1 /*
2  * Copyright (C) 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 /*
18  * update_verifier verifies the integrity of the partitions after an A/B OTA update. It gets invoked
19  * by init, and will only perform the verification if it's the first boot post an A/B OTA update
20  * (https://source.android.com/devices/tech/ota/ab/#after_reboot).
21  *
22  * update_verifier relies on device-mapper-verity (dm-verity) to capture any corruption on the
23  * partitions being verified (https://source.android.com/security/verifiedboot). The verification
24  * will be skipped, if dm-verity is not enabled on the device.
25  *
26  * Upon detecting verification failures, the device will be rebooted, although the trigger of the
27  * reboot depends on the dm-verity mode.
28  *   enforcing mode: dm-verity reboots the device
29  *   eio mode: dm-verity fails the read and update_verifier reboots the device
30  *   other mode: not supported and update_verifier reboots the device
31  *
32  * All these reboots prevent the device from booting into a known corrupt state. If the device
33  * continuously fails to boot into the new slot, the bootloader should mark the slot as unbootable
34  * and trigger a fallback to the old slot.
35  *
36  * The current slot will be marked as having booted successfully if the verifier reaches the end
37  * after the verification.
38  */
39 
40 #include "update_verifier/update_verifier.h"
41 
42 #include <dirent.h>
43 #include <errno.h>
44 #include <fcntl.h>
45 #include <stdint.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <string.h>
49 #include <unistd.h>
50 
51 #include <algorithm>
52 #include <future>
53 #include <thread>
54 
55 #include <android-base/file.h>
56 #include <android-base/logging.h>
57 #include <android-base/parseint.h>
58 #include <android-base/properties.h>
59 #include <android-base/strings.h>
60 #include <android-base/unique_fd.h>
61 #include <android/hardware/boot/1.0/IBootControl.h>
62 #include <android/os/IVold.h>
63 #include <binder/BinderService.h>
64 #include <binder/Status.h>
65 #include <cutils/android_reboot.h>
66 
67 #include "care_map.pb.h"
68 
69 using android::sp;
70 using android::hardware::boot::V1_0::IBootControl;
71 using android::hardware::boot::V1_0::BoolResult;
72 using android::hardware::boot::V1_0::CommandResult;
73 
74 // TODO(xunchang) remove the prefix and use a default path instead.
75 constexpr const char* kDefaultCareMapPrefix = "/data/ota_package/care_map";
76 
77 // Find directories in format of "/sys/block/dm-X".
dm_name_filter(const dirent * de)78 static int dm_name_filter(const dirent* de) {
79   if (android::base::StartsWith(de->d_name, "dm-")) {
80     return 1;
81   }
82   return 0;
83 }
84 
UpdateVerifier()85 UpdateVerifier::UpdateVerifier()
86     : care_map_prefix_(kDefaultCareMapPrefix),
87       property_reader_([](const std::string& id) { return android::base::GetProperty(id, ""); }) {}
88 
89 // Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices.
90 // We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target
91 // partition's integrity.
FindDmPartitions()92 std::map<std::string, std::string> UpdateVerifier::FindDmPartitions() {
93   static constexpr auto DM_PATH_PREFIX = "/sys/block/";
94   dirent** namelist;
95   int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort);
96   if (n == -1) {
97     PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX;
98     return {};
99   }
100   if (n == 0) {
101     LOG(ERROR) << "No dm block device found.";
102     return {};
103   }
104 
105   static constexpr auto DM_PATH_SUFFIX = "/dm/name";
106   static constexpr auto DEV_PATH = "/dev/block/";
107   std::map<std::string, std::string> dm_block_devices;
108   while (n--) {
109     std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX;
110     std::string content;
111     if (!android::base::ReadFileToString(path, &content)) {
112       PLOG(WARNING) << "Failed to read " << path;
113     } else {
114       std::string dm_block_name = android::base::Trim(content);
115       // AVB is using 'vroot' for the root block device but we're expecting 'system'.
116       if (dm_block_name == "vroot") {
117         dm_block_name = "system";
118       } else if (android::base::EndsWith(dm_block_name, "-verity")) {
119         auto npos = dm_block_name.rfind("-verity");
120         dm_block_name = dm_block_name.substr(0, npos);
121       } else if (!android::base::GetProperty("ro.boot.avb_version", "").empty()) {
122         // Verified Boot 1.0 doesn't add a -verity suffix. On AVB 2 devices,
123         // if DAP is enabled, then a -verity suffix must be used to
124         // differentiate between dm-linear and dm-verity devices. If we get
125         // here, we're AVB 2 and looking at a non-verity partition.
126         continue;
127       }
128 
129       dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name));
130     }
131     free(namelist[n]);
132   }
133   free(namelist);
134 
135   return dm_block_devices;
136 }
137 
ReadBlocks(const std::string partition_name,const std::string & dm_block_device,const RangeSet & ranges)138 bool UpdateVerifier::ReadBlocks(const std::string partition_name,
139                                 const std::string& dm_block_device, const RangeSet& ranges) {
140   // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for
141   // the last group).
142   size_t thread_num = std::thread::hardware_concurrency() ?: 4;
143   std::vector<RangeSet> groups = ranges.Split(thread_num);
144 
145   std::vector<std::future<bool>> threads;
146   for (const auto& group : groups) {
147     auto thread_func = [&group, &dm_block_device, &partition_name]() {
148       android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY)));
149       if (fd.get() == -1) {
150         PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name;
151         return false;
152       }
153 
154       static constexpr size_t kBlockSize = 4096;
155       std::vector<uint8_t> buf(1024 * kBlockSize);
156 
157       size_t block_count = 0;
158       for (const auto& [range_start, range_end] : group) {
159         if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) {
160           PLOG(ERROR) << "lseek to " << range_start << " failed";
161           return false;
162         }
163 
164         size_t remain = (range_end - range_start) * kBlockSize;
165         while (remain > 0) {
166           size_t to_read = std::min(remain, 1024 * kBlockSize);
167           if (!android::base::ReadFully(fd.get(), buf.data(), to_read)) {
168             PLOG(ERROR) << "Failed to read blocks " << range_start << " to " << range_end;
169             return false;
170           }
171           remain -= to_read;
172         }
173         block_count += (range_end - range_start);
174       }
175       LOG(INFO) << "Finished reading " << block_count << " blocks on " << dm_block_device;
176       return true;
177     };
178 
179     threads.emplace_back(std::async(std::launch::async, thread_func));
180   }
181 
182   bool ret = true;
183   for (auto& t : threads) {
184     ret = t.get() && ret;
185   }
186   LOG(INFO) << "Finished reading blocks on " << dm_block_device << " with " << thread_num
187             << " threads.";
188   return ret;
189 }
190 
VerifyPartitions()191 bool UpdateVerifier::VerifyPartitions() {
192   auto dm_block_devices = FindDmPartitions();
193   if (dm_block_devices.empty()) {
194     LOG(ERROR) << "No dm-enabled block device is found.";
195     return false;
196   }
197 
198   for (const auto& [partition_name, ranges] : partition_map_) {
199     if (dm_block_devices.find(partition_name) == dm_block_devices.end()) {
200       LOG(ERROR) << "Failed to find dm block device for " << partition_name;
201       return false;
202     }
203 
204     if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) {
205       return false;
206     }
207   }
208 
209   return true;
210 }
211 
ParseCareMap()212 bool UpdateVerifier::ParseCareMap() {
213   partition_map_.clear();
214 
215   std::string care_map_name = care_map_prefix_ + ".pb";
216   if (access(care_map_name.c_str(), R_OK) == -1) {
217     LOG(ERROR) << care_map_name << " doesn't exist";
218     return false;
219   }
220 
221   android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY)));
222   // If the device is flashed before the current boot, it may not have care_map.txt in
223   // /data/ota_package. To allow the device to continue booting in this situation, we should
224   // print a warning and skip the block verification.
225   if (care_map_fd.get() == -1) {
226     PLOG(WARNING) << "Failed to open " << care_map_name;
227     return false;
228   }
229 
230   std::string file_content;
231   if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) {
232     PLOG(WARNING) << "Failed to read " << care_map_name;
233     return false;
234   }
235 
236   if (file_content.empty()) {
237     LOG(WARNING) << "Unexpected empty care map";
238     return false;
239   }
240 
241   recovery_update_verifier::CareMap care_map;
242   if (!care_map.ParseFromString(file_content)) {
243     LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format.";
244     return false;
245   }
246 
247   for (const auto& partition : care_map.partitions()) {
248     if (partition.name().empty()) {
249       LOG(WARNING) << "Unexpected empty partition name.";
250       return false;
251     }
252     if (partition.ranges().empty()) {
253       LOG(WARNING) << "Unexpected block ranges for partition " << partition.name();
254       return false;
255     }
256     RangeSet ranges = RangeSet::Parse(partition.ranges());
257     if (!ranges) {
258       LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges();
259       return false;
260     }
261 
262     // Continues to check other partitions if there is a fingerprint mismatch.
263     if (partition.id().empty() || partition.id() == "unknown") {
264       LOG(WARNING) << "Skip reading partition " << partition.name()
265                    << ": property_id is not provided to get fingerprint.";
266       continue;
267     }
268 
269     std::string fingerprint = property_reader_(partition.id());
270     if (fingerprint != partition.fingerprint()) {
271       LOG(WARNING) << "Skip reading partition " << partition.name() << ": fingerprint "
272                    << fingerprint << " doesn't match the expected value "
273                    << partition.fingerprint();
274       continue;
275     }
276 
277     partition_map_.emplace(partition.name(), ranges);
278   }
279 
280   if (partition_map_.empty()) {
281     LOG(WARNING) << "No partition to verify";
282     return false;
283   }
284 
285   return true;
286 }
287 
set_care_map_prefix(const std::string & prefix)288 void UpdateVerifier::set_care_map_prefix(const std::string& prefix) {
289   care_map_prefix_ = prefix;
290 }
291 
set_property_reader(const std::function<std::string (const std::string &)> & property_reader)292 void UpdateVerifier::set_property_reader(
293     const std::function<std::string(const std::string&)>& property_reader) {
294   property_reader_ = property_reader;
295 }
296 
reboot_device()297 static int reboot_device() {
298   if (android_reboot(ANDROID_RB_RESTART2, 0, nullptr) == -1) {
299     LOG(ERROR) << "Failed to reboot.";
300     return -1;
301   }
302   while (true) pause();
303 }
304 
update_verifier(int argc,char ** argv)305 int update_verifier(int argc, char** argv) {
306   for (int i = 1; i < argc; i++) {
307     LOG(INFO) << "Started with arg " << i << ": " << argv[i];
308   }
309 
310   sp<IBootControl> module = IBootControl::getService();
311   if (module == nullptr) {
312     LOG(ERROR) << "Error getting bootctrl module.";
313     return reboot_device();
314   }
315 
316   uint32_t current_slot = module->getCurrentSlot();
317   BoolResult is_successful = module->isSlotMarkedSuccessful(current_slot);
318   LOG(INFO) << "Booting slot " << current_slot << ": isSlotMarkedSuccessful="
319             << static_cast<int32_t>(is_successful);
320 
321   if (is_successful == BoolResult::FALSE) {
322     // The current slot has not booted successfully.
323 
324     bool skip_verification = false;
325     std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", "");
326     if (verity_mode.empty()) {
327       // Skip the verification if ro.boot.veritymode property is not set. This could be a result
328       // that device doesn't support dm-verity, or has disabled that.
329       LOG(WARNING) << "dm-verity not enabled; marking without verification.";
330       skip_verification = true;
331     } else if (android::base::EqualsIgnoreCase(verity_mode, "eio")) {
332       // We shouldn't see verity in EIO mode if the current slot hasn't booted successfully before.
333       // Continue the verification until we fail to read some blocks.
334       LOG(WARNING) << "Found dm-verity in EIO mode.";
335     } else if (android::base::EqualsIgnoreCase(verity_mode, "disabled")) {
336       LOG(WARNING) << "dm-verity in disabled mode; marking without verification.";
337       skip_verification = true;
338     } else if (verity_mode != "enforcing") {
339       LOG(ERROR) << "Unexpected dm-verity mode: " << verity_mode << ", expecting enforcing.";
340       return reboot_device();
341     }
342 
343     if (!skip_verification) {
344       UpdateVerifier verifier;
345       if (!verifier.ParseCareMap()) {
346         LOG(WARNING) << "Failed to parse the care map file, skipping verification";
347       } else if (!verifier.VerifyPartitions()) {
348         LOG(ERROR) << "Failed to verify all blocks in care map file.";
349         return reboot_device();
350       }
351     }
352 
353     bool supports_checkpoint = false;
354     auto sm = android::defaultServiceManager();
355     android::sp<android::IBinder> binder = sm->getService(android::String16("vold"));
356     if (binder) {
357       auto vold = android::interface_cast<android::os::IVold>(binder);
358       android::binder::Status status = vold->supportsCheckpoint(&supports_checkpoint);
359       if (!status.isOk()) {
360         LOG(ERROR) << "Failed to check if checkpoints supported. Continuing";
361       }
362     } else {
363       LOG(ERROR) << "Failed to obtain vold Binder. Continuing";
364     }
365 
366     if (!supports_checkpoint) {
367       CommandResult cr;
368       module->markBootSuccessful([&cr](CommandResult result) { cr = result; });
369       if (!cr.success) {
370         LOG(ERROR) << "Error marking booted successfully: " << cr.errMsg;
371         return reboot_device();
372       }
373       LOG(INFO) << "Marked slot " << current_slot << " as booted successfully.";
374       // Clears the warm reset flag for next reboot.
375       if (!android::base::SetProperty("ota.warm_reset", "0")) {
376         LOG(WARNING) << "Failed to reset the warm reset flag";
377       }
378     } else {
379       LOG(INFO) << "Deferred marking slot " << current_slot << " as booted successfully.";
380     }
381   }
382 
383   LOG(INFO) << "Leaving update_verifier.";
384   return 0;
385 }
386