeOffset) 451 return kMetadataParseInsufficientData; 452 453 // Validate the magic string. 454 if (memcmp(payload.data(), kDeltaMagic, sizeof(kDeltaMagic)) != 0) { 455 LOG(ERROR) << "Bad payload format -- invalid delta magic."; 456 *error = ErrorCode::kDownloadInvalidMetadataMagicString; 457 return kMetadataParseError; 458 } 459 460 // Extract the payload version from the metadata. 461 static_assert(sizeof(major_payload_version_) == kDeltaVersionSize, 462 "Major payload version size mismatch"); 463 memcpy(&major_payload_version_, 464 &payload[kDeltaVersionOffset], 465 kDeltaVersionSize); 466 // switch big endian to host 467 major_payload_version_ = be64toh(major_payload_version_); 468 469 if (major_payload_version_ != supported_major_version_ && 470 major_payload_version_ != kChromeOSMajorPayloadVersion) { 471 LOG(ERROR) << "Bad payload format -- unsupported payload version: " 472 << major_payload_version_; 473 *error = ErrorCode::kUnsupportedMajorPayloadVersion; 474 return kMetadataParseError; 475 } 476 477 // Get the manifest offset now that we have payload version. 478 if (!GetManifestOffset(&manifest_offset)) { 479 *error = ErrorCode::kUnsupportedMajorPayloadVersion; 480 return kMetadataParseError; 481 } 482 // Check again with the manifest offset. 483 if (payload.size() < manifest_offset) 484 return kMetadataParseInsufficientData; 485 486 // Next, parse the manifest size. 487 static_assert(sizeof(manifest_size_) == kDeltaManifestSizeSize, 488 "manifest_size size mismatch"); 489 memcpy(&manifest_size_, 490 &payload[kDeltaManifestSizeOffset], 491 kDeltaManifestSizeSize); 492 manifest_size_ = be64toh(manifest_size_); // switch big endian to host 493 494 if (GetMajorVersion() == kBrilloMajorPayloadVersion) { 495 // Parse the metadata signature size. 496 static_assert(sizeof(metadata_signature_size_) == 497 kDeltaMetadataSignatureSizeSize, 498 "metadata_signature_size size mismatch"); 499 uint64_t metadata_signature_size_offset; 500 if (!GetMetadataSignatureSizeOffset(&metadata_signature_size_offset)) { 501 *error = ErrorCode::kError; 502 return kMetadataParseError; 503 } 504 memcpy(&metadata_signature_size_, 505 &payload[metadata_signature_size_offset], 506 kDeltaMetadataSignatureSizeSize); 507 metadata_signature_size_ = be32toh(metadata_signature_size_); 508 } 509 510 // If the metadata size is present in install plan, check for it immediately 511 // even before waiting for that many number of bytes to be downloaded in the 512 // payload. This will prevent any attack which relies on us downloading data 513 // beyond the expected metadata size. 514 metadata_size_ = manifest_offset + manifest_size_; 515 if (install_plan_->hash_checks_mandatory) { 516 if (install_plan_->metadata_size != metadata_size_) { 517 LOG(ERROR) << "Mandatory metadata size in Omaha response (" 518 << install_plan_->metadata_size 519 << ") is missing/incorrect, actual = " << metadata_size_; 520 *error = ErrorCode::kDownloadInvalidMetadataSize; 521 return kMetadataParseError; 522 } 523 } 524 } 525 526 // Now that we have validated the metadata size, we should wait for the full 527 // metadata and its signature (if exist) to be read in before we can parse it. 528 if (payload.size() < metadata_size_ + metadata_signature_size_) 529 return kMetadataParseInsufficientData; 530 531 // Log whether we validated the size or simply trusting what's in the payload 532 // here. This is logged here (after we received the full metadata data) so 533 // that we just log once (instead of logging n times) if it takes n 534 // DeltaPerformer::Write calls to download the full manifest. 535 if (install_plan_->metadata_size == metadata_size_) { 536 LOG(INFO) << "Manifest size in payload matches expected value from Omaha"; 537 } else { 538 // For mandatory-cases, we'd have already returned a kMetadataParseError 539 // above. We'll be here only for non-mandatory cases. Just send a UMA stat. 540 LOG(WARNING) << "Ignoring missing/incorrect metadata size (" 541 << install_plan_->metadata_size 542 << ") in Omaha response as validation is not mandatory. " 543 << "Trusting metadata size in payload = " << metadata_size_; 544 } 545 546 // We have the full metadata in |payload|. Verify its integrity 547 // and authenticity based on the information we have in Omaha response. 548 *error = ValidateMetadataSignature(payload); 549 if (*error != ErrorCode::kSuccess) { 550 if (install_plan_->hash_checks_mandatory) { 551 // The autoupdate_CatchBadSignatures test checks for this string 552 // in log-files. Keep in sync. 553 LOG(ERROR) << "Mandatory metadata signature validation failed"; 554 return kMetadataParseError; 555 } 556 557 // For non-mandatory cases, just send a UMA stat. 558 LOG(WARNING) << "Ignoring metadata signature validation failures"; 559 *error = ErrorCode::kSuccess; 560 } 561 562 if (!GetManifestOffset(&manifest_offset)) { 563 *error = ErrorCode::kUnsupportedMajorPayloadVersion; 564 return kMetadataParseError; 565 } 566 // The payload metadata is deemed valid, it's safe to parse the protobuf. 567 if (!manifest_.ParseFromArray(&payload[manifest_offset], manifest_size_)) { 568 LOG(ERROR) << "Unable to parse manifest in update file."; 569 *error = ErrorCode::kDownloadManifestParseError; 570 return kMetadataParseError; 571 } 572 573 manifest_parsed_ = true; 574 return kMetadataParseSuccess; 575} 576 577// Wrapper around write. Returns true if all requested bytes 578// were written, or false on any error, regardless of progress 579// and stores an action exit code in |error|. 580bool DeltaPerformer::Write(const void* bytes, size_t count, ErrorCode *error) { 581 *error = ErrorCode::kSuccess; 582 583 const char* c_bytes = reinterpret_cast<const char*>(bytes); 584 585 // Update the total byte downloaded count and the progress logs. 586 total_bytes_received_ += count; 587 UpdateOverallProgress(false, "Completed "); 588 589 while (!manifest_valid_) { 590 // Read data up to the needed limit; this is either maximium payload header 591 // size, or the full metadata size (once it becomes known). 592 const bool do_read_header = !IsHeaderParsed(); 593 CopyDataToBuffer(&c_bytes, &count, 594 (do_read_header ? kMaxPayloadHeaderSize : 595 metadata_size_ + metadata_signature_size_)); 596 597 MetadataParseResult result = ParsePayloadMetadata(buffer_, error); 598 if (result == kMetadataParseError) 599 return false; 600 if (result == kMetadataParseInsufficientData) { 601 // If we just processed the header, make an attempt on the manifest. 602 if (do_read_header && IsHeaderParsed()) 603 continue; 604 605 return true; 606 } 607 608 // Checks the integrity of the payload manifest. 609 if ((*error = ValidateManifest()) != ErrorCode::kSuccess) 610 return false; 611 manifest_valid_ = true; 612 613 // Clear the download buffer. 614 DiscardBuffer(false, metadata_size_); 615 616 // This populates |partitions_| and the |install_plan.partitions| with the 617 // list of partitions from the manifest. 618 if (!ParseManifestPartitions(error)) 619 return false; 620 621 num_total_operations_ = 0; 622 for (const auto& partition : partitions_) { 623 num_total_operations_ += partition.operations_size(); 624 acc_num_operations_.push_back(num_total_operations_); 625 } 626 627 LOG_IF(WARNING, !prefs_->SetInt64(kPrefsManifestMetadataSize, 628 metadata_size_)) 629 << "Unable to save the manifest metadata size."; 630 LOG_IF(WARNING, !prefs_->SetInt64(kPrefsManifestSignatureSize, 631 metadata_signature_size_)) 632 << "Unable to save the manifest signature size."; 633 634 if (!PrimeUpdateState()) { 635 *error = ErrorCode::kDownloadStateInitializationError; 636 LOG(ERROR) << "Unable to prime the update state."; 637 return false; 638 } 639 640 if (!OpenCurrentPartition()) { 641 *error = ErrorCode::kInstallDeviceOpenError; 642 return false; 643 } 644 645 if (next_operation_num_ > 0) 646 UpdateOverallProgress(true, "Resuming after "); 647 LOG(INFO) << "Starting to apply update payload operations"; 648 } 649 650 while (next_operation_num_ < num_total_operations_) { 651 // Check if we should cancel the current attempt for any reason. 652 // In this case, *error will have already been populated with the reason 653 // why we're canceling. 654 if (download_delegate_ && download_delegate_->ShouldCancel(error)) 655 return false; 656 657 // We know there are more operations to perform because we didn't reach the 658 // |num_total_operations_| limit yet. 659 while (next_operation_num_ >= acc_num_operations_[current_partition_]) { 660 CloseCurrentPartition(); 661 current_partition_++; 662 if (!OpenCurrentPartition()) { 663 *error = ErrorCode::kInstallDeviceOpenError; 664 return false; 665 } 666 } 667 const size_t partition_operation_num = next_operation_num_ - ( 668 current_partition_ ? acc_num_operations_[current_partition_ - 1] : 0); 669 670 const InstallOperation& op = 671 partitions_[current_partition_].operations(partition_operation_num); 672 673 CopyDataToBuffer(&c_bytes, &count, op.data_length()); 674 675 // Check whether we received all of the next operation's data payload. 676 if (!CanPerformInstallOperation(op)) 677 return true; 678 679 // Validate the operation only if the metadata signature is present. 680 // Otherwise, keep the old behavior. This serves as a knob to disable 681 // the validation logic in case we find some regression after rollout. 682 // NOTE: If hash checks are mandatory and if metadata_signature is empty, 683 // we would have already failed in ParsePayloadMetadata method and thus not 684 // even be here. So no need to handle that case again here. 685 if (!install_plan_->metadata_signature.empty()) { 686 // Note: Validate must be called only if CanPerformInstallOperation is 687 // called. Otherwise, we might be failing operations before even if there 688 // isn't sufficient data to compute the proper hash. 689 *error = ValidateOperationHash(op); 690 if (*error != ErrorCode::kSuccess) { 691 if (install_plan_->hash_checks_mandatory) { 692 LOG(ERROR) << "Mandatory operation hash check failed"; 693 return false; 694 } 695 696 // For non-mandatory cases, just send a UMA stat. 697 LOG(WARNING) << "Ignoring operation validation errors"; 698 *error = ErrorCode::kSuccess; 699 } 700 } 701 702 // Makes sure we unblock exit when this operation completes. 703 ScopedTerminatorExitUnblocker exit_unblocker = 704 ScopedTerminatorExitUnblocker(); // Avoids a compiler unused var bug. 705 706 bool op_result; 707 switch (op.type()) { 708 case InstallOperation::REPLACE: 709 case InstallOperation::REPLACE_BZ: 710 case InstallOperation::REPLACE_XZ: 711 op_result = PerformReplaceOperation(op); 712 break; 713 case InstallOperation::ZERO: 714 case InstallOperation::DISCARD: 715 op_result = PerformZeroOrDiscardOperation(op); 716 break; 717 case InstallOperation::MOVE: 718 op_result = PerformMoveOperation(op); 719 break; 720 case InstallOperation::BSDIFF: 721 op_result = PerformBsdiffOperation(op); 722 break; 723 case InstallOperation::SOURCE_COPY: 724 op_result = PerformSourceCopyOperation(op); 725 break; 726 case InstallOperation::SOURCE_BSDIFF: 727 op_result = PerformSourceBsdiffOperation(op); 728 break; 729 case InstallOperation::IMGDIFF: 730 op_result = PerformImgdiffOperation(op); 731 break; 732 default: 733 op_result = false; 734 } 735 if (!HandleOpResult(op_result, InstallOperationTypeName(op.type()), error)) 736 return false; 737 738 next_operation_num_++; 739 UpdateOverallProgress(false, "Completed "); 740 CheckpointUpdateProgress(); 741 } 742 743 // In major version 2, we don't add dummy operation to the payload. 744 // If we already extracted the signature we should skip this step. 745 if (major_payload_version_ == kBrilloMajorPayloadVersion && 746 manifest_.has_signatures_offset() && manifest_.has_signatures_size() && 747 signatures_message_data_.empty()) { 748 if (manifest_.signatures_offset() != buffer_offset_) { 749 LOG(ERROR) << "Payload signatures offset points to blob offset " 750 << manifest_.signatures_offset() 751 << " but signatures are expected at offset " 752 << buffer_offset_; 753 *error = ErrorCode::kDownloadPayloadVerificationError; 754 return false; 755 } 756 CopyDataToBuffer(&c_bytes, &count, manifest_.signatures_size()); 757 // Needs more data to cover entire signature. 758 if (buffer_.size() < manifest_.signatures_size()) 759 return true; 760 if (!ExtractSignatureMessage()) { 761 LOG(ERROR) << "Extract payload signature failed."; 762 *error = ErrorCode::kDownloadPayloadVerificationError; 763 return false; 764 } 765 DiscardBuffer(true, 0); 766 // Since we extracted the SignatureMessage we need to advance the 767 // checkpoint, otherwise we would reload the signature and try to extract 768 // it again. 769 CheckpointUpdateProgress(); 770 } 771 772 return true; 773} 774 775bool DeltaPerformer::IsManifestValid() { 776 return manifest_valid_; 777} 778 779bool DeltaPerformer::ParseManifestPartitions(ErrorCode* error) { 780 if (major_payload_version_ == kBrilloMajorPayloadVersion) { 781 partitions_.clear(); 782 for (const PartitionUpdate& partition : manifest_.partitions()) { 783 partitions_.push_back(partition); 784 } 785 manifest_.clear_partitions(); 786 } else if (major_payload_version_ == kChromeOSMajorPayloadVersion) { 787 LOG(INFO) << "Converting update information from old format."; 788 PartitionUpdate root_part; 789 root_part.set_partition_name(kLegacyPartitionNameRoot); 790#ifdef __ANDROID__ 791 LOG(WARNING) << "Legacy payload major version provided to an Android " 792 "build. Assuming no post-install. Please use major version " 793 "2 or newer."; 794 root_part.set_run_postinstall(false); 795#else 796 root_part.set_run_postinstall(true); 797#endif // __ANDROID__ 798 if (manifest_.has_old_rootfs_info()) { 799 *root_part.mutable_old_partition_info() = manifest_.old_rootfs_info(); 800 manifest_.clear_old_rootfs_info(); 801 } 802 if (manifest_.has_new_rootfs_info()) { 803 *root_part.mutable_new_partition_info() = manifest_.new_rootfs_info(); 804 manifest_.clear_new_rootfs_info(); 805 } 806 *root_part.mutable_operations() = manifest_.install_operations(); 807 manifest_.clear_install_operations(); 808 partitions_.push_back(std::move(root_part)); 809 810 PartitionUpdate kern_part; 811 kern_part.set_partition_name(kLegacyPartitionNameKernel); 812 kern_part.set_run_postinstall(false); 813 if (manifest_.has_old_kernel_info()) { 814 *kern_part.mutable_old_partition_info() = manifest_.old_kernel_info(); 815 manifest_.clear_old_kernel_info(); 816 } 817 if (manifest_.has_new_kernel_info()) { 818 *kern_part.mutable_new_partition_info() = manifest_.new_kernel_info(); 819 manifest_.clear_new_kernel_info(); 820 } 821 *kern_part.mutable_operations() = manifest_.kernel_install_operations(); 822 manifest_.clear_kernel_install_operations(); 823 partitions_.push_back(std::move(kern_part)); 824 } 825 826 // Fill in the InstallPlan::partitions based on the partitions from the 827 // payload. 828 install_plan_->partitions.clear(); 829 for (const auto& partition : partitions_) { 830 InstallPlan::Partition install_part; 831 install_part.name = partition.partition_name(); 832 install_part.run_postinstall = 833 partition.has_run_postinstall() && partition.run_postinstall(); 834 if (install_part.run_postinstall) { 835 install_part.postinstall_path = 836 (partition.has_postinstall_path() ? partition.postinstall_path() 837 : kPostinstallDefaultScript); 838 install_part.filesystem_type = partition.filesystem_type(); 839 } 840 841 if (partition.has_old_partition_info()) { 842 const PartitionInfo& info = partition.old_partition_info(); 843 install_part.source_size = info.size(); 844 install_part.source_hash.assign(info.hash().begin(), info.hash().end()); 845 } 846 847 if (!partition.has_new_partition_info()) { 848 LOG(ERROR) << "Unable to get new partition hash info on partition " 849 << install_part.name << "."; 850 *error = ErrorCode::kDownloadNewPartitionInfoError; 851 return false; 852 } 853 const PartitionInfo& info = partition.new_partition_info(); 854 install_part.target_size = info.size(); 855 install_part.target_hash.assign(info.hash().begin(), info.hash().end()); 856 857 install_plan_->partitions.push_back(install_part); 858 } 859 860 if (!install_plan_->LoadPartitionsFromSlots(boot_control_)) { 861 LOG(ERROR) << "Unable to determine all the partition devices."; 862 *error = ErrorCode::kInstallDeviceOpenError; 863 return false; 864 } 865 LogPartitionInfo(partitions_); 866 return true; 867} 868 869bool DeltaPerformer::CanPerformInstallOperation( 870 const chromeos_update_engine::InstallOperation& operation) { 871 // If we don't have a data blob we can apply it right away. 872 if (!operation.has_data_offset() && !operation.has_data_length()) 873 return true; 874 875 // See if we have the entire data blob in the buffer 876 if (operation.data_offset() < buffer_offset_) { 877 LOG(ERROR) << "we threw away data it seems?"; 878 return false; 879 } 880 881 return (operation.data_offset() + operation.data_length() <= 882 buffer_offset_ + buffer_.size()); 883} 884 885bool DeltaPerformer::PerformReplaceOperation( 886 const InstallOperation& operation) { 887 CHECK(operation.type() == InstallOperation::REPLACE || 888 operation.type() == InstallOperation::REPLACE_BZ || 889 operation.type() == InstallOperation::REPLACE_XZ); 890 891 // Since we delete data off the beginning of the buffer as we use it, 892 // the data we need should be exactly at the beginning of the buffer. 893 TEST_AND_RETURN_FALSE(buffer_offset_ == operation.data_offset()); 894 TEST_AND_RETURN_FALSE(buffer_.size() >= operation.data_length()); 895 896 // Extract the signature message if it's in this operation. 897 if (ExtractSignatureMessageFromOperation(operation)) { 898 // If this is dummy replace operation, we ignore it after extracting the 899 // signature. 900 DiscardBuffer(true, 0); 901 return true; 902 } 903 904 // Setup the ExtentWriter stack based on the operation type. 905 std::unique_ptr<ExtentWriter> writer = 906 brillo::make_unique_ptr(new ZeroPadExtentWriter( 907 brillo::make_unique_ptr(new DirectExtentWriter()))); 908 909 if (operation.type() == InstallOperation::REPLACE_BZ) { 910 writer.reset(new BzipExtentWriter(std::move(writer))); 911 } else if (operation.type() == InstallOperation::REPLACE_XZ) { 912 writer.reset(new XzExtentWriter(std::move(writer))); 913 } 914 915 // Create a vector of extents to pass to the ExtentWriter. 916 vector<Extent> extents; 917 for (int i = 0; i < operation.dst_extents_size(); i++) { 918 extents.push_back(operation.dst_extents(i)); 919 } 920 921 TEST_AND_RETURN_FALSE(writer->Init(target_fd_, extents, block_size_)); 922 TEST_AND_RETURN_FALSE(writer->Write(buffer_.data(), operation.data_length())); 923 TEST_AND_RETURN_FALSE(writer->End()); 924 925 // Update buffer 926 DiscardBuffer(true, buffer_.size()); 927 return true; 928} 929 930bool DeltaPerformer::PerformZeroOrDiscardOperation( 931 const InstallOperation& operation) { 932 CHECK(operation.type() == InstallOperation::DISCARD || 933 operation.type() == InstallOperation::ZERO); 934 935 // These operations have no blob. 936 TEST_AND_RETURN_FALSE(!operation.has_data_offset()); 937 TEST_AND_RETURN_FALSE(!operation.has_data_length()); 938 939#ifdef BLKZEROOUT 940 bool attempt_ioctl = true; 941 int request = 942 (operation.type() == InstallOperation::ZERO ? BLKZEROOUT : BLKDISCARD); 943#else // !defined(BLKZEROOUT) 944 bool attempt_ioctl = false; 945 int request = 0; 946#endif // !defined(BLKZEROOUT) 947 948 brillo::Blob zeros; 949 for (int i = 0; i < operation.dst_extents_size(); i++) { 950 Extent extent = operation.dst_extents(i); 951 const uint64_t start = extent.start_block() * block_size_; 952 const uint64_t length = extent.num_blocks() * block_size_; 953 if (attempt_ioctl) { 954 int result = 0; 955 if (target_fd_->BlkIoctl(request, start, length, &result) && result == 0) 956 continue; 957 attempt_ioctl = false; 958 zeros.resize(16 * block_size_); 959 } 960 // In case of failure, we fall back to writing 0 to the selected region. 961 for (uint64_t offset = 0; offset < length; offset += zeros.size()) { 962 uint64_t chunk_length = min(length - offset, 963 static_cast<uint64_t>(zeros.size())); 964 TEST_AND_RETURN_FALSE( 965 utils::PWriteAll(target_fd_, zeros.data(), chunk_length, start + offset)); 966 } 967 } 968 return true; 969} 970 971bool DeltaPerformer::PerformMoveOperation(const InstallOperation& operation) { 972 // Calculate buffer size. Note, this function doesn't do a sliding 973 // window to copy in case the source and destination blocks overlap. 974 // If we wanted to do a sliding window, we could program the server 975 // to generate deltas that effectively did a sliding window. 976 977 uint64_t blocks_to_read = 0; 978 for (int i = 0; i < operation.src_extents_size(); i++) 979 blocks_to_read += operation.src_extents(i).num_blocks(); 980 981 uint64_t blocks_to_write = 0; 982 for (int i = 0; i < operation.dst_extents_size(); i++) 983 blocks_to_write += operation.dst_extents(i).num_blocks(); 984 985 DCHECK_EQ(blocks_to_write, blocks_to_read); 986 brillo::Blob buf(blocks_to_write * block_size_); 987 988 // Read in bytes. 989 ssize_t bytes_read = 0; 990 for (int i = 0; i < operation.src_extents_size(); i++) { 991 ssize_t bytes_read_this_iteration = 0; 992 const Extent& extent = operation.src_extents(i); 993 const size_t bytes = extent.num_blocks() * block_size_; 994 TEST_AND_RETURN_FALSE(extent.start_block() != kSparseHole); 995 TEST_AND_RETURN_FALSE(utils::PReadAll(target_fd_, 996 &buf[bytes_read], 997 bytes, 998 extent.start_block() * block_size_, 999 &bytes_read_this_iteration)); 1000 TEST_AND_RETURN_FALSE( 1001 bytes_read_this_iteration == static_cast<ssize_t>(bytes)); 1002 bytes_read += bytes_read_this_iteration; 1003 } 1004 1005 // Write bytes out. 1006 ssize_t bytes_written = 0; 1007 for (int i = 0; i < operation.dst_extents_size(); i++) { 1008 const Extent& extent = operation.dst_extents(i); 1009 const size_t bytes = extent.num_blocks() * block_size_; 1010 TEST_AND_RETURN_FALSE(extent.start_block() != kSparseHole); 1011 TEST_AND_RETURN_FALSE(utils::PWriteAll(target_fd_, 1012 &buf[bytes_written], 1013 bytes, 1014 extent.start_block() * block_size_)); 1015 bytes_written += bytes; 1016 } 1017 DCHECK_EQ(bytes_written, bytes_read); 1018 DCHECK_EQ(bytes_written, static_cast<ssize_t>(buf.size())); 1019 return true; 1020} 1021 1022namespace { 1023 1024// Takes |extents| and fills an empty vector |blocks| with a block index for 1025// each block in |extents|. For example, [(3, 2), (8, 1)] would give [3, 4, 8]. 1026void ExtentsToBlocks(const RepeatedPtrField<Extent>& extents, 1027 vector<uint64_t>* blocks) { 1028 for (Extent ext : extents) { 1029 for (uint64_t j = 0; j < ext.num_blocks(); j++) 1030 blocks->push_back(ext.start_block() + j); 1031 } 1032} 1033 1034// Takes |extents| and returns the number of blocks in those extents. 1035uint64_t GetBlockCount(const RepeatedPtrField<Extent>& extents) { 1036 uint64_t sum = 0; 1037 for (Extent ext : extents) { 1038 sum += ext.num_blocks(); 1039 } 1040 return sum; 1041} 1042 1043// Compare |calculated_hash| with source hash in |operation|, return false and 1044// dump hash if don't match. 1045bool ValidateSourceHash(const brillo::Blob& calculated_hash, 1046 const InstallOperation& operation) { 1047 brillo::Blob expected_source_hash(operation.src_sha256_hash().begin(), 1048 operation.src_sha256_hash().end()); 1049 if (calculated_hash != expected_source_hash) { 1050 LOG(ERROR) << "The hash of the source data on disk for this operation " 1051 << "doesn't match the expected value. This could mean that the " 1052 << "delta update payload was targeted for another version, or " 1053 << "that the source partition was modified after it was " 1054 << "installed, for example, by mounting a filesystem."; 1055 LOG(ERROR) << "Expected: sha256|hex = " 1056 << base::HexEncode(expected_source_hash.data(), 1057 expected_source_hash.size()); 1058 LOG(ERROR) << "Calculated: sha256|hex = " 1059 << base::HexEncode(calculated_hash.data(), 1060 calculated_hash.size()); 1061 1062 vector<string> source_extents; 1063 for (const Extent& ext : operation.src_extents()) { 1064 source_extents.push_back(base::StringPrintf( 1065 "%" PRIu64 ":%" PRIu64, ext.start_block(), ext.num_blocks())); 1066 } 1067 LOG(ERROR) << "Operation source (offset:size) in blocks: " 1068 << base::JoinString(source_extents, ","); 1069 return false; 1070 } 1071 return true; 1072} 1073 1074} // namespace 1075 1076bool DeltaPerformer::PerformSourceCopyOperation( 1077 const InstallOperation& operation) { 1078 if (operation.has_src_length()) 1079 TEST_AND_RETURN_FALSE(operation.src_length() % block_size_ == 0); 1080 if (operation.has_dst_length()) 1081 TEST_AND_RETURN_FALSE(operation.dst_length() % block_size_ == 0); 1082 1083 uint64_t blocks_to_read = GetBlockCount(operation.src_extents()); 1084 uint64_t blocks_to_write = GetBlockCount(operation.dst_extents()); 1085 TEST_AND_RETURN_FALSE(blocks_to_write == blocks_to_read); 1086 1087 // Create vectors of all the individual src/dst blocks. 1088 vector<uint64_t> src_blocks; 1089 vector<uint64_t> dst_blocks; 1090 ExtentsToBlocks(operation.src_extents(), &src_blocks); 1091 ExtentsToBlocks(operation.dst_extents(), &dst_blocks); 1092 DCHECK_EQ(src_blocks.size(), blocks_to_read); 1093 DCHECK_EQ(src_blocks.size(), dst_blocks.size()); 1094 1095 brillo::Blob buf(block_size_); 1096 ssize_t bytes_read = 0; 1097 HashCalculator source_hasher; 1098 // Read/write one block at a time. 1099 for (uint64_t i = 0; i < blocks_to_read; i++) { 1100 ssize_t bytes_read_this_iteration = 0; 1101 uint64_t src_block = src_blocks[i]; 1102 uint64_t dst_block = dst_blocks[i]; 1103 1104 // Read in bytes. 1105 TEST_AND_RETURN_FALSE( 1106 utils::PReadAll(source_fd_, 1107 buf.data(), 1108 block_size_, 1109 src_block * block_size_, 1110 &bytes_read_this_iteration)); 1111 1112 // Write bytes out. 1113 TEST_AND_RETURN_FALSE( 1114 utils::PWriteAll(target_fd_, 1115 buf.data(), 1116 block_size_, 1117 dst_block * block_size_)); 1118 1119 bytes_read += bytes_read_this_iteration; 1120 TEST_AND_RETURN_FALSE(bytes_read_this_iteration == 1121 static_cast<ssize_t>(block_size_)); 1122 1123 if (operation.has_src_sha256_hash()) 1124 TEST_AND_RETURN_FALSE(source_hasher.Update(buf.data(), buf.size())); 1125 } 1126 1127 if (operation.has_src_sha256_hash()) { 1128 TEST_AND_RETURN_FALSE(source_hasher.Finalize()); 1129 TEST_AND_RETURN_FALSE( 1130 ValidateSourceHash(source_hasher.raw_hash(), operation)); 1131 } 1132 1133 DCHECK_EQ(bytes_read, static_cast<ssize_t>(blocks_to_read * block_size_)); 1134 return true; 1135} 1136 1137bool DeltaPerformer::ExtentsToBsdiffPositionsString( 1138 const RepeatedPtrField<Extent>& extents, 1139 uint64_t block_size, 1140 uint64_t full_length, 1141 string* positions_string) { 1142 string ret; 1143 uint64_t length = 0; 1144 for (int i = 0; i < extents.size(); i++) { 1145 Extent extent = extents.Get(i); 1146 int64_t start = extent.start_block() * block_size; 1147 uint64_t this_length = min(full_length - length, 1148 extent.num_blocks() * block_size); 1149 ret += base::StringPrintf("%" PRIi64 ":%" PRIu64 ",", start, this_length); 1150 length += this_length; 1151 } 1152 TEST_AND_RETURN_FALSE(length == full_length); 1153 if (!ret.empty()) 1154 ret.resize(ret.size() - 1); // Strip trailing comma off 1155 *positions_string = ret; 1156 return true; 1157} 1158 1159bool DeltaPerformer::PerformBsdiffOperation(const InstallOperation& operation) { 1160 // Since we delete data off the beginning of the buffer as we use it, 1161 // the data we need should be exactly at the beginning of the buffer. 1162 TEST_AND_RETURN_FALSE(buffer_offset_ == operation.data_offset()); 1163 TEST_AND_RETURN_FALSE(buffer_.size() >= operation.data_length()); 1164 1165 string input_positions; 1166 TEST_AND_RETURN_FALSE(ExtentsToBsdiffPositionsString(operation.src_extents(), 1167 block_size_, 1168 operation.src_length(), 1169 &input_positions)); 1170 string output_positions; 1171 TEST_AND_RETURN_FALSE(ExtentsToBsdiffPositionsString(operation.dst_extents(), 1172 block_size_, 1173 operation.dst_length(), 1174 &output_positions)); 1175 1176 string temp_filename; 1177 TEST_AND_RETURN_FALSE(utils::MakeTempFile("au_patch.XXXXXX", 1178 &temp_filename, 1179 nullptr)); 1180 ScopedPathUnlinker path_unlinker(temp_filename); 1181 { 1182 int fd = open(temp_filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0644); 1183 ScopedFdCloser fd_closer(&fd); 1184 TEST_AND_RETURN_FALSE( 1185 utils::WriteAll(fd, buffer_.data(), operation.data_length())); 1186 } 1187 1188 // Update the buffer to release the patch data memory as soon as the patch 1189 // file is written out. 1190 DiscardBuffer(true, buffer_.size()); 1191 1192 vector<string> cmd{kBspatchPath, target_path_, target_path_, temp_filename, 1193 input_positions, output_positions}; 1194 1195 int return_code = 0; 1196 TEST_AND_RETURN_FALSE( 1197 Subprocess::SynchronousExecFlags(cmd, Subprocess::kSearchPath, 1198 &return_code, nullptr)); 1199 TEST_AND_RETURN_FALSE(return_code == 0); 1200 1201 if (operation.dst_length() % block_size_) { 1202 // Zero out rest of final block. 1203 // TODO(adlr): build this into bspatch; it's more efficient that way. 1204 const Extent& last_extent = 1205 operation.dst_extents(operation.dst_extents_size() - 1); 1206 const uint64_t end_byte = 1207 (last_extent.start_block() + last_extent.num_blocks()) * block_size_; 1208 const uint64_t begin_byte = 1209 end_byte - (block_size_ - operation.dst_length() % block_size_); 1210 brillo::Blob zeros(end_byte - begin_byte); 1211 TEST_AND_RETURN_FALSE( 1212 utils::PWriteAll(target_fd_, zeros.data(), end_byte - begin_byte, begin_byte)); 1213 } 1214 return true; 1215} 1216 1217bool DeltaPerformer::PerformSourceBsdiffOperation( 1218 const InstallOperation& operation) { 1219 // Since we delete data off the beginning of the buffer as we use it, 1220 // the data we need should be exactly at the beginning of the buffer. 1221 TEST_AND_RETURN_FALSE(buffer_offset_ == operation.data_offset()); 1222 TEST_AND_RETURN_FALSE(buffer_.size() >= operation.data_length()); 1223 if (operation.has_src_length()) 1224 TEST_AND_RETURN_FALSE(operation.src_length() % block_size_ == 0); 1225 if (operation.has_dst_length()) 1226 TEST_AND_RETURN_FALSE(operation.dst_length() % block_size_ == 0); 1227 1228 if (operation.has_src_sha256_hash()) { 1229 HashCalculator source_hasher; 1230 const uint64_t kMaxBlocksToRead = 512; // 2MB if block size is 4KB 1231 brillo::Blob buf(kMaxBlocksToRead * block_size_); 1232 for (const Extent& extent : operation.src_extents()) { 1233 for (uint64_t i = 0; i < extent.num_blocks(); i += kMaxBlocksToRead) { 1234 uint64_t blocks_to_read = 1235 min(kMaxBlocksToRead, extent.num_blocks() - i); 1236 ssize_t bytes_to_read = blocks_to_read * block_size_; 1237 ssize_t bytes_read_this_iteration = 0; 1238 TEST_AND_RETURN_FALSE( 1239 utils::PReadAll(source_fd_, buf.data(), bytes_to_read, 1240 (extent.start_block() + i) * block_size_, 1241 &bytes_read_this_iteration)); 1242 TEST_AND_RETURN_FALSE(bytes_read_this_iteration == bytes_to_read); 1243 TEST_AND_RETURN_FALSE(source_hasher.Update(buf.data(), bytes_to_read)); 1244 } 1245 } 1246 TEST_AND_RETURN_FALSE(source_hasher.Finalize()); 1247 TEST_AND_RETURN_FALSE( 1248 ValidateSourceHash(source_hasher.raw_hash(), operation)); 1249 } 1250 1251 string input_positions; 1252 TEST_AND_RETURN_FALSE(ExtentsToBsdiffPositionsString(operation.src_extents(), 1253 block_size_, 1254 operation.src_length(), 1255 &input_positions)); 1256 string output_positions; 1257 TEST_AND_RETURN_FALSE(ExtentsToBsdiffPositionsString(operation.dst_extents(), 1258 block_size_, 1259 operation.dst_length(), 1260 &output_positions)); 1261 1262 string temp_filename; 1263 TEST_AND_RETURN_FALSE(utils::MakeTempFile("au_patch.XXXXXX", 1264 &temp_filename, 1265 nullptr)); 1266 ScopedPathUnlinker path_unlinker(temp_filename); 1267 { 1268 int fd = open(temp_filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0644); 1269 ScopedFdCloser fd_closer(&fd); 1270 TEST_AND_RETURN_FALSE( 1271 utils::WriteAll(fd, buffer_.data(), operation.data_length())); 1272 } 1273 1274 // Update the buffer to release the patch data memory as soon as the patch 1275 // file is written out. 1276 DiscardBuffer(true, buffer_.size()); 1277 1278 vector<string> cmd{kBspatchPath, source_path_, target_path_, temp_filename, 1279 input_positions, output_positions}; 1280 1281 int return_code = 0; 1282 TEST_AND_RETURN_FALSE( 1283 Subprocess::SynchronousExecFlags(cmd, Subprocess::kSearchPath, 1284 &return_code, nullptr)); 1285 TEST_AND_RETURN_FALSE(return_code == 0); 1286 return true; 1287} 1288 1289bool DeltaPerformer::PerformImgdiffOperation( 1290 const InstallOperation& operation) { 1291 // Since we delete data off the beginning of the buffer as we use it, 1292 // the data we need should be exactly at the beginning of the buffer. 1293 TEST_AND_RETURN_FALSE(buffer_offset_ == operation.data_offset()); 1294 TEST_AND_RETURN_FALSE(buffer_.size() >= operation.data_length()); 1295 1296 uint64_t src_blocks = GetBlockCount(operation.src_extents()); 1297 brillo::Blob src_data(src_blocks * block_size_); 1298 1299 ssize_t bytes_read = 0; 1300 for (const Extent& extent : operation.src_extents()) { 1301 ssize_t bytes_read_this_iteration = 0; 1302 ssize_t bytes_to_read = extent.num_blocks() * block_size_; 1303 TEST_AND_RETURN_FALSE(utils::PReadAll(source_fd_, 1304 &src_data[bytes_read], 1305 bytes_to_read, 1306 extent.start_block() * block_size_, 1307 &bytes_read_this_iteration)); 1308 TEST_AND_RETURN_FALSE(bytes_read_this_iteration == bytes_to_read); 1309 bytes_read += bytes_read_this_iteration; 1310 } 1311 1312 if (operation.has_src_sha256_hash()) { 1313 brillo::Blob src_hash; 1314 TEST_AND_RETURN_FALSE(HashCalculator::RawHashOfData(src_data, &src_hash)); 1315 TEST_AND_RETURN_FALSE(ValidateSourceHash(src_hash, operation)); 1316 } 1317 1318 vector<Extent> target_extents(operation.dst_extents().begin(), 1319 operation.dst_extents().end()); 1320 DirectExtentWriter writer; 1321 TEST_AND_RETURN_FALSE(writer.Init(target_fd_, target_extents, block_size_)); 1322 TEST_AND_RETURN_FALSE( 1323 ApplyImagePatch(src_data.data(), 1324 src_data.size(), 1325 buffer_.data(), 1326 operation.data_length(), 1327 [](const unsigned char* data, ssize_t len, void* token) { 1328 return reinterpret_cast<ExtentWriter*>(token) 1329 ->Write(data, len) 1330 ? len 1331 : 0; 1332 }, 1333 &writer) == 0); 1334 TEST_AND_RETURN_FALSE(writer.End()); 1335 1336 DiscardBuffer(true, buffer_.size()); 1337 return true; 1338} 1339 1340bool DeltaPerformer::ExtractSignatureMessageFromOperation( 1341 const InstallOperation& operation) { 1342 if (operation.type() != InstallOperation::REPLACE || 1343 !manifest_.has_signatures_offset() || 1344 manifest_.signatures_offset() != operation.data_offset()) { 1345 return false; 1346 } 1347 TEST_AND_RETURN_FALSE(manifest_.has_signatures_size() && 1348 manifest_.signatures_size() == operation.data_length()); 1349 TEST_AND_RETURN_FALSE(ExtractSignatureMessage()); 1350 return true; 1351} 1352 1353bool DeltaPerformer::ExtractSignatureMessage() { 1354 TEST_AND_RETURN_FALSE(signatures_message_data_.empty()); 1355 TEST_AND_RETURN_FALSE(buffer_offset_ == manifest_.signatures_offset()); 1356 TEST_AND_RETURN_FALSE(buffer_.size() >= manifest_.signatures_size()); 1357 signatures_message_data_.assign( 1358 buffer_.begin(), 1359 buffer_.begin() + manifest_.signatures_size()); 1360 1361 // Save the signature blob because if the update is interrupted after the 1362 // download phase we don't go through this path anymore. Some alternatives to 1363 // consider: 1364 // 1365 // 1. On resume, re-download the signature blob from the server and re-verify 1366 // it. 1367 // 1368 // 2. Verify the signature as soon as it's received and don't checkpoint the 1369 // blob and the signed sha-256 context. 1370 LOG_IF(WARNING, !prefs_->SetString(kPrefsUpdateStateSignatureBlob, 1371 string(signatures_message_data_.begin(), 1372 signatures_message_data_.end()))) 1373 << "Unable to store the signature blob."; 1374 1375 LOG(INFO) << "Extracted signature data of size " 1376 << manifest_.signatures_size() << " at " 1377 << manifest_.signatures_offset(); 1378 return true; 1379} 1380 1381bool DeltaPerformer::GetPublicKeyFromResponse(base::FilePath *out_tmp_key) { 1382 if (hardware_->IsOfficialBuild() || 1383 utils::FileExists(public_key_path_.c_str()) || 1384 install_plan_->public_key_rsa.empty()) 1385 return false; 1386 1387 if (!utils::DecodeAndStoreBase64String(install_plan_->public_key_rsa, 1388 out_tmp_key)) 1389 return false; 1390 1391 return true; 1392} 1393 1394ErrorCode DeltaPerformer::ValidateMetadataSignature( 1395 const brillo::Blob& payload) { 1396 if (payload.size() < metadata_size_ + metadata_signature_size_) 1397 return ErrorCode::kDownloadMetadataSignatureError; 1398 1399 brillo::Blob metadata_signature_blob, metadata_signature_protobuf_blob; 1400 if (!install_plan_->metadata_signature.empty()) { 1401 // Convert base64-encoded signature to raw bytes. 1402 if (!brillo::data_encoding::Base64Decode( 1403 install_plan_->metadata_signature, &metadata_signature_blob)) { 1404 LOG(ERROR) << "Unable to decode base64 metadata signature: " 1405 << install_plan_->metadata_signature; 1406 return ErrorCode::kDownloadMetadataSignatureError; 1407 } 1408 } else if (major_payload_version_ == kBrilloMajorPayloadVersion) { 1409 metadata_signature_protobuf_blob.assign(payload.begin() + metadata_size_, 1410 payload.begin() + metadata_size_ + 1411 metadata_signature_size_); 1412 } 1413 1414 if (metadata_signature_blob.empty() && 1415 metadata_signature_protobuf_blob.empty()) { 1416 if (install_plan_->hash_checks_mandatory) { 1417 LOG(ERROR) << "Missing mandatory metadata signature in both Omaha " 1418 << "response and payload."; 1419 return ErrorCode::kDownloadMetadataSignatureMissingError; 1420 } 1421 1422 LOG(WARNING) << "Cannot validate metadata as the signature is empty"; 1423 return ErrorCode::kSuccess; 1424 } 1425 1426 // See if we should use the public RSA key in the Omaha response. 1427 base::FilePath path_to_public_key(public_key_path_); 1428 base::FilePath tmp_key; 1429 if (GetPublicKeyFromResponse(&tmp_key)) 1430 path_to_public_key = tmp_key; 1431 ScopedPathUnlinker tmp_key_remover(tmp_key.value()); 1432 if (tmp_key.empty()) 1433 tmp_key_remover.set_should_remove(false); 1434 1435 LOG(INFO) << "Verifying metadata hash signature using public key: " 1436 << path_to_public_key.value(); 1437 1438 HashCalculator metadata_hasher; 1439 metadata_hasher.Update(payload.data(), metadata_size_); 1440 if (!metadata_hasher.Finalize()) { 1441 LOG(ERROR) << "Unable to compute actual hash of manifest"; 1442 return ErrorCode::kDownloadMetadataSignatureVerificationError; 1443 } 1444 1445 brillo::Blob calculated_metadata_hash = metadata_hasher.raw_hash(); 1446 PayloadVerifier::PadRSA2048SHA256Hash(&calculated_metadata_hash); 1447 if (calculated_metadata_hash.empty()) { 1448 LOG(ERROR) << "Computed actual hash of metadata is empty."; 1449 return ErrorCode::kDownloadMetadataSignatureVerificationError; 1450 } 1451 1452 if (!metadata_signature_blob.empty()) { 1453 brillo::Blob expected_metadata_hash; 1454 if (!PayloadVerifier::GetRawHashFromSignature(metadata_signature_blob, 1455 path_to_public_key.value(), 1456 &expected_metadata_hash)) { 1457 LOG(ERROR) << "Unable to compute expected hash from metadata signature"; 1458 return ErrorCode::kDownloadMetadataSignatureError; 1459 } 1460 if (calculated_metadata_hash != expected_metadata_hash) { 1461 LOG(ERROR) << "Manifest hash verification failed. Expected hash = "; 1462 utils::HexDumpVector(expected_metadata_hash); 1463 LOG(ERROR) << "Calculated hash = "; 1464 utils::HexDumpVector(calculated_metadata_hash); 1465 return ErrorCode::kDownloadMetadataSignatureMismatch; 1466 } 1467 } else { 1468 if (!PayloadVerifier::VerifySignature(metadata_signature_protobuf_blob, 1469 path_to_public_key.value(), 1470 calculated_metadata_hash)) { 1471 LOG(ERROR) << "Manifest hash verification failed."; 1472 return ErrorCode::kDownloadMetadataSignatureMismatch; 1473 } 1474 } 1475 1476 // The autoupdate_CatchBadSignatures test checks for this string in 1477 // log-files. Keep in sync. 1478 LOG(INFO) << "Metadata hash signature matches value in Omaha response."; 1479 return ErrorCode::kSuccess; 1480} 1481 1482ErrorCode DeltaPerformer::ValidateManifest() { 1483 // Perform assorted checks to sanity check the manifest, make sure it 1484 // matches data from other sources, and that it is a supported version. 1485 1486 bool has_old_fields = 1487 (manifest_.has_old_kernel_info() || manifest_.has_old_rootfs_info()); 1488 for (const PartitionUpdate& partition : manifest_.partitions()) { 1489 has_old_fields = has_old_fields || partition.has_old_partition_info(); 1490 } 1491 1492 // The presence of an old partition hash is the sole indicator for a delta 1493 // update. 1494 InstallPayloadType actual_payload_type = 1495 has_old_fields ? InstallPayloadType::kDelta : InstallPayloadType::kFull; 1496 1497 if (install_plan_->payload_type == InstallPayloadType::kUnknown) { 1498 LOG(INFO) << "Detected a '" 1499 << InstallPayloadTypeToString(actual_payload_type) 1500 << "' payload."; 1501 install_plan_->payload_type = actual_payload_type; 1502 } else if (install_plan_->payload_type != actual_payload_type) { 1503 LOG(ERROR) << "InstallPlan expected a '" 1504 << InstallPayloadTypeToString(install_plan_->payload_type) 1505 << "' payload but the downloaded manifest contains a '" 1506 << InstallPayloadTypeToString(actual_payload_type) 1507 << "' payload."; 1508 return ErrorCode::kPayloadMismatchedType; 1509 } 1510 1511 // Check that the minor version is compatible. 1512 if (actual_payload_type == InstallPayloadType::kFull) { 1513 if (manifest_.minor_version() != kFullPayloadMinorVersion) { 1514 LOG(ERROR) << "Manifest contains minor version " 1515 << manifest_.minor_version() 1516 << ", but all full payloads should have version " 1517 << kFullPayloadMinorVersion << "."; 1518 return ErrorCode::kUnsupportedMinorPayloadVersion; 1519 } 1520 } else { 1521 if (manifest_.minor_version() != supported_minor_version_) { 1522 LOG(ERROR) << "Manifest contains minor version " 1523 << manifest_.minor_version() 1524 << " not the supported " 1525 << supported_minor_version_; 1526 return ErrorCode::kUnsupportedMinorPayloadVersion; 1527 } 1528 } 1529 1530 if (major_payload_version_ != kChromeOSMajorPayloadVersion) { 1531 if (manifest_.has_old_rootfs_info() || 1532 manifest_.has_new_rootfs_info() || 1533 manifest_.has_old_kernel_info() || 1534 manifest_.has_new_kernel_info() || 1535 manifest_.install_operations_size() != 0 || 1536 manifest_.kernel_install_operations_size() != 0) { 1537 LOG(ERROR) << "Manifest contains deprecated field only supported in " 1538 << "major payload version 1, but the payload major version is " 1539 << major_payload_version_; 1540 return ErrorCode::kPayloadMismatchedType; 1541 } 1542 } 1543 1544 // TODO(garnold) we should be adding more and more manifest checks, such as 1545 // partition boundaries etc (see chromium-os:37661). 1546 1547 return ErrorCode::kSuccess; 1548} 1549 1550ErrorCode DeltaPerformer::ValidateOperationHash( 1551 const InstallOperation& operation) { 1552 if (!operation.data_sha256_hash().size()) { 1553 if (!operation.data_length()) { 1554 // Operations that do not have any data blob won't have any operation hash 1555 // either. So, these operations are always considered validated since the 1556 // metadata that contains all the non-data-blob portions of the operation 1557 // has already been validated. This is true for both HTTP and HTTPS cases. 1558 return ErrorCode::kSuccess; 1559 } 1560 1561 // No hash is present for an operation that has data blobs. This shouldn't 1562 // happen normally for any client that has this code, because the 1563 // corresponding update should have been produced with the operation 1564 // hashes. So if it happens it means either we've turned operation hash 1565 // generation off in DeltaDiffGenerator or it's a regression of some sort. 1566 // One caveat though: The last operation is a dummy signature operation 1567 // that doesn't have a hash at the time the manifest is created. So we 1568 // should not complaint about that operation. This operation can be 1569 // recognized by the fact that it's offset is mentioned in the manifest. 1570 if (manifest_.signatures_offset() && 1571 manifest_.signatures_offset() == operation.data_offset()) { 1572 LOG(INFO) << "Skipping hash verification for signature operation " 1573 << next_operation_num_ + 1; 1574 } else { 1575 if (install_plan_->hash_checks_mandatory) { 1576 LOG(ERROR) << "Missing mandatory operation hash for operation " 1577 << next_operation_num_ + 1; 1578 return ErrorCode::kDownloadOperationHashMissingError; 1579 } 1580 1581 LOG(WARNING) << "Cannot validate operation " << next_operation_num_ + 1 1582 << " as there's no operation hash in manifest"; 1583 } 1584 return ErrorCode::kSuccess; 1585 } 1586 1587 brillo::Blob expected_op_hash; 1588 expected_op_hash.assign(operation.data_sha256_hash().data(), 1589 (operation.data_sha256_hash().data() + 1590 operation.data_sha256_hash().size())); 1591 1592 HashCalculator operation_hasher; 1593 operation_hasher.Update(buffer_.data(), operation.data_length()); 1594 if (!operation_hasher.Finalize()) { 1595 LOG(ERROR) << "Unable to compute actual hash of operation " 1596 << next_operation_num_; 1597 return ErrorCode::kDownloadOperationHashVerificationError; 1598 } 1599 1600 brillo::Blob calculated_op_hash = operation_hasher.raw_hash(); 1601 if (calculated_op_hash != expected_op_hash) { 1602 LOG(ERROR) << "Hash verification failed for operation " 1603 << next_operation_num_ << ". Expected hash = "; 1604 utils::HexDumpVector(expected_op_hash); 1605 LOG(ERROR) << "Calculated hash over " << operation.data_length() 1606 << " bytes at offset: " << operation.data_offset() << " = "; 1607 utils::HexDumpVector(calculated_op_hash); 1608 return ErrorCode::kDownloadOperationHashMismatch; 1609 } 1610 1611 return ErrorCode::kSuccess; 1612} 1613 1614#define TEST_AND_RETURN_VAL(_retval, _condition) \ 1615 do { \ 1616 if (!(_condition)) { \ 1617 LOG(ERROR) << "VerifyPayload failure: " << #_condition; \ 1618 return _retval; \ 1619 } \ 1620 } while (0); 1621 1622ErrorCode DeltaPerformer::VerifyPayload( 1623 const string& update_check_response_hash, 1624 const uint64_t update_check_response_size) { 1625 1626 // See if we should use the public RSA key in the Omaha response. 1627 base::FilePath path_to_public_key(public_key_path_); 1628 base::FilePath tmp_key; 1629 if (GetPublicKeyFromResponse(&tmp_key)) 1630 path_to_public_key = tmp_key; 1631 ScopedPathUnlinker tmp_key_remover(tmp_key.value()); 1632 if (tmp_key.empty()) 1633 tmp_key_remover.set_should_remove(false); 1634 1635 LOG(INFO) << "Verifying payload using public key: " 1636 << path_to_public_key.value(); 1637 1638 // Verifies the download size. 1639 TEST_AND_RETURN_VAL(ErrorCode::kPayloadSizeMismatchError, 1640 update_check_response_size == 1641 metadata_size_ + metadata_signature_size_ + 1642 buffer_offset_); 1643 1644 // Verifies the payload hash. 1645 const string& payload_hash_data = payload_hash_calculator_.hash(); 1646 TEST_AND_RETURN_VAL(ErrorCode::kDownloadPayloadVerificationError, 1647 !payload_hash_data.empty()); 1648 TEST_AND_RETURN_VAL(ErrorCode::kPayloadHashMismatchError, 1649 payload_hash_data == update_check_response_hash); 1650 1651 // Verifies the signed payload hash. 1652 if (!utils::FileExists(path_to_public_key.value().c_str())) { 1653 LOG(WARNING) << "Not verifying signed delta payload -- missing public key."; 1654 return ErrorCode::kSuccess; 1655 } 1656 TEST_AND_RETURN_VAL(ErrorCode::kSignedDeltaPayloadExpectedError, 1657 !signatures_message_data_.empty()); 1658 brillo::Blob hash_data = signed_hash_calculator_.raw_hash(); 1659 TEST_AND_RETURN_VAL(ErrorCode::kDownloadPayloadPubKeyVerificationError, 1660 PayloadVerifier::PadRSA2048SHA256Hash(&hash_data)); 1661 TEST_AND_RETURN_VAL(ErrorCode::kDownloadPayloadPubKeyVerificationError, 1662 !hash_data.empty()); 1663 1664 if (!PayloadVerifier::VerifySignature( 1665 signatures_message_data_, path_to_public_key.value(), hash_data)) { 1666 // The autoupdate_CatchBadSignatures test checks for this string 1667 // in log-files. Keep in sync. 1668 LOG(ERROR) << "Public key verification failed, thus update failed."; 1669 return ErrorCode::kDownloadPayloadPubKeyVerificationError; 1670 } 1671 1672 LOG(INFO) << "Payload hash matches value in payload."; 1673 1674 // At this point, we are guaranteed to have downloaded a full payload, i.e 1675 // the one whose size matches the size mentioned in Omaha response. If any 1676 // errors happen after this, it's likely a problem with the payload itself or 1677 // the state of the system and not a problem with the URL or network. So, 1678 // indicate that to the download delegate so that AU can backoff 1679 // appropriately. 1680 if (download_delegate_) 1681 download_delegate_->DownloadComplete(); 1682 1683 return ErrorCode::kSuccess; 1684} 1685 1686void DeltaPerformer::DiscardBuffer(bool do_advance_offset, 1687 size_t signed_hash_buffer_size) { 1688 // Update the buffer offset. 1689 if (do_advance_offset) 1690 buffer_offset_ += buffer_.size(); 1691 1692 // Hash the content. 1693 payload_hash_calculator_.Update(buffer_.data(), buffer_.size()); 1694 signed_hash_calculator_.Update(buffer_.data(), signed_hash_buffer_size); 1695 1696 // Swap content with an empty vector to ensure that all memory is released. 1697 brillo::Blob().swap(buffer_); 1698} 1699 1700bool DeltaPerformer::CanResumeUpdate(PrefsInterface* prefs, 1701 string update_check_response_hash) { 1702 int64_t next_operation = kUpdateStateOperationInvalid; 1703 if (!(prefs->GetInt64(kPrefsUpdateStateNextOperation, &next_operation) && 1704 next_operation != kUpdateStateOperationInvalid && 1705 next_operation > 0)) 1706 return false; 1707 1708 string interrupted_hash; 1709 if (!(prefs->GetString(kPrefsUpdateCheckResponseHash, &interrupted_hash) && 1710 !interrupted_hash.empty() && 1711 interrupted_hash == update_check_response_hash)) 1712 return false; 1713 1714 int64_t resumed_update_failures; 1715 // Note that storing this value is optional, but if it is there it should not 1716 // be more than the limit. 1717 if (prefs->GetInt64(kPrefsResumedUpdateFailures, &resumed_update_failures) && 1718 resumed_update_failures > kMaxResumedUpdateFailures) 1719 return false; 1720 1721 // Sanity check the rest. 1722 int64_t next_data_offset = -1; 1723 if (!(prefs->GetInt64(kPrefsUpdateStateNextDataOffset, &next_data_offset) && 1724 next_data_offset >= 0)) 1725 return false; 1726 1727 string sha256_context; 1728 if (!(prefs->GetString(kPrefsUpdateStateSHA256Context, &sha256_context) && 1729 !sha256_context.empty())) 1730 return false; 1731 1732 int64_t manifest_metadata_size = 0; 1733 if (!(prefs->GetInt64(kPrefsManifestMetadataSize, &manifest_metadata_size) && 1734 manifest_metadata_size > 0)) 1735 return false; 1736 1737 int64_t manifest_signature_size = 0; 1738 if (!(prefs->GetInt64(kPrefsManifestSignatureSize, 1739 &manifest_signature_size) && 1740 manifest_signature_size >= 0)) 1741 return false; 1742 1743 return true; 1744} 1745 1746bool DeltaPerformer::ResetUpdateProgress(PrefsInterface* prefs, bool quick) { 1747 TEST_AND_RETURN_FALSE(prefs->SetInt64(kPrefsUpdateStateNextOperation, 1748 kUpdateStateOperationInvalid)); 1749 if (!quick) { 1750 prefs->SetString(kPrefsUpdateCheckResponseHash, ""); 1751 prefs->SetInt64(kPrefsUpdateStateNextDataOffset, -1); 1752 prefs->SetInt64(kPrefsUpdateStateNextDataLength, 0); 1753 prefs->SetString(kPrefsUpdateStateSHA256Context, ""); 1754 prefs->SetString(kPrefsUpdateStateSignedSHA256Context, ""); 1755 prefs->SetString(kPrefsUpdateStateSignatureBlob, ""); 1756 prefs->SetInt64(kPrefsManifestMetadataSize, -1); 1757 prefs->SetInt64(kPrefsManifestSignatureSize, -1); 1758 prefs->SetInt64(kPrefsResumedUpdateFailures, 0); 1759 } 1760 return true; 1761} 1762 1763bool DeltaPerformer::CheckpointUpdateProgress() { 1764 Terminator::set_exit_blocked(true); 1765 if (last_updated_buffer_offset_ != buffer_offset_) { 1766 // Resets the progress in case we die in the middle of the state update. 1767 ResetUpdateProgress(prefs_, true); 1768 TEST_AND_RETURN_FALSE( 1769 prefs_->SetString(kPrefsUpdateStateSHA256Context, 1770 payload_hash_calculator_.GetContext())); 1771 TEST_AND_RETURN_FALSE( 1772 prefs_->SetString(kPrefsUpdateStateSignedSHA256Context, 1773 signed_hash_calculator_.GetContext())); 1774 TEST_AND_RETURN_FALSE(prefs_->SetInt64(kPrefsUpdateStateNextDataOffset, 1775 buffer_offset_)); 1776 last_updated_buffer_offset_ = buffer_offset_; 1777 1778 if (next_operation_num_ < num_total_operations_) { 1779 size_t partition_index = current_partition_; 1780 while (next_operation_num_ >= acc_num_operations_[partition_index]) 1781 partition_index++; 1782 const size_t partition_operation_num = next_operation_num_ - ( 1783 partition_index ? acc_num_operations_[partition_index - 1] : 0); 1784 const InstallOperation& op = 1785 partitions_[partition_index].operations(partition_operation_num); 1786 TEST_AND_RETURN_FALSE(prefs_->SetInt64(kPrefsUpdateStateNextDataLength, 1787 op.data_length())); 1788 } else { 1789 TEST_AND_RETURN_FALSE(prefs_->SetInt64(kPrefsUpdateStateNextDataLength, 1790 0)); 1791 } 1792 } 1793 TEST_AND_RETURN_FALSE(prefs_->SetInt64(kPrefsUpdateStateNextOperation, 1794 next_operation_num_)); 1795 return true; 1796} 1797 1798bool DeltaPerformer::PrimeUpdateState() { 1799 CHECK(manifest_valid_); 1800 block_size_ = manifest_.block_size(); 1801 1802 int64_t next_operation = kUpdateStateOperationInvalid; 1803 if (!prefs_->GetInt64(kPrefsUpdateStateNextOperation, &next_operation) || 1804 next_operation == kUpdateStateOperationInvalid || 1805 next_operation <= 0) { 1806 // Initiating a new update, no more state needs to be initialized. 1807 return true; 1808 } 1809 next_operation_num_ = next_operation; 1810 1811 // Resuming an update -- load the rest of the update state. 1812 int64_t next_data_offset = -1; 1813 TEST_AND_RETURN_FALSE(prefs_->GetInt64(kPrefsUpdateStateNextDataOffset, 1814 &next_data_offset) && 1815 next_data_offset >= 0); 1816 buffer_offset_ = next_data_offset; 1817 1818 // The signed hash context and the signature blob may be empty if the 1819 // interrupted update didn't reach the signature. 1820 string signed_hash_context; 1821 if (prefs_->GetString(kPrefsUpdateStateSignedSHA256Context, 1822 &signed_hash_context)) { 1823 TEST_AND_RETURN_FALSE( 1824 signed_hash_calculator_.SetContext(signed_hash_context)); 1825 } 1826 1827 string signature_blob; 1828 if (prefs_->GetString(kPrefsUpdateStateSignatureBlob, &signature_blob)) { 1829 signatures_message_data_.assign(signature_blob.begin(), 1830 signature_blob.end()); 1831 } 1832 1833 string hash_context; 1834 TEST_AND_RETURN_FALSE(prefs_->GetString(kPrefsUpdateStateSHA256Context, 1835 &hash_context) && 1836 payload_hash_calculator_.SetContext(hash_context)); 1837 1838 int64_t manifest_metadata_size = 0; 1839 TEST_AND_RETURN_FALSE(prefs_->GetInt64(kPrefsManifestMetadataSize, 1840 &manifest_metadata_size) && 1841 manifest_metadata_size > 0); 1842 metadata_size_ = manifest_metadata_size; 1843 1844 int64_t manifest_signature_size = 0; 1845 TEST_AND_RETURN_FALSE( 1846 prefs_->GetInt64(kPrefsManifestSignatureSize, &manifest_signature_size) && 1847 manifest_signature_size >= 0); 1848 metadata_signature_size_ = manifest_signature_size; 1849 1850 // Advance the download progress to reflect what doesn't need to be 1851 // re-downloaded. 1852 total_bytes_received_ += buffer_offset_; 1853 1854 // Speculatively count the resume as a failure. 1855 int64_t resumed_update_failures; 1856 if (prefs_->GetInt64(kPrefsResumedUpdateFailures, &resumed_update_failures)) { 1857 resumed_update_failures++; 1858 } else { 1859 resumed_update_failures = 1; 1860 } 1861 prefs_->SetInt64(kPrefsResumedUpdateFailures, resumed_update_failures); 1862 return true; 1863} 1864 1865} // namespace chromeos_update_engine 1866