1 /* 2 * Copyright (C) 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 /* 18 * update_verifier verifies the integrity of the partitions after an A/B OTA update. It gets invoked 19 * by init, and will only perform the verification if it's the first boot post an A/B OTA update 20 * (https://source.android.com/devices/tech/ota/ab/#after_reboot). 21 * 22 * update_verifier relies on device-mapper-verity (dm-verity) to capture any corruption on the 23 * partitions being verified (https://source.android.com/security/verifiedboot). The verification 24 * will be skipped, if dm-verity is not enabled on the device. 25 * 26 * Upon detecting verification failures, the device will be rebooted, although the trigger of the 27 * reboot depends on the dm-verity mode. 28 * enforcing mode: dm-verity reboots the device 29 * eio mode: dm-verity fails the read and update_verifier reboots the device 30 * other mode: not supported and update_verifier reboots the device 31 * 32 * All these reboots prevent the device from booting into a known corrupt state. If the device 33 * continuously fails to boot into the new slot, the bootloader should mark the slot as unbootable 34 * and trigger a fallback to the old slot. 35 * 36 * The current slot will be marked as having booted successfully if the verifier reaches the end 37 * after the verification. 38 */ 39 40 #include "update_verifier/update_verifier.h" 41 42 #include <dirent.h> 43 #include <errno.h> 44 #include <fcntl.h> 45 #include <stdint.h> 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <string.h> 49 #include <unistd.h> 50 51 #include <algorithm> 52 #include <future> 53 #include <thread> 54 55 #include <android-base/file.h> 56 #include <android-base/logging.h> 57 #include <android-base/parseint.h> 58 #include <android-base/properties.h> 59 #include <android-base/strings.h> 60 #include <android-base/unique_fd.h> 61 #include <android/hardware/boot/1.0/IBootControl.h> 62 #include <android/os/IVold.h> 63 #include <binder/BinderService.h> 64 #include <binder/Status.h> 65 #include <cutils/android_reboot.h> 66 67 #include "care_map.pb.h" 68 69 using android::sp; 70 using android::hardware::boot::V1_0::IBootControl; 71 using android::hardware::boot::V1_0::BoolResult; 72 using android::hardware::boot::V1_0::CommandResult; 73 74 // TODO(xunchang) remove the prefix and use a default path instead. 75 constexpr const char* kDefaultCareMapPrefix = "/data/ota_package/care_map"; 76 77 // Find directories in format of "/sys/block/dm-X". 78 static int dm_name_filter(const dirent* de) { 79 if (android::base::StartsWith(de->d_name, "dm-")) { 80 return 1; 81 } 82 return 0; 83 } 84 85 UpdateVerifier::UpdateVerifier() 86 : care_map_prefix_(kDefaultCareMapPrefix), 87 property_reader_([](const std::string& id) { return android::base::GetProperty(id, ""); }) {} 88 89 // Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices. 90 // We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target 91 // partition's integrity. 92 std::map<std::string, std::string> UpdateVerifier::FindDmPartitions() { 93 static constexpr auto DM_PATH_PREFIX = "/sys/block/"; 94 dirent** namelist; 95 int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort); 96 if (n == -1) { 97 PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX; 98 return {}; 99 } 100 if (n == 0) { 101 LOG(ERROR) << "No dm block device found."; 102 return {}; 103 } 104 105 static constexpr auto DM_PATH_SUFFIX = "/dm/name"; 106 static constexpr auto DEV_PATH = "/dev/block/"; 107 std::map<std::string, std::string> dm_block_devices; 108 while (n--) { 109 std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX; 110 std::string content; 111 if (!android::base::ReadFileToString(path, &content)) { 112 PLOG(WARNING) << "Failed to read " << path; 113 } else { 114 std::string dm_block_name = android::base::Trim(content); 115 // AVB is using 'vroot' for the root block device but we're expecting 'system'. 116 if (dm_block_name == "vroot") { 117 dm_block_name = "system"; 118 } else if (android::base::EndsWith(dm_block_name, "-verity")) { 119 auto npos = dm_block_name.rfind("-verity"); 120 dm_block_name = dm_block_name.substr(0, npos); 121 } else if (!android::base::GetProperty("ro.boot.avb_version", "").empty()) { 122 // Verified Boot 1.0 doesn't add a -verity suffix. On AVB 2 devices, 123 // if DAP is enabled, then a -verity suffix must be used to 124 // differentiate between dm-linear and dm-verity devices. If we get 125 // here, we're AVB 2 and looking at a non-verity partition. 126 continue; 127 } 128 129 dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name)); 130 } 131 free(namelist[n]); 132 } 133 free(namelist); 134 135 return dm_block_devices; 136 } 137 138 bool UpdateVerifier::ReadBlocks(const std::string partition_name, 139 const std::string& dm_block_device, const RangeSet& ranges) { 140 // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for 141 // the last group). 142 size_t thread_num = std::thread::hardware_concurrency() ?: 4; 143 std::vector<RangeSet> groups = ranges.Split(thread_num); 144 145 std::vector<std::future<bool>> threads; 146 for (const auto& group : groups) { 147 auto thread_func = [&group, &dm_block_device, &partition_name]() { 148 android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY))); 149 if (fd.get() == -1) { 150 PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name; 151 return false; 152 } 153 154 static constexpr size_t kBlockSize = 4096; 155 std::vector<uint8_t> buf(1024 * kBlockSize); 156 157 size_t block_count = 0; 158 for (const auto& [range_start, range_end] : group) { 159 if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) { 160 PLOG(ERROR) << "lseek to " << range_start << " failed"; 161 return false; 162 } 163 164 size_t remain = (range_end - range_start) * kBlockSize; 165 while (remain > 0) { 166 size_t to_read = std::min(remain, 1024 * kBlockSize); 167 if (!android::base::ReadFully(fd.get(), buf.data(), to_read)) { 168 PLOG(ERROR) << "Failed to read blocks " << range_start << " to " << range_end; 169 return false; 170 } 171 remain -= to_read; 172 } 173 block_count += (range_end - range_start); 174 } 175 LOG(INFO) << "Finished reading " << block_count << " blocks on " << dm_block_device; 176 return true; 177 }; 178 179 threads.emplace_back(std::async(std::launch::async, thread_func)); 180 } 181 182 bool ret = true; 183 for (auto& t : threads) { 184 ret = t.get() && ret; 185 } 186 LOG(INFO) << "Finished reading blocks on " << dm_block_device << " with " << thread_num 187 << " threads."; 188 return ret; 189 } 190 191 bool UpdateVerifier::VerifyPartitions() { 192 auto dm_block_devices = FindDmPartitions(); 193 if (dm_block_devices.empty()) { 194 LOG(ERROR) << "No dm-enabled block device is found."; 195 return false; 196 } 197 198 for (const auto& [partition_name, ranges] : partition_map_) { 199 if (dm_block_devices.find(partition_name) == dm_block_devices.end()) { 200 LOG(ERROR) << "Failed to find dm block device for " << partition_name; 201 return false; 202 } 203 204 if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) { 205 return false; 206 } 207 } 208 209 return true; 210 } 211 212 bool UpdateVerifier::ParseCareMap() { 213 partition_map_.clear(); 214 215 std::string care_map_name = care_map_prefix_ + ".pb"; 216 if (access(care_map_name.c_str(), R_OK) == -1) { 217 LOG(ERROR) << care_map_name << " doesn't exist"; 218 return false; 219 } 220 221 android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY))); 222 // If the device is flashed before the current boot, it may not have care_map.txt in 223 // /data/ota_package. To allow the device to continue booting in this situation, we should 224 // print a warning and skip the block verification. 225 if (care_map_fd.get() == -1) { 226 PLOG(WARNING) << "Failed to open " << care_map_name; 227 return false; 228 } 229 230 std::string file_content; 231 if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) { 232 PLOG(WARNING) << "Failed to read " << care_map_name; 233 return false; 234 } 235 236 if (file_content.empty()) { 237 LOG(WARNING) << "Unexpected empty care map"; 238 return false; 239 } 240 241 recovery_update_verifier::CareMap care_map; 242 if (!care_map.ParseFromString(file_content)) { 243 LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format."; 244 return false; 245 } 246 247 for (const auto& partition : care_map.partitions()) { 248 if (partition.name().empty()) { 249 LOG(WARNING) << "Unexpected empty partition name."; 250 return false; 251 } 252 if (partition.ranges().empty()) { 253 LOG(WARNING) << "Unexpected block ranges for partition " << partition.name(); 254 return false; 255 } 256 RangeSet ranges = RangeSet::Parse(partition.ranges()); 257 if (!ranges) { 258 LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges(); 259 return false; 260 } 261 262 // Continues to check other partitions if there is a fingerprint mismatch. 263 if (partition.id().empty() || partition.id() == "unknown") { 264 LOG(WARNING) << "Skip reading partition " << partition.name() 265 << ": property_id is not provided to get fingerprint."; 266 continue; 267 } 268 269 std::string fingerprint = property_reader_(partition.id()); 270 if (fingerprint != partition.fingerprint()) { 271 LOG(WARNING) << "Skip reading partition " << partition.name() << ": fingerprint " 272 << fingerprint << " doesn't match the expected value " 273 << partition.fingerprint(); 274 continue; 275 } 276 277 partition_map_.emplace(partition.name(), ranges); 278 } 279 280 if (partition_map_.empty()) { 281 LOG(WARNING) << "No partition to verify"; 282 return false; 283 } 284 285 return true; 286 } 287 288 void UpdateVerifier::set_care_map_prefix(const std::string& prefix) { 289 care_map_prefix_ = prefix; 290 } 291 292 void UpdateVerifier::set_property_reader( 293 const std::function<std::string(const std::string&)>& property_reader) { 294 property_reader_ = property_reader; 295 } 296 297 static int reboot_device() { 298 if (android_reboot(ANDROID_RB_RESTART2, 0, nullptr) == -1) { 299 LOG(ERROR) << "Failed to reboot."; 300 return -1; 301 } 302 while (true) pause(); 303 } 304 305 int update_verifier(int argc, char** argv) { 306 for (int i = 1; i < argc; i++) { 307 LOG(INFO) << "Started with arg " << i << ": " << argv[i]; 308 } 309 310 sp<IBootControl> module = IBootControl::getService(); 311 if (module == nullptr) { 312 LOG(ERROR) << "Error getting bootctrl module."; 313 return reboot_device(); 314 } 315 316 uint32_t current_slot = module->getCurrentSlot(); 317 BoolResult is_successful = module->isSlotMarkedSuccessful(current_slot); 318 LOG(INFO) << "Booting slot " << current_slot << ": isSlotMarkedSuccessful=" 319 << static_cast<int32_t>(is_successful); 320 321 if (is_successful == BoolResult::FALSE) { 322 // The current slot has not booted successfully. 323 324 bool skip_verification = false; 325 std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", ""); 326 if (verity_mode.empty()) { 327 // Skip the verification if ro.boot.veritymode property is not set. This could be a result 328 // that device doesn't support dm-verity, or has disabled that. 329 LOG(WARNING) << "dm-verity not enabled; marking without verification."; 330 skip_verification = true; 331 } else if (android::base::EqualsIgnoreCase(verity_mode, "eio")) { 332 // We shouldn't see verity in EIO mode if the current slot hasn't booted successfully before. 333 // Continue the verification until we fail to read some blocks. 334 LOG(WARNING) << "Found dm-verity in EIO mode."; 335 } else if (android::base::EqualsIgnoreCase(verity_mode, "disabled")) { 336 LOG(WARNING) << "dm-verity in disabled mode; marking without verification."; 337 skip_verification = true; 338 } else if (verity_mode != "enforcing") { 339 LOG(ERROR) << "Unexpected dm-verity mode: " << verity_mode << ", expecting enforcing."; 340 return reboot_device(); 341 } 342 343 if (!skip_verification) { 344 UpdateVerifier verifier; 345 if (!verifier.ParseCareMap()) { 346 LOG(WARNING) << "Failed to parse the care map file, skipping verification"; 347 } else if (!verifier.VerifyPartitions()) { 348 LOG(ERROR) << "Failed to verify all blocks in care map file."; 349 return reboot_device(); 350 } 351 } 352 353 bool supports_checkpoint = false; 354 auto sm = android::defaultServiceManager(); 355 android::sp<android::IBinder> binder = sm->getService(android::String16("vold")); 356 if (binder) { 357 auto vold = android::interface_cast<android::os::IVold>(binder); 358 android::binder::Status status = vold->supportsCheckpoint(&supports_checkpoint); 359 if (!status.isOk()) { 360 LOG(ERROR) << "Failed to check if checkpoints supported. Continuing"; 361 } 362 } else { 363 LOG(ERROR) << "Failed to obtain vold Binder. Continuing"; 364 } 365 366 if (!supports_checkpoint) { 367 CommandResult cr; 368 module->markBootSuccessful([&cr](CommandResult result) { cr = result; }); 369 if (!cr.success) { 370 LOG(ERROR) << "Error marking booted successfully: " << cr.errMsg; 371 return reboot_device(); 372 } 373 LOG(INFO) << "Marked slot " << current_slot << " as booted successfully."; 374 } else { 375 LOG(INFO) << "Deferred marking slot " << current_slot << " as booted successfully."; 376 } 377 } 378 379 LOG(INFO) << "Leaving update_verifier."; 380 return 0; 381 } 382