diff --git a/tests/component/update_verifier_test.cpp b/tests/component/update_verifier_test.cpp index a9707163..543e4278 100644 --- a/tests/component/update_verifier_test.cpp +++ b/tests/component/update_verifier_test.cpp @@ -29,19 +29,29 @@ #include "care_map.pb.h" +using namespace std::string_literals; + class UpdateVerifierTest : public ::testing::Test { protected: void SetUp() override { std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", ""); verity_supported = android::base::EqualsIgnoreCase(verity_mode, "enforcing"); + + care_map_pb_ = care_map_dir_.path + "/care_map.pb"s; + care_map_txt_ = care_map_dir_.path + "/care_map.txt"s; + } + + void TearDown() override { + unlink(care_map_pb_.c_str()); + unlink(care_map_txt_.c_str()); } // Returns a serialized string of the proto3 message according to the given partition info. std::string ConstructProto( std::vector>& partitions) { - UpdateVerifier::CareMap result; + recovery_update_verifier::CareMap result; for (const auto& partition : partitions) { - UpdateVerifier::CareMap::PartitionInfo info; + recovery_update_verifier::CareMap::PartitionInfo info; if (partition.find("name") != partition.end()) { info.set_name(partition.at("name")); } @@ -59,12 +69,16 @@ class UpdateVerifierTest : public ::testing::Test { } bool verity_supported; - TemporaryFile care_map_file; + UpdateVerifier verifier_; + + TemporaryDir care_map_dir_; + std::string care_map_pb_; + std::string care_map_txt_; }; TEST_F(UpdateVerifierTest, verify_image_no_care_map) { // Non-existing care_map is allowed. - ASSERT_TRUE(verify_image("/doesntexist")); + ASSERT_FALSE(verifier_.ParseCareMap("/doesntexist")); } TEST_F(UpdateVerifierTest, verify_image_smoke) { @@ -75,25 +89,27 @@ TEST_F(UpdateVerifierTest, verify_image_smoke) { } std::string content = "system\n2,0,1"; - ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path)); - ASSERT_TRUE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_)); + ASSERT_TRUE(verifier_.ParseCareMap(care_map_txt_)); + ASSERT_TRUE(verifier_.VerifyPartitions()); // Leading and trailing newlines should be accepted. - ASSERT_TRUE(android::base::WriteStringToFile("\n" + content + "\n\n", care_map_file.path)); - ASSERT_TRUE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile("\n" + content + "\n\n", care_map_txt_)); + ASSERT_TRUE(verifier_.ParseCareMap(care_map_txt_)); + ASSERT_TRUE(verifier_.VerifyPartitions()); } TEST_F(UpdateVerifierTest, verify_image_empty_care_map) { - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_)); } TEST_F(UpdateVerifierTest, verify_image_wrong_lines) { // The care map file can have only 2 / 4 / 6 lines. - ASSERT_TRUE(android::base::WriteStringToFile("line1", care_map_file.path)); - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile("line1", care_map_txt_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_)); - ASSERT_TRUE(android::base::WriteStringToFile("line1\nline2\nline3", care_map_file.path)); - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile("line1\nline2\nline3", care_map_txt_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_)); } TEST_F(UpdateVerifierTest, verify_image_malformed_care_map) { @@ -104,8 +120,8 @@ TEST_F(UpdateVerifierTest, verify_image_malformed_care_map) { } std::string content = "system\n2,1,0"; - ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path)); - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_)); } TEST_F(UpdateVerifierTest, verify_image_legacy_care_map) { @@ -116,8 +132,8 @@ TEST_F(UpdateVerifierTest, verify_image_legacy_care_map) { } std::string content = "/dev/block/bootdevice/by-name/system\n2,1,0"; - ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path)); - ASSERT_TRUE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_)); } TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_smoke) { @@ -132,8 +148,9 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_smoke) { }; std::string proto = ConstructProto(partitions); - ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path)); - ASSERT_TRUE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_)); + ASSERT_TRUE(verifier_.ParseCareMap(care_map_pb_)); + ASSERT_TRUE(verifier_.VerifyPartitions()); } TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_missing_name) { @@ -148,8 +165,8 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_missing_name) { }; std::string proto = ConstructProto(partitions); - ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path)); - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_pb_)); } TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_bad_ranges) { @@ -164,6 +181,6 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_bad_ranges) { }; std::string proto = ConstructProto(partitions); - ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path)); - ASSERT_FALSE(verify_image(care_map_file.path)); + ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_)); + ASSERT_FALSE(verifier_.ParseCareMap(care_map_pb_)); } diff --git a/update_verifier/Android.bp b/update_verifier/Android.bp index 7a860a14..1b84619a 100644 --- a/update_verifier/Android.bp +++ b/update_verifier/Android.bp @@ -15,9 +15,8 @@ cc_defaults { name: "update_verifier_defaults", - cflags: [ - "-Wall", - "-Werror", + defaults: [ + "recovery_defaults", ], local_include_dirs: [ diff --git a/update_verifier/care_map.proto b/update_verifier/care_map.proto index 442ddd4a..15d3afa8 100644 --- a/update_verifier/care_map.proto +++ b/update_verifier/care_map.proto @@ -16,7 +16,7 @@ syntax = "proto3"; -package UpdateVerifier; +package recovery_update_verifier; option optimize_for = LITE_RUNTIME; message CareMap { diff --git a/update_verifier/include/update_verifier/update_verifier.h b/update_verifier/include/update_verifier/update_verifier.h index 534384e1..bdfabed0 100644 --- a/update_verifier/include/update_verifier/update_verifier.h +++ b/update_verifier/include/update_verifier/update_verifier.h @@ -16,17 +16,45 @@ #pragma once +#include #include +#include -int update_verifier(int argc, char** argv); +#include "otautil/rangeset.h" + +// The update verifier performs verification upon the first boot to a new slot on A/B devices. +// During the verification, it reads all the blocks in the care_map. And if a failure happens, +// it rejects the current boot and triggers a fallback. -// Returns true to indicate a passing verification (or the error should be ignored); Otherwise -// returns false on fatal errors, where we should reject the current boot and trigger a fallback. -// This function tries to process the care_map.txt as protobuf message; and falls back to use the -// plain text format if the parse failed. -// // Note that update_verifier should be backward compatible to not reject care_map.txt from old // releases, which could otherwise fail to boot into the new release. For example, we've changed // the care_map format between N and O. An O update_verifier would fail to work with N care_map.txt. // This could be a result of sideloading an O OTA while the device having a pending N update. -bool verify_image(const std::string& care_map_name); +int update_verifier(int argc, char** argv); + +// The UpdateVerifier parses the content in the care map, and continues to verify the +// partitions by reading the cared blocks if there's no format error in the file. Otherwise, +// it should skip the verification to avoid bricking the device. +class UpdateVerifier { + public: + // This function tries to process the care_map.pb as protobuf message; and falls back to use + // care_map.txt if the pb format file doesn't exist. If the parsing succeeds, put the result of + // the pair into the |partition_map_|. + bool ParseCareMap(const std::string& file_name = ""); + + // Verifies the new boot by reading all the cared blocks for partitions in |partition_map_|. + bool VerifyPartitions(); + + private: + // Parses the legacy care_map.txt in plain text format. + bool ParseCareMapPlainText(const std::string& content); + + // Finds all the dm-enabled partitions, and returns a map of . + std::map FindDmPartitions(); + + // Returns true if we successfully read the blocks in |ranges| of the |dm_block_device|. + bool ReadBlocks(const std::string partition_name, const std::string& dm_block_device, + const RangeSet& ranges); + + std::map partition_map_; +}; diff --git a/update_verifier/update_verifier.cpp b/update_verifier/update_verifier.cpp index 5e5aa181..6e86ac9d 100644 --- a/update_verifier/update_verifier.cpp +++ b/update_verifier/update_verifier.cpp @@ -48,8 +48,6 @@ #include #include -#include -#include #include #include @@ -61,7 +59,6 @@ #include #include "care_map.pb.h" -#include "otautil/rangeset.h" using android::sp; using android::hardware::boot::V1_0::IBootControl; @@ -76,29 +73,25 @@ static int dm_name_filter(const dirent* de) { return 0; } -static bool read_blocks(const std::string& partition, const std::string& range_str) { - if (partition != "system" && partition != "vendor" && partition != "product") { - LOG(ERROR) << "Invalid partition name \"" << partition << "\""; - return false; - } - // Iterate the content of "/sys/block/dm-X/dm/name". If it matches one of "system", "vendor" or - // "product", then dm-X is a dm-wrapped device for that target. We will later read all the - // ("cared") blocks from "/dev/block/dm-X" to ensure the target partition's integrity. +// Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices. +// We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target +// partition's integrity. +std::map UpdateVerifier::FindDmPartitions() { static constexpr auto DM_PATH_PREFIX = "/sys/block/"; dirent** namelist; int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort); if (n == -1) { PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX; - return false; + return {}; } if (n == 0) { - LOG(ERROR) << "dm block device not found for " << partition; - return false; + LOG(ERROR) << "No dm block device found."; + return {}; } static constexpr auto DM_PATH_SUFFIX = "/dm/name"; static constexpr auto DEV_PATH = "/dev/block/"; - std::string dm_block_device; + std::map dm_block_devices; while (n--) { std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX; std::string content; @@ -110,33 +103,18 @@ static bool read_blocks(const std::string& partition, const std::string& range_s if (dm_block_name == "vroot") { dm_block_name = "system"; } - if (dm_block_name == partition) { - dm_block_device = DEV_PATH + std::string(namelist[n]->d_name); - while (n--) { - free(namelist[n]); - } - break; - } + + dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name)); } free(namelist[n]); } free(namelist); - if (dm_block_device.empty()) { - LOG(ERROR) << "Failed to find dm block device for " << partition; - return false; - } - - // For block range string, first integer 'count' equals 2 * total number of valid ranges, - // followed by 'count' number comma separated integers. Every two integers reprensent a - // block range with the first number included in range but second number not included. - // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150). - RangeSet ranges = RangeSet::Parse(range_str); - if (!ranges) { - LOG(ERROR) << "Error parsing RangeSet string " << range_str; - return false; - } + return dm_block_devices; +} +bool UpdateVerifier::ReadBlocks(const std::string partition_name, + const std::string& dm_block_device, const RangeSet& ranges) { // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for // the last group). size_t thread_num = std::thread::hardware_concurrency() ?: 4; @@ -144,10 +122,10 @@ static bool read_blocks(const std::string& partition, const std::string& range_s std::vector> threads; for (const auto& group : groups) { - auto thread_func = [&group, &dm_block_device, &partition]() { + auto thread_func = [&group, &dm_block_device, &partition_name]() { android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY))); if (fd.get() == -1) { - PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition; + PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name; return false; } @@ -155,9 +133,7 @@ static bool read_blocks(const std::string& partition, const std::string& range_s std::vector buf(1024 * kBlockSize); size_t block_count = 0; - for (const auto& range : group) { - size_t range_start = range.first; - size_t range_end = range.second; + for (const auto& [range_start, range_end] : group) { if (lseek64(fd.get(), static_cast(range_start) * kBlockSize, SEEK_SET) == -1) { PLOG(ERROR) << "lseek to " << range_start << " failed"; return false; @@ -190,26 +166,20 @@ static bool read_blocks(const std::string& partition, const std::string& range_s return ret; } -static bool process_care_map_plain_text(const std::string& care_map_contents) { - // care_map file has up to six lines, where every two lines make a pair. Within each pair, the - // first line has the partition name (e.g. "system"), while the second line holds the ranges of - // all the blocks to verify. - std::vector lines = - android::base::Split(android::base::Trim(care_map_contents), "\n"); - if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) { - LOG(ERROR) << "Invalid lines in care_map: found " << lines.size() - << " lines, expecting 2 or 4 or 6 lines."; +bool UpdateVerifier::VerifyPartitions() { + auto dm_block_devices = FindDmPartitions(); + if (dm_block_devices.empty()) { + LOG(ERROR) << "No dm-enabled block device is found."; return false; } - for (size_t i = 0; i < lines.size(); i += 2) { - // We're seeing an N care_map.txt. Skip the verification since it's not compatible with O - // update_verifier (the last few metadata blocks can't be read via device mapper). - if (android::base::StartsWith(lines[i], "/dev/block/")) { - LOG(WARNING) << "Found legacy care_map.txt; skipped."; - return true; + for (const auto& [partition_name, ranges] : partition_map_) { + if (dm_block_devices.find(partition_name) == dm_block_devices.end()) { + LOG(ERROR) << "Failed to find dm block device for " << partition_name; + return false; } - if (!read_blocks(lines[i], lines[i+1])) { + + if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) { return false; } } @@ -217,45 +187,109 @@ static bool process_care_map_plain_text(const std::string& care_map_contents) { return true; } -bool verify_image(const std::string& care_map_name) { +bool UpdateVerifier::ParseCareMapPlainText(const std::string& content) { + // care_map file has up to six lines, where every two lines make a pair. Within each pair, the + // first line has the partition name (e.g. "system"), while the second line holds the ranges of + // all the blocks to verify. + auto lines = android::base::Split(android::base::Trim(content), "\n"); + if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) { + LOG(WARNING) << "Invalid lines in care_map: found " << lines.size() + << " lines, expecting 2 or 4 or 6 lines."; + return false; + } + + for (size_t i = 0; i < lines.size(); i += 2) { + const std::string& partition_name = lines[i]; + const std::string& range_str = lines[i + 1]; + // We're seeing an N care_map.txt. Skip the verification since it's not compatible with O + // update_verifier (the last few metadata blocks can't be read via device mapper). + if (android::base::StartsWith(partition_name, "/dev/block/")) { + LOG(WARNING) << "Found legacy care_map.txt; skipped."; + return false; + } + + // For block range string, first integer 'count' equals 2 * total number of valid ranges, + // followed by 'count' number comma separated integers. Every two integers reprensent a + // block range with the first number included in range but second number not included. + // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150). + RangeSet ranges = RangeSet::Parse(range_str); + if (!ranges) { + LOG(WARNING) << "Error parsing RangeSet string " << range_str; + return false; + } + + partition_map_.emplace(partition_name, ranges); + } + + return true; +} + +bool UpdateVerifier::ParseCareMap(const std::string& file_name) { + partition_map_.clear(); + + std::string care_map_name = file_name; + if (care_map_name.empty()) { + std::string care_map_prefix = "/data/ota_package/care_map"; + care_map_name = care_map_prefix + ".pb"; + if (access(care_map_name.c_str(), R_OK) == -1) { + LOG(WARNING) << care_map_name + << " doesn't exist, falling back to read the care_map in plain text format."; + care_map_name = care_map_prefix + ".txt"; + } + } + android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY))); // If the device is flashed before the current boot, it may not have care_map.txt in // /data/ota_package. To allow the device to continue booting in this situation, we should // print a warning and skip the block verification. if (care_map_fd.get() == -1) { PLOG(WARNING) << "Failed to open " << care_map_name; - return true; + return false; } std::string file_content; if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) { - PLOG(ERROR) << "Failed to read " << care_map_name; + PLOG(WARNING) << "Failed to read " << care_map_name; return false; } if (file_content.empty()) { - LOG(ERROR) << "Unexpected empty care map"; + LOG(WARNING) << "Unexpected empty care map"; return false; } - UpdateVerifier::CareMap care_map; - // Falls back to use the plain text version if we cannot parse the file as protobuf message. + if (android::base::EndsWith(care_map_name, ".txt")) { + return ParseCareMapPlainText(file_content); + } + + recovery_update_verifier::CareMap care_map; if (!care_map.ParseFromString(file_content)) { - return process_care_map_plain_text(file_content); + LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format."; + return false; } for (const auto& partition : care_map.partitions()) { if (partition.name().empty()) { - LOG(ERROR) << "Unexpected empty partition name."; + LOG(WARNING) << "Unexpected empty partition name."; return false; } if (partition.ranges().empty()) { - LOG(ERROR) << "Unexpected block ranges for partition " << partition.name(); + LOG(WARNING) << "Unexpected block ranges for partition " << partition.name(); return false; } - if (!read_blocks(partition.name(), partition.ranges())) { + RangeSet ranges = RangeSet::Parse(partition.ranges()); + if (!ranges) { + LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges(); return false; } + + // TODO(xunchang) compare the fingerprint of the partition. + partition_map_.emplace(partition.name(), ranges); + } + + if (partition_map_.empty()) { + LOG(WARNING) << "No partition to verify"; + return false; } return true; @@ -308,8 +342,10 @@ int update_verifier(int argc, char** argv) { } if (!skip_verification) { - static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt"; - if (!verify_image(CARE_MAP_FILE)) { + UpdateVerifier verifier; + if (!verifier.ParseCareMap()) { + LOG(WARNING) << "Failed to parse the care map file, skipping verification"; + } else if (!verifier.VerifyPartitions()) { LOG(ERROR) << "Failed to verify all blocks in care map file."; return reboot_device(); }