1 // Copyright (C) 2019 The Android Open Source Project 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #pragma once 16 17 #include <stdint.h> 18 #include <unistd.h> 19 20 #include <chrono> 21 #include <map> 22 #include <memory> 23 #include <optional> 24 #include <ostream> 25 #include <string> 26 #include <string_view> 27 #include <vector> 28 29 #include <android-base/unique_fd.h> 30 #include <android/snapshot/snapshot.pb.h> 31 #include <fs_mgr_dm_linear.h> 32 #include <libdm/dm.h> 33 #include <libfiemap/image_manager.h> 34 #include <liblp/builder.h> 35 #include <liblp/liblp.h> 36 #include <update_engine/update_metadata.pb.h> 37 38 #include <libsnapshot/auto_device.h> 39 #include <libsnapshot/return.h> 40 #include <libsnapshot/snapshot_writer.h> 41 #include <snapuserd/snapuserd_client.h> 42 43 #ifndef FRIEND_TEST 44 #define FRIEND_TEST(test_set_name, individual_test) \ 45 friend class test_set_name##_##individual_test##_Test 46 #define DEFINED_FRIEND_TEST 47 #endif 48 49 namespace aidl::android::hardware::boot { 50 enum class MergeStatus; 51 } 52 53 namespace android { 54 55 namespace fiemap { 56 class IImageManager; 57 } // namespace fiemap 58 59 namespace fs_mgr { 60 struct CreateLogicalPartitionParams; 61 class IPartitionOpener; 62 } // namespace fs_mgr 63 64 // Forward declare IBootControl types since we cannot include only the headers 65 // with Soong. Note: keep the enum width in sync. 66 67 namespace snapshot { 68 69 struct AutoDeleteCowImage; 70 struct AutoDeleteSnapshot; 71 struct AutoDeviceList; 72 struct PartitionCowCreator; 73 class ISnapshotMergeStats; 74 class SnapshotMergeStats; 75 class SnapshotStatus; 76 77 static constexpr const std::string_view kCowGroupName = "cow"; 78 static constexpr char kVirtualAbCompressionProp[] = "ro.virtual_ab.compression.enabled"; 79 80 bool OptimizeSourceCopyOperation(const chromeos_update_engine::InstallOperation& operation, 81 chromeos_update_engine::InstallOperation* optimized); 82 83 enum class CreateResult : unsigned int { 84 ERROR, 85 CREATED, 86 NOT_CREATED, 87 }; 88 89 class ISnapshotManager { 90 public: 91 // Dependency injection for testing. 92 class IDeviceInfo { 93 public: 94 using IImageManager = android::fiemap::IImageManager; 95 using MergeStatus = aidl::android::hardware::boot::MergeStatus; 96 ~IDeviceInfo()97 virtual ~IDeviceInfo() {} 98 virtual std::string GetMetadataDir() const = 0; 99 virtual std::string GetSlotSuffix() const = 0; 100 virtual std::string GetOtherSlotSuffix() const = 0; 101 virtual std::string GetSuperDevice(uint32_t slot) const = 0; 102 virtual const android::fs_mgr::IPartitionOpener& GetPartitionOpener() const = 0; 103 virtual bool IsOverlayfsSetup() const = 0; 104 virtual bool SetBootControlMergeStatus(MergeStatus status) = 0; 105 virtual bool SetSlotAsUnbootable(unsigned int slot) = 0; 106 virtual bool IsRecovery() const = 0; IsTestDevice()107 virtual bool IsTestDevice() const { return false; } 108 virtual bool IsFirstStageInit() const = 0; 109 virtual std::unique_ptr<IImageManager> OpenImageManager() const = 0; 110 virtual android::dm::IDeviceMapper& GetDeviceMapper() = 0; 111 112 // Helper method for implementing OpenImageManager. 113 std::unique_ptr<IImageManager> OpenImageManager(const std::string& gsid_dir) const; 114 }; 115 virtual ~ISnapshotManager() = default; 116 117 // Begin an update. This must be called before creating any snapshots. It 118 // will fail if GetUpdateState() != None. 119 virtual bool BeginUpdate() = 0; 120 121 // Cancel an update; any snapshots will be deleted. This is allowed if the 122 // state == Initiated, None, or Unverified (before rebooting to the new 123 // slot). 124 virtual bool CancelUpdate() = 0; 125 126 // Mark snapshot writes as having completed. After this, new snapshots cannot 127 // be created, and the device must either cancel the OTA (either before 128 // rebooting or after rolling back), or merge the OTA. 129 // Before calling this function, all snapshots must be mapped. 130 // If |wipe| is set to true, wipe is scheduled after reboot, and snapshots 131 // may need to be merged before wiping. 132 virtual bool FinishedSnapshotWrites(bool wipe) = 0; 133 134 // Set feature flags on an ISnapshotMergeStats object. 135 virtual void SetMergeStatsFeatures(ISnapshotMergeStats* stats) = 0; 136 137 // Update an ISnapshotMergeStats object with statistics about COW usage. 138 // This should be called before the merge begins as otherwise snapshots 139 // may be deleted. 140 virtual void UpdateCowStats(ISnapshotMergeStats* stats) = 0; 141 142 // Initiate a merge on all snapshot devices. This should only be used after an 143 // update has been marked successful after booting. 144 virtual bool InitiateMerge() = 0; 145 146 // Perform any necessary post-boot actions. This should be run soon after 147 // /data is mounted. 148 // 149 // If a merge is in progress, this function will block until the merge is 150 // completed. 151 // - Callback is called periodically during the merge. If callback() 152 // returns false during the merge, ProcessUpdateState() will pause 153 // and returns Merging. 154 // If a merge or update was cancelled, this will clean up any 155 // update artifacts and return. 156 // 157 // Note that after calling this, GetUpdateState() may still return that a 158 // merge is in progress: 159 // MergeFailed indicates that a fatal error occurred. WaitForMerge() may 160 // called any number of times again to attempt to make more progress, but 161 // we do not expect it to succeed if a catastrophic error occurred. 162 // 163 // MergeNeedsReboot indicates that the merge has completed, but cleanup 164 // failed. This can happen if for some reason resources were not closed 165 // properly. In this case another reboot is needed before we can take 166 // another OTA. However, WaitForMerge() can be called again without 167 // rebooting, to attempt to finish cleanup anyway. 168 // 169 // MergeCompleted indicates that the update has fully completed. 170 // GetUpdateState will return None, and a new update can begin. 171 // 172 // The optional callback allows the caller to periodically check the 173 // progress with GetUpdateState(). 174 virtual UpdateState ProcessUpdateState(const std::function<bool()>& callback = {}, 175 const std::function<bool()>& before_cancel = {}) = 0; 176 177 // If ProcessUpdateState() returned MergeFailed, this returns the appropriate 178 // code. Otherwise, MergeFailureCode::Ok is returned. 179 virtual MergeFailureCode ReadMergeFailureCode() = 0; 180 181 // If an update is in progress, return the source build fingerprint. 182 virtual std::string ReadSourceBuildFingerprint() = 0; 183 184 // Find the status of the current update, if any. 185 // 186 // |progress| depends on the returned status: 187 // Merging: Value in the range [0, 100] 188 // MergeCompleted: 100 189 // Other: 0 190 virtual UpdateState GetUpdateState(double* progress = nullptr) = 0; 191 192 // Returns true if compression is enabled for the current update. This always returns false if 193 // UpdateState is None, or no snapshots have been created. 194 virtual bool UpdateUsesCompression() = 0; 195 196 // Returns true if userspace snapshots is enabled for the current update. 197 virtual bool UpdateUsesUserSnapshots() = 0; 198 199 // Create necessary COW device / files for OTA clients. New logical partitions will be added to 200 // group "cow" in target_metadata. Regions of partitions of current_metadata will be 201 // "write-protected" and snapshotted. 202 virtual Return CreateUpdateSnapshots( 203 const chromeos_update_engine::DeltaArchiveManifest& manifest) = 0; 204 205 // Map a snapshotted partition for OTA clients to write to. Write-protected regions are 206 // determined previously in CreateSnapshots. 207 // 208 // |snapshot_path| must not be nullptr. 209 // 210 // This method will return false if ro.virtual_ab.compression.enabled is true. 211 virtual bool MapUpdateSnapshot(const android::fs_mgr::CreateLogicalPartitionParams& params, 212 std::string* snapshot_path) = 0; 213 214 // Create an ISnapshotWriter to build a snapshot against a target partition. The partition name 215 // must be suffixed. If a source partition exists, it must be specified as well. The source 216 // partition will only be used if raw bytes are needed. The source partition should be an 217 // absolute path to the device, not a partition name. 218 // 219 // After calling OpenSnapshotWriter, the caller must invoke Initialize or InitializeForAppend 220 // before invoking write operations. 221 virtual std::unique_ptr<ISnapshotWriter> OpenSnapshotWriter( 222 const android::fs_mgr::CreateLogicalPartitionParams& params, 223 const std::optional<std::string>& source_device) = 0; 224 225 // Unmap a snapshot device or CowWriter that was previously opened with MapUpdateSnapshot, 226 // OpenSnapshotWriter. All outstanding open descriptors, writers, or 227 // readers must be deleted before this is called. 228 virtual bool UnmapUpdateSnapshot(const std::string& target_partition_name) = 0; 229 230 // If this returns true, first-stage mount must call 231 // CreateLogicalAndSnapshotPartitions rather than CreateLogicalPartitions. 232 virtual bool NeedSnapshotsInFirstStageMount() = 0; 233 234 // Perform first-stage mapping of snapshot targets. This replaces init's 235 // call to CreateLogicalPartitions when snapshots are present. 236 virtual bool CreateLogicalAndSnapshotPartitions( 237 const std::string& super_device, const std::chrono::milliseconds& timeout_ms = {}) = 0; 238 239 // Map all snapshots. This is analogous to CreateLogicalAndSnapshotPartitions, except it maps 240 // the target slot rather than the current slot. It should only be used immediately after 241 // applying an update, before rebooting to the new slot. 242 virtual bool MapAllSnapshots(const std::chrono::milliseconds& timeout_ms = {}) = 0; 243 244 // Unmap all snapshots. This should be called to undo MapAllSnapshots(). 245 virtual bool UnmapAllSnapshots() = 0; 246 247 // This method should be called preceding any wipe or flash of metadata or 248 // userdata. It is only valid in recovery or fastbootd, and it ensures that 249 // a merge has been completed. 250 // 251 // When userdata will be wiped or flashed, it is necessary to clean up any 252 // snapshot state. If a merge is in progress, the merge must be finished. 253 // If a snapshot is present but not yet merged, the slot must be marked as 254 // unbootable. 255 // 256 // Returns true on success (or nothing to do), false on failure. The 257 // optional callback fires periodically to query progress via GetUpdateState. 258 virtual bool HandleImminentDataWipe(const std::function<void()>& callback = {}) = 0; 259 260 // Force a merge to complete in recovery. This is similar to HandleImminentDataWipe 261 // but does not expect a data wipe after. 262 virtual bool FinishMergeInRecovery() = 0; 263 264 // This method is only allowed in recovery and is used as a helper to 265 // initialize the snapshot devices as a requirement to mount a snapshotted 266 // /system in recovery. 267 // This function returns: 268 // - CreateResult::CREATED if snapshot devices were successfully created; 269 // - CreateResult::NOT_CREATED if it was not necessary to create snapshot 270 // devices; 271 // - CreateResult::ERROR if a fatal error occurred, mounting /system should 272 // be aborted. 273 // This function mounts /metadata when called, and unmounts /metadata upon 274 // return. 275 virtual CreateResult RecoveryCreateSnapshotDevices() = 0; 276 277 // Same as RecoveryCreateSnapshotDevices(), but does not auto mount/umount 278 // /metadata. 279 virtual CreateResult RecoveryCreateSnapshotDevices( 280 const std::unique_ptr<AutoDevice>& metadata_device) = 0; 281 282 // Dump debug information. 283 virtual bool Dump(std::ostream& os) = 0; 284 285 // Ensure metadata directory is mounted in recovery. When the returned 286 // AutoDevice is destroyed, the metadata directory is automatically 287 // unmounted. 288 // Return nullptr if any failure. 289 // In Android mode, Return an AutoDevice that does nothing 290 // In recovery, return an AutoDevice that does nothing if metadata entry 291 // is not found in fstab. 292 // Note: if this function is called the second time before the AutoDevice returned from the 293 // first call is destroyed, the device will be unmounted when any of these AutoDevices is 294 // destroyed. For example: 295 // auto a = mgr->EnsureMetadataMounted(); // mounts 296 // auto b = mgr->EnsureMetadataMounted(); // does nothing 297 // b.reset() // unmounts 298 // a.reset() // does nothing 299 virtual std::unique_ptr<AutoDevice> EnsureMetadataMounted() = 0; 300 301 // Return the associated ISnapshotMergeStats instance. Never null. 302 virtual ISnapshotMergeStats* GetSnapshotMergeStatsInstance() = 0; 303 }; 304 305 class SnapshotManager final : public ISnapshotManager { 306 using CreateLogicalPartitionParams = android::fs_mgr::CreateLogicalPartitionParams; 307 using IPartitionOpener = android::fs_mgr::IPartitionOpener; 308 using LpMetadata = android::fs_mgr::LpMetadata; 309 using MetadataBuilder = android::fs_mgr::MetadataBuilder; 310 using DeltaArchiveManifest = chromeos_update_engine::DeltaArchiveManifest; 311 using MergeStatus = aidl::android::hardware::boot::MergeStatus; 312 using FiemapStatus = android::fiemap::FiemapStatus; 313 314 friend class SnapshotMergeStats; 315 316 public: 317 ~SnapshotManager(); 318 319 // Return a new SnapshotManager instance, or null on error. The device 320 // pointer is owned for the lifetime of SnapshotManager. If null, a default 321 // instance will be created. 322 static std::unique_ptr<SnapshotManager> New(IDeviceInfo* device = nullptr); 323 324 // This is similar to New(), except designed specifically for first-stage 325 // init or recovery. 326 static std::unique_ptr<SnapshotManager> NewForFirstStageMount(IDeviceInfo* device = nullptr); 327 328 // Helper function for first-stage init to check whether a SnapshotManager 329 // might be needed to perform first-stage mounts. 330 static bool IsSnapshotManagerNeeded(); 331 332 // Helper function for second stage init to restorecon on the rollback indicator. 333 static std::string GetGlobalRollbackIndicatorPath(); 334 335 // Populate |snapuserd_argv| with the necessary arguments to restart snapuserd 336 // after loading selinux policy. 337 bool PrepareSnapuserdArgsForSelinux(std::vector<std::string>* snapuserd_argv); 338 339 // Detach dm-user devices from the first stage snapuserd. Load 340 // new dm-user tables after loading selinux policy. 341 bool DetachFirstStageSnapuserdForSelinux(); 342 343 // Perform the transition from the selinux stage of snapuserd into the 344 // second-stage of snapuserd. This process involves re-creating the dm-user 345 // table entries for each device, so that they connect to the new daemon. 346 // Once all new tables have been activated, we ask the first-stage daemon 347 // to cleanly exit. 348 bool PerformSecondStageInitTransition(); 349 350 // ISnapshotManager overrides. 351 bool BeginUpdate() override; 352 bool CancelUpdate() override; 353 bool FinishedSnapshotWrites(bool wipe) override; 354 void UpdateCowStats(ISnapshotMergeStats* stats) override; 355 MergeFailureCode ReadMergeFailureCode() override; 356 bool InitiateMerge() override; 357 UpdateState ProcessUpdateState(const std::function<bool()>& callback = {}, 358 const std::function<bool()>& before_cancel = {}) override; 359 UpdateState GetUpdateState(double* progress = nullptr) override; 360 bool UpdateUsesCompression() override; 361 bool UpdateUsesUserSnapshots() override; 362 Return CreateUpdateSnapshots(const DeltaArchiveManifest& manifest) override; 363 bool MapUpdateSnapshot(const CreateLogicalPartitionParams& params, 364 std::string* snapshot_path) override; 365 std::unique_ptr<ISnapshotWriter> OpenSnapshotWriter( 366 const android::fs_mgr::CreateLogicalPartitionParams& params, 367 const std::optional<std::string>& source_device) override; 368 bool UnmapUpdateSnapshot(const std::string& target_partition_name) override; 369 bool NeedSnapshotsInFirstStageMount() override; 370 bool CreateLogicalAndSnapshotPartitions( 371 const std::string& super_device, 372 const std::chrono::milliseconds& timeout_ms = {}) override; 373 bool HandleImminentDataWipe(const std::function<void()>& callback = {}) override; 374 bool FinishMergeInRecovery() override; 375 CreateResult RecoveryCreateSnapshotDevices() override; 376 CreateResult RecoveryCreateSnapshotDevices( 377 const std::unique_ptr<AutoDevice>& metadata_device) override; 378 bool Dump(std::ostream& os) override; 379 std::unique_ptr<AutoDevice> EnsureMetadataMounted() override; 380 ISnapshotMergeStats* GetSnapshotMergeStatsInstance() override; 381 bool MapAllSnapshots(const std::chrono::milliseconds& timeout_ms = {}) override; 382 bool UnmapAllSnapshots() override; 383 std::string ReadSourceBuildFingerprint() override; 384 void SetMergeStatsFeatures(ISnapshotMergeStats* stats) override; 385 386 // We can't use WaitForFile during first-stage init, because ueventd is not 387 // running and therefore will not automatically create symlinks. Instead, 388 // we let init provide us with the correct function to use to ensure 389 // uevents have been processed and symlink/mknod calls completed. SetUeventRegenCallback(std::function<bool (const std::string &)> callback)390 void SetUeventRegenCallback(std::function<bool(const std::string&)> callback) { 391 uevent_regen_callback_ = callback; 392 } 393 394 // If true, compression is enabled for this update. This is used by 395 // first-stage to decide whether to launch snapuserd. 396 bool IsSnapuserdRequired(); 397 398 // This is primarily used to device reboot. If OTA update is in progress, 399 // init will avoid killing processes 400 bool IsUserspaceSnapshotUpdateInProgress(); 401 402 enum class SnapshotDriver { 403 DM_SNAPSHOT, 404 DM_USER, 405 }; 406 407 // Add new public entries above this line. 408 409 // Helpers for failure injection. 410 using MergeConsistencyChecker = 411 std::function<MergeFailureCode(const std::string& name, const SnapshotStatus& status)>; 412 set_merge_consistency_checker(MergeConsistencyChecker checker)413 void set_merge_consistency_checker(MergeConsistencyChecker checker) { 414 merge_consistency_checker_ = checker; 415 } merge_consistency_checker()416 MergeConsistencyChecker merge_consistency_checker() const { return merge_consistency_checker_; } 417 418 private: 419 FRIEND_TEST(SnapshotTest, CleanFirstStageMount); 420 FRIEND_TEST(SnapshotTest, CreateSnapshot); 421 FRIEND_TEST(SnapshotTest, FirstStageMountAfterRollback); 422 FRIEND_TEST(SnapshotTest, FirstStageMountAndMerge); 423 FRIEND_TEST(SnapshotTest, FlashSuperDuringMerge); 424 FRIEND_TEST(SnapshotTest, FlashSuperDuringUpdate); 425 FRIEND_TEST(SnapshotTest, MapPartialSnapshot); 426 FRIEND_TEST(SnapshotTest, MapSnapshot); 427 FRIEND_TEST(SnapshotTest, Merge); 428 FRIEND_TEST(SnapshotTest, MergeFailureCode); 429 FRIEND_TEST(SnapshotTest, NoMergeBeforeReboot); 430 FRIEND_TEST(SnapshotTest, UpdateBootControlHal); 431 FRIEND_TEST(SnapshotUpdateTest, AddPartition); 432 FRIEND_TEST(SnapshotUpdateTest, ConsistencyCheckResume); 433 FRIEND_TEST(SnapshotUpdateTest, DaemonTransition); 434 FRIEND_TEST(SnapshotUpdateTest, DataWipeAfterRollback); 435 FRIEND_TEST(SnapshotUpdateTest, DataWipeRollbackInRecovery); 436 FRIEND_TEST(SnapshotUpdateTest, DataWipeWithStaleSnapshots); 437 FRIEND_TEST(SnapshotUpdateTest, FullUpdateFlow); 438 FRIEND_TEST(SnapshotUpdateTest, MergeCannotRemoveCow); 439 FRIEND_TEST(SnapshotUpdateTest, MergeInRecovery); 440 FRIEND_TEST(SnapshotUpdateTest, QueryStatusError); 441 FRIEND_TEST(SnapshotUpdateTest, SnapshotStatusFileWithoutCow); 442 FRIEND_TEST(SnapshotUpdateTest, SpaceSwapUpdate); 443 friend class SnapshotTest; 444 friend class SnapshotUpdateTest; 445 friend class FlashAfterUpdateTest; 446 friend class LockTestConsumer; 447 friend class SnapshotFuzzEnv; 448 friend struct AutoDeleteCowImage; 449 friend struct AutoDeleteSnapshot; 450 friend struct PartitionCowCreator; 451 452 using DmTargetSnapshot = android::dm::DmTargetSnapshot; 453 using IImageManager = android::fiemap::IImageManager; 454 using TargetInfo = android::dm::DeviceMapper::TargetInfo; 455 456 explicit SnapshotManager(IDeviceInfo* info); 457 458 // This is created lazily since it can connect via binder. 459 bool EnsureImageManager(); 460 461 // Ensure we're connected to snapuserd. 462 bool EnsureSnapuserdConnected(); 463 464 // Helpers for first-stage init. device()465 const std::unique_ptr<IDeviceInfo>& device() const { return device_; } 466 467 // Helper functions for tests. image_manager()468 IImageManager* image_manager() const { return images_.get(); } set_use_first_stage_snapuserd(bool value)469 void set_use_first_stage_snapuserd(bool value) { use_first_stage_snapuserd_ = value; } 470 471 // Since libsnapshot is included into multiple processes, we flock() our 472 // files for simple synchronization. LockedFile is a helper to assist with 473 // this. It also serves as a proof-of-lock for some functions. 474 class LockedFile final { 475 public: LockedFile(const std::string & path,android::base::unique_fd && fd,int lock_mode)476 LockedFile(const std::string& path, android::base::unique_fd&& fd, int lock_mode) 477 : path_(path), fd_(std::move(fd)), lock_mode_(lock_mode) {} 478 ~LockedFile(); lock_mode()479 int lock_mode() const { return lock_mode_; } 480 481 private: 482 std::string path_; 483 android::base::unique_fd fd_; 484 int lock_mode_; 485 }; 486 static std::unique_ptr<LockedFile> OpenFile(const std::string& file, int lock_flags); 487 488 SnapshotDriver GetSnapshotDriver(LockedFile* lock); 489 490 // Create a new snapshot record. This creates the backing COW store and 491 // persists information needed to map the device. The device can be mapped 492 // with MapSnapshot(). 493 // 494 // |status|.device_size should be the size of the base_device that will be passed 495 // via MapDevice(). |status|.snapshot_size should be the number of bytes in the 496 // base device, starting from 0, that will be snapshotted. |status|.cow_file_size 497 // should be the amount of space that will be allocated to store snapshot 498 // deltas. 499 // 500 // If |status|.snapshot_size < |status|.device_size, then the device will always 501 // be mapped with two table entries: a dm-snapshot range covering 502 // snapshot_size, and a dm-linear range covering the remainder. 503 // 504 // All sizes are specified in bytes, and the device, snapshot, COW partition and COW file sizes 505 // must be a multiple of the sector size (512 bytes). 506 bool CreateSnapshot(LockedFile* lock, PartitionCowCreator* cow_creator, SnapshotStatus* status); 507 508 // |name| should be the base partition name (e.g. "system_a"). Create the 509 // backing COW image using the size previously passed to CreateSnapshot(). 510 Return CreateCowImage(LockedFile* lock, const std::string& name); 511 512 // Map a snapshot device that was previously created with CreateSnapshot. 513 // If a merge was previously initiated, the device-mapper table will have a 514 // snapshot-merge target instead of a snapshot target. If the timeout 515 // parameter greater than zero, this function will wait the given amount 516 // of time for |dev_path| to become available, and fail otherwise. If 517 // timeout_ms is 0, then no wait will occur and |dev_path| may not yet 518 // exist on return. 519 bool MapSnapshot(LockedFile* lock, const std::string& name, const std::string& base_device, 520 const std::string& cow_device, const std::chrono::milliseconds& timeout_ms, 521 std::string* dev_path); 522 523 // Create a dm-user device for a given snapshot. 524 bool MapDmUserCow(LockedFile* lock, const std::string& name, const std::string& cow_file, 525 const std::string& base_device, const std::string& base_path_merge, 526 const std::chrono::milliseconds& timeout_ms, std::string* path); 527 528 // Map the source device used for dm-user. 529 bool MapSourceDevice(LockedFile* lock, const std::string& name, 530 const std::chrono::milliseconds& timeout_ms, std::string* path); 531 532 // Map a COW image that was previous created with CreateCowImage. 533 std::optional<std::string> MapCowImage(const std::string& name, 534 const std::chrono::milliseconds& timeout_ms); 535 536 // Remove the backing copy-on-write image and snapshot states for the named snapshot. The 537 // caller is responsible for ensuring that the snapshot is unmapped. 538 bool DeleteSnapshot(LockedFile* lock, const std::string& name); 539 540 // Unmap a snapshot device previously mapped with MapSnapshotDevice(). 541 bool UnmapSnapshot(LockedFile* lock, const std::string& name); 542 543 // Unmap a COW image device previously mapped with MapCowImage(). 544 bool UnmapCowImage(const std::string& name); 545 546 // Unmap a COW and remove it from a MetadataBuilder. 547 void UnmapAndDeleteCowPartition(MetadataBuilder* current_metadata); 548 549 // Remove invalid snapshots if any 550 void RemoveInvalidSnapshots(LockedFile* lock); 551 552 // Unmap and remove all known snapshots. 553 bool RemoveAllSnapshots(LockedFile* lock); 554 555 // List the known snapshot names. 556 bool ListSnapshots(LockedFile* lock, std::vector<std::string>* snapshots, 557 const std::string& suffix = ""); 558 559 // Check for a cancelled or rolled back merge, returning true if such a 560 // condition was detected and handled. 561 bool HandleCancelledUpdate(LockedFile* lock, const std::function<bool()>& before_cancel); 562 563 // Helper for HandleCancelledUpdate. Assumes booting from new slot. 564 bool AreAllSnapshotsCancelled(LockedFile* lock); 565 566 // Determine whether partition names in |snapshots| have been flashed and 567 // store result to |out|. 568 // Return true if values are successfully retrieved and false on error 569 // (e.g. super partition metadata cannot be read). When it returns true, 570 // |out| stores true for partitions that have been flashed and false for 571 // partitions that have not been flashed. 572 bool GetSnapshotFlashingStatus(LockedFile* lock, const std::vector<std::string>& snapshots, 573 std::map<std::string, bool>* out); 574 575 // Remove artifacts created by the update process, such as snapshots, and 576 // set the update state to None. 577 bool RemoveAllUpdateState(LockedFile* lock, const std::function<bool()>& prolog = {}); 578 579 // Interact with /metadata/ota. 580 std::unique_ptr<LockedFile> OpenLock(int lock_flags); 581 std::unique_ptr<LockedFile> LockShared(); 582 std::unique_ptr<LockedFile> LockExclusive(); 583 std::string GetLockPath() const; 584 585 // Interact with /metadata/ota/state. 586 UpdateState ReadUpdateState(LockedFile* file); 587 SnapshotUpdateStatus ReadSnapshotUpdateStatus(LockedFile* file); 588 bool WriteUpdateState(LockedFile* file, UpdateState state, 589 MergeFailureCode failure_code = MergeFailureCode::Ok); 590 bool WriteSnapshotUpdateStatus(LockedFile* file, const SnapshotUpdateStatus& status); 591 std::string GetStateFilePath() const; 592 593 // Interact with /metadata/ota/merge_state. 594 // This file contains information related to the snapshot merge process. 595 std::string GetMergeStateFilePath() const; 596 597 // Helpers for merging. 598 MergeFailureCode MergeSecondPhaseSnapshots(LockedFile* lock); 599 MergeFailureCode SwitchSnapshotToMerge(LockedFile* lock, const std::string& name); 600 MergeFailureCode RewriteSnapshotDeviceTable(const std::string& dm_name); 601 bool MarkSnapshotMergeCompleted(LockedFile* snapshot_lock, const std::string& snapshot_name); 602 void AcknowledgeMergeSuccess(LockedFile* lock); 603 void AcknowledgeMergeFailure(MergeFailureCode failure_code); 604 MergePhase DecideMergePhase(const SnapshotStatus& status); 605 std::unique_ptr<LpMetadata> ReadCurrentMetadata(); 606 607 enum class MetadataPartitionState { 608 // Partition does not exist. 609 None, 610 // Partition is flashed. 611 Flashed, 612 // Partition is created by OTA client. 613 Updated, 614 }; 615 // Helper function to check the state of a partition as described in metadata. 616 MetadataPartitionState GetMetadataPartitionState(const LpMetadata& metadata, 617 const std::string& name); 618 619 // Note that these require the name of the device containing the snapshot, 620 // which may be the "inner" device. Use GetsnapshotDeviecName(). 621 bool QuerySnapshotStatus(const std::string& dm_name, std::string* target_type, 622 DmTargetSnapshot::Status* status); 623 bool IsSnapshotDevice(const std::string& dm_name, TargetInfo* target = nullptr); 624 625 // Internal callback for when merging is complete. 626 bool OnSnapshotMergeComplete(LockedFile* lock, const std::string& name, 627 const SnapshotStatus& status); 628 bool CollapseSnapshotDevice(LockedFile* lock, const std::string& name, 629 const SnapshotStatus& status); 630 631 struct MergeResult { 632 explicit MergeResult(UpdateState state, 633 MergeFailureCode failure_code = MergeFailureCode::Ok) 634 : state(state), failure_code(failure_code) {} 635 UpdateState state; 636 MergeFailureCode failure_code; 637 }; 638 639 // Only the following UpdateStates are used here: 640 // UpdateState::Merging 641 // UpdateState::MergeCompleted 642 // UpdateState::MergeFailed 643 // UpdateState::MergeNeedsReboot 644 MergeResult CheckMergeState(const std::function<bool()>& before_cancel); 645 MergeResult CheckMergeState(LockedFile* lock, const std::function<bool()>& before_cancel); 646 MergeResult CheckTargetMergeState(LockedFile* lock, const std::string& name, 647 const SnapshotUpdateStatus& update_status); 648 MergeFailureCode CheckMergeConsistency(LockedFile* lock, const std::string& name, 649 const SnapshotStatus& update_status); 650 651 auto UpdateStateToStr(enum UpdateState state); 652 // Get status or table information about a device-mapper node with a single target. 653 enum class TableQuery { 654 Table, 655 Status, 656 }; 657 bool GetSingleTarget(const std::string& dm_name, TableQuery query, 658 android::dm::DeviceMapper::TargetInfo* target); 659 660 // Interact with status files under /metadata/ota/snapshots. 661 bool WriteSnapshotStatus(LockedFile* lock, const SnapshotStatus& status); 662 bool ReadSnapshotStatus(LockedFile* lock, const std::string& name, SnapshotStatus* status); 663 std::string GetSnapshotStatusFilePath(const std::string& name); 664 665 std::string GetSnapshotBootIndicatorPath(); 666 std::string GetRollbackIndicatorPath(); 667 std::string GetForwardMergeIndicatorPath(); 668 std::string GetOldPartitionMetadataPath(); 669 670 const LpMetadata* ReadOldPartitionMetadata(LockedFile* lock); 671 672 bool MapAllPartitions(LockedFile* lock, const std::string& super_device, uint32_t slot, 673 const std::chrono::milliseconds& timeout_ms); 674 675 // Reason for calling MapPartitionWithSnapshot. 676 enum class SnapshotContext { 677 // For writing or verification (during update_engine). 678 Update, 679 680 // For mounting a full readable device. 681 Mount, 682 }; 683 684 struct SnapshotPaths { 685 // Target/base device (eg system_b), always present. 686 std::string target_device; 687 688 // COW name (eg system_cow). Not present if no COW is needed. 689 std::string cow_device_name; 690 691 // dm-snapshot instance. Not present in Update mode for VABC. 692 std::string snapshot_device; 693 }; 694 695 // Helpers for OpenSnapshotWriter. 696 std::unique_ptr<ISnapshotWriter> OpenCompressedSnapshotWriter( 697 LockedFile* lock, const std::optional<std::string>& source_device, 698 const std::string& partition_name, const SnapshotStatus& status, 699 const SnapshotPaths& paths); 700 std::unique_ptr<ISnapshotWriter> OpenKernelSnapshotWriter( 701 LockedFile* lock, const std::optional<std::string>& source_device, 702 const std::string& partition_name, const SnapshotStatus& status, 703 const SnapshotPaths& paths); 704 705 // Map the base device, COW devices, and snapshot device. 706 bool MapPartitionWithSnapshot(LockedFile* lock, CreateLogicalPartitionParams params, 707 SnapshotContext context, SnapshotPaths* paths); 708 709 // Map the COW devices, including the partition in super and the images. 710 // |params|: 711 // - |partition_name| should be the name of the top-level partition (e.g. system_b), 712 // not system_b-cow-img 713 // - |device_name| and |partition| is ignored 714 // - |timeout_ms| and the rest is respected 715 // Return the path in |cow_device_path| (e.g. /dev/block/dm-1) and major:minor in 716 // |cow_device_string| 717 bool MapCowDevices(LockedFile* lock, const CreateLogicalPartitionParams& params, 718 const SnapshotStatus& snapshot_status, AutoDeviceList* created_devices, 719 std::string* cow_name); 720 721 // The reverse of MapCowDevices. 722 bool UnmapCowDevices(LockedFile* lock, const std::string& name); 723 724 // The reverse of MapPartitionWithSnapshot. 725 bool UnmapPartitionWithSnapshot(LockedFile* lock, const std::string& target_partition_name); 726 727 // Unmap a dm-user device through snapuserd. 728 bool UnmapDmUserDevice(const std::string& dm_user_name); 729 730 // Unmap a dm-user device for user space snapshots 731 bool UnmapUserspaceSnapshotDevice(LockedFile* lock, const std::string& snapshot_name); 732 733 // If there isn't a previous update, return true. |needs_merge| is set to false. 734 // If there is a previous update but the device has not boot into it, tries to cancel the 735 // update and delete any snapshots. Return true if successful. |needs_merge| is set to false. 736 // If there is a previous update and the device has boot into it, do nothing and return true. 737 // |needs_merge| is set to true. 738 bool TryCancelUpdate(bool* needs_merge); 739 740 // Helper for CreateUpdateSnapshots. 741 // Creates all underlying images, COW partitions and snapshot files. Does not initialize them. 742 Return CreateUpdateSnapshotsInternal( 743 LockedFile* lock, const DeltaArchiveManifest& manifest, 744 PartitionCowCreator* cow_creator, AutoDeviceList* created_devices, 745 std::map<std::string, SnapshotStatus>* all_snapshot_status); 746 747 // Initialize snapshots so that they can be mapped later. 748 // Map the COW partition and zero-initialize the header. 749 Return InitializeUpdateSnapshots( 750 LockedFile* lock, MetadataBuilder* target_metadata, 751 const LpMetadata* exported_target_metadata, const std::string& target_suffix, 752 const std::map<std::string, SnapshotStatus>& all_snapshot_status); 753 754 // Implementation of UnmapAllSnapshots(), with the lock provided. 755 bool UnmapAllSnapshots(LockedFile* lock); 756 757 // Unmap all partitions that were mapped by CreateLogicalAndSnapshotPartitions. 758 // This should only be called in recovery. 759 bool UnmapAllPartitionsInRecovery(); 760 761 // Check no snapshot overflows. Note that this returns false negatives if the snapshot 762 // overflows, then is remapped and not written afterwards. 763 bool EnsureNoOverflowSnapshot(LockedFile* lock); 764 765 enum class Slot { Unknown, Source, Target }; 766 friend std::ostream& operator<<(std::ostream& os, SnapshotManager::Slot slot); 767 Slot GetCurrentSlot(); 768 769 // Return the suffix we expect snapshots to have. 770 std::string GetSnapshotSlotSuffix(); 771 772 std::string ReadUpdateSourceSlotSuffix(); 773 774 // Helper for RemoveAllSnapshots. 775 // Check whether |name| should be deleted as a snapshot name. 776 bool ShouldDeleteSnapshot(const std::map<std::string, bool>& flashing_status, Slot current_slot, 777 const std::string& name); 778 779 // Create or delete forward merge indicator given |wipe|. Iff wipe is scheduled, 780 // allow forward merge on FDR. 781 bool UpdateForwardMergeIndicator(bool wipe); 782 783 // Helper for HandleImminentDataWipe. 784 // Call ProcessUpdateState and handle states with special rules before data wipe. Specifically, 785 // if |allow_forward_merge| and allow-forward-merge indicator exists, initiate merge if 786 // necessary. 787 UpdateState ProcessUpdateStateOnDataWipe(bool allow_forward_merge, 788 const std::function<bool()>& callback); 789 790 // Return device string of a mapped image, or if it is not available, the mapped image path. 791 bool GetMappedImageDeviceStringOrPath(const std::string& device_name, 792 std::string* device_string_or_mapped_path); 793 794 // Same as above, but for paths only (no major:minor device strings). 795 bool GetMappedImageDevicePath(const std::string& device_name, std::string* device_path); 796 797 // Wait for a device to be created by ueventd (eg, its symlink or node to be populated). 798 // This is needed for any code that uses device-mapper path in first-stage init. If 799 // |timeout_ms| is empty or the given device is not a path, WaitForDevice immediately 800 // returns true. 801 bool WaitForDevice(const std::string& device, std::chrono::milliseconds timeout_ms); 802 803 enum class InitTransition { SELINUX_DETACH, SECOND_STAGE }; 804 805 // Initiate the transition from first-stage to second-stage snapuserd. This 806 // process involves re-creating the dm-user table entries for each device, 807 // so that they connect to the new daemon. Once all new tables have been 808 // activated, we ask the first-stage daemon to cleanly exit. 809 // 810 // If the mode is SELINUX_DETACH, snapuserd_argv must be non-null and will 811 // be populated with a list of snapuserd arguments to pass to execve(). It 812 // is otherwise ignored. 813 bool PerformInitTransition(InitTransition transition, 814 std::vector<std::string>* snapuserd_argv = nullptr); 815 snapuserd_client()816 SnapuserdClient* snapuserd_client() const { return snapuserd_client_.get(); } 817 818 // Helper of UpdateUsesCompression 819 bool UpdateUsesCompression(LockedFile* lock); 820 // Locked and unlocked functions to test whether the current update uses 821 // userspace snapshots. 822 bool UpdateUsesUserSnapshots(LockedFile* lock); 823 824 // Check if io_uring API's need to be used 825 bool UpdateUsesIouring(LockedFile* lock); 826 827 // Wrapper around libdm, with diagnostics. 828 bool DeleteDeviceIfExists(const std::string& name, 829 const std::chrono::milliseconds& timeout_ms = {}); 830 831 android::dm::IDeviceMapper& dm_; 832 std::unique_ptr<IDeviceInfo> device_; 833 std::string metadata_dir_; 834 std::unique_ptr<IImageManager> images_; 835 bool use_first_stage_snapuserd_ = false; 836 bool in_factory_data_reset_ = false; 837 std::function<bool(const std::string&)> uevent_regen_callback_; 838 std::unique_ptr<SnapuserdClient> snapuserd_client_; 839 std::unique_ptr<LpMetadata> old_partition_metadata_; 840 std::optional<bool> is_snapshot_userspace_; 841 MergeConsistencyChecker merge_consistency_checker_; 842 }; 843 844 } // namespace snapshot 845 } // namespace android 846 847 #ifdef DEFINED_FRIEND_TEST 848 #undef DEFINED_FRIEND_TEST 849 #undef FRIEND_TEST 850 #endif 851