summaryrefslogtreecommitdiffstats
path: root/update_verifier (unfollow)
Commit message (Collapse)AuthorFilesLines
2017-08-10update_verifier: verify blocks in parallelWei Wang1-31/+51
This CL is to change update_verifier to verify blocks in parallel to maximize storage bandwidth, it also preallocate the buffer to avoid vector allocation within reading loop. Test: care_map.txt: system 16,0,517,556,32770,33084,98306,98620,163842,164156,229378,229692,294914,295228,483544,524288,524296 vendor 8,0,119,135,32770,32831,96150,98304,98306 With CL: init: Service 'update_verifier_nonencrypted' (pid 711) exited with status 0 waiting took 2.978424 seconds Without CL: init: Service 'update_verifier_nonencrypted' (pid 695) exited with status 0 waiting took 4.466320 seconds Bug: 63686531 Test: reboot with manual insert care_map.txt Change-Id: Idf791865f15f6ff6cad89bf7ff230ee46c6adccc (cherry picked from commit bd9664b5a01c8941949212973ca12be4df1b5d54)
2017-08-09update_verifier: verify blocks in parallelWei Wang1-31/+51
This CL is to change update_verifier to verify blocks in parallel to maximize storage bandwidth, it also preallocate the buffer to avoid vector allocation within reading loop. Test: care_map.txt: system 16,0,517,556,32770,33084,98306,98620,163842,164156,229378,229692,294914,295228,483544,524288,524296 vendor 8,0,119,135,32770,32831,96150,98304,98306 With CL: init: Service 'update_verifier_nonencrypted' (pid 711) exited with status 0 waiting took 2.978424 seconds Without CL: init: Service 'update_verifier_nonencrypted' (pid 695) exited with status 0 waiting took 4.466320 seconds Bug: 63686531 Test: reboot with manual insert care_map.txt Change-Id: Idf791865f15f6ff6cad89bf7ff230ee46c6adccc
2017-08-09update_verifier: Support androidboot.veritymode being empty or 'disabled'.David Zeuthen1-4/+17
Bootloaders using libavb will set androidboot.veritymode=disabled if the "disable dm-verity" flag has been set. Additionally if the "disable verification" flag is set androidboot.veritymode will not be set at all. Handle both cases. Without this fix we'll end up in a bootloop. Test: Manually tested on a device using AVB. (cherry-picked from commit 1a0929cc8aac532dba00b3c98cea22715719a421) Bug: 64404283 Change-Id: I3adf93f8dfd528fe9b869a63afa775f5730a3f69
2017-08-08update_verifier: Support androidboot.veritymode being empty or 'disabled'.David Zeuthen1-4/+17
Bootloaders using libavb will set androidboot.veritymode=disabled if the "disable dm-verity" flag has been set. Additionally if the "disable verification" flag is set androidboot.veritymode will not be set at all. Handle both cases. Without this fix we'll end up in a bootloop. Test: Manually tested on a device using AVB. Bug: 64315394 Change-Id: I8310849e347248f4a96158838310f688ecef4211
2017-07-24update_verifier: Handle legacy care_map.txt gracefully.Tao Bao1-29/+42
update_verifier should be backward compatible to not reject legacy care_map.txt from old releases, which could otherwise fail to boot into the new release. For example, we've changed the care_map format between N and O. An O update_verifier would fail to work with an N care_map.txt - a) we have switched update_verifier to read from device mapper in O; b) the last few blocks that contain metadata can't be read via device mapper. This could be a result of sideloading an O OTA while the device having a pending N update. Bug: 63544345 Test: As follows on sailfish: 1. Flash the device with this CL; 2. Put a copy of N care_map.txt at /data/ota_package/. Restore the permissions properly ('cache' group); 3. `adb reboot bootloader`; 4. `fastboot set_active <current_slot>` 5. Device boots up into home screen, with a warning in logcat that says it has skipped legacy care_map.txt. Change-Id: I6acc88c9e655a9245e6531f176fef7953953935f (cherry picked from commit 5a1dee01df3af346729b5791606b72d59b8e9815)
2017-07-22update_verifier: Handle legacy care_map.txt gracefully.Tao Bao1-29/+42
update_verifier should be backward compatible to not reject legacy care_map.txt from old releases, which could otherwise fail to boot into the new release. For example, we've changed the care_map format between N and O. An O update_verifier would fail to work with an N care_map.txt - a) we have switched update_verifier to read from device mapper in O; b) the last few blocks that contain metadata can't be read via device mapper. This could be a result of sideloading an O OTA while the device having a pending N update. Bug: 63544345 Test: As follows on sailfish: 1. Flash the device with this CL; 2. Put a copy of N care_map.txt at /data/ota_package/. Restore the permissions properly ('cache' group); 3. `adb reboot bootloader`; 4. `fastboot set_active <current_slot>` 5. Device boots up into home screen, with a warning in logcat that says it has skipped legacy care_map.txt. Change-Id: I6acc88c9e655a9245e6531f176fef7953953935f
2017-06-23update_verifier: Support AVB.David Zeuthen2-6/+19
When using AVB, PRODUCT_SUPPORTS_VERITY is not set so check for BOARD_ENABLE_AVB as well. Also AVB sets up the root filesystem as 'vroot' so map that to 'system' since this is what is expected. Managed to test at least that the code is at least compiled in: $ fastboot --set-active=_a Setting current slot to 'a'... OKAY [ 0.023s] finished. total time: 0.023s $ fastboot reboot rebooting... finished. total time: 0.050s $ adb wait-for-device $ adb logcat |grep update_verifier 03-04 05:28:56.773 630 630 I /system/bin/update_verifier: Started with arg 1: nonencrypted 03-04 05:28:56.776 630 630 I /system/bin/update_verifier: Booting slot 0: isSlotMarkedSuccessful=0 03-04 05:28:56.776 630 630 W /system/bin/update_verifier: Failed to open /data/ota_package/care_map.txt: No such file or directory 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Marked slot 0 as booted successfully. 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Leaving update_verifier. Bug: 62464819 Test: Manually tested on device using AVB bootloader. Merged-In: I13c0fe1cc5d0f397e36f5e62fcc05c8dfee5fd85 Change-Id: I2834b17688053411e7b904e31df9c83bf904cd56
2017-05-24update_verifier: Support AVB.David Zeuthen2-6/+19
When using AVB, PRODUCT_SUPPORTS_VERITY is not set so check for BOARD_ENABLE_AVB as well. Also AVB sets up the root filesystem as 'vroot' so map that to 'system' since this is what is expected. Managed to test at least that the code is at least compiled in: $ fastboot --set-active=_a Setting current slot to 'a'... OKAY [ 0.023s] finished. total time: 0.023s $ fastboot reboot rebooting... finished. total time: 0.050s $ adb wait-for-device $ adb logcat |grep update_verifier 03-04 05:28:56.773 630 630 I /system/bin/update_verifier: Started with arg 1: nonencrypted 03-04 05:28:56.776 630 630 I /system/bin/update_verifier: Booting slot 0: isSlotMarkedSuccessful=0 03-04 05:28:56.776 630 630 W /system/bin/update_verifier: Failed to open /data/ota_package/care_map.txt: No such file or directory 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Marked slot 0 as booted successfully. 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Leaving update_verifier. Bug: None Test: Manually tested on device using AVB bootloader. Change-Id: I13c0fe1cc5d0f397e36f5e62fcc05c8dfee5fd85
2017-04-27Fix potential OOM in update_verifierTianjie Xu1-6/+11
Limit the size of each read to 1024 * BLOCKSIZE. (Same as the I/O limit of each transfer command for block based OTA). Bug: 37729708 Test: U_V sets slot successfully on sailfish, and it takes about ~20s (no noticeable time increase) Change-Id: I7a6cdc744fe4c0760e09e0afed75b89c16d8eac3
2017-04-27Separate libupdate_verifier module and add testcases.Tao Bao4-16/+90
Enable -Wall and expose verify_image() for testing purpose. Test: mmma bootable/recovery Test: recovery_component_test Change-Id: I1ee1db2a775bafdc1112e25a1bc7194d8d6aee4f
2017-04-19Add 'system' to update_verifier's gidTianjie Xu1-2/+2
This addresses the denial to /dev/cpuset/tasks: update_verifier: type=1400 audit(0.0:377): avc: denied { dac_override } for capability=1 scontext=u:r:update_verifier:s0 tcontext=u:r:update_verifier:s0 tclass=capability permissive=1 update_verifier: type=1400 audit(0.0:378): avc: granted { write } for name="tasks" dev="cgroup" ino=5 scontext=u:r:update_verifier:s0 tcontext=u:object_r:cgroup:s0 tclass=file Bug: 37358323 Test: denial message gone after adding system group Change-Id: I66b4925295a13fbc1c6f26a1bb9bd2f9cebcec3d (cherry-picked from 0ad2de5eab12dbf63ad43bd0c3e5ef729984cf81)
2017-04-18Add 'system' to update_verifier's gidTianjie Xu1-2/+2
This addresses the denial to /dev/cpuset/tasks: update_verifier: type=1400 audit(0.0:377): avc: denied { dac_override } for capability=1 scontext=u:r:update_verifier:s0 tcontext=u:r:update_verifier:s0 tclass=capability permissive=1 update_verifier: type=1400 audit(0.0:378): avc: granted { write } for name="tasks" dev="cgroup" ino=5 scontext=u:r:update_verifier:s0 tcontext=u:object_r:cgroup:s0 tclass=file Bug: 37358323 Test: denial message gone after adding system group Change-Id: I66b4925295a13fbc1c6f26a1bb9bd2f9cebcec3d
2017-04-04update_verifier: correct group in rc fileTom Cherry2-3/+3
update_verifier should be in the cache group, not 'class'. Also use PLOG instead of LOG if care_map.txt cannot be opened. Bug: 36818743 Test: boot sailfish Test: fake OTA on sailfish and verify update_verifier reads care_package (cherry picked from commit 3a8002f8c0382894b65ea3cece784287a75c7881) Change-Id: I7e4cccd457ee84054164077c81d04ad7cb394c7a
2017-04-04update_verifier: tweak priority of update_verifier for quick bootWei Wang1-2/+2
Highest ioprio is 0 for CFQ and we should run update_verifier with that. Tested on device and showing boottime decreased. Bug: 36511808 Bug: 36102163 Test: Boot marlin Change-Id: Iddd925951d976e21014b61e5590bcdae3cea8470 (cherry picked from commit a015cd1d7a3af5d9c06622e00be47fee52ba4b02)
2017-04-04update_verifier: correct group in rc fileTom Cherry2-3/+3
update_verifier should be in the cache group, not 'class'. Also use PLOG instead of LOG if care_map.txt cannot be opened. Bug: 36818743 Test: boot sailfish Test: fake OTA on sailfish and verify update_verifier reads care_package Change-Id: I0ec844cac5ef5c63b18ebee90160854fd84ee829
2017-04-03update_verifier: tweak priority of update_verifier for quick bootWei Wang1-2/+2
Highest ioprio is 0 for CFQ and we should run update_verifier with that. Tested on device and showing boottime decreased. Bug: 36511808 Bug: 36102163 Test: Boot marlin Change-Id: Iddd925951d976e21014b61e5590bcdae3cea8470
2017-04-02Merge "Use regular check for partition name instead of CHECK()" am: 76cb4eeda6 am: cd66e52573Tianjie Xu1-3/+4
am: 705a4d72c8 Change-Id: Ie1f8e1c6ab9fddf1b355287f0c4e5fc0b2631441 (cherry picked from commit 2e797d9905df9ca3a6068a23f6ad6669b823657d)
2017-04-02Merge "Update_verifier should read blocks in EIO mode" am: 21d481c81e am: 89559e3cfeTianjie Xu1-26/+33
am: 81f5b04df2 Change-Id: I20f459c3403ec0e120769bd805b9508dbe11b989 (cherry picked from commit e3ea825181d073eb240cdedaf4aa412647b495fd)
2017-04-01Use regular check for partition name instead of CHECK()Tianjie Xu1-3/+4
Bug: 36260064 Test: Device reboots for invalid care_map. Change-Id: Id614f0d118fc2b9d9abf24918aa4b4324f4c94e1
2017-03-31Update_verifier should read blocks in EIO modeTianjie Xu1-26/+33
Update_verifier will reboot the device if it fails to read some blocks on the care_map when veritymode=eio. Also make some partition name changes to match the care_map.txt. Test: Update_verifier reboots the device after read failures in eio mode. Change-Id: Icf68e6151dee72f626a9ab72946100cf482a4e6c
2017-03-29update_verifier: raise priority and ioprio and start with exec_startTom Cherry2-0/+13
Raise the priority and ioprio of update_verifier and launch with exec_start. This saves ~100ms of time before `class_start main` is executed. Bug: 36511808 Bug: 36102163 Test: Boot bullhead Test: Verify boottime decrease on sailfish Change-Id: I944a6c0d4368ead5b99171f49142da2523ed1bdd (cherry picked from commit 545317f4fb99efd4d2c32187328e617ad6f69980)
2017-03-29update_verifier: raise priority and ioprio and start with exec_startTom Cherry2-0/+13
Raise the priority and ioprio of update_verifier and launch with exec_start. This saves ~100ms of time before `class_start main` is executed. Bug: 36511808 Bug: 36102163 Test: Boot bullhead Test: Verify boottime decrease on sailfish Change-Id: I944a6c0d4368ead5b99171f49142da2523ed1bdd
2017-03-11update_verifier: Set the success flag if dm-verity is not enabled.Tao Bao2-0/+9
For devices that are not using dm-verity, update_verifier can't verify anything, but to mark the successfully booted flag unconditionally. Test: Successfully-booted flag is set on devices w/o dm-verity. Test: Successfully-booted flag is set after verification on devices w/ dm-verity. Change-Id: I79ab2caec2d4284aad0d66dd161adabebde175b6
2017-01-26update_verifier should read dm wrapped partitionTianjie Xu1-6/+64
update_verifier used to read from system_block_device, which bypasses dm-verity check completely. Switch update_verifier to read the corresponding '/dev/block/dm-X' instead. U_v gets the verity block device number by comparing the contents in '/sys/block/dm-X/dm/name'. Bug: 34391662 Test: update_verifier detects the corrupped blocks and dm-verity trigger the reboot on Sailfish. Change-Id: Ie5c50c23410bd29fcc6e733ba29cf892e9a07460
2017-01-21bootctrl HAL uses "default" service nameChris Phoenix1-1/+1
The getService() and registerAsService() methods of interface objects now have default parameters of "default" for the service name. HALs will not have to use any service name unless they want to register more than one service. Test: builds; verify HAL still works Bug: 33844934 Change-Id: I86c44aaaaf663e774c631a469ebf2b81619f89c4
2017-01-20bootctrl HAL uses "default" service nameChris Phoenix1-1/+1
The getService() and registerAsService() methods of interface objects now have default parameters of "default" for the service name. HALs will not have to use any service name unless they want to register more than one service. Test: builds; verify HAL still works In support of b/33844934 Change-Id: I5ce988128b0471384e1472298a0ae383df2b7c3e Merged-In: I86c44aaaaf663e774c631a469ebf2b81619f89c4
2017-01-20update_verifier: Move property_get() to android::base::GetProperty().Tao Bao1-48/+46
Also make minor changes to android::base::ParseUint(), which accepts std::string now. Test: Flash an A/B device and make sure update_verifier works (by marking the active slot as successfully booted). Change-Id: Id6e578671cb3c87160c2b6ca717ee618ecf2342a
2016-11-21Switch update verifier to HIDL HALConnor O'Brien2-15/+21
Test: UV logs show success in both binderized and passthrough modes. Bug: 31864052 Change-Id: Ied67a52c458dba7fe600e0fe7eca84db1a9f2587 Signed-off-by: Connor O'Brien <connoro@google.com>
2016-11-19update_verifier: Sync Android.mk with aosp-master.Tao Bao1-2/+6
It's out of sync due to the cherry-pick in commit d007cf2da29f05eee002dd33e6c04262f709b274. Test: mmma bootable/recovery Change-Id: I286fe89c4c7d09de3a06d09f9a2b0cdecef326f5
2016-11-18Revert "Convert update_verifier to boot HIDL HAL"Connor O'Brien2-25/+15
This reverts commit 86199a47e18942c49423b04eb1f3deacd6072849. Bug: 32973182 Change-Id: If3eab18cc2e810446da447fadfd0fb44c02b771b
2016-11-18Revert "Convert update_verifier to boot HIDL HAL"Connor O'Brien2-21/+15
This reverts commit f50593c447faf8415615b5dea2666d7f0f24a0fb. Bug: 32973182 Change-Id: I5b14a812671ea02575cb452242ff1a6f05edb9c1
2016-11-18Revert "Convert update_verifier to boot HIDL HAL"Connor O'Brien2-25/+15
This reverts commit 13716c29c9e222045eab1edcc944eb23c8198e6a. Change-Id: Ib8d23e3e7ab0e3870d1b007fa8abd91a3980c287
2016-11-17Convert update_verifier to boot HIDL HALConnor O'Brien2-15/+25
Test: Flashed device and confirmed update_verifier runs successfully Change-Id: I5bce4ece1e3ba98f57299c9cf469a5e2a5226ff2 Signed-off-by: Connor O'Brien <connoro@google.com>
2016-11-16Convert update_verifier to boot HIDL HALConnor O'Brien2-15/+25
Test: Flashed device and confirmed update_verifier runs successfully Change-Id: I5bce4ece1e3ba98f57299c9cf469a5e2a5226ff2 Signed-off-by: Connor O'Brien <connoro@google.com>
2016-11-16Convert update_verifier to boot HIDL HALConnor O'Brien2-15/+21
Test: Flashed device and confirmed update_verifier runs successfully Change-Id: I5bce4ece1e3ba98f57299c9cf469a5e2a5226ff2 Merged-In: I5bce4ece1e3ba98f57299c9cf469a5e2a5226ff2 Signed-off-by: Connor O'Brien <connoro@google.com>
2016-11-09Touch blocks in care_map in update_verifierTianjie Xu2-12/+128
Read all blocks in system and vendor partition during boot time so that dm-verity could verify this partition is properly flashed. Bug: 27175949 Change-Id: I38ff7b18ee4f2733e639b89633d36f5ed551c989 Test: mma (cherry picked from commit 03ca853a1c8b974152b7c56cb887ac2f36cfd833) (cherry picked from commit 4bbe0c93c80789891d54a74424731caffda0d0db) (Fix a typo when comparing the verity mode) (cherry picked from commit da654af606d700c0a467c27025fb7f6ef745936d) (Skip update verification if care_map is not found)
2016-09-30Turn on -Werror for recoveryTianjie Xu1-0/+1
Also remove the 0xff comparison when validating the bootloader message fields. As the fields won't be erased to 0xff after we remove the MTD support. Bug: 28202046 Test: The recovery folder compiles for aosp_x86-eng Change-Id: Ibb30ea1b2b28676fb08c7e92a1e5f7b6ef3247ab (cherry picked from commit 7aa88748f6ec4e53333d1a15747bc44826ccc410)
2016-09-30Turn on -Werror for recoveryTianjie Xu1-0/+1
Also remove the 0xff comparison when validating the bootloader message fields. As the fields won't be erased to 0xff after we remove the MTD support. Bug: 28202046 Test: The recovery folder compiles for aosp_x86-eng Change-Id: Ibb30ea1b2b28676fb08c7e92a1e5f7b6ef3247ab
2016-09-01Switch recovery to libbase loggingTianjie Xu1-23/+22
Clean up the recovery image and switch to libbase logging. Bug: 28191554 Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35 (cherry picked from commit 747781433fb01f745529c7e9dd97c5599070ad0d)
2016-09-01Switch recovery to libbase loggingTianjie Xu2-10/+8
Clean up the recovery image and switch to libbase logging. Bug: 28191554 Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35 Merged-In: Icd999c3cc832f0639f204b5c36cea8afe303ad35
2016-09-01Switch recovery to libbase loggingTianjie Xu1-23/+22
Clean up the recovery image and switch to libbase logging. Bug: 28191554 Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35
2016-07-16Skip update verification if care_map is not foundTianjie Xu1-2/+5
Recently flashed devices may not have care_map.txt in /data/ota_package. This leads to a failure of update-verifier and prevents boot success flag from being set. So, we need to skip verification in case the file is not found. Error message: ... I update_verifier: Started with arg 1: nonencrypted ... I update_verifier: Booting slot 1: isSlotMarkedSuccessful=0 ... E update_verifier: Care map /data/ota_package/care_map.txt not found. ... E update_verifier: Failed to verify all blocks in care map file Bug: 30156449 Change-Id: Ia15f5f3e7ca2ea6981d49678e799b9f70d134faa
2016-07-15Fix a typo when comparing the verity modeTianjie Xu1-2/+2
The veritymode string used by the bootloader should be lowercase 'eio' instead of 'EIO'. Fix the typo and change to strcasecmp. Bug: 27175949 Change-Id: I376dacc70eef7364e2b9931a7c940adedcdb1929
2016-07-14Touch blocks in care_map in update_verifierTianjie Xu2-14/+122
Read all blocks in system and vendor partition during boot time so that dm-verity could verify this partition is properly flashed. Bug: 27175949 Change-Id: I38ff7b18ee4f2733e639b89633d36f5ed551c989
2015-12-09update_verifier: Track the API change for isSlotBootable().Tao Bao1-5/+6
[1] added a new API isSlotMarkedSuccessful() to actually query if a given slot has been marked as successful. [1]: commit 72c88c915d957bf2eba73950e7f0407b220d1ef4 Change-Id: I9155c9b9233882a295a9a6e607a844d9125e4c56
2015-12-08update_verifier: Log to logd instead of kernel log.Tao Bao2-12/+8
logd already gets started before we call update_verifier. Bug: 26039641 Change-Id: If00669a77bf9a6e5534e33f4e50b42eabba2667a (cherry picked from commit 45eac58ef188679f6df2d80efc0391c6d7904cd8)
2015-12-08Add update_verifier for A/B OTA update.Tao Bao2-0/+108
update_verifier checks the integrity of the updated system and vendor partitions on the first boot post an A/B OTA update. It marks the current slot as having booted successfully if it passes the verification. This CL doesn't perform any actual verification work which will be addressed in follow-up CLs. Bug: 26039641 Change-Id: Ia5504ed25b799b48b5886c2fc68073a360127f42 (cherry picked from commit 1171d3a12b13ca3f1d4301985cf068076e55ae26)
2015-12-08update_verifier: Log to logd instead of kernel log.Tao Bao2-12/+8
logd already gets started before we call update_verifier. Bug: 26039641 Change-Id: If00669a77bf9a6e5534e33f4e50b42eabba2667a
2015-12-07Add update_verifier for A/B OTA update.Tao Bao2-0/+108
update_verifier checks the integrity of the updated system and vendor partitions on the first boot post an A/B OTA update. It marks the current slot as having booted successfully if it passes the verification. This CL doesn't perform any actual verification work which will be addressed in follow-up CLs. Bug: 26039641 Change-Id: Ia5504ed25b799b48b5886c2fc68073a360127f42
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 00:01:32 +0100