1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Permission is hereby granted, free of charge, to any person 5 * obtaining a copy of this software and associated documentation 6 * files (the "Software"), to deal in the Software without 7 * restriction, including without limitation the rights to use, copy, 8 * modify, merge, publish, distribute, sublicense, and/or sell copies 9 * of the Software, and to permit persons to whom the Software is 10 * furnished to do so, subject to the following conditions: 11 * 12 * The above copyright notice and this permission notice shall be 13 * included in all copies or substantial portions of the Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 22 * SOFTWARE. 23 */ 24 25 #include "avb_cmdline.h" 26 #include "avb_sha.h" 27 #include "avb_util.h" 28 #include "avb_version.h" 29 30 #define NUM_GUIDS 3 31 32 /* Substitutes all variables (e.g. $(ANDROID_SYSTEM_PARTUUID)) with 33 * values. Returns NULL on OOM, otherwise the cmdline with values 34 * replaced. 35 */ 36 char* avb_sub_cmdline(AvbOps* ops, 37 const char* cmdline, 38 const char* ab_suffix, 39 bool using_boot_for_vbmeta, 40 const AvbCmdlineSubstList* additional_substitutions) { 41 const char* part_name_str[NUM_GUIDS] = {"system", "boot", "vbmeta"}; 42 const char* replace_str[NUM_GUIDS] = {"$(ANDROID_SYSTEM_PARTUUID)", 43 "$(ANDROID_BOOT_PARTUUID)", 44 "$(ANDROID_VBMETA_PARTUUID)"}; 45 char* ret = NULL; 46 AvbIOResult io_ret; 47 size_t n; 48 49 /* Special-case for when the top-level vbmeta struct is in the boot 50 * partition. 51 */ 52 if (using_boot_for_vbmeta) { 53 part_name_str[2] = "boot"; 54 } 55 56 /* Replace unique partition GUIDs */ 57 for (n = 0; n < NUM_GUIDS; n++) { 58 char part_name[AVB_PART_NAME_MAX_SIZE]; 59 char guid_buf[37]; 60 61 if (!avb_str_concat(part_name, 62 sizeof part_name, 63 part_name_str[n], 64 avb_strlen(part_name_str[n]), 65 ab_suffix, 66 avb_strlen(ab_suffix))) { 67 avb_error("Partition name and suffix does not fit.\n"); 68 goto fail; 69 } 70 71 io_ret = ops->get_unique_guid_for_partition( 72 ops, part_name, guid_buf, sizeof guid_buf); 73 if (io_ret == AVB_IO_RESULT_ERROR_OOM) { 74 goto fail; 75 } else if (io_ret != AVB_IO_RESULT_OK) { 76 avb_error("Error getting unique GUID for partition.\n"); 77 goto fail; 78 } 79 80 if (ret == NULL) { 81 ret = avb_replace(cmdline, replace_str[n], guid_buf); 82 } else { 83 char* new_ret = avb_replace(ret, replace_str[n], guid_buf); 84 avb_free(ret); 85 ret = new_ret; 86 } 87 if (ret == NULL) { 88 goto fail; 89 } 90 } 91 92 avb_assert(ret != NULL); 93 94 /* Replace any additional substitutions. */ 95 if (additional_substitutions != NULL) { 96 for (n = 0; n < additional_substitutions->size; ++n) { 97 char* new_ret = avb_replace(ret, 98 additional_substitutions->tokens[n], 99 additional_substitutions->values[n]); 100 avb_free(ret); 101 ret = new_ret; 102 if (ret == NULL) { 103 goto fail; 104 } 105 } 106 } 107 108 return ret; 109 110 fail: 111 if (ret != NULL) { 112 avb_free(ret); 113 } 114 return NULL; 115 } 116 117 static int cmdline_append_option(AvbSlotVerifyData* slot_data, 118 const char* key, 119 const char* value) { 120 size_t offset, key_len, value_len; 121 char* new_cmdline; 122 123 key_len = avb_strlen(key); 124 value_len = avb_strlen(value); 125 126 offset = 0; 127 if (slot_data->cmdline != NULL) { 128 offset = avb_strlen(slot_data->cmdline); 129 if (offset > 0) { 130 offset += 1; 131 } 132 } 133 134 new_cmdline = avb_calloc(offset + key_len + value_len + 2); 135 if (new_cmdline == NULL) { 136 return 0; 137 } 138 if (offset > 0) { 139 avb_memcpy(new_cmdline, slot_data->cmdline, offset - 1); 140 new_cmdline[offset - 1] = ' '; 141 } 142 avb_memcpy(new_cmdline + offset, key, key_len); 143 new_cmdline[offset + key_len] = '='; 144 avb_memcpy(new_cmdline + offset + key_len + 1, value, value_len); 145 if (slot_data->cmdline != NULL) { 146 avb_free(slot_data->cmdline); 147 } 148 slot_data->cmdline = new_cmdline; 149 150 return 1; 151 } 152 153 #define AVB_MAX_DIGITS_UINT64 32 154 155 /* Writes |value| to |digits| in base 10 followed by a NUL byte. 156 * Returns number of characters written excluding the NUL byte. 157 */ 158 static size_t uint64_to_base10(uint64_t value, 159 char digits[AVB_MAX_DIGITS_UINT64]) { 160 char rev_digits[AVB_MAX_DIGITS_UINT64]; 161 size_t n, num_digits; 162 163 for (num_digits = 0; num_digits < AVB_MAX_DIGITS_UINT64 - 1;) { 164 rev_digits[num_digits++] = avb_div_by_10(&value) + '0'; 165 if (value == 0) { 166 break; 167 } 168 } 169 170 for (n = 0; n < num_digits; n++) { 171 digits[n] = rev_digits[num_digits - 1 - n]; 172 } 173 digits[n] = '\0'; 174 return n; 175 } 176 177 static int cmdline_append_version(AvbSlotVerifyData* slot_data, 178 const char* key, 179 uint64_t major_version, 180 uint64_t minor_version) { 181 char major_digits[AVB_MAX_DIGITS_UINT64]; 182 char minor_digits[AVB_MAX_DIGITS_UINT64]; 183 char combined[AVB_MAX_DIGITS_UINT64 * 2 + 1]; 184 size_t num_major_digits, num_minor_digits; 185 186 num_major_digits = uint64_to_base10(major_version, major_digits); 187 num_minor_digits = uint64_to_base10(minor_version, minor_digits); 188 avb_memcpy(combined, major_digits, num_major_digits); 189 combined[num_major_digits] = '.'; 190 avb_memcpy(combined + num_major_digits + 1, minor_digits, num_minor_digits); 191 combined[num_major_digits + 1 + num_minor_digits] = '\0'; 192 193 return cmdline_append_option(slot_data, key, combined); 194 } 195 196 static int cmdline_append_uint64_base10(AvbSlotVerifyData* slot_data, 197 const char* key, 198 uint64_t value) { 199 char digits[AVB_MAX_DIGITS_UINT64]; 200 uint64_to_base10(value, digits); 201 return cmdline_append_option(slot_data, key, digits); 202 } 203 204 static int cmdline_append_hex(AvbSlotVerifyData* slot_data, 205 const char* key, 206 const uint8_t* data, 207 size_t data_len) { 208 int ret; 209 char* hex_data = avb_bin2hex(data, data_len); 210 if (hex_data == NULL) { 211 return 0; 212 } 213 ret = cmdline_append_option(slot_data, key, hex_data); 214 avb_free(hex_data); 215 return ret; 216 } 217 218 AvbSlotVerifyResult avb_append_options( 219 AvbOps* ops, 220 AvbSlotVerifyData* slot_data, 221 AvbVBMetaImageHeader* toplevel_vbmeta, 222 AvbAlgorithmType algorithm_type, 223 AvbHashtreeErrorMode hashtree_error_mode) { 224 AvbSlotVerifyResult ret; 225 const char* verity_mode; 226 bool is_device_unlocked; 227 AvbIOResult io_ret; 228 229 /* Add androidboot.vbmeta.device option. */ 230 if (!cmdline_append_option(slot_data, 231 "androidboot.vbmeta.device", 232 "PARTUUID=$(ANDROID_VBMETA_PARTUUID)")) { 233 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 234 goto out; 235 } 236 237 /* Add androidboot.vbmeta.avb_version option. */ 238 if (!cmdline_append_version(slot_data, 239 "androidboot.vbmeta.avb_version", 240 AVB_VERSION_MAJOR, 241 AVB_VERSION_MINOR)) { 242 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 243 goto out; 244 } 245 246 /* Set androidboot.avb.device_state to "locked" or "unlocked". */ 247 io_ret = ops->read_is_device_unlocked(ops, &is_device_unlocked); 248 if (io_ret == AVB_IO_RESULT_ERROR_OOM) { 249 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 250 goto out; 251 } else if (io_ret != AVB_IO_RESULT_OK) { 252 avb_error("Error getting device state.\n"); 253 ret = AVB_SLOT_VERIFY_RESULT_ERROR_IO; 254 goto out; 255 } 256 if (!cmdline_append_option(slot_data, 257 "androidboot.vbmeta.device_state", 258 is_device_unlocked ? "unlocked" : "locked")) { 259 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 260 goto out; 261 } 262 263 /* Set androidboot.vbmeta.{hash_alg, size, digest} - use same hash 264 * function as is used to sign vbmeta. 265 */ 266 switch (algorithm_type) { 267 /* Explicit fallthrough. */ 268 case AVB_ALGORITHM_TYPE_NONE: 269 case AVB_ALGORITHM_TYPE_SHA256_RSA2048: 270 case AVB_ALGORITHM_TYPE_SHA256_RSA4096: 271 case AVB_ALGORITHM_TYPE_SHA256_RSA8192: { 272 AvbSHA256Ctx ctx; 273 size_t n, total_size = 0; 274 avb_sha256_init(&ctx); 275 for (n = 0; n < slot_data->num_vbmeta_images; n++) { 276 avb_sha256_update(&ctx, 277 slot_data->vbmeta_images[n].vbmeta_data, 278 slot_data->vbmeta_images[n].vbmeta_size); 279 total_size += slot_data->vbmeta_images[n].vbmeta_size; 280 } 281 if (!cmdline_append_option( 282 slot_data, "androidboot.vbmeta.hash_alg", "sha256") || 283 !cmdline_append_uint64_base10( 284 slot_data, "androidboot.vbmeta.size", total_size) || 285 !cmdline_append_hex(slot_data, 286 "androidboot.vbmeta.digest", 287 avb_sha256_final(&ctx), 288 AVB_SHA256_DIGEST_SIZE)) { 289 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 290 goto out; 291 } 292 } break; 293 /* Explicit fallthrough. */ 294 case AVB_ALGORITHM_TYPE_SHA512_RSA2048: 295 case AVB_ALGORITHM_TYPE_SHA512_RSA4096: 296 case AVB_ALGORITHM_TYPE_SHA512_RSA8192: { 297 AvbSHA512Ctx ctx; 298 size_t n, total_size = 0; 299 avb_sha512_init(&ctx); 300 for (n = 0; n < slot_data->num_vbmeta_images; n++) { 301 avb_sha512_update(&ctx, 302 slot_data->vbmeta_images[n].vbmeta_data, 303 slot_data->vbmeta_images[n].vbmeta_size); 304 total_size += slot_data->vbmeta_images[n].vbmeta_size; 305 } 306 if (!cmdline_append_option( 307 slot_data, "androidboot.vbmeta.hash_alg", "sha512") || 308 !cmdline_append_uint64_base10( 309 slot_data, "androidboot.vbmeta.size", total_size) || 310 !cmdline_append_hex(slot_data, 311 "androidboot.vbmeta.digest", 312 avb_sha512_final(&ctx), 313 AVB_SHA512_DIGEST_SIZE)) { 314 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 315 goto out; 316 } 317 } break; 318 case _AVB_ALGORITHM_NUM_TYPES: 319 avb_assert_not_reached(); 320 break; 321 } 322 323 /* Set androidboot.veritymode and androidboot.vbmeta.invalidate_on_error */ 324 if (toplevel_vbmeta->flags & AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED) { 325 verity_mode = "disabled"; 326 } else { 327 const char* dm_verity_mode; 328 char* new_ret; 329 330 switch (hashtree_error_mode) { 331 case AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE: 332 if (!cmdline_append_option( 333 slot_data, "androidboot.vbmeta.invalidate_on_error", "yes")) { 334 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 335 goto out; 336 } 337 verity_mode = "enforcing"; 338 dm_verity_mode = "restart_on_corruption"; 339 break; 340 case AVB_HASHTREE_ERROR_MODE_RESTART: 341 verity_mode = "enforcing"; 342 dm_verity_mode = "restart_on_corruption"; 343 break; 344 case AVB_HASHTREE_ERROR_MODE_EIO: 345 verity_mode = "eio"; 346 /* For now there's no option to specify the EIO mode. So 347 * just use 'ignore_zero_blocks' since that's already set 348 * and dm-verity-target.c supports specifying this multiple 349 * times. 350 */ 351 dm_verity_mode = "ignore_zero_blocks"; 352 break; 353 case AVB_HASHTREE_ERROR_MODE_LOGGING: 354 verity_mode = "logging"; 355 dm_verity_mode = "ignore_corruption"; 356 break; 357 } 358 new_ret = avb_replace( 359 slot_data->cmdline, "$(ANDROID_VERITY_MODE)", dm_verity_mode); 360 avb_free(slot_data->cmdline); 361 slot_data->cmdline = new_ret; 362 if (slot_data->cmdline == NULL) { 363 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 364 goto out; 365 } 366 } 367 if (!cmdline_append_option( 368 slot_data, "androidboot.veritymode", verity_mode)) { 369 ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 370 goto out; 371 } 372 373 ret = AVB_SLOT_VERIFY_RESULT_OK; 374 375 out: 376 377 return ret; 378 } 379 380 AvbCmdlineSubstList* avb_new_cmdline_subst_list() { 381 return (AvbCmdlineSubstList*)avb_calloc(sizeof(AvbCmdlineSubstList)); 382 } 383 384 void avb_free_cmdline_subst_list(AvbCmdlineSubstList* cmdline_subst) { 385 size_t i; 386 for (i = 0; i < cmdline_subst->size; ++i) { 387 avb_free(cmdline_subst->tokens[i]); 388 avb_free(cmdline_subst->values[i]); 389 } 390 cmdline_subst->size = 0; 391 avb_free(cmdline_subst); 392 } 393 394 AvbSlotVerifyResult avb_add_root_digest_substitution( 395 const char* part_name, 396 const uint8_t* digest, 397 size_t digest_size, 398 AvbCmdlineSubstList* out_cmdline_subst) { 399 const char* kDigestSubPrefix = "$(AVB_"; 400 const char* kDigestSubSuffix = "_ROOT_DIGEST)"; 401 size_t part_name_len = avb_strlen(part_name); 402 size_t list_index = out_cmdline_subst->size; 403 404 avb_assert(part_name_len < AVB_PART_NAME_MAX_SIZE); 405 avb_assert(digest_size <= AVB_SHA512_DIGEST_SIZE); 406 if (part_name_len >= AVB_PART_NAME_MAX_SIZE || 407 digest_size > AVB_SHA512_DIGEST_SIZE) { 408 return AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA; 409 } 410 411 if (out_cmdline_subst->size >= AVB_MAX_NUM_CMDLINE_SUBST) { 412 /* The list is full. Currently dynamic growth of this list is not supported. 413 */ 414 return AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA; 415 } 416 417 /* Construct the token to replace in the command line based on the partition 418 * name. For partition 'foo', this will be '$(AVB_FOO_ROOT_DIGEST)'. 419 */ 420 out_cmdline_subst->tokens[list_index] = 421 avb_strdupv(kDigestSubPrefix, part_name, kDigestSubSuffix, NULL); 422 if (out_cmdline_subst->tokens[list_index] == NULL) { 423 goto fail; 424 } 425 avb_uppercase(out_cmdline_subst->tokens[list_index]); 426 427 /* The digest value is hex encoded when inserted in the command line. */ 428 out_cmdline_subst->values[list_index] = avb_bin2hex(digest, digest_size); 429 if (out_cmdline_subst->values[list_index] == NULL) { 430 goto fail; 431 } 432 433 out_cmdline_subst->size++; 434 return AVB_SLOT_VERIFY_RESULT_OK; 435 436 fail: 437 if (out_cmdline_subst->tokens[list_index]) { 438 avb_free(out_cmdline_subst->tokens[list_index]); 439 } 440 if (out_cmdline_subst->values[list_index]) { 441 avb_free(out_cmdline_subst->values[list_index]); 442 } 443 return AVB_SLOT_VERIFY_RESULT_ERROR_OOM; 444 } 445
