17197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao/* 27197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * Copyright (C) 2015 The Android Open Source Project 37197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * 47197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * Licensed under the Apache License, Version 2.0 (the "License"); 57197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * you may not use this file except in compliance with the License. 67197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * You may obtain a copy of the License at 77197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * 87197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * http://www.apache.org/licenses/LICENSE-2.0 97197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * 107197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * Unless required by applicable law or agreed to in writing, software 117197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * distributed under the License is distributed on an "AS IS" BASIS, 127197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 137197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * See the License for the specific language governing permissions and 147197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * limitations under the License. 157197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao */ 167197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 177197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao/* 187197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * This program verifies the integrity of the partitions after an A/B OTA 197197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * update. It gets invoked by init, and will only perform the verification if 207197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * it's the first boot post an A/B OTA update. 217197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * 223958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * Update_verifier relies on dm-verity to capture any corruption on the partitions 233958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * being verified. And its behavior varies depending on the dm-verity mode. 243958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * Upon detection of failures: 253958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * enforcing mode: dm-verity reboots the device 263958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * eio mode: dm-verity fails the read and update_verifier reboots the device 273958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * other mode: not supported and update_verifier reboots the device 283958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * 293958a95f54f3039da80394911f64e5a4857f219dTianjie Xu * After a predefined number of failing boot attempts, the bootloader should 30d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu * mark the slot as unbootable and stops trying. Other dm-verity modes ( 31d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu * for example, veritymode=EIO) are not accepted and simply lead to a 32d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu * verification failure. 337197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * 347197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * The current slot will be marked as having booted successfully if the 357197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao * verifier reaches the end after the verification. 367197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao */ 377197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 3883b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Bao#include "update_verifier/update_verifier.h" 3983b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Bao 40b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu#include <dirent.h> 41d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <errno.h> 42d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <fcntl.h> 43d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <stdio.h> 447197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao#include <string.h> 453958a95f54f3039da80394911f64e5a4857f219dTianjie Xu#include <unistd.h> 467197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 478fa8f0b16c0dc03c2d841405dfb02a707c08d5b0Tianjie Xu#include <algorithm> 485226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang#include <future> 49d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <string> 50d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <vector> 51d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 52d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <android-base/file.h> 537b0ad9c638176dc364dabb65b363536055a0ea9cTianjie Xu#include <android-base/logging.h> 54d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <android-base/parseint.h> 554f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao#include <android-base/properties.h> 56d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <android-base/strings.h> 57d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu#include <android-base/unique_fd.h> 58ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien#include <android/hardware/boot/1.0/IBootControl.h> 593958a95f54f3039da80394911f64e5a4857f219dTianjie Xu#include <cutils/android_reboot.h> 60ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien 61160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao#include "otautil/rangeset.h" 62160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao 63ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brienusing android::sp; 64ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brienusing android::hardware::boot::V1_0::IBootControl; 65ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brienusing android::hardware::boot::V1_0::BoolResult; 66ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brienusing android::hardware::boot::V1_0::CommandResult; 677197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 68b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu// Find directories in format of "/sys/block/dm-X". 69b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xustatic int dm_name_filter(const dirent* de) { 70b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu if (android::base::StartsWith(de->d_name, "dm-")) { 71b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu return 1; 72b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 73b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu return 0; 74b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu} 75b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu 763958a95f54f3039da80394911f64e5a4857f219dTianjie Xustatic bool read_blocks(const std::string& partition, const std::string& range_str) { 77454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao if (partition != "system" && partition != "vendor" && partition != "product") { 78454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao LOG(ERROR) << "Invalid partition name \"" << partition << "\""; 795a176c0d3c9a1d02046513da83076b8601fb691aTianjie Xu return false; 805a176c0d3c9a1d02046513da83076b8601fb691aTianjie Xu } 81454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // Iterate the content of "/sys/block/dm-X/dm/name". If it matches one of "system", "vendor" or 82454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // "product", then dm-X is a dm-wrapped device for that target. We will later read all the 83454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // ("cared") blocks from "/dev/block/dm-X" to ensure the target partition's integrity. 8483b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Bao static constexpr auto DM_PATH_PREFIX = "/sys/block/"; 85b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu dirent** namelist; 86b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort); 87b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu if (n == -1) { 88b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX; 89b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu return false; 90b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 91b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu if (n == 0) { 92b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu LOG(ERROR) << "dm block device not found for " << partition; 93b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu return false; 94b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 95b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu 9683b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Bao static constexpr auto DM_PATH_SUFFIX = "/dm/name"; 9783b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Bao static constexpr auto DEV_PATH = "/dev/block/"; 98b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu std::string dm_block_device; 99b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu while (n--) { 100b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX; 101b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu std::string content; 102b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu if (!android::base::ReadFileToString(path, &content)) { 103b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu PLOG(WARNING) << "Failed to read " << path; 1048ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen } else { 1058ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen std::string dm_block_name = android::base::Trim(content); 1068ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen#ifdef BOARD_AVB_ENABLE 1078ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen // AVB is using 'vroot' for the root block device but we're expecting 'system'. 1088ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen if (dm_block_name == "vroot") { 1098ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen dm_block_name = "system"; 1108ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen } 1118ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen#endif 1128ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen if (dm_block_name == partition) { 1138ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen dm_block_device = DEV_PATH + std::string(namelist[n]->d_name); 1148ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen while (n--) { 1158ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen free(namelist[n]); 1168ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen } 1178ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen break; 118b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 119b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 120b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu free(namelist[n]); 121b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 122b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu free(namelist); 123b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu 124b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu if (dm_block_device.empty()) { 125b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu LOG(ERROR) << "Failed to find dm block device for " << partition; 126b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu return false; 127b0ac872014830b08fd5935ef924d4b412afbeafcTianjie Xu } 128d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 1294f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao // For block range string, first integer 'count' equals 2 * total number of valid ranges, 1304f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao // followed by 'count' number comma separated integers. Every two integers reprensent a 1314f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao // block range with the first number included in range but second number not included. 1324f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150). 133160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao RangeSet ranges = RangeSet::Parse(range_str); 134160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao if (!ranges) { 135160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao LOG(ERROR) << "Error parsing RangeSet string " << range_str; 1364f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao return false; 1374f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao } 138d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 139160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for 140160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao // the last group). 1415226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang size_t thread_num = std::thread::hardware_concurrency() ?: 4; 142160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao std::vector<RangeSet> groups = ranges.Split(thread_num); 1435226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang 144160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao std::vector<std::future<bool>> threads; 145160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao for (const auto& group : groups) { 146160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao auto thread_func = [&group, &dm_block_device, &partition]() { 1475226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY))); 1485226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang if (fd.get() == -1) { 1495226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition; 1505226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang return false; 1515226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang } 152d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 153160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao static constexpr size_t kBlockSize = 4096; 154160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao std::vector<uint8_t> buf(1024 * kBlockSize); 155d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 156160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao size_t block_count = 0; 157160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao for (const auto& range : group) { 158160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao size_t range_start = range.first; 159160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao size_t range_end = range.second; 1605226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) { 1615226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang PLOG(ERROR) << "lseek to " << range_start << " failed"; 1625226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang return false; 1635226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang } 1645226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang 1655226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang size_t remain = (range_end - range_start) * kBlockSize; 1665226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang while (remain > 0) { 1675226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang size_t to_read = std::min(remain, 1024 * kBlockSize); 1685226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang if (!android::base::ReadFully(fd.get(), buf.data(), to_read)) { 1695226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang PLOG(ERROR) << "Failed to read blocks " << range_start << " to " << range_end; 1705226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang return false; 1715226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang } 1725226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang remain -= to_read; 1735226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang } 174160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao block_count += (range_end - range_start); 1758fa8f0b16c0dc03c2d841405dfb02a707c08d5b0Tianjie Xu } 176160514bf2bac2ad8b1af6cb5a72d88439596ada1Tao Bao LOG(INFO) << "Finished reading " << block_count << " blocks on " << dm_block_device; 1775226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang return true; 1785226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang }; 1795226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang 1805226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang threads.emplace_back(std::async(std::launch::async, thread_func)); 1814f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao } 182d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 1835226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang bool ret = true; 1845226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang for (auto& t : threads) { 1855226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang ret = t.get() && ret; 1865226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang } 1875226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang LOG(INFO) << "Finished reading blocks on " << dm_block_device << " with " << thread_num 1885226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang << " threads."; 1895226f4715d6c961311249552f7e41d68ae2e80e6Wei Wang return ret; 190d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu} 191d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 1925a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// Returns true to indicate a passing verification (or the error should be ignored); Otherwise 1935a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// returns false on fatal errors, where we should reject the current boot and trigger a fallback. 1945a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// Note that update_verifier should be backward compatible to not reject care_map.txt from old 1955a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// releases, which could otherwise fail to boot into the new release. For example, we've changed 1965a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// the care_map format between N and O. An O update_verifier would fail to work with N 1975a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// care_map.txt. This could be a result of sideloading an O OTA while the device having a pending N 1985a1dee01df3af346729b5791606b72d59b8e9815Tao Bao// update. 19983b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Baobool verify_image(const std::string& care_map_name) { 2005a1dee01df3af346729b5791606b72d59b8e9815Tao Bao android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY))); 2015a1dee01df3af346729b5791606b72d59b8e9815Tao Bao // If the device is flashed before the current boot, it may not have care_map.txt 2025a1dee01df3af346729b5791606b72d59b8e9815Tao Bao // in /data/ota_package. To allow the device to continue booting in this situation, 2035a1dee01df3af346729b5791606b72d59b8e9815Tao Bao // we should print a warning and skip the block verification. 2045a1dee01df3af346729b5791606b72d59b8e9815Tao Bao if (care_map_fd.get() == -1) { 2055a1dee01df3af346729b5791606b72d59b8e9815Tao Bao PLOG(WARNING) << "Failed to open " << care_map_name; 2065a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return true; 2075a1dee01df3af346729b5791606b72d59b8e9815Tao Bao } 208454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // care_map file has up to six lines, where every two lines make a pair. Within each pair, the 209454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // first line has the partition name (e.g. "system"), while the second line holds the ranges of 210454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao // all the blocks to verify. 2115a1dee01df3af346729b5791606b72d59b8e9815Tao Bao std::string file_content; 2125a1dee01df3af346729b5791606b72d59b8e9815Tao Bao if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) { 2135a1dee01df3af346729b5791606b72d59b8e9815Tao Bao LOG(ERROR) << "Error reading care map contents to string."; 2145a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return false; 2155a1dee01df3af346729b5791606b72d59b8e9815Tao Bao } 216d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 2175a1dee01df3af346729b5791606b72d59b8e9815Tao Bao std::vector<std::string> lines; 2185a1dee01df3af346729b5791606b72d59b8e9815Tao Bao lines = android::base::Split(android::base::Trim(file_content), "\n"); 219454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) { 2205a1dee01df3af346729b5791606b72d59b8e9815Tao Bao LOG(ERROR) << "Invalid lines in care_map: found " << lines.size() 221454d8cb805e633aaa1c6456a57ec9c2dc6c6e163Tao Bao << " lines, expecting 2 or 4 or 6 lines."; 2225a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return false; 2235a1dee01df3af346729b5791606b72d59b8e9815Tao Bao } 224d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 2255a1dee01df3af346729b5791606b72d59b8e9815Tao Bao for (size_t i = 0; i < lines.size(); i += 2) { 2265a1dee01df3af346729b5791606b72d59b8e9815Tao Bao // We're seeing an N care_map.txt. Skip the verification since it's not compatible with O 2275a1dee01df3af346729b5791606b72d59b8e9815Tao Bao // update_verifier (the last few metadata blocks can't be read via device mapper). 2285a1dee01df3af346729b5791606b72d59b8e9815Tao Bao if (android::base::StartsWith(lines[i], "/dev/block/")) { 2295a1dee01df3af346729b5791606b72d59b8e9815Tao Bao LOG(WARNING) << "Found legacy care_map.txt; skipped."; 2305a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return true; 2315a1dee01df3af346729b5791606b72d59b8e9815Tao Bao } 2325a1dee01df3af346729b5791606b72d59b8e9815Tao Bao if (!read_blocks(lines[i], lines[i+1])) { 2335a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return false; 234d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu } 2355a1dee01df3af346729b5791606b72d59b8e9815Tao Bao } 236d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 2375a1dee01df3af346729b5791606b72d59b8e9815Tao Bao return true; 238d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu} 239d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu 2403958a95f54f3039da80394911f64e5a4857f219dTianjie Xustatic int reboot_device() { 2413958a95f54f3039da80394911f64e5a4857f219dTianjie Xu if (android_reboot(ANDROID_RB_RESTART2, 0, nullptr) == -1) { 2423958a95f54f3039da80394911f64e5a4857f219dTianjie Xu LOG(ERROR) << "Failed to reboot."; 2433958a95f54f3039da80394911f64e5a4857f219dTianjie Xu return -1; 2443958a95f54f3039da80394911f64e5a4857f219dTianjie Xu } 2453958a95f54f3039da80394911f64e5a4857f219dTianjie Xu while (true) pause(); 2463958a95f54f3039da80394911f64e5a4857f219dTianjie Xu} 2473958a95f54f3039da80394911f64e5a4857f219dTianjie Xu 24883b0780dddcaddd661ac48f277f51f7cb6ac13f6Tao Baoint update_verifier(int argc, char** argv) { 2497197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao for (int i = 1; i < argc; i++) { 2507b0ad9c638176dc364dabb65b363536055a0ea9cTianjie Xu LOG(INFO) << "Started with arg " << i << ": " << argv[i]; 2517197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao } 2527197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 2530157c786740df494123cb49b3a8f00044dcfebbbChris Phoenix sp<IBootControl> module = IBootControl::getService(); 254ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien if (module == nullptr) { 2557b0ad9c638176dc364dabb65b363536055a0ea9cTianjie Xu LOG(ERROR) << "Error getting bootctrl module."; 2563958a95f54f3039da80394911f64e5a4857f219dTianjie Xu return reboot_device(); 2577197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao } 2587197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 259ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien uint32_t current_slot = module->getCurrentSlot(); 260ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien BoolResult is_successful = module->isSlotMarkedSuccessful(current_slot); 261ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien LOG(INFO) << "Booting slot " << current_slot << ": isSlotMarkedSuccessful=" 262ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien << static_cast<int32_t>(is_successful); 2637197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 264ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien if (is_successful == BoolResult::FALSE) { 2657197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao // The current slot has not booted successfully. 266db57f0d7f427538b177ef82dde385e4207e35067Tao Bao 2678ed9738b62b075205a81489b01ec882520da183aDavid Zeuthen#if defined(PRODUCT_SUPPORTS_VERITY) || defined(BOARD_AVB_ENABLE) 2681a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen bool skip_verification = false; 2694f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", ""); 2704f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao if (verity_mode.empty()) { 2711a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen // With AVB it's possible to disable verification entirely and 2721a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen // in this case ro.boot.veritymode is empty. 2731a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen#if defined(BOARD_AVB_ENABLE) 2741a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen LOG(WARNING) << "verification has been disabled; marking without verification."; 2751a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen skip_verification = true; 2761a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen#else 277d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu LOG(ERROR) << "Failed to get dm-verity mode."; 2783958a95f54f3039da80394911f64e5a4857f219dTianjie Xu return reboot_device(); 2791a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen#endif 2804f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao } else if (android::base::EqualsIgnoreCase(verity_mode, "eio")) { 2813958a95f54f3039da80394911f64e5a4857f219dTianjie Xu // We shouldn't see verity in EIO mode if the current slot hasn't booted successfully before. 2823958a95f54f3039da80394911f64e5a4857f219dTianjie Xu // Continue the verification until we fail to read some blocks. 2833958a95f54f3039da80394911f64e5a4857f219dTianjie Xu LOG(WARNING) << "Found dm-verity in EIO mode."; 2841a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen } else if (android::base::EqualsIgnoreCase(verity_mode, "disabled")) { 2851a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen LOG(WARNING) << "dm-verity in disabled mode; marking without verification."; 2861a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen skip_verification = true; 2874f8d21797117ed76e6f02b04db6aa9e819dd0da1Tao Bao } else if (verity_mode != "enforcing") { 288d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu LOG(ERROR) << "Unexpected dm-verity mode : " << verity_mode << ", expecting enforcing."; 2893958a95f54f3039da80394911f64e5a4857f219dTianjie Xu return reboot_device(); 2903958a95f54f3039da80394911f64e5a4857f219dTianjie Xu } 2913958a95f54f3039da80394911f64e5a4857f219dTianjie Xu 2921a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen if (!skip_verification) { 2931a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt"; 2941a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen if (!verify_image(CARE_MAP_FILE)) { 2951a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen LOG(ERROR) << "Failed to verify all blocks in care map file."; 2961a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen return reboot_device(); 2971a0929cc8aac532dba00b3c98cea22715719a421David Zeuthen } 298d007cf2da29f05eee002dd33e6c04262f709b274Tianjie Xu } 299db57f0d7f427538b177ef82dde385e4207e35067Tao Bao#else 300db57f0d7f427538b177ef82dde385e4207e35067Tao Bao LOG(WARNING) << "dm-verity not enabled; marking without verification."; 301db57f0d7f427538b177ef82dde385e4207e35067Tao Bao#endif 3027197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 303ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien CommandResult cr; 304ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien module->markBootSuccessful([&cr](CommandResult result) { cr = result; }); 305ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien if (!cr.success) { 306ad43d2dd30c5f2d9b5749e944377f43f6ff07488Connor O'Brien LOG(ERROR) << "Error marking booted successfully: " << cr.errMsg; 3073958a95f54f3039da80394911f64e5a4857f219dTianjie Xu return reboot_device(); 3087197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao } 3097b0ad9c638176dc364dabb65b363536055a0ea9cTianjie Xu LOG(INFO) << "Marked slot " << current_slot << " as booted successfully."; 3107197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao } 3117197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao 3127b0ad9c638176dc364dabb65b363536055a0ea9cTianjie Xu LOG(INFO) << "Leaving update_verifier."; 3137197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao return 0; 3147197ee0e39bebea3a1bbe5d980f4dbf1cfe58136Tao Bao} 315