1 // 2 // Copyright (C) 2010 The Android Open Source Project 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #ifndef UPDATE_ENGINE_PAYLOAD_CONSUMER_DELTA_PERFORMER_H_ 18 #define UPDATE_ENGINE_PAYLOAD_CONSUMER_DELTA_PERFORMER_H_ 19 20 #include <inttypes.h> 21 22 #include <limits> 23 #include <string> 24 #include <vector> 25 26 #include <base/time/time.h> 27 #include <brillo/secure_blob.h> 28 #include <google/protobuf/repeated_field.h> 29 #include <gtest/gtest_prod.h> // for FRIEND_TEST 30 31 #include "update_engine/common/hash_calculator.h" 32 #include "update_engine/common/platform_constants.h" 33 #include "update_engine/payload_consumer/file_descriptor.h" 34 #include "update_engine/payload_consumer/file_writer.h" 35 #include "update_engine/payload_consumer/install_plan.h" 36 #include "update_engine/payload_consumer/payload_metadata.h" 37 #include "update_engine/update_metadata.pb.h" 38 39 namespace chromeos_update_engine { 40 41 class DownloadActionDelegate; 42 class BootControlInterface; 43 class HardwareInterface; 44 class PrefsInterface; 45 46 // This class performs the actions in a delta update synchronously. The delta 47 // update itself should be passed in in chunks as it is received. 48 49 class DeltaPerformer : public FileWriter { 50 public: 51 static const uint64_t kSupportedMajorPayloadVersion; 52 static const uint32_t kSupportedMinorPayloadVersion; 53 54 // Defines the granularity of progress logging in terms of how many "completed 55 // chunks" we want to report at the most. 56 static const unsigned kProgressLogMaxChunks; 57 // Defines a timeout since the last progress was logged after which we want to 58 // force another log message (even if the current chunk was not completed). 59 static const unsigned kProgressLogTimeoutSeconds; 60 // These define the relative weights (0-100) we give to the different work 61 // components associated with an update when computing an overall progress. 62 // Currently they include the download progress and the number of completed 63 // operations. They must add up to one hundred (100). 64 static const unsigned kProgressDownloadWeight; 65 static const unsigned kProgressOperationsWeight; 66 67 DeltaPerformer(PrefsInterface* prefs, 68 BootControlInterface* boot_control, 69 HardwareInterface* hardware, 70 DownloadActionDelegate* download_delegate, 71 InstallPlan* install_plan, 72 InstallPlan::Payload* payload, 73 bool is_interactive) 74 : prefs_(prefs), 75 boot_control_(boot_control), 76 hardware_(hardware), 77 download_delegate_(download_delegate), 78 install_plan_(install_plan), 79 payload_(payload), 80 is_interactive_(is_interactive) {} 81 82 // FileWriter's Write implementation where caller doesn't care about 83 // error codes. 84 bool Write(const void* bytes, size_t count) override { 85 ErrorCode error; 86 return Write(bytes, count, &error); 87 } 88 89 // FileWriter's Write implementation that returns a more specific |error| code 90 // in case of failures in Write operation. 91 bool Write(const void* bytes, size_t count, ErrorCode *error) override; 92 93 // Wrapper around close. Returns 0 on success or -errno on error. 94 // Closes both 'path' given to Open() and the kernel path. 95 int Close() override; 96 97 // Open the target and source (if delta payload) file descriptors for the 98 // |current_partition_|. The manifest needs to be already parsed for this to 99 // work. Returns whether the required file descriptors were successfully open. 100 bool OpenCurrentPartition(); 101 102 // Closes the current partition file descriptors if open. Returns 0 on success 103 // or -errno on error. 104 int CloseCurrentPartition(); 105 106 // Returns |true| only if the manifest has been processed and it's valid. 107 bool IsManifestValid(); 108 109 // Verifies the downloaded payload against the signed hash included in the 110 // payload, against the update check hash and size using the public key and 111 // returns ErrorCode::kSuccess on success, an error code on failure. 112 // This method should be called after closing the stream. Note this method 113 // skips the signed hash check if the public key is unavailable; it returns 114 // ErrorCode::kSignedDeltaPayloadExpectedError if the public key is available 115 // but the delta payload doesn't include a signature. 116 ErrorCode VerifyPayload(const brillo::Blob& update_check_response_hash, 117 const uint64_t update_check_response_size); 118 119 // Converts an ordered collection of Extent objects which contain data of 120 // length full_length to a comma-separated string. For each Extent, the 121 // string will have the start offset and then the length in bytes. 122 // The length value of the last extent in the string may be short, since 123 // the full length of all extents in the string is capped to full_length. 124 // Also, an extent starting at kSparseHole, appears as -1 in the string. 125 // For example, if the Extents are {1, 1}, {4, 2}, {kSparseHole, 1}, 126 // {0, 1}, block_size is 4096, and full_length is 5 * block_size - 13, 127 // the resulting string will be: "4096:4096,16384:8192,-1:4096,0:4083" 128 static bool ExtentsToBsdiffPositionsString( 129 const google::protobuf::RepeatedPtrField<Extent>& extents, 130 uint64_t block_size, 131 uint64_t full_length, 132 std::string* positions_string); 133 134 // Returns true if a previous update attempt can be continued based on the 135 // persistent preferences and the new update check response hash. 136 static bool CanResumeUpdate(PrefsInterface* prefs, 137 const std::string& update_check_response_hash); 138 139 // Resets the persistent update progress state to indicate that an update 140 // can't be resumed. Performs a quick update-in-progress reset if |quick| is 141 // true, otherwise resets all progress-related update state. Returns true on 142 // success, false otherwise. 143 static bool ResetUpdateProgress(PrefsInterface* prefs, bool quick); 144 145 // Attempts to parse the update metadata starting from the beginning of 146 // |payload|. On success, returns kMetadataParseSuccess. Returns 147 // kMetadataParseInsufficientData if more data is needed to parse the complete 148 // metadata. Returns kMetadataParseError if the metadata can't be parsed given 149 // the payload. 150 MetadataParseResult ParsePayloadMetadata(const brillo::Blob& payload, 151 ErrorCode* error); 152 153 void set_public_key_path(const std::string& public_key_path) { 154 public_key_path_ = public_key_path; 155 } 156 157 // Return true if header parsing is finished and no errors occurred. 158 bool IsHeaderParsed() const; 159 160 // Returns the delta minor version. If this value is defined in the manifest, 161 // it returns that value, otherwise it returns the default value. 162 uint32_t GetMinorVersion() const; 163 164 // Compare |calculated_hash| with source hash in |operation|, return false and 165 // dump hash and set |error| if don't match. 166 // |source_fd| is the file descriptor of the source partition. 167 static bool ValidateSourceHash(const brillo::Blob& calculated_hash, 168 const InstallOperation& operation, 169 const FileDescriptorPtr source_fd, 170 ErrorCode* error); 171 172 private: 173 friend class DeltaPerformerTest; 174 friend class DeltaPerformerIntegrationTest; 175 FRIEND_TEST(DeltaPerformerTest, BrilloMetadataSignatureSizeTest); 176 FRIEND_TEST(DeltaPerformerTest, BrilloParsePayloadMetadataTest); 177 FRIEND_TEST(DeltaPerformerTest, UsePublicKeyFromResponse); 178 179 // Parse and move the update instructions of all partitions into our local 180 // |partitions_| variable based on the version of the payload. Requires the 181 // manifest to be parsed and valid. 182 bool ParseManifestPartitions(ErrorCode* error); 183 184 // Appends up to |*count_p| bytes from |*bytes_p| to |buffer_|, but only to 185 // the extent that the size of |buffer_| does not exceed |max|. Advances 186 // |*cbytes_p| and decreases |*count_p| by the actual number of bytes copied, 187 // and returns this number. 188 size_t CopyDataToBuffer(const char** bytes_p, size_t* count_p, size_t max); 189 190 // If |op_result| is false, emits an error message using |op_type_name| and 191 // sets |*error| accordingly. Otherwise does nothing. Returns |op_result|. 192 bool HandleOpResult(bool op_result, const char* op_type_name, 193 ErrorCode* error); 194 195 // Logs the progress of downloading/applying an update. 196 void LogProgress(const char* message_prefix); 197 198 // Update overall progress metrics, log as necessary. 199 void UpdateOverallProgress(bool force_log, const char* message_prefix); 200 201 // Returns true if enough of the delta file has been passed via Write() 202 // to be able to perform a given install operation. 203 bool CanPerformInstallOperation(const InstallOperation& operation); 204 205 // Checks the integrity of the payload manifest. Returns true upon success, 206 // false otherwise. 207 ErrorCode ValidateManifest(); 208 209 // Validates that the hash of the blobs corresponding to the given |operation| 210 // matches what's specified in the manifest in the payload. 211 // Returns ErrorCode::kSuccess on match or a suitable error code otherwise. 212 ErrorCode ValidateOperationHash(const InstallOperation& operation); 213 214 // Returns true on success. 215 bool PerformInstallOperation(const InstallOperation& operation); 216 217 // These perform a specific type of operation and return true on success. 218 // |error| will be set if source hash mismatch, otherwise |error| might not be 219 // set even if it fails. 220 bool PerformReplaceOperation(const InstallOperation& operation); 221 bool PerformZeroOrDiscardOperation(const InstallOperation& operation); 222 bool PerformMoveOperation(const InstallOperation& operation); 223 bool PerformBsdiffOperation(const InstallOperation& operation); 224 bool PerformSourceCopyOperation(const InstallOperation& operation, 225 ErrorCode* error); 226 bool PerformSourceBsdiffOperation(const InstallOperation& operation, 227 ErrorCode* error); 228 bool PerformPuffDiffOperation(const InstallOperation& operation, 229 ErrorCode* error); 230 231 // Extracts the payload signature message from the blob on the |operation| if 232 // the offset matches the one specified by the manifest. Returns whether the 233 // signature was extracted. 234 bool ExtractSignatureMessageFromOperation(const InstallOperation& operation); 235 236 // Extracts the payload signature message from the current |buffer_| if the 237 // offset matches the one specified by the manifest. Returns whether the 238 // signature was extracted. 239 bool ExtractSignatureMessage(); 240 241 // Updates the payload hash calculator with the bytes in |buffer_|, also 242 // updates the signed hash calculator with the first |signed_hash_buffer_size| 243 // bytes in |buffer_|. Then discard the content, ensuring that memory is being 244 // deallocated. If |do_advance_offset|, advances the internal offset counter 245 // accordingly. 246 void DiscardBuffer(bool do_advance_offset, size_t signed_hash_buffer_size); 247 248 // Checkpoints the update progress into persistent storage to allow this 249 // update attempt to be resumed after reboot. 250 bool CheckpointUpdateProgress(); 251 252 // Primes the required update state. Returns true if the update state was 253 // successfully initialized to a saved resume state or if the update is a new 254 // update. Returns false otherwise. 255 bool PrimeUpdateState(); 256 257 // If the Omaha response contains a public RSA key and we're allowed 258 // to use it (e.g. if we're in developer mode), extract the key from 259 // the response and store it in a temporary file and return true. In 260 // the affirmative the path to the temporary file is stored in 261 // |out_tmp_key| and it is the responsibility of the caller to clean 262 // it up. 263 bool GetPublicKeyFromResponse(base::FilePath *out_tmp_key); 264 265 // Update Engine preference store. 266 PrefsInterface* prefs_; 267 268 // BootControl and Hardware interface references. 269 BootControlInterface* boot_control_; 270 HardwareInterface* hardware_; 271 272 // The DownloadActionDelegate instance monitoring the DownloadAction, or a 273 // nullptr if not used. 274 DownloadActionDelegate* download_delegate_; 275 276 // Install Plan based on Omaha Response. 277 InstallPlan* install_plan_; 278 279 // Pointer to the current payload in install_plan_.payloads. 280 InstallPlan::Payload* payload_{nullptr}; 281 282 // File descriptor of the source partition. Only set while updating a 283 // partition when using a delta payload. 284 FileDescriptorPtr source_fd_{nullptr}; 285 286 // File descriptor of the target partition. Only set while performing the 287 // operations of a given partition. 288 FileDescriptorPtr target_fd_{nullptr}; 289 290 // Paths the |source_fd_| and |target_fd_| refer to. 291 std::string source_path_; 292 std::string target_path_; 293 294 PayloadMetadata payload_metadata_; 295 296 // Parsed manifest. Set after enough bytes to parse the manifest were 297 // downloaded. 298 DeltaArchiveManifest manifest_; 299 bool manifest_parsed_{false}; 300 bool manifest_valid_{false}; 301 uint64_t metadata_size_{0}; 302 uint32_t metadata_signature_size_{0}; 303 uint64_t major_payload_version_{0}; 304 305 // Accumulated number of operations per partition. The i-th element is the 306 // sum of the number of operations for all the partitions from 0 to i 307 // inclusive. Valid when |manifest_valid_| is true. 308 std::vector<size_t> acc_num_operations_; 309 310 // The total operations in a payload. Valid when |manifest_valid_| is true, 311 // otherwise 0. 312 size_t num_total_operations_{0}; 313 314 // The list of partitions to update as found in the manifest major version 2. 315 // When parsing an older manifest format, the information is converted over to 316 // this format instead. 317 std::vector<PartitionUpdate> partitions_; 318 319 // Index in the list of partitions (|partitions_| member) of the current 320 // partition being processed. 321 size_t current_partition_{0}; 322 323 // Index of the next operation to perform in the manifest. The index is linear 324 // on the total number of operation on the manifest. 325 size_t next_operation_num_{0}; 326 327 // A buffer used for accumulating downloaded data. Initially, it stores the 328 // payload metadata; once that's downloaded and parsed, it stores data for the 329 // next update operation. 330 brillo::Blob buffer_; 331 // Offset of buffer_ in the binary blobs section of the update. 332 uint64_t buffer_offset_{0}; 333 334 // Last |buffer_offset_| value updated as part of the progress update. 335 uint64_t last_updated_buffer_offset_{std::numeric_limits<uint64_t>::max()}; 336 337 // The block size (parsed from the manifest). 338 uint32_t block_size_{0}; 339 340 // Calculates the whole payload file hash, including headers and signatures. 341 HashCalculator payload_hash_calculator_; 342 343 // Calculates the hash of the portion of the payload signed by the payload 344 // signature. This hash skips the metadata signature portion, located after 345 // the metadata and doesn't include the payload signature itself. 346 HashCalculator signed_hash_calculator_; 347 348 // Signatures message blob extracted directly from the payload. 349 brillo::Blob signatures_message_data_; 350 351 // The public key to be used. Provided as a member so that tests can 352 // override with test keys. 353 std::string public_key_path_{constants::kUpdatePayloadPublicKeyPath}; 354 355 // The number of bytes received so far, used for progress tracking. 356 size_t total_bytes_received_{0}; 357 358 // An overall progress counter, which should reflect both download progress 359 // and the ratio of applied operations. Range is 0-100. 360 unsigned overall_progress_{0}; 361 362 // The last progress chunk recorded. 363 unsigned last_progress_chunk_{0}; 364 365 // If |true|, the update is user initiated (vs. periodic update checks). 366 bool is_interactive_{false}; 367 368 // The timeout after which we should force emitting a progress log (constant), 369 // and the actual point in time for the next forced log to be emitted. 370 const base::TimeDelta forced_progress_log_wait_{ 371 base::TimeDelta::FromSeconds(kProgressLogTimeoutSeconds)}; 372 base::Time forced_progress_log_time_; 373 374 // The payload major payload version supported by DeltaPerformer. 375 uint64_t supported_major_version_{kSupportedMajorPayloadVersion}; 376 377 // The delta minor payload version supported by DeltaPerformer. 378 uint32_t supported_minor_version_{kSupportedMinorPayloadVersion}; 379 380 DISALLOW_COPY_AND_ASSIGN(DeltaPerformer); 381 }; 382 383 } // namespace chromeos_update_engine 384 385 #endif // UPDATE_ENGINE_PAYLOAD_CONSUMER_DELTA_PERFORMER_H_ 386