Merge "Refactor update_verifier into a class" (ff29eb7f) · Commits · e / os / android_bootable_recovery

tests/component/update_verifier_test.cpp

+40 −23

Original line number	Diff line number	Diff line
		@@ -29,19 +29,29 @@

		#include "care_map.pb.h"

		using namespace std::string_literals;

		class UpdateVerifierTest : public ::testing::Test {
		protected:
		void SetUp() override {
		std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", "");
		verity_supported = android::base::EqualsIgnoreCase(verity_mode, "enforcing");

		care_map_pb_ = care_map_dir_.path + "/care_map.pb"s;
		care_map_txt_ = care_map_dir_.path + "/care_map.txt"s;
		}

		void TearDown() override {
		unlink(care_map_pb_.c_str());
		unlink(care_map_txt_.c_str());
		}

		// Returns a serialized string of the proto3 message according to the given partition info.
		std::string ConstructProto(
		std::vector<std::unordered_map<std::string, std::string>>& partitions) {
		UpdateVerifier::CareMap result;
		recovery_update_verifier::CareMap result;
		for (const auto& partition : partitions) {
		UpdateVerifier::CareMap::PartitionInfo info;
		recovery_update_verifier::CareMap::PartitionInfo info;
		if (partition.find("name") != partition.end()) {
		info.set_name(partition.at("name"));
		}
		@@ -59,12 +69,16 @@ class UpdateVerifierTest : public ::testing::Test {
		}

		bool verity_supported;
		TemporaryFile care_map_file;
		UpdateVerifier verifier_;

		TemporaryDir care_map_dir_;
		std::string care_map_pb_;
		std::string care_map_txt_;
		};

		TEST_F(UpdateVerifierTest, verify_image_no_care_map) {
		// Non-existing care_map is allowed.
		ASSERT_TRUE(verify_image("/doesntexist"));
		ASSERT_FALSE(verifier_.ParseCareMap("/doesntexist"));
		}

		TEST_F(UpdateVerifierTest, verify_image_smoke) {
		@@ -75,25 +89,27 @@ TEST_F(UpdateVerifierTest, verify_image_smoke) {
		}

		std::string content = "system\n2,0,1";
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path));
		ASSERT_TRUE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_));
		ASSERT_TRUE(verifier_.ParseCareMap(care_map_txt_));
		ASSERT_TRUE(verifier_.VerifyPartitions());

		// Leading and trailing newlines should be accepted.
		ASSERT_TRUE(android::base::WriteStringToFile("\n" + content + "\n\n", care_map_file.path));
		ASSERT_TRUE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile("\n" + content + "\n\n", care_map_txt_));
		ASSERT_TRUE(verifier_.ParseCareMap(care_map_txt_));
		ASSERT_TRUE(verifier_.VerifyPartitions());
		}

		TEST_F(UpdateVerifierTest, verify_image_empty_care_map) {
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_));
		}

		TEST_F(UpdateVerifierTest, verify_image_wrong_lines) {
		// The care map file can have only 2 / 4 / 6 lines.
		ASSERT_TRUE(android::base::WriteStringToFile("line1", care_map_file.path));
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile("line1", care_map_txt_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_));

		ASSERT_TRUE(android::base::WriteStringToFile("line1\nline2\nline3", care_map_file.path));
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile("line1\nline2\nline3", care_map_txt_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_));
		}

		TEST_F(UpdateVerifierTest, verify_image_malformed_care_map) {
		@@ -104,8 +120,8 @@ TEST_F(UpdateVerifierTest, verify_image_malformed_care_map) {
		}

		std::string content = "system\n2,1,0";
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path));
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_));
		}

		TEST_F(UpdateVerifierTest, verify_image_legacy_care_map) {
		@@ -116,8 +132,8 @@ TEST_F(UpdateVerifierTest, verify_image_legacy_care_map) {
		}

		std::string content = "/dev/block/bootdevice/by-name/system\n2,1,0";
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_file.path));
		ASSERT_TRUE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(content, care_map_txt_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_txt_));
		}

		TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_smoke) {
		@@ -132,8 +148,9 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_smoke) {
		};

		std::string proto = ConstructProto(partitions);
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path));
		ASSERT_TRUE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_));
		ASSERT_TRUE(verifier_.ParseCareMap(care_map_pb_));
		ASSERT_TRUE(verifier_.VerifyPartitions());
		}

		TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_missing_name) {
		@@ -148,8 +165,8 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_missing_name) {
		};

		std::string proto = ConstructProto(partitions);
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path));
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_pb_));
		}

		TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_bad_ranges) {
		@@ -164,6 +181,6 @@ TEST_F(UpdateVerifierTest, verify_image_protobuf_care_map_bad_ranges) {
		};

		std::string proto = ConstructProto(partitions);
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_file.path));
		ASSERT_FALSE(verify_image(care_map_file.path));
		ASSERT_TRUE(android::base::WriteStringToFile(proto, care_map_pb_));
		ASSERT_FALSE(verifier_.ParseCareMap(care_map_pb_));
		}

update_verifier/Android.bp

+2 −3

Original line number	Diff line number	Diff line
		@@ -15,9 +15,8 @@
		cc_defaults {
		name: "update_verifier_defaults",

		cflags: [
		"-Wall",
		"-Werror",
		defaults: [
		"recovery_defaults",
		],

		local_include_dirs: [

update_verifier/care_map.proto

+1 −1

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@

		syntax = "proto3";

		package UpdateVerifier;
		package recovery_update_verifier;
		option optimize_for = LITE_RUNTIME;

		message CareMap {

update_verifier/include/update_verifier/update_verifier.h

+35 −7

Original line number	Diff line number	Diff line
		@@ -16,17 +16,45 @@

		#pragma once

		#include <map>
		#include <string>
		#include <vector>

		int update_verifier(int argc, char** argv);
		#include "otautil/rangeset.h"

		// The update verifier performs verification upon the first boot to a new slot on A/B devices.
		// During the verification, it reads all the blocks in the care_map. And if a failure happens,
		// it rejects the current boot and triggers a fallback.

		// Returns true to indicate a passing verification (or the error should be ignored); Otherwise
		// returns false on fatal errors, where we should reject the current boot and trigger a fallback.
		// This function tries to process the care_map.txt as protobuf message; and falls back to use the
		// plain text format if the parse failed.
		//
		// Note that update_verifier should be backward compatible to not reject care_map.txt from old
		// releases, which could otherwise fail to boot into the new release. For example, we've changed
		// the care_map format between N and O. An O update_verifier would fail to work with N care_map.txt.
		// This could be a result of sideloading an O OTA while the device having a pending N update.
		bool verify_image(const std::string& care_map_name);
		int update_verifier(int argc, char** argv);

		// The UpdateVerifier parses the content in the care map, and continues to verify the
		// partitions by reading the cared blocks if there's no format error in the file. Otherwise,
		// it should skip the verification to avoid bricking the device.
		class UpdateVerifier {
		public:
		// This function tries to process the care_map.pb as protobuf message; and falls back to use
		// care_map.txt if the pb format file doesn't exist. If the parsing succeeds, put the result of
		// the pair <partition_name, ranges> into the \|partition_map_\|.
		bool ParseCareMap(const std::string& file_name = "");

		// Verifies the new boot by reading all the cared blocks for partitions in \|partition_map_\|.
		bool VerifyPartitions();

		private:
		// Parses the legacy care_map.txt in plain text format.
		bool ParseCareMapPlainText(const std::string& content);

		// Finds all the dm-enabled partitions, and returns a map of <partition_name, block_device>.
		std::map<std::string, std::string> FindDmPartitions();

		// Returns true if we successfully read the blocks in \|ranges\| of the \|dm_block_device\|.
		bool ReadBlocks(const std::string partition_name, const std::string& dm_block_device,
		const RangeSet& ranges);

		std::map<std::string, RangeSet> partition_map_;
		};

update_verifier/update_verifier.cpp

+97 −61

Original line number	Diff line number	Diff line
		@@ -48,8 +48,6 @@

		#include <algorithm>
		#include <future>
		#include <string>
		#include <vector>

		#include <android-base/file.h>
		#include <android-base/logging.h>
		@@ -61,7 +59,6 @@
		#include <cutils/android_reboot.h>

		#include "care_map.pb.h"
		#include "otautil/rangeset.h"

		using android::sp;
		using android::hardware::boot::V1_0::IBootControl;
		@@ -76,29 +73,25 @@ static int dm_name_filter(const dirent* de) {
		return 0;
		}

		static bool read_blocks(const std::string& partition, const std::string& range_str) {
		if (partition != "system" && partition != "vendor" && partition != "product") {
		LOG(ERROR) << "Invalid partition name \"" << partition << "\"";
		return false;
		}
		// Iterate the content of "/sys/block/dm-X/dm/name". If it matches one of "system", "vendor" or
		// "product", then dm-X is a dm-wrapped device for that target. We will later read all the
		// ("cared") blocks from "/dev/block/dm-X" to ensure the target partition's integrity.
		// Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices.
		// We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target
		// partition's integrity.
		std::map<std::string, std::string> UpdateVerifier::FindDmPartitions() {
		static constexpr auto DM_PATH_PREFIX = "/sys/block/";
		dirent** namelist;
		int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort);
		if (n == -1) {
		PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX;
		return false;
		return {};
		}
		if (n == 0) {
		LOG(ERROR) << "dm block device not found for " << partition;
		return false;
		LOG(ERROR) << "No dm block device found.";
		return {};
		}

		static constexpr auto DM_PATH_SUFFIX = "/dm/name";
		static constexpr auto DEV_PATH = "/dev/block/";
		std::string dm_block_device;
		std::map<std::string, std::string> dm_block_devices;
		while (n--) {
		std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX;
		std::string content;
		@@ -110,33 +103,18 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
		if (dm_block_name == "vroot") {
		dm_block_name = "system";
		}
		if (dm_block_name == partition) {
		dm_block_device = DEV_PATH + std::string(namelist[n]->d_name);
		while (n--) {
		free(namelist[n]);
		}
		break;
		}

		dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name));
		}
		free(namelist[n]);
		}
		free(namelist);

		if (dm_block_device.empty()) {
		LOG(ERROR) << "Failed to find dm block device for " << partition;
		return false;
		}

		// For block range string, first integer 'count' equals 2 * total number of valid ranges,
		// followed by 'count' number comma separated integers. Every two integers reprensent a
		// block range with the first number included in range but second number not included.
		// For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150).
		RangeSet ranges = RangeSet::Parse(range_str);
		if (!ranges) {
		LOG(ERROR) << "Error parsing RangeSet string " << range_str;
		return false;
		return dm_block_devices;
		}

		bool UpdateVerifier::ReadBlocks(const std::string partition_name,
		const std::string& dm_block_device, const RangeSet& ranges) {
		// RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for
		// the last group).
		size_t thread_num = std::thread::hardware_concurrency() ?: 4;
		@@ -144,10 +122,10 @@ static bool read_blocks(const std::string& partition, const std::string& range_s

		std::vector<std::future<bool>> threads;
		for (const auto& group : groups) {
		auto thread_func = [&group, &dm_block_device, &partition]() {
		auto thread_func = [&group, &dm_block_device, &partition_name]() {
		android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY)));
		if (fd.get() == -1) {
		PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition;
		PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name;
		return false;
		}

		@@ -155,9 +133,7 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
		std::vector<uint8_t> buf(1024 * kBlockSize);

		size_t block_count = 0;
		for (const auto& range : group) {
		size_t range_start = range.first;
		size_t range_end = range.second;
		for (const auto& [range_start, range_end] : group) {
		if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) {
		PLOG(ERROR) << "lseek to " << range_start << " failed";
		return false;
		@@ -190,72 +166,130 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
		return ret;
		}

		static bool process_care_map_plain_text(const std::string& care_map_contents) {
		bool UpdateVerifier::VerifyPartitions() {
		auto dm_block_devices = FindDmPartitions();
		if (dm_block_devices.empty()) {
		LOG(ERROR) << "No dm-enabled block device is found.";
		return false;
		}

		for (const auto& [partition_name, ranges] : partition_map_) {
		if (dm_block_devices.find(partition_name) == dm_block_devices.end()) {
		LOG(ERROR) << "Failed to find dm block device for " << partition_name;
		return false;
		}

		if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) {
		return false;
		}
		}

		return true;
		}

		bool UpdateVerifier::ParseCareMapPlainText(const std::string& content) {
		// care_map file has up to six lines, where every two lines make a pair. Within each pair, the
		// first line has the partition name (e.g. "system"), while the second line holds the ranges of
		// all the blocks to verify.
		std::vector<std::string> lines =
		android::base::Split(android::base::Trim(care_map_contents), "\n");
		auto lines = android::base::Split(android::base::Trim(content), "\n");
		if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) {
		LOG(ERROR) << "Invalid lines in care_map: found " << lines.size()
		LOG(WARNING) << "Invalid lines in care_map: found " << lines.size()
		<< " lines, expecting 2 or 4 or 6 lines.";
		return false;
		}

		for (size_t i = 0; i < lines.size(); i += 2) {
		const std::string& partition_name = lines[i];
		const std::string& range_str = lines[i + 1];
		// We're seeing an N care_map.txt. Skip the verification since it's not compatible with O
		// update_verifier (the last few metadata blocks can't be read via device mapper).
		if (android::base::StartsWith(lines[i], "/dev/block/")) {
		if (android::base::StartsWith(partition_name, "/dev/block/")) {
		LOG(WARNING) << "Found legacy care_map.txt; skipped.";
		return true;
		return false;
		}
		if (!read_blocks(lines[i], lines[i+1])) {

		// For block range string, first integer 'count' equals 2 * total number of valid ranges,
		// followed by 'count' number comma separated integers. Every two integers reprensent a
		// block range with the first number included in range but second number not included.
		// For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150).
		RangeSet ranges = RangeSet::Parse(range_str);
		if (!ranges) {
		LOG(WARNING) << "Error parsing RangeSet string " << range_str;
		return false;
		}

		partition_map_.emplace(partition_name, ranges);
		}

		return true;
		}

		bool verify_image(const std::string& care_map_name) {
		bool UpdateVerifier::ParseCareMap(const std::string& file_name) {
		partition_map_.clear();

		std::string care_map_name = file_name;
		if (care_map_name.empty()) {
		std::string care_map_prefix = "/data/ota_package/care_map";
		care_map_name = care_map_prefix + ".pb";
		if (access(care_map_name.c_str(), R_OK) == -1) {
		LOG(WARNING) << care_map_name
		<< " doesn't exist, falling back to read the care_map in plain text format.";
		care_map_name = care_map_prefix + ".txt";
		}
		}

		android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY)));
		// If the device is flashed before the current boot, it may not have care_map.txt in
		// /data/ota_package. To allow the device to continue booting in this situation, we should
		// print a warning and skip the block verification.
		if (care_map_fd.get() == -1) {
		PLOG(WARNING) << "Failed to open " << care_map_name;
		return true;
		return false;
		}

		std::string file_content;
		if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) {
		PLOG(ERROR) << "Failed to read " << care_map_name;
		PLOG(WARNING) << "Failed to read " << care_map_name;
		return false;
		}

		if (file_content.empty()) {
		LOG(ERROR) << "Unexpected empty care map";
		LOG(WARNING) << "Unexpected empty care map";
		return false;
		}

		UpdateVerifier::CareMap care_map;
		// Falls back to use the plain text version if we cannot parse the file as protobuf message.
		if (android::base::EndsWith(care_map_name, ".txt")) {
		return ParseCareMapPlainText(file_content);
		}

		recovery_update_verifier::CareMap care_map;
		if (!care_map.ParseFromString(file_content)) {
		return process_care_map_plain_text(file_content);
		LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format.";
		return false;
		}

		for (const auto& partition : care_map.partitions()) {
		if (partition.name().empty()) {
		LOG(ERROR) << "Unexpected empty partition name.";
		LOG(WARNING) << "Unexpected empty partition name.";
		return false;
		}
		if (partition.ranges().empty()) {
		LOG(ERROR) << "Unexpected block ranges for partition " << partition.name();
		LOG(WARNING) << "Unexpected block ranges for partition " << partition.name();
		return false;
		}
		if (!read_blocks(partition.name(), partition.ranges())) {
		RangeSet ranges = RangeSet::Parse(partition.ranges());
		if (!ranges) {
		LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges();
		return false;
		}

		// TODO(xunchang) compare the fingerprint of the partition.
		partition_map_.emplace(partition.name(), ranges);
		}

		if (partition_map_.empty()) {
		LOG(WARNING) << "No partition to verify";
		return false;
		}

		return true;
		@@ -308,8 +342,10 @@ int update_verifier(int argc, char** argv) {
		}

		if (!skip_verification) {
		static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt";
		if (!verify_image(CARE_MAP_FILE)) {
		UpdateVerifier verifier;
		if (!verifier.ParseCareMap()) {
		LOG(WARNING) << "Failed to parse the care map file, skipping verification";
		} else if (!verifier.VerifyPartitions()) {
		LOG(ERROR) << "Failed to verify all blocks in care map file.";
		return reboot_device();
		}