android-14.0.0_r21/s

/*
 * Copyright (C) 2021 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include "vendor_boot_img_utils.h"

#include <string.h>

#include <android-base/file.h>
#include <android-base/result.h>
#include <bootimg.h>
#include <libavb/libavb.h>

namespace {

using android::base::Result;

// Updates a given buffer by creating a new one.
class DataUpdater {
  public:
    DataUpdater(const std::string& old_data) : old_data_(&old_data) {
        old_data_ptr_ = old_data_->data();
        new_data_.resize(old_data_->size(), '\0');
        new_data_ptr_ = new_data_.data();
    }
    // Copy |num_bytes| from src to dst.
    [[nodiscard]] Result<void> Copy(uint32_t num_bytes) {
        if (num_bytes == 0) return {};
        if (auto res = CheckAdvance(old_data_ptr_, old_end(), num_bytes, __FUNCTION__); !res.ok())
            return res;
        if (auto res = CheckAdvance(new_data_ptr_, new_end(), num_bytes, __FUNCTION__); !res.ok())
            return res;
        memcpy(new_data_ptr_, old_data_ptr_, num_bytes);
        old_data_ptr_ += num_bytes;
        new_data_ptr_ += num_bytes;
        return {};
    }
    // Replace |old_num_bytes| from src with new data.
    [[nodiscard]] Result<void> Replace(uint32_t old_num_bytes, const std::string& new_data) {
        return Replace(old_num_bytes, new_data.data(), new_data.size());
    }
    [[nodiscard]] Result<void> Replace(uint32_t old_num_bytes, const void* new_data,
                                       uint32_t new_data_size) {
        if (auto res = CheckAdvance(old_data_ptr_, old_end(), old_num_bytes, __FUNCTION__);
            !res.ok())
            return res;
        old_data_ptr_ += old_num_bytes;

        if (new_data_size == 0) return {};
        if (auto res = CheckAdvance(new_data_ptr_, new_end(), new_data_size, __FUNCTION__);
            !res.ok())
            return res;
        memcpy(new_data_ptr_, new_data, new_data_size);
        new_data_ptr_ += new_data_size;
        return {};
    }
    // Skip |old_skip| from src and |new_skip| from dst, respectively.
    [[nodiscard]] Result<void> Skip(uint32_t old_skip, uint32_t new_skip) {
        if (auto res = CheckAdvance(old_data_ptr_, old_end(), old_skip, __FUNCTION__); !res.ok())
            return res;
        old_data_ptr_ += old_skip;
        if (auto res = CheckAdvance(new_data_ptr_, new_end(), new_skip, __FUNCTION__); !res.ok())
            return res;
        new_data_ptr_ += new_skip;
        return {};
    }

    [[nodiscard]] Result<void> Seek(uint32_t offset) {
        if (offset > size()) return Errorf("Cannot seek 0x{:x}, size is 0x{:x}", offset, size());
        old_data_ptr_ = old_begin() + offset;
        new_data_ptr_ = new_begin() + offset;
        return {};
    }

    std::string Finish() {
        new_data_ptr_ = nullptr;
        return std::move(new_data_);
    }

    [[nodiscard]] Result<void> CheckOffset(uint32_t old_offset, uint32_t new_offset) {
        if (old_begin() + old_offset != old_cur())
            return Errorf("Old offset mismatch: expected: 0x{:x}, actual: 0x{:x}", old_offset,
                          old_cur() - old_begin());
        if (new_begin() + new_offset != new_cur())
            return Errorf("New offset mismatch: expected: 0x{:x}, actual: 0x{:x}", new_offset,
                          new_cur() - new_begin());
        return {};
    }

    uint64_t size() const { return old_data_->size(); }
    const char* old_begin() const { return old_data_->data(); }
    const char* old_cur() { return old_data_ptr_; }
    const char* old_end() const { return old_data_->data() + old_data_->size(); }
    char* new_begin() { return new_data_.data(); }
    char* new_cur() { return new_data_ptr_; }
    char* new_end() { return new_data_.data() + new_data_.size(); }

  private:
    // Check if it is okay to advance |num_bytes| from |current|.
    [[nodiscard]] Result<void> CheckAdvance(const char* current, const char* end,
                                            uint32_t num_bytes, const char* op) {
        auto new_end = current + num_bytes;
        if (new_end < current /* add overflow */)
            return Errorf("{}: Addition overflow: 0x{} + 0x{:x} < 0x{}", op, fmt::ptr(current),
                          num_bytes, fmt::ptr(current));
        if (new_end > end)
            return Errorf("{}: Boundary overflow: 0x{} + 0x{:x} > 0x{}", op, fmt::ptr(current),
                          num_bytes, fmt::ptr(end));
        return {};
    }
    const std::string* old_data_;
    std::string new_data_;
    const char* old_data_ptr_;
    char* new_data_ptr_;
};

// Get the size of vendor boot header.
[[nodiscard]] Result<uint32_t> get_vendor_boot_header_size(const vendor_boot_img_hdr_v3* hdr) {
    if (hdr->header_version == 3) return sizeof(vendor_boot_img_hdr_v3);
    if (hdr->header_version == 4) return sizeof(vendor_boot_img_hdr_v4);
    return Errorf("Unrecognized vendor boot header version {}", hdr->header_version);
}

// Check that content contains a valid vendor boot image header with a version at least |version|.
[[nodiscard]] Result<void> check_vendor_boot_hdr(const std::string& content, uint32_t version) {
    // get_vendor_boot_header_size reads header_version, so make sure reading it does not
    // go out of bounds by ensuring that the content has at least the size of V3 header.
    if (content.size() < sizeof(vendor_boot_img_hdr_v3)) {
        return Errorf("Size of vendor boot is 0x{:x}, less than size of V3 header: 0x{:x}",
                      content.size(), sizeof(vendor_boot_img_hdr_v3));
    }
    // Now read hdr->header_version and assert the size.
    auto hdr = reinterpret_cast<const vendor_boot_img_hdr_v3*>(content.data());
    auto expect_header_size = get_vendor_boot_header_size(hdr);
    if (!expect_header_size.ok()) return expect_header_size.error();
    if (content.size() < *expect_header_size) {
        return Errorf("Size of vendor boot is 0x{:x}, less than size of V{} header: 0x{:x}",
                      content.size(), version, *expect_header_size);
    }
    if (memcmp(hdr->magic, VENDOR_BOOT_MAGIC, VENDOR_BOOT_MAGIC_SIZE) != 0) {
        return Errorf("Vendor boot image magic mismatch");
    }
    if (hdr->page_size == 0) {
        return Errorf("Page size cannot be zero");
    }
    if (hdr->header_version < version) {
        return Errorf("Require vendor boot header V{} but is V{}", version, hdr->header_version);
    }
    return {};
}

// Wrapper of ReadFdToString. Seek to the beginning and read the whole file to string.
[[nodiscard]] Result<std::string> load_file(android::base::borrowed_fd fd, uint64_t expected_size,
                                            const char* what) {
    if (lseek(fd.get(), 0, SEEK_SET) != 0) {
        return ErrnoErrorf("Can't seek to the beginning of {} image", what);
    }
    std::string content;
    if (!android::base::ReadFdToString(fd, &content)) {
        return ErrnoErrorf("Cannot read {} to string", what);
    }
    if (content.size() != expected_size) {
        return Errorf("Size of {} does not match, expected 0x{:x}, read 0x{:x}", what,
                      expected_size, content.size());
    }
    return content;
}

// Wrapper of WriteStringToFd. Seek to the beginning and write the whole file to string.
[[nodiscard]] Result<void> store_file(android::base::borrowed_fd fd, const std::string& data,
                                      const char* what) {
    if (lseek(fd.get(), 0, SEEK_SET) != 0) {
        return ErrnoErrorf("Cannot seek to beginning of {} before writing", what);
    }
    if (!android::base::WriteStringToFd(data, fd)) {
        return ErrnoErrorf("Cannot write new content to {}", what);
    }
    if (TEMP_FAILURE_RETRY(ftruncate(fd.get(), data.size())) == -1) {
        return ErrnoErrorf("Truncating new vendor boot image to 0x{:x} fails", data.size());
    }
    return {};
}

// Copy AVB footer if it exists in the old buffer.
[[nodiscard]] Result<void> copy_avb_footer(DataUpdater* updater) {
    if (updater->size() < AVB_FOOTER_SIZE) return {};
    if (auto res = updater->Seek(updater->size() - AVB_FOOTER_SIZE); !res.ok()) return res;
    if (memcmp(updater->old_cur(), AVB_FOOTER_MAGIC, AVB_FOOTER_MAGIC_LEN) != 0) return {};
    return updater->Copy(AVB_FOOTER_SIZE);
}

// round |value| up to a multiple of |page_size|.
// aware that this can be integer overflow if value is too large
inline uint32_t round_up(uint32_t value, uint32_t page_size) {
    return (value + page_size - 1) / page_size * page_size;
}

// Replace the vendor ramdisk as a whole.
[[nodiscard]] Result<std::string> replace_default_vendor_ramdisk(const std::string& vendor_boot,
                                                                 const std::string& new_ramdisk) {
    if (auto res = check_vendor_boot_hdr(vendor_boot, 3); !res.ok()) return res.error();
    auto hdr = reinterpret_cast<const vendor_boot_img_hdr_v3*>(vendor_boot.data());
    auto hdr_size = get_vendor_boot_header_size(hdr);
    if (!hdr_size.ok()) return hdr_size.error();
    // Refer to bootimg.h for details. Numbers are in bytes.
    const uint32_t o = round_up(*hdr_size, hdr->page_size);
    const uint32_t p = round_up(hdr->vendor_ramdisk_size, hdr->page_size);
    const uint32_t q = round_up(hdr->dtb_size, hdr->page_size);

    DataUpdater updater(vendor_boot);

    // Copy header (O bytes), then update fields in header.
    if (auto res = updater.Copy(o); !res.ok()) return res.error();
    auto new_hdr = reinterpret_cast<vendor_boot_img_hdr_v3*>(updater.new_begin());
    new_hdr->vendor_ramdisk_size = new_ramdisk.size();
    // Because it is unknown how the new ramdisk is fragmented, the whole table is replaced
    // with a single entry representing the full ramdisk.
    if (new_hdr->header_version >= 4) {
        auto new_hdr_v4 = static_cast<vendor_boot_img_hdr_v4*>(new_hdr);
        new_hdr_v4->vendor_ramdisk_table_entry_size = sizeof(vendor_ramdisk_table_entry_v4);
        new_hdr_v4->vendor_ramdisk_table_entry_num = 1;
        new_hdr_v4->vendor_ramdisk_table_size = new_hdr_v4->vendor_ramdisk_table_entry_num *
                                                new_hdr_v4->vendor_ramdisk_table_entry_size;
    }

    // Copy the new ramdisk.
    if (auto res = updater.Replace(hdr->vendor_ramdisk_size, new_ramdisk); !res.ok())
        return res.error();
    const uint32_t new_p = round_up(new_hdr->vendor_ramdisk_size, new_hdr->page_size);
    if (auto res = updater.Skip(p - hdr->vendor_ramdisk_size, new_p - new_hdr->vendor_ramdisk_size);
        !res.ok())
        return res.error();
    if (auto res = updater.CheckOffset(o + p, o + new_p); !res.ok()) return res.error();

    // Copy DTB (Q bytes).
    if (auto res = updater.Copy(q); !res.ok()) return res.error();

    if (new_hdr->header_version >= 4) {
        auto hdr_v4 = static_cast<const vendor_boot_img_hdr_v4*>(hdr);
        const uint32_t r = round_up(hdr_v4->vendor_ramdisk_table_size, hdr_v4->page_size);
        const uint32_t s = round_up(hdr_v4->bootconfig_size, hdr_v4->page_size);

        auto new_entry = reinterpret_cast<vendor_ramdisk_table_entry_v4*>(updater.new_cur());
        auto new_hdr_v4 = static_cast<const vendor_boot_img_hdr_v4*>(new_hdr);
        auto new_r = round_up(new_hdr_v4->vendor_ramdisk_table_size, new_hdr->page_size);
        if (auto res = updater.Skip(r, new_r); !res.ok()) return res.error();
        if (auto res = updater.CheckOffset(o + p + q + r, o + new_p + q + new_r); !res.ok())
            return res.error();

        // Replace table with single entry representing the full ramdisk.
        new_entry->ramdisk_size = new_hdr->vendor_ramdisk_size;
        new_entry->ramdisk_offset = 0;
        new_entry->ramdisk_type = VENDOR_RAMDISK_TYPE_NONE;
        memset(new_entry->ramdisk_name, '\0', VENDOR_RAMDISK_NAME_SIZE);
        memset(new_entry->board_id, '\0', VENDOR_RAMDISK_TABLE_ENTRY_BOARD_ID_SIZE);

        // Copy bootconfig (S bytes).
        if (auto res = updater.Copy(s); !res.ok()) return res.error();
    }

    if (auto res = copy_avb_footer(&updater); !res.ok()) return res.error();
    return updater.Finish();
}

// Find a ramdisk fragment with a unique name. Abort if none or multiple fragments are found.
[[nodiscard]] Result<const vendor_ramdisk_table_entry_v4*> find_unique_ramdisk(
        const std::string& ramdisk_name, const vendor_ramdisk_table_entry_v4* table,
        uint32_t size) {
    const vendor_ramdisk_table_entry_v4* ret = nullptr;
    uint32_t idx = 0;
    const vendor_ramdisk_table_entry_v4* entry = table;
    for (; idx < size; idx++, entry++) {
        auto entry_name_c_str = reinterpret_cast<const char*>(entry->ramdisk_name);
        auto entry_name_len = strnlen(entry_name_c_str, VENDOR_RAMDISK_NAME_SIZE);
        std::string_view entry_name(entry_name_c_str, entry_name_len);
        if (entry_name == ramdisk_name) {
            if (ret != nullptr) {
                return Errorf("Multiple vendor ramdisk '{}' found, name should be unique",
                              ramdisk_name.c_str());
            }
            ret = entry;
        }
    }
    if (ret == nullptr) {
        return Errorf("Vendor ramdisk '{}' not found", ramdisk_name.c_str());
    }
    return ret;
}

// Find the vendor ramdisk fragment with |ramdisk_name| within the content of |vendor_boot|, and
// replace it with the content of |new_ramdisk|.
[[nodiscard]] Result<std::string> replace_vendor_ramdisk_fragment(const std::string& ramdisk_name,
                                                                  const std::string& vendor_boot,
                                                                  const std::string& new_ramdisk) {
    if (auto res = check_vendor_boot_hdr(vendor_boot, 4); !res.ok()) return res.error();
    auto hdr = reinterpret_cast<const vendor_boot_img_hdr_v4*>(vendor_boot.data());
    auto hdr_size = get_vendor_boot_header_size(hdr);
    if (!hdr_size.ok()) return hdr_size.error();
    // Refer to bootimg.h for details. Numbers are in bytes.
    const uint32_t o = round_up(*hdr_size, hdr->page_size);
    const uint32_t p = round_up(hdr->vendor_ramdisk_size, hdr->page_size);
    const uint32_t q = round_up(hdr->dtb_size, hdr->page_size);
    const uint32_t r = round_up(hdr->vendor_ramdisk_table_size, hdr->page_size);
    const uint32_t s = round_up(hdr->bootconfig_size, hdr->page_size);

    uint64_t total_size = (uint64_t)o + p + q + r + s;
    if (total_size > vendor_boot.size()) {
        return Errorf("Vendor boot image size is too small, overflow");
    }

    if ((uint64_t)hdr->vendor_ramdisk_table_entry_num * sizeof(vendor_ramdisk_table_entry_v4) >
        (uint64_t)o + p + q + r) {
        return Errorf("Too many vendor ramdisk entries in table, overflow");
    }

    // Find entry with name |ramdisk_name|.
    auto old_table_start =
            reinterpret_cast<const vendor_ramdisk_table_entry_v4*>(vendor_boot.data() + o + p + q);
    auto find_res =
            find_unique_ramdisk(ramdisk_name, old_table_start, hdr->vendor_ramdisk_table_entry_num);
    if (!find_res.ok()) return find_res.error();
    const vendor_ramdisk_table_entry_v4* replace_entry = *find_res;
    uint32_t replace_idx = replace_entry - old_table_start;

    // Now reconstruct.
    DataUpdater updater(vendor_boot);

    // Copy header (O bytes), then update fields in header.
    if (auto res = updater.Copy(o); !res.ok()) return res.error();
    auto new_hdr = reinterpret_cast<vendor_boot_img_hdr_v4*>(updater.new_begin());

    // Copy ramdisk fragments, replace for the matching index.
    {
        auto old_ramdisk_entry = reinterpret_cast<const vendor_ramdisk_table_entry_v4*>(
                vendor_boot.data() + o + p + q);
        uint32_t new_total_ramdisk_size = 0;
        for (uint32_t new_ramdisk_idx = 0; new_ramdisk_idx < hdr->vendor_ramdisk_table_entry_num;
             new_ramdisk_idx++, old_ramdisk_entry++) {
            if (new_ramdisk_idx == replace_idx) {
                if (auto res = updater.Replace(replace_entry->ramdisk_size, new_ramdisk); !res.ok())
                    return res.error();
                new_total_ramdisk_size += new_ramdisk.size();
            } else {
                if (auto res = updater.Copy(old_ramdisk_entry->ramdisk_size); !res.ok())
                    return res.error();
                new_total_ramdisk_size += old_ramdisk_entry->ramdisk_size;
            }
        }
        new_hdr->vendor_ramdisk_size = new_total_ramdisk_size;
    }

    // Pad ramdisk to page boundary.
    const uint32_t new_p = round_up(new_hdr->vendor_ramdisk_size, new_hdr->page_size);
    if (auto res = updater.Skip(p - hdr->vendor_ramdisk_size, new_p - new_hdr->vendor_ramdisk_size);
        !res.ok())
        return res.error();
    if (auto res = updater.CheckOffset(o + p, o + new_p); !res.ok()) return res.error();

    // Copy DTB (Q bytes).
    if (auto res = updater.Copy(q); !res.ok()) return res.error();

    // Copy table, but with corresponding entries modified, including:
    // - ramdisk_size of the entry replaced
    // - ramdisk_offset of subsequent entries.
    for (uint32_t new_total_ramdisk_size = 0, new_entry_idx = 0;
         new_entry_idx < hdr->vendor_ramdisk_table_entry_num; new_entry_idx++) {
        auto new_entry = reinterpret_cast<vendor_ramdisk_table_entry_v4*>(updater.new_cur());
        if (auto res = updater.Copy(hdr->vendor_ramdisk_table_entry_size); !res.ok())
            return res.error();
        new_entry->ramdisk_offset = new_total_ramdisk_size;

        if (new_entry_idx == replace_idx) {
            new_entry->ramdisk_size = new_ramdisk.size();
        }
        new_total_ramdisk_size += new_entry->ramdisk_size;
    }

    // Copy padding of R pages; this is okay because table size is not changed.
    if (auto res = updater.Copy(r - hdr->vendor_ramdisk_table_entry_num *
                                            hdr->vendor_ramdisk_table_entry_size);
        !res.ok())
        return res.error();
    if (auto res = updater.CheckOffset(o + p + q + r, o + new_p + q + r); !res.ok())
        return res.error();

    // Copy bootconfig (S bytes).
    if (auto res = updater.Copy(s); !res.ok()) return res.error();

    if (auto res = copy_avb_footer(&updater); !res.ok()) return res.error();
    return updater.Finish();
}

}  // namespace

[[nodiscard]] Result<void> replace_vendor_ramdisk(android::base::borrowed_fd vendor_boot_fd,
                                                  uint64_t vendor_boot_size,
                                                  const std::string& ramdisk_name,
                                                  android::base::borrowed_fd new_ramdisk_fd,
                                                  uint64_t new_ramdisk_size) {
    if (new_ramdisk_size > std::numeric_limits<uint32_t>::max()) {
        return Errorf("New vendor ramdisk is too big");
    }

    auto vendor_boot = load_file(vendor_boot_fd, vendor_boot_size, "vendor boot");
    if (!vendor_boot.ok()) return vendor_boot.error();
    auto new_ramdisk = load_file(new_ramdisk_fd, new_ramdisk_size, "new vendor ramdisk");
    if (!new_ramdisk.ok()) return new_ramdisk.error();

    Result<std::string> new_vendor_boot;
    if (ramdisk_name == "default") {
        new_vendor_boot = replace_default_vendor_ramdisk(*vendor_boot, *new_ramdisk);
    } else {
        new_vendor_boot = replace_vendor_ramdisk_fragment(ramdisk_name, *vendor_boot, *new_ramdisk);
    }
    if (!new_vendor_boot.ok()) return new_vendor_boot.error();
    if (auto res = store_file(vendor_boot_fd, *new_vendor_boot, "new vendor boot image"); !res.ok())
        return res.error();

    return {};
}