1 /* 2 * Copyright (C) 2007 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include <ctype.h> 18 #include <dirent.h> 19 #include <errno.h> 20 #include <fcntl.h> 21 #include <getopt.h> 22 #include <inttypes.h> 23 #include <limits.h> 24 #include <linux/fs.h> 25 #include <linux/input.h> 26 #include <stdarg.h> 27 #include <stdio.h> 28 #include <stdlib.h> 29 #include <string.h> 30 #include <sys/klog.h> 31 #include <sys/stat.h> 32 #include <sys/types.h> 33 #include <sys/wait.h> 34 #include <time.h> 35 #include <unistd.h> 36 37 #include <chrono> 38 #include <string> 39 #include <vector> 40 41 #include <adb.h> 42 #include <android/log.h> /* Android Log Priority Tags */ 43 #include <android-base/file.h> 44 #include <android-base/parseint.h> 45 #include <android-base/stringprintf.h> 46 #include <android-base/strings.h> 47 #include <bootloader_message/bootloader_message.h> 48 #include <cutils/android_reboot.h> 49 #include <cutils/properties.h> 50 #include <log/logger.h> /* Android Log packet format */ 51 #include <private/android_logger.h> /* private pmsg functions */ 52 53 #include <healthd/BatteryMonitor.h> 54 55 #include "adb_install.h" 56 #include "common.h" 57 #include "device.h" 58 #include "error_code.h" 59 #include "fuse_sdcard_provider.h" 60 #include "fuse_sideload.h" 61 #include "install.h" 62 #include "minui/minui.h" 63 #include "minzip/DirUtil.h" 64 #include "minzip/Zip.h" 65 #include "roots.h" 66 #include "ui.h" 67 #include "unique_fd.h" 68 #include "screen_ui.h" 69 70 struct selabel_handle *sehandle; 71 72 static const struct option OPTIONS[] = { 73 { "send_intent", required_argument, NULL, 'i' }, 74 { "update_package", required_argument, NULL, 'u' }, 75 { "retry_count", required_argument, NULL, 'n' }, 76 { "wipe_data", no_argument, NULL, 'w' }, 77 { "wipe_cache", no_argument, NULL, 'c' }, 78 { "show_text", no_argument, NULL, 't' }, 79 { "sideload", no_argument, NULL, 's' }, 80 { "sideload_auto_reboot", no_argument, NULL, 'a' }, 81 { "just_exit", no_argument, NULL, 'x' }, 82 { "locale", required_argument, NULL, 'l' }, 83 { "stages", required_argument, NULL, 'g' }, 84 { "shutdown_after", no_argument, NULL, 'p' }, 85 { "reason", required_argument, NULL, 'r' }, 86 { "security", no_argument, NULL, 'e'}, 87 { "wipe_ab", no_argument, NULL, 0 }, 88 { "wipe_package_size", required_argument, NULL, 0 }, 89 { NULL, 0, NULL, 0 }, 90 }; 91 92 // More bootreasons can be found in "system/core/bootstat/bootstat.cpp". 93 static const std::vector<std::string> bootreason_blacklist { 94 "kernel_panic", 95 "Panic", 96 }; 97 98 static const char *CACHE_LOG_DIR = "/cache/recovery"; 99 static const char *COMMAND_FILE = "/cache/recovery/command"; 100 static const char *INTENT_FILE = "/cache/recovery/intent"; 101 static const char *LOG_FILE = "/cache/recovery/log"; 102 static const char *LAST_INSTALL_FILE = "/cache/recovery/last_install"; 103 static const char *LOCALE_FILE = "/cache/recovery/last_locale"; 104 static const char *CONVERT_FBE_DIR = "/tmp/convert_fbe"; 105 static const char *CONVERT_FBE_FILE = "/tmp/convert_fbe/convert_fbe"; 106 static const char *CACHE_ROOT = "/cache"; 107 static const char *DATA_ROOT = "/data"; 108 static const char *SDCARD_ROOT = "/sdcard"; 109 static const char *TEMPORARY_LOG_FILE = "/tmp/recovery.log"; 110 static const char *TEMPORARY_INSTALL_FILE = "/tmp/last_install"; 111 static const char *LAST_KMSG_FILE = "/cache/recovery/last_kmsg"; 112 static const char *LAST_LOG_FILE = "/cache/recovery/last_log"; 113 static const int KEEP_LOG_COUNT = 10; 114 // We will try to apply the update package 5 times at most in case of an I/O error. 115 static const int EIO_RETRY_COUNT = 4; 116 static const int BATTERY_READ_TIMEOUT_IN_SEC = 10; 117 // GmsCore enters recovery mode to install package when having enough battery 118 // percentage. Normally, the threshold is 40% without charger and 20% with charger. 119 // So we should check battery with a slightly lower limitation. 120 static const int BATTERY_OK_PERCENTAGE = 20; 121 static const int BATTERY_WITH_CHARGER_OK_PERCENTAGE = 15; 122 constexpr const char* RECOVERY_WIPE = "/etc/recovery.wipe"; 123 124 RecoveryUI* ui = NULL; 125 static const char* locale = "en_US"; 126 char* stage = NULL; 127 char* reason = NULL; 128 bool modified_flash = false; 129 static bool has_cache = false; 130 131 /* 132 * The recovery tool communicates with the main system through /cache files. 133 * /cache/recovery/command - INPUT - command line for tool, one arg per line 134 * /cache/recovery/log - OUTPUT - combined log file from recovery run(s) 135 * /cache/recovery/intent - OUTPUT - intent that was passed in 136 * 137 * The arguments which may be supplied in the recovery.command file: 138 * --send_intent=anystring - write the text out to recovery.intent 139 * --update_package=path - verify install an OTA package file 140 * --wipe_data - erase user data (and cache), then reboot 141 * --wipe_cache - wipe cache (but not user data), then reboot 142 * --set_encrypted_filesystem=on|off - enables / diasables encrypted fs 143 * --just_exit - do nothing; exit and reboot 144 * 145 * After completing, we remove /cache/recovery/command and reboot. 146 * Arguments may also be supplied in the bootloader control block (BCB). 147 * These important scenarios must be safely restartable at any point: 148 * 149 * FACTORY RESET 150 * 1. user selects "factory reset" 151 * 2. main system writes "--wipe_data" to /cache/recovery/command 152 * 3. main system reboots into recovery 153 * 4. get_args() writes BCB with "boot-recovery" and "--wipe_data" 154 * -- after this, rebooting will restart the erase -- 155 * 5. erase_volume() reformats /data 156 * 6. erase_volume() reformats /cache 157 * 7. finish_recovery() erases BCB 158 * -- after this, rebooting will restart the main system -- 159 * 8. main() calls reboot() to boot main system 160 * 161 * OTA INSTALL 162 * 1. main system downloads OTA package to /cache/some-filename.zip 163 * 2. main system writes "--update_package=/cache/some-filename.zip" 164 * 3. main system reboots into recovery 165 * 4. get_args() writes BCB with "boot-recovery" and "--update_package=..." 166 * -- after this, rebooting will attempt to reinstall the update -- 167 * 5. install_package() attempts to install the update 168 * NOTE: the package install must itself be restartable from any point 169 * 6. finish_recovery() erases BCB 170 * -- after this, rebooting will (try to) restart the main system -- 171 * 7. ** if install failed ** 172 * 7a. prompt_and_wait() shows an error icon and waits for the user 173 * 7b; the user reboots (pulling the battery, etc) into the main system 174 * 8. main() calls maybe_install_firmware_update() 175 * ** if the update contained radio/hboot firmware **: 176 * 8a. m_i_f_u() writes BCB with "boot-recovery" and "--wipe_cache" 177 * -- after this, rebooting will reformat cache & restart main system -- 178 * 8b. m_i_f_u() writes firmware image into raw cache partition 179 * 8c. m_i_f_u() writes BCB with "update-radio/hboot" and "--wipe_cache" 180 * -- after this, rebooting will attempt to reinstall firmware -- 181 * 8d. bootloader tries to flash firmware 182 * 8e. bootloader writes BCB with "boot-recovery" (keeping "--wipe_cache") 183 * -- after this, rebooting will reformat cache & restart main system -- 184 * 8f. erase_volume() reformats /cache 185 * 8g. finish_recovery() erases BCB 186 * -- after this, rebooting will (try to) restart the main system -- 187 * 9. main() calls reboot() to boot main system 188 */ 189 190 static const int MAX_ARG_LENGTH = 4096; 191 static const int MAX_ARGS = 100; 192 193 // open a given path, mounting partitions as necessary 194 FILE* fopen_path(const char *path, const char *mode) { 195 if (ensure_path_mounted(path) != 0) { 196 LOGE("Can't mount %s\n", path); 197 return NULL; 198 } 199 200 // When writing, try to create the containing directory, if necessary. 201 // Use generous permissions, the system (init.rc) will reset them. 202 if (strchr("wa", mode[0])) dirCreateHierarchy(path, 0777, NULL, 1, sehandle); 203 204 FILE *fp = fopen(path, mode); 205 return fp; 206 } 207 208 // close a file, log an error if the error indicator is set 209 static void check_and_fclose(FILE *fp, const char *name) { 210 fflush(fp); 211 if (ferror(fp)) LOGE("Error in %s\n(%s)\n", name, strerror(errno)); 212 fclose(fp); 213 } 214 215 bool is_ro_debuggable() { 216 char value[PROPERTY_VALUE_MAX+1]; 217 return (property_get("ro.debuggable", value, NULL) == 1 && value[0] == '1'); 218 } 219 220 static void redirect_stdio(const char* filename) { 221 int pipefd[2]; 222 if (pipe(pipefd) == -1) { 223 LOGE("pipe failed: %s\n", strerror(errno)); 224 225 // Fall back to traditional logging mode without timestamps. 226 // If these fail, there's not really anywhere to complain... 227 freopen(filename, "a", stdout); setbuf(stdout, NULL); 228 freopen(filename, "a", stderr); setbuf(stderr, NULL); 229 230 return; 231 } 232 233 pid_t pid = fork(); 234 if (pid == -1) { 235 LOGE("fork failed: %s\n", strerror(errno)); 236 237 // Fall back to traditional logging mode without timestamps. 238 // If these fail, there's not really anywhere to complain... 239 freopen(filename, "a", stdout); setbuf(stdout, NULL); 240 freopen(filename, "a", stderr); setbuf(stderr, NULL); 241 242 return; 243 } 244 245 if (pid == 0) { 246 /// Close the unused write end. 247 close(pipefd[1]); 248 249 auto start = std::chrono::steady_clock::now(); 250 251 // Child logger to actually write to the log file. 252 FILE* log_fp = fopen(filename, "a"); 253 if (log_fp == nullptr) { 254 LOGE("fopen \"%s\" failed: %s\n", filename, strerror(errno)); 255 close(pipefd[0]); 256 _exit(1); 257 } 258 259 FILE* pipe_fp = fdopen(pipefd[0], "r"); 260 if (pipe_fp == nullptr) { 261 LOGE("fdopen failed: %s\n", strerror(errno)); 262 check_and_fclose(log_fp, filename); 263 close(pipefd[0]); 264 _exit(1); 265 } 266 267 char* line = nullptr; 268 size_t len = 0; 269 while (getline(&line, &len, pipe_fp) != -1) { 270 auto now = std::chrono::steady_clock::now(); 271 double duration = std::chrono::duration_cast<std::chrono::duration<double>>( 272 now - start).count(); 273 if (line[0] == '\n') { 274 fprintf(log_fp, "[%12.6lf]\n", duration); 275 } else { 276 fprintf(log_fp, "[%12.6lf] %s", duration, line); 277 } 278 fflush(log_fp); 279 } 280 281 LOGE("getline failed: %s\n", strerror(errno)); 282 283 free(line); 284 check_and_fclose(log_fp, filename); 285 close(pipefd[0]); 286 _exit(1); 287 } else { 288 // Redirect stdout/stderr to the logger process. 289 // Close the unused read end. 290 close(pipefd[0]); 291 292 setbuf(stdout, nullptr); 293 setbuf(stderr, nullptr); 294 295 if (dup2(pipefd[1], STDOUT_FILENO) == -1) { 296 LOGE("dup2 stdout failed: %s\n", strerror(errno)); 297 } 298 if (dup2(pipefd[1], STDERR_FILENO) == -1) { 299 LOGE("dup2 stderr failed: %s\n", strerror(errno)); 300 } 301 302 close(pipefd[1]); 303 } 304 } 305 306 // command line args come from, in decreasing precedence: 307 // - the actual command line 308 // - the bootloader control block (one per line, after "recovery") 309 // - the contents of COMMAND_FILE (one per line) 310 static void 311 get_args(int *argc, char ***argv) { 312 bootloader_message boot = {}; 313 std::string err; 314 if (!read_bootloader_message(&boot, &err)) { 315 LOGE("%s\n", err.c_str()); 316 // If fails, leave a zeroed bootloader_message. 317 memset(&boot, 0, sizeof(boot)); 318 } 319 stage = strndup(boot.stage, sizeof(boot.stage)); 320 321 if (boot.command[0] != 0 && boot.command[0] != 255) { 322 LOGI("Boot command: %.*s\n", (int)sizeof(boot.command), boot.command); 323 } 324 325 if (boot.status[0] != 0 && boot.status[0] != 255) { 326 LOGI("Boot status: %.*s\n", (int)sizeof(boot.status), boot.status); 327 } 328 329 // --- if arguments weren't supplied, look in the bootloader control block 330 if (*argc <= 1) { 331 boot.recovery[sizeof(boot.recovery) - 1] = '\0'; // Ensure termination 332 const char *arg = strtok(boot.recovery, "\n"); 333 if (arg != NULL && !strcmp(arg, "recovery")) { 334 *argv = (char **) malloc(sizeof(char *) * MAX_ARGS); 335 (*argv)[0] = strdup(arg); 336 for (*argc = 1; *argc < MAX_ARGS; ++*argc) { 337 if ((arg = strtok(NULL, "\n")) == NULL) break; 338 (*argv)[*argc] = strdup(arg); 339 } 340 LOGI("Got arguments from boot message\n"); 341 } else if (boot.recovery[0] != 0 && boot.recovery[0] != 255) { 342 LOGE("Bad boot message\n\"%.20s\"\n", boot.recovery); 343 } 344 } 345 346 // --- if that doesn't work, try the command file (if we have /cache). 347 if (*argc <= 1 && has_cache) { 348 FILE *fp = fopen_path(COMMAND_FILE, "r"); 349 if (fp != NULL) { 350 char *token; 351 char *argv0 = (*argv)[0]; 352 *argv = (char **) malloc(sizeof(char *) * MAX_ARGS); 353 (*argv)[0] = argv0; // use the same program name 354 355 char buf[MAX_ARG_LENGTH]; 356 for (*argc = 1; *argc < MAX_ARGS; ++*argc) { 357 if (!fgets(buf, sizeof(buf), fp)) break; 358 token = strtok(buf, "\r\n"); 359 if (token != NULL) { 360 (*argv)[*argc] = strdup(token); // Strip newline. 361 } else { 362 --*argc; 363 } 364 } 365 366 check_and_fclose(fp, COMMAND_FILE); 367 LOGI("Got arguments from %s\n", COMMAND_FILE); 368 } 369 } 370 371 // --> write the arguments we have back into the bootloader control block 372 // always boot into recovery after this (until finish_recovery() is called) 373 strlcpy(boot.command, "boot-recovery", sizeof(boot.command)); 374 strlcpy(boot.recovery, "recovery\n", sizeof(boot.recovery)); 375 int i; 376 for (i = 1; i < *argc; ++i) { 377 strlcat(boot.recovery, (*argv)[i], sizeof(boot.recovery)); 378 strlcat(boot.recovery, "\n", sizeof(boot.recovery)); 379 } 380 if (!write_bootloader_message(boot, &err)) { 381 LOGE("%s\n", err.c_str()); 382 } 383 } 384 385 static void 386 set_sdcard_update_bootloader_message() { 387 bootloader_message boot = {}; 388 strlcpy(boot.command, "boot-recovery", sizeof(boot.command)); 389 strlcpy(boot.recovery, "recovery\n", sizeof(boot.recovery)); 390 std::string err; 391 if (!write_bootloader_message(boot, &err)) { 392 LOGE("%s\n", err.c_str()); 393 } 394 } 395 396 // Read from kernel log into buffer and write out to file. 397 static void save_kernel_log(const char* destination) { 398 int klog_buf_len = klogctl(KLOG_SIZE_BUFFER, 0, 0); 399 if (klog_buf_len <= 0) { 400 LOGE("Error getting klog size: %s\n", strerror(errno)); 401 return; 402 } 403 404 std::string buffer(klog_buf_len, 0); 405 int n = klogctl(KLOG_READ_ALL, &buffer[0], klog_buf_len); 406 if (n == -1) { 407 LOGE("Error in reading klog: %s\n", strerror(errno)); 408 return; 409 } 410 buffer.resize(n); 411 android::base::WriteStringToFile(buffer, destination); 412 } 413 414 // write content to the current pmsg session. 415 static ssize_t __pmsg_write(const char *filename, const char *buf, size_t len) { 416 return __android_log_pmsg_file_write(LOG_ID_SYSTEM, ANDROID_LOG_INFO, 417 filename, buf, len); 418 } 419 420 static void copy_log_file_to_pmsg(const char* source, const char* destination) { 421 std::string content; 422 android::base::ReadFileToString(source, &content); 423 __pmsg_write(destination, content.c_str(), content.length()); 424 } 425 426 // How much of the temp log we have copied to the copy in cache. 427 static long tmplog_offset = 0; 428 429 static void copy_log_file(const char* source, const char* destination, bool append) { 430 FILE* dest_fp = fopen_path(destination, append ? "a" : "w"); 431 if (dest_fp == nullptr) { 432 LOGE("Can't open %s\n", destination); 433 } else { 434 FILE* source_fp = fopen(source, "r"); 435 if (source_fp != nullptr) { 436 if (append) { 437 fseek(source_fp, tmplog_offset, SEEK_SET); // Since last write 438 } 439 char buf[4096]; 440 size_t bytes; 441 while ((bytes = fread(buf, 1, sizeof(buf), source_fp)) != 0) { 442 fwrite(buf, 1, bytes, dest_fp); 443 } 444 if (append) { 445 tmplog_offset = ftell(source_fp); 446 } 447 check_and_fclose(source_fp, source); 448 } 449 check_and_fclose(dest_fp, destination); 450 } 451 } 452 453 // Rename last_log -> last_log.1 -> last_log.2 -> ... -> last_log.$max. 454 // Similarly rename last_kmsg -> last_kmsg.1 -> ... -> last_kmsg.$max. 455 // Overwrite any existing last_log.$max and last_kmsg.$max. 456 static void rotate_logs(int max) { 457 // Logs should only be rotated once. 458 static bool rotated = false; 459 if (rotated) { 460 return; 461 } 462 rotated = true; 463 ensure_path_mounted(LAST_LOG_FILE); 464 ensure_path_mounted(LAST_KMSG_FILE); 465 466 for (int i = max-1; i >= 0; --i) { 467 std::string old_log = android::base::StringPrintf("%s", LAST_LOG_FILE); 468 if (i > 0) { 469 old_log += "." + std::to_string(i); 470 } 471 std::string new_log = android::base::StringPrintf("%s.%d", LAST_LOG_FILE, i+1); 472 // Ignore errors if old_log doesn't exist. 473 rename(old_log.c_str(), new_log.c_str()); 474 475 std::string old_kmsg = android::base::StringPrintf("%s", LAST_KMSG_FILE); 476 if (i > 0) { 477 old_kmsg += "." + std::to_string(i); 478 } 479 std::string new_kmsg = android::base::StringPrintf("%s.%d", LAST_KMSG_FILE, i+1); 480 rename(old_kmsg.c_str(), new_kmsg.c_str()); 481 } 482 } 483 484 static void copy_logs() { 485 // We only rotate and record the log of the current session if there are 486 // actual attempts to modify the flash, such as wipes, installs from BCB 487 // or menu selections. This is to avoid unnecessary rotation (and 488 // possible deletion) of log files, if it does not do anything loggable. 489 if (!modified_flash) { 490 return; 491 } 492 493 // Always write to pmsg, this allows the OTA logs to be caught in logcat -L 494 copy_log_file_to_pmsg(TEMPORARY_LOG_FILE, LAST_LOG_FILE); 495 copy_log_file_to_pmsg(TEMPORARY_INSTALL_FILE, LAST_INSTALL_FILE); 496 497 // We can do nothing for now if there's no /cache partition. 498 if (!has_cache) { 499 return; 500 } 501 502 rotate_logs(KEEP_LOG_COUNT); 503 504 // Copy logs to cache so the system can find out what happened. 505 copy_log_file(TEMPORARY_LOG_FILE, LOG_FILE, true); 506 copy_log_file(TEMPORARY_LOG_FILE, LAST_LOG_FILE, false); 507 copy_log_file(TEMPORARY_INSTALL_FILE, LAST_INSTALL_FILE, false); 508 save_kernel_log(LAST_KMSG_FILE); 509 chmod(LOG_FILE, 0600); 510 chown(LOG_FILE, 1000, 1000); // system user 511 chmod(LAST_KMSG_FILE, 0600); 512 chown(LAST_KMSG_FILE, 1000, 1000); // system user 513 chmod(LAST_LOG_FILE, 0640); 514 chmod(LAST_INSTALL_FILE, 0644); 515 sync(); 516 } 517 518 // clear the recovery command and prepare to boot a (hopefully working) system, 519 // copy our log file to cache as well (for the system to read), and 520 // record any intent we were asked to communicate back to the system. 521 // this function is idempotent: call it as many times as you like. 522 static void 523 finish_recovery(const char *send_intent) { 524 // By this point, we're ready to return to the main system... 525 if (send_intent != NULL && has_cache) { 526 FILE *fp = fopen_path(INTENT_FILE, "w"); 527 if (fp == NULL) { 528 LOGE("Can't open %s\n", INTENT_FILE); 529 } else { 530 fputs(send_intent, fp); 531 check_and_fclose(fp, INTENT_FILE); 532 } 533 } 534 535 // Save the locale to cache, so if recovery is next started up 536 // without a --locale argument (eg, directly from the bootloader) 537 // it will use the last-known locale. 538 if (locale != NULL) { 539 size_t len = strlen(locale); 540 __pmsg_write(LOCALE_FILE, locale, len); 541 if (has_cache) { 542 LOGI("Saving locale \"%s\"\n", locale); 543 FILE* fp = fopen_path(LOCALE_FILE, "w"); 544 fwrite(locale, 1, len, fp); 545 fflush(fp); 546 fsync(fileno(fp)); 547 check_and_fclose(fp, LOCALE_FILE); 548 } 549 } 550 551 copy_logs(); 552 553 // Reset to normal system boot so recovery won't cycle indefinitely. 554 bootloader_message boot = {}; 555 std::string err; 556 if (!write_bootloader_message(boot, &err)) { 557 LOGE("%s\n", err.c_str()); 558 } 559 560 // Remove the command file, so recovery won't repeat indefinitely. 561 if (has_cache) { 562 if (ensure_path_mounted(COMMAND_FILE) != 0 || (unlink(COMMAND_FILE) && errno != ENOENT)) { 563 LOGW("Can't unlink %s\n", COMMAND_FILE); 564 } 565 ensure_path_unmounted(CACHE_ROOT); 566 } 567 568 sync(); // For good measure. 569 } 570 571 typedef struct _saved_log_file { 572 char* name; 573 struct stat st; 574 unsigned char* data; 575 struct _saved_log_file* next; 576 } saved_log_file; 577 578 static bool erase_volume(const char* volume) { 579 bool is_cache = (strcmp(volume, CACHE_ROOT) == 0); 580 bool is_data = (strcmp(volume, DATA_ROOT) == 0); 581 582 ui->SetBackground(RecoveryUI::ERASING); 583 ui->SetProgressType(RecoveryUI::INDETERMINATE); 584 585 saved_log_file* head = NULL; 586 587 if (is_cache) { 588 // If we're reformatting /cache, we load any past logs 589 // (i.e. "/cache/recovery/last_*") and the current log 590 // ("/cache/recovery/log") into memory, so we can restore them after 591 // the reformat. 592 593 ensure_path_mounted(volume); 594 595 DIR* d; 596 struct dirent* de; 597 d = opendir(CACHE_LOG_DIR); 598 if (d) { 599 char path[PATH_MAX]; 600 strcpy(path, CACHE_LOG_DIR); 601 strcat(path, "/"); 602 int path_len = strlen(path); 603 while ((de = readdir(d)) != NULL) { 604 if (strncmp(de->d_name, "last_", 5) == 0 || strcmp(de->d_name, "log") == 0) { 605 saved_log_file* p = (saved_log_file*) malloc(sizeof(saved_log_file)); 606 strcpy(path+path_len, de->d_name); 607 p->name = strdup(path); 608 if (stat(path, &(p->st)) == 0) { 609 // truncate files to 512kb 610 if (p->st.st_size > (1 << 19)) { 611 p->st.st_size = 1 << 19; 612 } 613 p->data = (unsigned char*) malloc(p->st.st_size); 614 FILE* f = fopen(path, "rb"); 615 fread(p->data, 1, p->st.st_size, f); 616 fclose(f); 617 p->next = head; 618 head = p; 619 } else { 620 free(p); 621 } 622 } 623 } 624 closedir(d); 625 } else { 626 if (errno != ENOENT) { 627 printf("opendir failed: %s\n", strerror(errno)); 628 } 629 } 630 } 631 632 ui->Print("Formatting %s...\n", volume); 633 634 ensure_path_unmounted(volume); 635 636 int result; 637 638 if (is_data && reason && strcmp(reason, "convert_fbe") == 0) { 639 // Create convert_fbe breadcrumb file to signal to init 640 // to convert to file based encryption, not full disk encryption 641 if (mkdir(CONVERT_FBE_DIR, 0700) != 0) { 642 ui->Print("Failed to make convert_fbe dir %s\n", strerror(errno)); 643 return true; 644 } 645 FILE* f = fopen(CONVERT_FBE_FILE, "wb"); 646 if (!f) { 647 ui->Print("Failed to convert to file encryption %s\n", strerror(errno)); 648 return true; 649 } 650 fclose(f); 651 result = format_volume(volume, CONVERT_FBE_DIR); 652 remove(CONVERT_FBE_FILE); 653 rmdir(CONVERT_FBE_DIR); 654 } else { 655 result = format_volume(volume); 656 } 657 658 if (is_cache) { 659 while (head) { 660 FILE* f = fopen_path(head->name, "wb"); 661 if (f) { 662 fwrite(head->data, 1, head->st.st_size, f); 663 fclose(f); 664 chmod(head->name, head->st.st_mode); 665 chown(head->name, head->st.st_uid, head->st.st_gid); 666 } 667 free(head->name); 668 free(head->data); 669 saved_log_file* temp = head->next; 670 free(head); 671 head = temp; 672 } 673 674 // Any part of the log we'd copied to cache is now gone. 675 // Reset the pointer so we copy from the beginning of the temp 676 // log. 677 tmplog_offset = 0; 678 copy_logs(); 679 } 680 681 return (result == 0); 682 } 683 684 static int 685 get_menu_selection(const char* const * headers, const char* const * items, 686 int menu_only, int initial_selection, Device* device) { 687 // throw away keys pressed previously, so user doesn't 688 // accidentally trigger menu items. 689 ui->FlushKeys(); 690 691 ui->StartMenu(headers, items, initial_selection); 692 int selected = initial_selection; 693 int chosen_item = -1; 694 695 while (chosen_item < 0) { 696 int key = ui->WaitKey(); 697 int visible = ui->IsTextVisible(); 698 699 if (key == -1) { // ui_wait_key() timed out 700 if (ui->WasTextEverVisible()) { 701 continue; 702 } else { 703 LOGI("timed out waiting for key input; rebooting.\n"); 704 ui->EndMenu(); 705 return 0; // XXX fixme 706 } 707 } 708 709 int action = device->HandleMenuKey(key, visible); 710 711 if (action < 0) { 712 switch (action) { 713 case Device::kHighlightUp: 714 selected = ui->SelectMenu(--selected); 715 break; 716 case Device::kHighlightDown: 717 selected = ui->SelectMenu(++selected); 718 break; 719 case Device::kInvokeItem: 720 chosen_item = selected; 721 break; 722 case Device::kNoAction: 723 break; 724 } 725 } else if (!menu_only) { 726 chosen_item = action; 727 } 728 } 729 730 ui->EndMenu(); 731 return chosen_item; 732 } 733 734 static int compare_string(const void* a, const void* b) { 735 return strcmp(*(const char**)a, *(const char**)b); 736 } 737 738 // Returns a malloc'd path, or NULL. 739 static char* browse_directory(const char* path, Device* device) { 740 ensure_path_mounted(path); 741 742 DIR* d = opendir(path); 743 if (d == NULL) { 744 LOGE("error opening %s: %s\n", path, strerror(errno)); 745 return NULL; 746 } 747 748 int d_size = 0; 749 int d_alloc = 10; 750 char** dirs = (char**)malloc(d_alloc * sizeof(char*)); 751 int z_size = 1; 752 int z_alloc = 10; 753 char** zips = (char**)malloc(z_alloc * sizeof(char*)); 754 zips[0] = strdup("../"); 755 756 struct dirent* de; 757 while ((de = readdir(d)) != NULL) { 758 int name_len = strlen(de->d_name); 759 760 if (de->d_type == DT_DIR) { 761 // skip "." and ".." entries 762 if (name_len == 1 && de->d_name[0] == '.') continue; 763 if (name_len == 2 && de->d_name[0] == '.' && 764 de->d_name[1] == '.') continue; 765 766 if (d_size >= d_alloc) { 767 d_alloc *= 2; 768 dirs = (char**)realloc(dirs, d_alloc * sizeof(char*)); 769 } 770 dirs[d_size] = (char*)malloc(name_len + 2); 771 strcpy(dirs[d_size], de->d_name); 772 dirs[d_size][name_len] = '/'; 773 dirs[d_size][name_len+1] = '\0'; 774 ++d_size; 775 } else if (de->d_type == DT_REG && 776 name_len >= 4 && 777 strncasecmp(de->d_name + (name_len-4), ".zip", 4) == 0) { 778 if (z_size >= z_alloc) { 779 z_alloc *= 2; 780 zips = (char**)realloc(zips, z_alloc * sizeof(char*)); 781 } 782 zips[z_size++] = strdup(de->d_name); 783 } 784 } 785 closedir(d); 786 787 qsort(dirs, d_size, sizeof(char*), compare_string); 788 qsort(zips, z_size, sizeof(char*), compare_string); 789 790 // append dirs to the zips list 791 if (d_size + z_size + 1 > z_alloc) { 792 z_alloc = d_size + z_size + 1; 793 zips = (char**)realloc(zips, z_alloc * sizeof(char*)); 794 } 795 memcpy(zips + z_size, dirs, d_size * sizeof(char*)); 796 free(dirs); 797 z_size += d_size; 798 zips[z_size] = NULL; 799 800 const char* headers[] = { "Choose a package to install:", path, NULL }; 801 802 char* result; 803 int chosen_item = 0; 804 while (true) { 805 chosen_item = get_menu_selection(headers, zips, 1, chosen_item, device); 806 807 char* item = zips[chosen_item]; 808 int item_len = strlen(item); 809 if (chosen_item == 0) { // item 0 is always "../" 810 // go up but continue browsing (if the caller is update_directory) 811 result = NULL; 812 break; 813 } 814 815 char new_path[PATH_MAX]; 816 strlcpy(new_path, path, PATH_MAX); 817 strlcat(new_path, "/", PATH_MAX); 818 strlcat(new_path, item, PATH_MAX); 819 820 if (item[item_len-1] == '/') { 821 // recurse down into a subdirectory 822 new_path[strlen(new_path)-1] = '\0'; // truncate the trailing '/' 823 result = browse_directory(new_path, device); 824 if (result) break; 825 } else { 826 // selected a zip file: return the malloc'd path to the caller. 827 result = strdup(new_path); 828 break; 829 } 830 } 831 832 for (int i = 0; i < z_size; ++i) free(zips[i]); 833 free(zips); 834 835 return result; 836 } 837 838 static bool yes_no(Device* device, const char* question1, const char* question2) { 839 const char* headers[] = { question1, question2, NULL }; 840 const char* items[] = { " No", " Yes", NULL }; 841 842 int chosen_item = get_menu_selection(headers, items, 1, 0, device); 843 return (chosen_item == 1); 844 } 845 846 // Return true on success. 847 static bool wipe_data(int should_confirm, Device* device) { 848 if (should_confirm && !yes_no(device, "Wipe all user data?", " THIS CAN NOT BE UNDONE!")) { 849 return false; 850 } 851 852 modified_flash = true; 853 854 ui->Print("\n-- Wiping data...\n"); 855 bool success = 856 device->PreWipeData() && 857 erase_volume("/data") && 858 (has_cache ? erase_volume("/cache") : true) && 859 device->PostWipeData(); 860 ui->Print("Data wipe %s.\n", success ? "complete" : "failed"); 861 return success; 862 } 863 864 // Return true on success. 865 static bool wipe_cache(bool should_confirm, Device* device) { 866 if (!has_cache) { 867 ui->Print("No /cache partition found.\n"); 868 return false; 869 } 870 871 if (should_confirm && !yes_no(device, "Wipe cache?", " THIS CAN NOT BE UNDONE!")) { 872 return false; 873 } 874 875 modified_flash = true; 876 877 ui->Print("\n-- Wiping cache...\n"); 878 bool success = erase_volume("/cache"); 879 ui->Print("Cache wipe %s.\n", success ? "complete" : "failed"); 880 return success; 881 } 882 883 // Secure-wipe a given partition. It uses BLKSECDISCARD, if supported. 884 // Otherwise, it goes with BLKDISCARD (if device supports BLKDISCARDZEROES) or 885 // BLKZEROOUT. 886 static bool secure_wipe_partition(const std::string& partition) { 887 unique_fd fd(TEMP_FAILURE_RETRY(open(partition.c_str(), O_WRONLY))); 888 if (fd.get() == -1) { 889 LOGE("failed to open \"%s\": %s\n", partition.c_str(), strerror(errno)); 890 return false; 891 } 892 893 uint64_t range[2] = {0, 0}; 894 if (ioctl(fd.get(), BLKGETSIZE64, &range[1]) == -1 || range[1] == 0) { 895 LOGE("failed to get partition size: %s\n", strerror(errno)); 896 return false; 897 } 898 printf("Secure-wiping \"%s\" from %" PRIu64 " to %" PRIu64 ".\n", 899 partition.c_str(), range[0], range[1]); 900 901 printf("Trying BLKSECDISCARD...\t"); 902 if (ioctl(fd.get(), BLKSECDISCARD, &range) == -1) { 903 printf("failed: %s\n", strerror(errno)); 904 905 // Use BLKDISCARD if it zeroes out blocks, otherwise use BLKZEROOUT. 906 unsigned int zeroes; 907 if (ioctl(fd.get(), BLKDISCARDZEROES, &zeroes) == 0 && zeroes != 0) { 908 printf("Trying BLKDISCARD...\t"); 909 if (ioctl(fd.get(), BLKDISCARD, &range) == -1) { 910 printf("failed: %s\n", strerror(errno)); 911 return false; 912 } 913 } else { 914 printf("Trying BLKZEROOUT...\t"); 915 if (ioctl(fd.get(), BLKZEROOUT, &range) == -1) { 916 printf("failed: %s\n", strerror(errno)); 917 return false; 918 } 919 } 920 } 921 922 printf("done\n"); 923 return true; 924 } 925 926 // Check if the wipe package matches expectation: 927 // 1. verify the package. 928 // 2. check metadata (ota-type, pre-device and serial number if having one). 929 static bool check_wipe_package(size_t wipe_package_size) { 930 if (wipe_package_size == 0) { 931 LOGE("wipe_package_size is zero.\n"); 932 return false; 933 } 934 std::string wipe_package; 935 std::string err_str; 936 if (!read_wipe_package(&wipe_package, wipe_package_size, &err_str)) { 937 LOGE("Failed to read wipe package: %s\n", err_str.c_str()); 938 return false; 939 } 940 if (!verify_package(reinterpret_cast<const unsigned char*>(wipe_package.data()), 941 wipe_package.size())) { 942 LOGE("Failed to verify package.\n"); 943 return false; 944 } 945 946 // Extract metadata 947 ZipArchive zip; 948 int err = mzOpenZipArchive(reinterpret_cast<unsigned char*>(&wipe_package[0]), 949 wipe_package.size(), &zip); 950 if (err != 0) { 951 LOGE("Can't open wipe package: %s\n", err != -1 ? strerror(err) : "bad"); 952 return false; 953 } 954 std::string metadata; 955 if (!read_metadata_from_package(&zip, &metadata)) { 956 mzCloseZipArchive(&zip); 957 return false; 958 } 959 mzCloseZipArchive(&zip); 960 961 // Check metadata 962 std::vector<std::string> lines = android::base::Split(metadata, "\n"); 963 bool ota_type_matched = false; 964 bool device_type_matched = false; 965 bool has_serial_number = false; 966 bool serial_number_matched = false; 967 for (const auto& line : lines) { 968 if (line == "ota-type=BRICK") { 969 ota_type_matched = true; 970 } else if (android::base::StartsWith(line, "pre-device=")) { 971 std::string device_type = line.substr(strlen("pre-device=")); 972 char real_device_type[PROPERTY_VALUE_MAX]; 973 property_get("ro.build.product", real_device_type, ""); 974 device_type_matched = (device_type == real_device_type); 975 } else if (android::base::StartsWith(line, "serialno=")) { 976 std::string serial_no = line.substr(strlen("serialno=")); 977 char real_serial_no[PROPERTY_VALUE_MAX]; 978 property_get("ro.serialno", real_serial_no, ""); 979 has_serial_number = true; 980 serial_number_matched = (serial_no == real_serial_no); 981 } 982 } 983 return ota_type_matched && device_type_matched && (!has_serial_number || serial_number_matched); 984 } 985 986 // Wipe the current A/B device, with a secure wipe of all the partitions in 987 // RECOVERY_WIPE. 988 static bool wipe_ab_device(size_t wipe_package_size) { 989 ui->SetBackground(RecoveryUI::ERASING); 990 ui->SetProgressType(RecoveryUI::INDETERMINATE); 991 992 if (!check_wipe_package(wipe_package_size)) { 993 LOGE("Failed to verify wipe package\n"); 994 return false; 995 } 996 std::string partition_list; 997 if (!android::base::ReadFileToString(RECOVERY_WIPE, &partition_list)) { 998 LOGE("failed to read \"%s\".\n", RECOVERY_WIPE); 999 return false; 1000 } 1001 1002 std::vector<std::string> lines = android::base::Split(partition_list, "\n"); 1003 for (const std::string& line : lines) { 1004 std::string partition = android::base::Trim(line); 1005 // Ignore '#' comment or empty lines. 1006 if (android::base::StartsWith(partition, "#") || partition.empty()) { 1007 continue; 1008 } 1009 1010 // Proceed anyway even if it fails to wipe some partition. 1011 secure_wipe_partition(partition); 1012 } 1013 return true; 1014 } 1015 1016 static void choose_recovery_file(Device* device) { 1017 // "Back" + KEEP_LOG_COUNT * 2 + terminating nullptr entry 1018 char* entries[1 + KEEP_LOG_COUNT * 2 + 1]; 1019 memset(entries, 0, sizeof(entries)); 1020 1021 unsigned int n = 0; 1022 1023 if (has_cache) { 1024 // Add LAST_LOG_FILE + LAST_LOG_FILE.x 1025 // Add LAST_KMSG_FILE + LAST_KMSG_FILE.x 1026 for (int i = 0; i < KEEP_LOG_COUNT; i++) { 1027 char* log_file; 1028 int ret; 1029 ret = (i == 0) ? asprintf(&log_file, "%s", LAST_LOG_FILE) : 1030 asprintf(&log_file, "%s.%d", LAST_LOG_FILE, i); 1031 if (ret == -1) { 1032 // memory allocation failure - return early. Should never happen. 1033 return; 1034 } 1035 if ((ensure_path_mounted(log_file) != 0) || (access(log_file, R_OK) == -1)) { 1036 free(log_file); 1037 } else { 1038 entries[n++] = log_file; 1039 } 1040 1041 char* kmsg_file; 1042 ret = (i == 0) ? asprintf(&kmsg_file, "%s", LAST_KMSG_FILE) : 1043 asprintf(&kmsg_file, "%s.%d", LAST_KMSG_FILE, i); 1044 if (ret == -1) { 1045 // memory allocation failure - return early. Should never happen. 1046 return; 1047 } 1048 if ((ensure_path_mounted(kmsg_file) != 0) || (access(kmsg_file, R_OK) == -1)) { 1049 free(kmsg_file); 1050 } else { 1051 entries[n++] = kmsg_file; 1052 } 1053 } 1054 } else { 1055 // If cache partition is not found, view /tmp/recovery.log instead. 1056 ui->Print("No /cache partition found.\n"); 1057 if (access(TEMPORARY_LOG_FILE, R_OK) == -1) { 1058 return; 1059 } else{ 1060 entries[n++] = strdup(TEMPORARY_LOG_FILE); 1061 } 1062 } 1063 1064 entries[n++] = strdup("Back"); 1065 1066 const char* headers[] = { "Select file to view", nullptr }; 1067 1068 while (true) { 1069 int chosen_item = get_menu_selection(headers, entries, 1, 0, device); 1070 if (strcmp(entries[chosen_item], "Back") == 0) break; 1071 1072 ui->ShowFile(entries[chosen_item]); 1073 } 1074 1075 for (size_t i = 0; i < (sizeof(entries) / sizeof(*entries)); i++) { 1076 free(entries[i]); 1077 } 1078 } 1079 1080 static void run_graphics_test(Device* device) { 1081 // Switch to graphics screen. 1082 ui->ShowText(false); 1083 1084 ui->SetProgressType(RecoveryUI::INDETERMINATE); 1085 ui->SetBackground(RecoveryUI::INSTALLING_UPDATE); 1086 sleep(1); 1087 1088 ui->SetBackground(RecoveryUI::ERROR); 1089 sleep(1); 1090 1091 ui->SetBackground(RecoveryUI::NO_COMMAND); 1092 sleep(1); 1093 1094 ui->SetBackground(RecoveryUI::ERASING); 1095 sleep(1); 1096 1097 ui->SetBackground(RecoveryUI::INSTALLING_UPDATE); 1098 1099 ui->SetProgressType(RecoveryUI::DETERMINATE); 1100 ui->ShowProgress(1.0, 10.0); 1101 float fraction = 0.0; 1102 for (size_t i = 0; i < 100; ++i) { 1103 fraction += .01; 1104 ui->SetProgress(fraction); 1105 usleep(100000); 1106 } 1107 1108 ui->ShowText(true); 1109 } 1110 1111 // How long (in seconds) we wait for the fuse-provided package file to 1112 // appear, before timing out. 1113 #define SDCARD_INSTALL_TIMEOUT 10 1114 1115 static int apply_from_sdcard(Device* device, bool* wipe_cache) { 1116 modified_flash = true; 1117 1118 if (ensure_path_mounted(SDCARD_ROOT) != 0) { 1119 ui->Print("\n-- Couldn't mount %s.\n", SDCARD_ROOT); 1120 return INSTALL_ERROR; 1121 } 1122 1123 char* path = browse_directory(SDCARD_ROOT, device); 1124 if (path == NULL) { 1125 ui->Print("\n-- No package file selected.\n"); 1126 ensure_path_unmounted(SDCARD_ROOT); 1127 return INSTALL_ERROR; 1128 } 1129 1130 ui->Print("\n-- Install %s ...\n", path); 1131 set_sdcard_update_bootloader_message(); 1132 1133 // We used to use fuse in a thread as opposed to a process. Since accessing 1134 // through fuse involves going from kernel to userspace to kernel, it leads 1135 // to deadlock when a page fault occurs. (Bug: 26313124) 1136 pid_t child; 1137 if ((child = fork()) == 0) { 1138 bool status = start_sdcard_fuse(path); 1139 1140 _exit(status ? EXIT_SUCCESS : EXIT_FAILURE); 1141 } 1142 1143 // FUSE_SIDELOAD_HOST_PATHNAME will start to exist once the fuse in child 1144 // process is ready. 1145 int result = INSTALL_ERROR; 1146 int status; 1147 bool waited = false; 1148 for (int i = 0; i < SDCARD_INSTALL_TIMEOUT; ++i) { 1149 if (waitpid(child, &status, WNOHANG) == -1) { 1150 result = INSTALL_ERROR; 1151 waited = true; 1152 break; 1153 } 1154 1155 struct stat sb; 1156 if (stat(FUSE_SIDELOAD_HOST_PATHNAME, &sb) == -1) { 1157 if (errno == ENOENT && i < SDCARD_INSTALL_TIMEOUT-1) { 1158 sleep(1); 1159 continue; 1160 } else { 1161 LOGE("Timed out waiting for the fuse-provided package.\n"); 1162 result = INSTALL_ERROR; 1163 kill(child, SIGKILL); 1164 break; 1165 } 1166 } 1167 1168 result = install_package(FUSE_SIDELOAD_HOST_PATHNAME, wipe_cache, 1169 TEMPORARY_INSTALL_FILE, false, 0/*retry_count*/); 1170 break; 1171 } 1172 1173 if (!waited) { 1174 // Calling stat() on this magic filename signals the fuse 1175 // filesystem to shut down. 1176 struct stat sb; 1177 stat(FUSE_SIDELOAD_HOST_EXIT_PATHNAME, &sb); 1178 1179 waitpid(child, &status, 0); 1180 } 1181 1182 if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) { 1183 LOGE("Error exit from the fuse process: %d\n", WEXITSTATUS(status)); 1184 } 1185 1186 ensure_path_unmounted(SDCARD_ROOT); 1187 return result; 1188 } 1189 1190 // Return REBOOT, SHUTDOWN, or REBOOT_BOOTLOADER. Returning NO_ACTION 1191 // means to take the default, which is to reboot or shutdown depending 1192 // on if the --shutdown_after flag was passed to recovery. 1193 static Device::BuiltinAction 1194 prompt_and_wait(Device* device, int status) { 1195 for (;;) { 1196 finish_recovery(NULL); 1197 switch (status) { 1198 case INSTALL_SUCCESS: 1199 case INSTALL_NONE: 1200 ui->SetBackground(RecoveryUI::NO_COMMAND); 1201 break; 1202 1203 case INSTALL_ERROR: 1204 case INSTALL_CORRUPT: 1205 ui->SetBackground(RecoveryUI::ERROR); 1206 break; 1207 } 1208 ui->SetProgressType(RecoveryUI::EMPTY); 1209 1210 int chosen_item = get_menu_selection(nullptr, device->GetMenuItems(), 0, 0, device); 1211 1212 // device-specific code may take some action here. It may 1213 // return one of the core actions handled in the switch 1214 // statement below. 1215 Device::BuiltinAction chosen_action = device->InvokeMenuItem(chosen_item); 1216 1217 bool should_wipe_cache = false; 1218 switch (chosen_action) { 1219 case Device::NO_ACTION: 1220 break; 1221 1222 case Device::REBOOT: 1223 case Device::SHUTDOWN: 1224 case Device::REBOOT_BOOTLOADER: 1225 return chosen_action; 1226 1227 case Device::WIPE_DATA: 1228 wipe_data(ui->IsTextVisible(), device); 1229 if (!ui->IsTextVisible()) return Device::NO_ACTION; 1230 break; 1231 1232 case Device::WIPE_CACHE: 1233 wipe_cache(ui->IsTextVisible(), device); 1234 if (!ui->IsTextVisible()) return Device::NO_ACTION; 1235 break; 1236 1237 case Device::APPLY_ADB_SIDELOAD: 1238 case Device::APPLY_SDCARD: 1239 { 1240 bool adb = (chosen_action == Device::APPLY_ADB_SIDELOAD); 1241 if (adb) { 1242 status = apply_from_adb(ui, &should_wipe_cache, TEMPORARY_INSTALL_FILE); 1243 } else { 1244 status = apply_from_sdcard(device, &should_wipe_cache); 1245 } 1246 1247 if (status == INSTALL_SUCCESS && should_wipe_cache) { 1248 if (!wipe_cache(false, device)) { 1249 status = INSTALL_ERROR; 1250 } 1251 } 1252 1253 if (status != INSTALL_SUCCESS) { 1254 ui->SetBackground(RecoveryUI::ERROR); 1255 ui->Print("Installation aborted.\n"); 1256 copy_logs(); 1257 } else if (!ui->IsTextVisible()) { 1258 return Device::NO_ACTION; // reboot if logs aren't visible 1259 } else { 1260 ui->Print("\nInstall from %s complete.\n", adb ? "ADB" : "SD card"); 1261 } 1262 } 1263 break; 1264 1265 case Device::VIEW_RECOVERY_LOGS: 1266 choose_recovery_file(device); 1267 break; 1268 1269 case Device::RUN_GRAPHICS_TEST: 1270 run_graphics_test(device); 1271 break; 1272 1273 case Device::MOUNT_SYSTEM: 1274 char system_root_image[PROPERTY_VALUE_MAX]; 1275 property_get("ro.build.system_root_image", system_root_image, ""); 1276 1277 // For a system image built with the root directory (i.e. 1278 // system_root_image == "true"), we mount it to /system_root, and symlink /system 1279 // to /system_root/system to make adb shell work (the symlink is created through 1280 // the build system). 1281 // Bug: 22855115 1282 if (strcmp(system_root_image, "true") == 0) { 1283 if (ensure_path_mounted_at("/", "/system_root") != -1) { 1284 ui->Print("Mounted /system.\n"); 1285 } 1286 } else { 1287 if (ensure_path_mounted("/system") != -1) { 1288 ui->Print("Mounted /system.\n"); 1289 } 1290 } 1291 1292 break; 1293 } 1294 } 1295 } 1296 1297 static void 1298 print_property(const char *key, const char *name, void *cookie) { 1299 printf("%s=%s\n", key, name); 1300 } 1301 1302 static void 1303 load_locale_from_cache() { 1304 FILE* fp = fopen_path(LOCALE_FILE, "r"); 1305 char buffer[80]; 1306 if (fp != NULL) { 1307 fgets(buffer, sizeof(buffer), fp); 1308 int j = 0; 1309 unsigned int i; 1310 for (i = 0; i < sizeof(buffer) && buffer[i]; ++i) { 1311 if (!isspace(buffer[i])) { 1312 buffer[j++] = buffer[i]; 1313 } 1314 } 1315 buffer[j] = 0; 1316 locale = strdup(buffer); 1317 check_and_fclose(fp, LOCALE_FILE); 1318 } 1319 } 1320 1321 static RecoveryUI* gCurrentUI = NULL; 1322 1323 void 1324 ui_print(const char* format, ...) { 1325 char buffer[256]; 1326 1327 va_list ap; 1328 va_start(ap, format); 1329 vsnprintf(buffer, sizeof(buffer), format, ap); 1330 va_end(ap); 1331 1332 if (gCurrentUI != NULL) { 1333 gCurrentUI->Print("%s", buffer); 1334 } else { 1335 fputs(buffer, stdout); 1336 } 1337 } 1338 1339 static bool is_battery_ok() { 1340 struct healthd_config healthd_config = { 1341 .batteryStatusPath = android::String8(android::String8::kEmptyString), 1342 .batteryHealthPath = android::String8(android::String8::kEmptyString), 1343 .batteryPresentPath = android::String8(android::String8::kEmptyString), 1344 .batteryCapacityPath = android::String8(android::String8::kEmptyString), 1345 .batteryVoltagePath = android::String8(android::String8::kEmptyString), 1346 .batteryTemperaturePath = android::String8(android::String8::kEmptyString), 1347 .batteryTechnologyPath = android::String8(android::String8::kEmptyString), 1348 .batteryCurrentNowPath = android::String8(android::String8::kEmptyString), 1349 .batteryCurrentAvgPath = android::String8(android::String8::kEmptyString), 1350 .batteryChargeCounterPath = android::String8(android::String8::kEmptyString), 1351 .batteryFullChargePath = android::String8(android::String8::kEmptyString), 1352 .batteryCycleCountPath = android::String8(android::String8::kEmptyString), 1353 .energyCounter = NULL, 1354 .boot_min_cap = 0, 1355 .screen_on = NULL 1356 }; 1357 healthd_board_init(&healthd_config); 1358 1359 android::BatteryMonitor monitor; 1360 monitor.init(&healthd_config); 1361 1362 int wait_second = 0; 1363 while (true) { 1364 int charge_status = monitor.getChargeStatus(); 1365 // Treat unknown status as charged. 1366 bool charged = (charge_status != android::BATTERY_STATUS_DISCHARGING && 1367 charge_status != android::BATTERY_STATUS_NOT_CHARGING); 1368 android::BatteryProperty capacity; 1369 android::status_t status = monitor.getProperty(android::BATTERY_PROP_CAPACITY, &capacity); 1370 ui_print("charge_status %d, charged %d, status %d, capacity %lld\n", charge_status, 1371 charged, status, capacity.valueInt64); 1372 // At startup, the battery drivers in devices like N5X/N6P take some time to load 1373 // the battery profile. Before the load finishes, it reports value 50 as a fake 1374 // capacity. BATTERY_READ_TIMEOUT_IN_SEC is set that the battery drivers are expected 1375 // to finish loading the battery profile earlier than 10 seconds after kernel startup. 1376 if (status == 0 && capacity.valueInt64 == 50) { 1377 if (wait_second < BATTERY_READ_TIMEOUT_IN_SEC) { 1378 sleep(1); 1379 wait_second++; 1380 continue; 1381 } 1382 } 1383 // If we can't read battery percentage, it may be a device without battery. In this 1384 // situation, use 100 as a fake battery percentage. 1385 if (status != 0) { 1386 capacity.valueInt64 = 100; 1387 } 1388 return (charged && capacity.valueInt64 >= BATTERY_WITH_CHARGER_OK_PERCENTAGE) || 1389 (!charged && capacity.valueInt64 >= BATTERY_OK_PERCENTAGE); 1390 } 1391 } 1392 1393 static void set_retry_bootloader_message(int retry_count, int argc, char** argv) { 1394 bootloader_message boot = {}; 1395 strlcpy(boot.command, "boot-recovery", sizeof(boot.command)); 1396 strlcpy(boot.recovery, "recovery\n", sizeof(boot.recovery)); 1397 1398 for (int i = 1; i < argc; ++i) { 1399 if (strstr(argv[i], "retry_count") == nullptr) { 1400 strlcat(boot.recovery, argv[i], sizeof(boot.recovery)); 1401 strlcat(boot.recovery, "\n", sizeof(boot.recovery)); 1402 } 1403 } 1404 1405 // Initialize counter to 1 if it's not in BCB, otherwise increment it by 1. 1406 if (retry_count == 0) { 1407 strlcat(boot.recovery, "--retry_count=1\n", sizeof(boot.recovery)); 1408 } else { 1409 char buffer[20]; 1410 snprintf(buffer, sizeof(buffer), "--retry_count=%d\n", retry_count+1); 1411 strlcat(boot.recovery, buffer, sizeof(boot.recovery)); 1412 } 1413 std::string err; 1414 if (!write_bootloader_message(boot, &err)) { 1415 LOGE("%s\n", err.c_str()); 1416 } 1417 } 1418 1419 static bool bootreason_in_blacklist() { 1420 char bootreason[PROPERTY_VALUE_MAX]; 1421 if (property_get("ro.boot.bootreason", bootreason, nullptr) > 0) { 1422 for (const auto& str : bootreason_blacklist) { 1423 if (strcasecmp(str.c_str(), bootreason) == 0) { 1424 return true; 1425 } 1426 } 1427 } 1428 return false; 1429 } 1430 1431 static void log_failure_code(ErrorCode code, const char *update_package) { 1432 FILE* install_log = fopen_path(TEMPORARY_INSTALL_FILE, "w"); 1433 if (install_log != nullptr) { 1434 fprintf(install_log, "%s\n", update_package); 1435 fprintf(install_log, "0\n"); 1436 fprintf(install_log, "error: %d\n", code); 1437 fclose(install_log); 1438 } else { 1439 LOGE("failed to open last_install: %s\n", strerror(errno)); 1440 } 1441 } 1442 1443 static ssize_t logbasename( 1444 log_id_t /* logId */, 1445 char /* prio */, 1446 const char *filename, 1447 const char * /* buf */, size_t len, 1448 void *arg) { 1449 if (strstr(LAST_KMSG_FILE, filename) || 1450 strstr(LAST_LOG_FILE, filename)) { 1451 bool *doRotate = reinterpret_cast<bool *>(arg); 1452 *doRotate = true; 1453 } 1454 return len; 1455 } 1456 1457 static ssize_t logrotate( 1458 log_id_t logId, 1459 char prio, 1460 const char *filename, 1461 const char *buf, size_t len, 1462 void *arg) { 1463 bool *doRotate = reinterpret_cast<bool *>(arg); 1464 if (!*doRotate) { 1465 return __android_log_pmsg_file_write(logId, prio, filename, buf, len); 1466 } 1467 1468 std::string name(filename); 1469 size_t dot = name.find_last_of("."); 1470 std::string sub = name.substr(0, dot); 1471 1472 if (!strstr(LAST_KMSG_FILE, sub.c_str()) && 1473 !strstr(LAST_LOG_FILE, sub.c_str())) { 1474 return __android_log_pmsg_file_write(logId, prio, filename, buf, len); 1475 } 1476 1477 // filename rotation 1478 if (dot == std::string::npos) { 1479 name += ".1"; 1480 } else { 1481 std::string number = name.substr(dot + 1); 1482 if (!isdigit(number.data()[0])) { 1483 name += ".1"; 1484 } else { 1485 unsigned long long i = std::stoull(number); 1486 name = sub + "." + std::to_string(i + 1); 1487 } 1488 } 1489 1490 return __android_log_pmsg_file_write(logId, prio, name.c_str(), buf, len); 1491 } 1492 1493 int main(int argc, char **argv) { 1494 // Take last pmsg contents and rewrite it to the current pmsg session. 1495 static const char filter[] = "recovery/"; 1496 // Do we need to rotate? 1497 bool doRotate = false; 1498 __android_log_pmsg_file_read( 1499 LOG_ID_SYSTEM, ANDROID_LOG_INFO, filter, 1500 logbasename, &doRotate); 1501 // Take action to refresh pmsg contents 1502 __android_log_pmsg_file_read( 1503 LOG_ID_SYSTEM, ANDROID_LOG_INFO, filter, 1504 logrotate, &doRotate); 1505 1506 // If this binary is started with the single argument "--adbd", 1507 // instead of being the normal recovery binary, it turns into kind 1508 // of a stripped-down version of adbd that only supports the 1509 // 'sideload' command. Note this must be a real argument, not 1510 // anything in the command file or bootloader control block; the 1511 // only way recovery should be run with this argument is when it 1512 // starts a copy of itself from the apply_from_adb() function. 1513 if (argc == 2 && strcmp(argv[1], "--adbd") == 0) { 1514 adb_server_main(0, DEFAULT_ADB_PORT, -1); 1515 return 0; 1516 } 1517 1518 time_t start = time(NULL); 1519 1520 // redirect_stdio should be called only in non-sideload mode. Otherwise 1521 // we may have two logger instances with different timestamps. 1522 redirect_stdio(TEMPORARY_LOG_FILE); 1523 1524 printf("Starting recovery (pid %d) on %s", getpid(), ctime(&start)); 1525 1526 load_volume_table(); 1527 has_cache = volume_for_path(CACHE_ROOT) != nullptr; 1528 1529 get_args(&argc, &argv); 1530 1531 const char *send_intent = NULL; 1532 const char *update_package = NULL; 1533 bool should_wipe_data = false; 1534 bool should_wipe_cache = false; 1535 bool should_wipe_ab = false; 1536 size_t wipe_package_size = 0; 1537 bool show_text = false; 1538 bool sideload = false; 1539 bool sideload_auto_reboot = false; 1540 bool just_exit = false; 1541 bool shutdown_after = false; 1542 int retry_count = 0; 1543 bool security_update = false; 1544 1545 int arg; 1546 int option_index; 1547 while ((arg = getopt_long(argc, argv, "", OPTIONS, &option_index)) != -1) { 1548 switch (arg) { 1549 case 'i': send_intent = optarg; break; 1550 case 'n': android::base::ParseInt(optarg, &retry_count, 0); break; 1551 case 'u': update_package = optarg; break; 1552 case 'w': should_wipe_data = true; break; 1553 case 'c': should_wipe_cache = true; break; 1554 case 't': show_text = true; break; 1555 case 's': sideload = true; break; 1556 case 'a': sideload = true; sideload_auto_reboot = true; break; 1557 case 'x': just_exit = true; break; 1558 case 'l': locale = optarg; break; 1559 case 'g': { 1560 if (stage == NULL || *stage == '\0') { 1561 char buffer[20] = "1/"; 1562 strncat(buffer, optarg, sizeof(buffer)-3); 1563 stage = strdup(buffer); 1564 } 1565 break; 1566 } 1567 case 'p': shutdown_after = true; break; 1568 case 'r': reason = optarg; break; 1569 case 'e': security_update = true; break; 1570 case 0: { 1571 if (strcmp(OPTIONS[option_index].name, "wipe_ab") == 0) { 1572 should_wipe_ab = true; 1573 break; 1574 } else if (strcmp(OPTIONS[option_index].name, "wipe_package_size") == 0) { 1575 android::base::ParseUint(optarg, &wipe_package_size); 1576 break; 1577 } 1578 break; 1579 } 1580 case '?': 1581 LOGE("Invalid command argument\n"); 1582 continue; 1583 } 1584 } 1585 1586 if (locale == nullptr && has_cache) { 1587 load_locale_from_cache(); 1588 } 1589 printf("locale is [%s]\n", locale); 1590 printf("stage is [%s]\n", stage); 1591 printf("reason is [%s]\n", reason); 1592 1593 Device* device = make_device(); 1594 ui = device->GetUI(); 1595 gCurrentUI = ui; 1596 1597 ui->SetLocale(locale); 1598 ui->Init(); 1599 // Set background string to "installing security update" for security update, 1600 // otherwise set it to "installing system update". 1601 ui->SetSystemUpdateText(security_update); 1602 1603 int st_cur, st_max; 1604 if (stage != NULL && sscanf(stage, "%d/%d", &st_cur, &st_max) == 2) { 1605 ui->SetStage(st_cur, st_max); 1606 } 1607 1608 ui->SetBackground(RecoveryUI::NONE); 1609 if (show_text) ui->ShowText(true); 1610 1611 struct selinux_opt seopts[] = { 1612 { SELABEL_OPT_PATH, "/file_contexts" } 1613 }; 1614 1615 sehandle = selabel_open(SELABEL_CTX_FILE, seopts, 1); 1616 1617 if (!sehandle) { 1618 ui->Print("Warning: No file_contexts\n"); 1619 } 1620 1621 device->StartRecovery(); 1622 1623 printf("Command:"); 1624 for (arg = 0; arg < argc; arg++) { 1625 printf(" \"%s\"", argv[arg]); 1626 } 1627 printf("\n"); 1628 1629 if (update_package) { 1630 // For backwards compatibility on the cache partition only, if 1631 // we're given an old 'root' path "CACHE:foo", change it to 1632 // "/cache/foo". 1633 if (strncmp(update_package, "CACHE:", 6) == 0) { 1634 int len = strlen(update_package) + 10; 1635 char* modified_path = (char*)malloc(len); 1636 if (modified_path) { 1637 strlcpy(modified_path, "/cache/", len); 1638 strlcat(modified_path, update_package+6, len); 1639 printf("(replacing path \"%s\" with \"%s\")\n", 1640 update_package, modified_path); 1641 update_package = modified_path; 1642 } 1643 else 1644 printf("modified_path allocation failed\n"); 1645 } 1646 } 1647 printf("\n"); 1648 1649 property_list(print_property, NULL); 1650 printf("\n"); 1651 1652 ui->Print("Supported API: %d\n", RECOVERY_API_VERSION); 1653 1654 int status = INSTALL_SUCCESS; 1655 1656 if (update_package != NULL) { 1657 // It's not entirely true that we will modify the flash. But we want 1658 // to log the update attempt since update_package is non-NULL. 1659 modified_flash = true; 1660 1661 if (!is_battery_ok()) { 1662 ui->Print("battery capacity is not enough for installing package, needed is %d%%\n", 1663 BATTERY_OK_PERCENTAGE); 1664 // Log the error code to last_install when installation skips due to 1665 // low battery. 1666 log_failure_code(kLowBattery, update_package); 1667 status = INSTALL_SKIPPED; 1668 } else if (bootreason_in_blacklist()) { 1669 // Skip update-on-reboot when bootreason is kernel_panic or similar 1670 ui->Print("bootreason is in the blacklist; skip OTA installation\n"); 1671 log_failure_code(kBootreasonInBlacklist, update_package); 1672 status = INSTALL_SKIPPED; 1673 } else { 1674 status = install_package(update_package, &should_wipe_cache, 1675 TEMPORARY_INSTALL_FILE, true, retry_count); 1676 if (status == INSTALL_SUCCESS && should_wipe_cache) { 1677 wipe_cache(false, device); 1678 } 1679 if (status != INSTALL_SUCCESS) { 1680 ui->Print("Installation aborted.\n"); 1681 // When I/O error happens, reboot and retry installation EIO_RETRY_COUNT 1682 // times before we abandon this OTA update. 1683 if (status == INSTALL_RETRY && retry_count < EIO_RETRY_COUNT) { 1684 copy_logs(); 1685 set_retry_bootloader_message(retry_count, argc, argv); 1686 // Print retry count on screen. 1687 ui->Print("Retry attempt %d\n", retry_count); 1688 1689 // Reboot and retry the update 1690 int ret = property_set(ANDROID_RB_PROPERTY, "reboot,recovery"); 1691 if (ret < 0) { 1692 ui->Print("Reboot failed\n"); 1693 } else { 1694 while (true) { 1695 pause(); 1696 } 1697 } 1698 } 1699 // If this is an eng or userdebug build, then automatically 1700 // turn the text display on if the script fails so the error 1701 // message is visible. 1702 if (is_ro_debuggable()) { 1703 ui->ShowText(true); 1704 } 1705 } 1706 } 1707 } else if (should_wipe_data) { 1708 if (!wipe_data(false, device)) { 1709 status = INSTALL_ERROR; 1710 } 1711 } else if (should_wipe_cache) { 1712 if (!wipe_cache(false, device)) { 1713 status = INSTALL_ERROR; 1714 } 1715 } else if (should_wipe_ab) { 1716 if (!wipe_ab_device(wipe_package_size)) { 1717 status = INSTALL_ERROR; 1718 } 1719 } else if (sideload) { 1720 // 'adb reboot sideload' acts the same as user presses key combinations 1721 // to enter the sideload mode. When 'sideload-auto-reboot' is used, text 1722 // display will NOT be turned on by default. And it will reboot after 1723 // sideload finishes even if there are errors. Unless one turns on the 1724 // text display during the installation. This is to enable automated 1725 // testing. 1726 if (!sideload_auto_reboot) { 1727 ui->ShowText(true); 1728 } 1729 status = apply_from_adb(ui, &should_wipe_cache, TEMPORARY_INSTALL_FILE); 1730 if (status == INSTALL_SUCCESS && should_wipe_cache) { 1731 if (!wipe_cache(false, device)) { 1732 status = INSTALL_ERROR; 1733 } 1734 } 1735 ui->Print("\nInstall from ADB complete (status: %d).\n", status); 1736 if (sideload_auto_reboot) { 1737 ui->Print("Rebooting automatically.\n"); 1738 } 1739 } else if (!just_exit) { 1740 status = INSTALL_NONE; // No command specified 1741 ui->SetBackground(RecoveryUI::NO_COMMAND); 1742 1743 // http://b/17489952 1744 // If this is an eng or userdebug build, automatically turn on the 1745 // text display if no command is specified. 1746 if (is_ro_debuggable()) { 1747 ui->ShowText(true); 1748 } 1749 } 1750 1751 if (!sideload_auto_reboot && (status == INSTALL_ERROR || status == INSTALL_CORRUPT)) { 1752 copy_logs(); 1753 ui->SetBackground(RecoveryUI::ERROR); 1754 } 1755 1756 Device::BuiltinAction after = shutdown_after ? Device::SHUTDOWN : Device::REBOOT; 1757 if ((status != INSTALL_SUCCESS && status != INSTALL_SKIPPED && !sideload_auto_reboot) || 1758 ui->IsTextVisible()) { 1759 Device::BuiltinAction temp = prompt_and_wait(device, status); 1760 if (temp != Device::NO_ACTION) { 1761 after = temp; 1762 } 1763 } 1764 1765 // Save logs and clean up before rebooting or shutting down. 1766 finish_recovery(send_intent); 1767 1768 switch (after) { 1769 case Device::SHUTDOWN: 1770 ui->Print("Shutting down...\n"); 1771 property_set(ANDROID_RB_PROPERTY, "shutdown,"); 1772 break; 1773 1774 case Device::REBOOT_BOOTLOADER: 1775 ui->Print("Rebooting to bootloader...\n"); 1776 property_set(ANDROID_RB_PROPERTY, "reboot,bootloader"); 1777 break; 1778 1779 default: 1780 ui->Print("Rebooting...\n"); 1781 property_set(ANDROID_RB_PROPERTY, "reboot,"); 1782 break; 1783 } 1784 while (true) { 1785 pause(); 1786 } 1787 // Should be unreachable. 1788 return EXIT_SUCCESS; 1789 } 1790
