1 /*
2  * Copyright (C) 2018 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 #include "flashing.h"
17 
18 #include <fcntl.h>
19 #include <string.h>
20 #include <sys/stat.h>
21 #include <unistd.h>
22 
23 #include <algorithm>
24 #include <memory>
25 #include <optional>
26 #include <set>
27 #include <string>
28 
29 #include <android-base/file.h>
30 #include <android-base/logging.h>
31 #include <android-base/properties.h>
32 #include <android-base/strings.h>
33 #include <ext4_utils/ext4_utils.h>
34 #include <fs_mgr_overlayfs.h>
35 #include <fstab/fstab.h>
36 #include <libavb/libavb.h>
37 #include <liblp/builder.h>
38 #include <liblp/liblp.h>
39 #include <libsnapshot/snapshot.h>
40 #include <sparse/sparse.h>
41 
42 #include "fastboot_device.h"
43 #include "utility.h"
44 
45 using namespace android::fs_mgr;
46 using namespace std::literals;
47 
48 namespace {
49 
50 constexpr uint32_t SPARSE_HEADER_MAGIC = 0xed26ff3a;
51 
WipeOverlayfsForPartition(FastbootDevice * device,const std::string & partition_name)52 void WipeOverlayfsForPartition(FastbootDevice* device, const std::string& partition_name) {
53     // May be called, in the case of sparse data, multiple times so cache/skip.
54     static std::set<std::string> wiped;
55     if (wiped.find(partition_name) != wiped.end()) return;
56     wiped.insert(partition_name);
57     // Following appears to have a first time 2% impact on flashing speeds.
58 
59     // Convert partition_name to a validated mount point and wipe.
60     Fstab fstab;
61     ReadDefaultFstab(&fstab);
62 
63     std::optional<AutoMountMetadata> mount_metadata;
64     for (const auto& entry : fstab) {
65         auto partition = android::base::Basename(entry.mount_point);
66         if ("/" == entry.mount_point) {
67             partition = "system";
68         }
69 
70         if ((partition + device->GetCurrentSlot()) == partition_name) {
71             mount_metadata.emplace();
72             android::fs_mgr::TeardownAllOverlayForMountPoint(entry.mount_point);
73         }
74     }
75 }
76 
77 }  // namespace
78 
FlashRawDataChunk(PartitionHandle * handle,const char * data,size_t len)79 int FlashRawDataChunk(PartitionHandle* handle, const char* data, size_t len) {
80     size_t ret = 0;
81     const size_t max_write_size = 1048576;
82     void* aligned_buffer;
83 
84     if (posix_memalign(&aligned_buffer, 4096, max_write_size)) {
85         PLOG(ERROR) << "Failed to allocate write buffer";
86         return -ENOMEM;
87     }
88 
89     auto aligned_buffer_unique_ptr = std::unique_ptr<void, decltype(&free)>{aligned_buffer, free};
90 
91     while (ret < len) {
92         int this_len = std::min(max_write_size, len - ret);
93         memcpy(aligned_buffer_unique_ptr.get(), data, this_len);
94         // In case of non 4KB aligned writes, reopen without O_DIRECT flag
95         if (this_len & 0xFFF) {
96             if (handle->Reset(O_WRONLY) != true) {
97                 PLOG(ERROR) << "Failed to reset file descriptor";
98                 return -1;
99             }
100         }
101 
102         int this_ret = write(handle->fd(), aligned_buffer_unique_ptr.get(), this_len);
103         if (this_ret < 0) {
104             PLOG(ERROR) << "Failed to flash data of len " << len;
105             return -1;
106         }
107         data += this_ret;
108         ret += this_ret;
109     }
110     return 0;
111 }
112 
FlashRawData(PartitionHandle * handle,const std::vector<char> & downloaded_data)113 int FlashRawData(PartitionHandle* handle, const std::vector<char>& downloaded_data) {
114     int ret = FlashRawDataChunk(handle, downloaded_data.data(), downloaded_data.size());
115     if (ret < 0) {
116         return -errno;
117     }
118     return ret;
119 }
120 
WriteCallback(void * priv,const void * data,size_t len)121 int WriteCallback(void* priv, const void* data, size_t len) {
122     PartitionHandle* handle = reinterpret_cast<PartitionHandle*>(priv);
123     if (!data) {
124         if (lseek64(handle->fd(), len, SEEK_CUR) < 0) {
125             int rv = -errno;
126             PLOG(ERROR) << "lseek failed";
127             return rv;
128         }
129         return 0;
130     }
131     return FlashRawDataChunk(handle, reinterpret_cast<const char*>(data), len);
132 }
133 
FlashSparseData(PartitionHandle * handle,std::vector<char> & downloaded_data)134 int FlashSparseData(PartitionHandle* handle, std::vector<char>& downloaded_data) {
135     struct sparse_file* file = sparse_file_import_buf(downloaded_data.data(),
136                                                       downloaded_data.size(), true, false);
137     if (!file) {
138         // Invalid sparse format
139         LOG(ERROR) << "Unable to open sparse data for flashing";
140         return -EINVAL;
141     }
142     return sparse_file_callback(file, false, false, WriteCallback, reinterpret_cast<void*>(handle));
143 }
144 
FlashBlockDevice(PartitionHandle * handle,std::vector<char> & downloaded_data)145 int FlashBlockDevice(PartitionHandle* handle, std::vector<char>& downloaded_data) {
146     lseek64(handle->fd(), 0, SEEK_SET);
147     if (downloaded_data.size() >= sizeof(SPARSE_HEADER_MAGIC) &&
148         *reinterpret_cast<uint32_t*>(downloaded_data.data()) == SPARSE_HEADER_MAGIC) {
149         return FlashSparseData(handle, downloaded_data);
150     } else {
151         return FlashRawData(handle, downloaded_data);
152     }
153 }
154 
CopyAVBFooter(std::vector<char> * data,const uint64_t block_device_size)155 static void CopyAVBFooter(std::vector<char>* data, const uint64_t block_device_size) {
156     if (data->size() < AVB_FOOTER_SIZE) {
157         return;
158     }
159     std::string footer;
160     uint64_t footer_offset = data->size() - AVB_FOOTER_SIZE;
161     for (int idx = 0; idx < AVB_FOOTER_MAGIC_LEN; idx++) {
162         footer.push_back(data->at(footer_offset + idx));
163     }
164     if (0 != footer.compare(AVB_FOOTER_MAGIC)) {
165         return;
166     }
167 
168     // copy AVB footer from end of data to end of block device
169     uint64_t original_data_size = data->size();
170     data->resize(block_device_size, 0);
171     for (int idx = 0; idx < AVB_FOOTER_SIZE; idx++) {
172         data->at(block_device_size - 1 - idx) = data->at(original_data_size - 1 - idx);
173     }
174 }
175 
Flash(FastbootDevice * device,const std::string & partition_name)176 int Flash(FastbootDevice* device, const std::string& partition_name) {
177     PartitionHandle handle;
178     if (!OpenPartition(device, partition_name, &handle, O_WRONLY | O_DIRECT)) {
179         return -ENOENT;
180     }
181 
182     std::vector<char> data = std::move(device->download_data());
183     if (data.size() == 0) {
184         LOG(ERROR) << "Cannot flash empty data vector";
185         return -EINVAL;
186     }
187     uint64_t block_device_size = get_block_device_size(handle.fd());
188     if (data.size() > block_device_size) {
189         LOG(ERROR) << "Cannot flash " << data.size() << " bytes to block device of size "
190                    << block_device_size;
191         return -EOVERFLOW;
192     } else if (data.size() < block_device_size &&
193                (partition_name == "boot" || partition_name == "boot_a" ||
194                 partition_name == "boot_b" || partition_name == "init_boot" ||
195                 partition_name == "init_boot_a" || partition_name == "init_boot_b")) {
196         CopyAVBFooter(&data, block_device_size);
197     }
198     if (android::base::GetProperty("ro.system.build.type", "") != "user") {
199         WipeOverlayfsForPartition(device, partition_name);
200     }
201     int result = FlashBlockDevice(&handle, data);
202     sync();
203     return result;
204 }
205 
RemoveScratchPartition()206 static void RemoveScratchPartition() {
207     AutoMountMetadata mount_metadata;
208     android::fs_mgr::TeardownAllOverlayForMountPoint();
209 }
210 
UpdateSuper(FastbootDevice * device,const std::string & super_name,bool wipe)211 bool UpdateSuper(FastbootDevice* device, const std::string& super_name, bool wipe) {
212     std::vector<char> data = std::move(device->download_data());
213     if (data.empty()) {
214         return device->WriteFail("No data available");
215     }
216 
217     std::unique_ptr<LpMetadata> new_metadata = ReadFromImageBlob(data.data(), data.size());
218     if (!new_metadata) {
219         return device->WriteFail("Data is not a valid logical partition metadata image");
220     }
221 
222     if (!FindPhysicalPartition(super_name)) {
223         return device->WriteFail("Cannot find " + super_name +
224                                  ", build may be missing broken or missing boot_devices");
225     }
226 
227     std::string slot_suffix = device->GetCurrentSlot();
228     uint32_t slot_number = SlotNumberForSlotSuffix(slot_suffix);
229 
230     std::string other_slot_suffix;
231     if (!slot_suffix.empty()) {
232         other_slot_suffix = (slot_suffix == "_a") ? "_b" : "_a";
233     }
234 
235     // If we are unable to read the existing metadata, then the super partition
236     // is corrupt. In this case we reflash the whole thing using the provided
237     // image.
238     std::unique_ptr<LpMetadata> old_metadata = ReadMetadata(super_name, slot_number);
239     if (wipe || !old_metadata) {
240         if (!FlashPartitionTable(super_name, *new_metadata.get())) {
241             return device->WriteFail("Unable to flash new partition table");
242         }
243         RemoveScratchPartition();
244         sync();
245         return device->WriteOkay("Successfully flashed partition table");
246     }
247 
248     std::set<std::string> partitions_to_keep;
249     bool virtual_ab = android::base::GetBoolProperty("ro.virtual_ab.enabled", false);
250     for (const auto& partition : old_metadata->partitions) {
251         // Preserve partitions in the other slot, but not the current slot.
252         std::string partition_name = GetPartitionName(partition);
253         if (!slot_suffix.empty()) {
254             auto part_suffix = GetPartitionSlotSuffix(partition_name);
255             if (part_suffix == slot_suffix || (part_suffix == other_slot_suffix && virtual_ab)) {
256                 continue;
257             }
258         }
259         std::string group_name = GetPartitionGroupName(old_metadata->groups[partition.group_index]);
260         // Skip partitions in the COW group
261         if (group_name == android::snapshot::kCowGroupName) {
262             continue;
263         }
264         partitions_to_keep.emplace(partition_name);
265     }
266 
267     // Do not preserve the scratch partition.
268     partitions_to_keep.erase("scratch");
269 
270     if (!partitions_to_keep.empty()) {
271         std::unique_ptr<MetadataBuilder> builder = MetadataBuilder::New(*new_metadata.get());
272         if (!builder->ImportPartitions(*old_metadata.get(), partitions_to_keep)) {
273             return device->WriteFail(
274                     "Old partitions are not compatible with the new super layout; wipe needed");
275         }
276 
277         new_metadata = builder->Export();
278         if (!new_metadata) {
279             return device->WriteFail("Unable to build new partition table; wipe needed");
280         }
281     }
282 
283     // Write the new table to every metadata slot.
284     if (!UpdateAllPartitionMetadata(device, super_name, *new_metadata.get())) {
285         return device->WriteFail("Unable to write new partition table");
286     }
287     RemoveScratchPartition();
288     sync();
289     return device->WriteOkay("Successfully updated partition table");
290 }
291