Use structured format for verity metadata

Specify the location of verity metadata in fstab, and use a
type-length-value format for the metadata that allows other
data to be stored in the same location in an extensible way.

Change-Id: Id8711f7d51dc1e4e9a4d84f9951240f64528e69d

3 files changed, 197 insertions, 63 deletions

diff --git a/fs_mgr/fs_mgr_fstab.c b/fs_mgr/fs_mgr_fstab.c
index ab8f128..2c3c90d 100644
--- a/fs_mgr/fs_mgr_fstab.c
+++ b/fs_mgr/fs_mgr_fstab.c
@@ -24,6 +24,7 @@
 
 struct fs_mgr_flag_values {
     char *key_loc;
+    char *verity_loc;
     long long part_length;
     char *label;
     int partnum;
@@ -107,6 +108,14 @@ static int parse_flags(char *flags, struct flag_list *fl,
                      * location of the keys.  Get it and return it.
                      */
                     flag_vals->key_loc = strdup(strchr(p, '=') + 1);
+                } else if ((fl[i].flag == MF_VERIFY) && flag_vals) {
+                    /* If the verify flag is followed by an = and the
+                     * location for the verity state,  get it and return it.
+                     */
+                    char *start = strchr(p, '=');
+                    if (start) {
+                        flag_vals->verity_loc = strdup(start + 1);
+                    }
                 } else if ((fl[i].flag == MF_FORCECRYPT) && flag_vals) {
                     /* The forceencrypt flag is followed by an = and the
                      * location of the keys.  Get it and return it.
@@ -291,6 +300,7 @@ struct fstab *fs_mgr_read_fstab(const char *fstab_path)
         fstab->recs[cnt].fs_mgr_flags = parse_flags(p, fs_mgr_flags,
                                                     &flag_vals, NULL, 0);
         fstab->recs[cnt].key_loc = flag_vals.key_loc;
+        fstab->recs[cnt].verity_loc = flag_vals.verity_loc;
         fstab->recs[cnt].length = flag_vals.part_length;
         fstab->recs[cnt].label = flag_vals.label;
         fstab->recs[cnt].partnum = flag_vals.partnum;
diff --git a/fs_mgr/fs_mgr_verity.c b/fs_mgr/fs_mgr_verity.c
index 5c67333..0d5357b 100644
--- a/fs_mgr/fs_mgr_verity.c
+++ b/fs_mgr/fs_mgr_verity.c
@@ -47,16 +47,23 @@
 #define VERITY_METADATA_SIZE 32768
 #define VERITY_TABLE_RSA_KEY "/verity_key"
 
+#define METADATA_MAGIC 0x01564c54
+#define METADATA_TAG_MAX_LENGTH 63
+#define METADATA_EOD "eod"
+
+#define VERITY_STATE_TAG "verity_state"
 #define VERITY_STATE_HEADER 0x83c0ae9d
 #define VERITY_STATE_VERSION 1
 
 #define VERITY_KMSG_RESTART "dm-verity device corrupted"
 #define VERITY_KMSG_BUFSIZE 1024
 
+#define __STRINGIFY(x) #x
+#define STRINGIFY(x) __STRINGIFY(x)
+
 struct verity_state {
     uint32_t header;
     uint32_t version;
-    uint32_t size;
     int32_t mode;
 };
 
@@ -453,83 +460,151 @@ static int was_verity_restart()
     return 0;
 }
 
-static int write_verity_state(const char *fname, off64_t offset, int32_t mode)
+static int metadata_add(FILE *fp, long start, const char *tag,
+        unsigned int length, off64_t *offset)
 {
-    int fd;
+    if (TEMP_FAILURE_RETRY(fseek(fp, start, SEEK_SET)) < 0 ||
+        TEMP_FAILURE_RETRY(fprintf(fp, "%s %u\n", tag, length)) < 0) {
+        return -1;
+    }
+
+    *offset = ftell(fp);
+
+    if (TEMP_FAILURE_RETRY(fseek(fp, length, SEEK_CUR)) < 0 ||
+        TEMP_FAILURE_RETRY(fprintf(fp, METADATA_EOD " 0\n")) < 0) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static int metadata_find(const char *fname, const char *stag,
+        unsigned int slength, off64_t *offset)
+{
+    FILE *fp = NULL;
+    char tag[METADATA_TAG_MAX_LENGTH + 1];
     int rc = -1;
+    int n;
+    long start = 0x4000; /* skip cryptfs metadata area */
+    uint32_t magic;
+    unsigned int length = 0;
 
-    struct verity_state s = {
-        VERITY_STATE_HEADER,
-        VERITY_STATE_VERSION,
-        sizeof(struct verity_state),
-        mode
-    };
+    if (!fname) {
+        return -1;
+    }
 
-    fd = TEMP_FAILURE_RETRY(open(fname, O_WRONLY | O_SYNC | O_CLOEXEC));
+    fp = TEMP_FAILURE_RETRY(fopen(fname, "r+"));
 
-    if (fd == -1) {
+    if (!fp) {
         ERROR("Failed to open %s (%s)\n", fname, strerror(errno));
         goto out;
     }
 
-    if (TEMP_FAILURE_RETRY(lseek64(fd, offset, SEEK_SET)) < 0) {
-        ERROR("Failed to seek %s to %" PRIu64 " (%s)\n", fname, offset, strerror(errno));
+    /* check magic */
+    if (TEMP_FAILURE_RETRY(fseek(fp, start, SEEK_SET)) < 0 ||
+        TEMP_FAILURE_RETRY(fread(&magic, sizeof(magic), 1, fp)) != 1) {
+        ERROR("Failed to read magic from %s (%s)\n", fname, strerror(errno));
         goto out;
     }
 
-    if (TEMP_FAILURE_RETRY(write(fd, &s, sizeof(s))) != sizeof(s)) {
-        ERROR("Failed to write %zu bytes to %s (%s)\n", sizeof(s), fname, strerror(errno));
+    if (magic != METADATA_MAGIC) {
+        magic = METADATA_MAGIC;
+
+        if (TEMP_FAILURE_RETRY(fseek(fp, start, SEEK_SET)) < 0 ||
+            TEMP_FAILURE_RETRY(fwrite(&magic, sizeof(magic), 1, fp)) != 1) {
+            ERROR("Failed to write magic to %s (%s)\n", fname, strerror(errno));
+            goto out;
+        }
+
+        rc = metadata_add(fp, start + sizeof(magic), stag, slength, offset);
+        if (rc < 0) {
+            ERROR("Failed to add metadata to %s: %s\n", fname, strerror(errno));
+        }
+
         goto out;
     }
 
-    rc = 0;
+    start += sizeof(magic);
+
+    while (1) {
+        n = TEMP_FAILURE_RETRY(fscanf(fp,
+                "%" STRINGIFY(METADATA_TAG_MAX_LENGTH) "s %u\n",
+                tag, &length));
+
+        if (n == 2 && strcmp(tag, METADATA_EOD)) {
+            /* found a tag */
+            start = ftell(fp);
+
+            if (!strcmp(tag, stag) && length == slength) {
+                *offset = start;
+                rc = 0;
+                goto out;
+            }
+
+            start += length;
+
+            if (TEMP_FAILURE_RETRY(fseek(fp, length, SEEK_CUR)) < 0) {
+                ERROR("Failed to seek %s (%s)\n", fname, strerror(errno));
+                goto out;
+            }
+        } else {
+            rc = metadata_add(fp, start, stag, slength, offset);
+            if (rc < 0) {
+                ERROR("Failed to write metadata to %s: %s\n", fname,
+                    strerror(errno));
+            }
+            goto out;
+        }
+   }
 
 out:
-    if (fd != -1) {
-        TEMP_FAILURE_RETRY(close(fd));
+    if (fp) {
+        TEMP_FAILURE_RETRY(fflush(fp));
+        TEMP_FAILURE_RETRY(fclose(fp));
     }
 
     return rc;
 }
 
-static int get_verity_state_location(char *location, off64_t *offset)
+static int write_verity_state(const char *fname, off64_t offset, int32_t mode)
 {
-    char state_off[PROPERTY_VALUE_MAX];
+    int fd;
+    int rc = -1;
+    struct verity_state s = { VERITY_STATE_HEADER, VERITY_STATE_VERSION, mode };
 
-    if (property_get("ro.verity.state.location", location, NULL) <= 0) {
-        return -1;
-    }
+    fd = TEMP_FAILURE_RETRY(open(fname, O_WRONLY | O_SYNC | O_CLOEXEC));
 
-    if (*location != '/' || access(location, R_OK | W_OK) == -1) {
-        ERROR("Failed to access verity state %s (%s)\n", location, strerror(errno));
-        return -1;
+    if (fd == -1) {
+        ERROR("Failed to open %s (%s)\n", fname, strerror(errno));
+        goto out;
     }
 
-    *offset = 0;
+    if (TEMP_FAILURE_RETRY(pwrite64(fd, &s, sizeof(s), offset)) != sizeof(s)) {
+        ERROR("Failed to write %zu bytes to %s to offset %" PRIu64 " (%s)\n",
+            sizeof(s), fname, offset, strerror(errno));
+        goto out;
+    }
 
-    if (property_get("ro.verity.state.offset", state_off, NULL) > 0) {
-        *offset = strtoll(state_off, NULL, 0);
+    rc = 0;
 
-        if (errno == ERANGE || errno == EINVAL) {
-            ERROR("Invalid value in ro.verity.state.offset (%s)\n", state_off);
-            return -1;
-        }
+out:
+    if (fd != -1) {
+        TEMP_FAILURE_RETRY(close(fd));
     }
 
-    return 0;
+    return rc;
 }
 
-int fs_mgr_load_verity_state(int *mode)
+static int load_verity_state(struct fstab_rec *fstab, int *mode)
 {
-    char fname[PROPERTY_VALUE_MAX];
     int fd = -1;
     int rc = -1;
     off64_t offset = 0;
     struct verity_state s;
 
-    if (get_verity_state_location(fname, &offset) < 0) {
-        /* location for dm-verity state is not specified, fall back to
-         * default behavior: return -EIO for corrupted blocks */
+    if (metadata_find(fstab->verity_loc, VERITY_STATE_TAG, sizeof(s),
+            &offset) < 0) {
+        /* fall back to stateless behavior */
         *mode = VERITY_MODE_EIO;
         rc = 0;
         goto out;
@@ -539,28 +614,27 @@ int fs_mgr_load_verity_state(int *mode)
         /* device was restarted after dm-verity detected a corrupted
          * block, so switch to logging mode */
         *mode = VERITY_MODE_LOGGING;
-        rc = write_verity_state(fname, offset, *mode);
+        rc = write_verity_state(fstab->verity_loc, offset, *mode);
         goto out;
     }
 
-    fd = TEMP_FAILURE_RETRY(open(fname, O_RDONLY | O_CLOEXEC));
+    fd = TEMP_FAILURE_RETRY(open(fstab->verity_loc, O_RDONLY | O_CLOEXEC));
 
     if (fd == -1) {
-        ERROR("Failed to open %s (%s)\n", fname, strerror(errno));
-        goto out;
-    }
-
-    if (TEMP_FAILURE_RETRY(lseek64(fd, offset, SEEK_SET)) < 0) {
-        ERROR("Failed to seek %s to %" PRIu64 " (%s)\n", fname, offset, strerror(errno));
+        ERROR("Failed to open %s (%s)\n", fstab->verity_loc, strerror(errno));
         goto out;
     }
 
-    if (TEMP_FAILURE_RETRY(read(fd, &s, sizeof(s))) != sizeof(s)) {
-        ERROR("Failed to read %zu bytes from %s (%s)\n", sizeof(s), fname, strerror(errno));
+    if (TEMP_FAILURE_RETRY(pread64(fd, &s, sizeof(s), offset)) != sizeof(s)) {
+        ERROR("Failed to read %zu bytes from %s offset %" PRIu64 " (%s)\n",
+            sizeof(s), fstab->verity_loc, offset, strerror(errno));
         goto out;
     }
 
     if (s.header != VERITY_STATE_HEADER) {
+        /* space allocated, but no state written. write default state */
+        *mode = VERITY_MODE_DEFAULT;
+        rc = write_verity_state(fstab->verity_loc, offset, *mode);
         goto out;
     }
 
@@ -569,11 +643,6 @@ int fs_mgr_load_verity_state(int *mode)
         goto out;
     }
 
-    if (s.size != sizeof(s)) {
-        ERROR("Unexpected verity state size (%u)\n", s.size);
-        goto out;
-    }
-
     if (s.mode < VERITY_MODE_EIO ||
         s.mode > VERITY_MODE_LAST) {
         ERROR("Unsupported verity mode (%u)\n", s.mode);
@@ -591,13 +660,61 @@ out:
     return rc;
 }
 
+int fs_mgr_load_verity_state(int *mode)
+{
+    char fstab_filename[PROPERTY_VALUE_MAX + sizeof(FSTAB_PREFIX)];
+    char propbuf[PROPERTY_VALUE_MAX];
+    int rc = -1;
+    int i;
+    struct fstab *fstab = NULL;
+
+    *mode = VERITY_MODE_DEFAULT;
+
+    property_get("ro.hardware", propbuf, "");
+    snprintf(fstab_filename, sizeof(fstab_filename), FSTAB_PREFIX"%s", propbuf);
+
+    fstab = fs_mgr_read_fstab(fstab_filename);
+
+    if (!fstab) {
+        ERROR("Failed to read %s\n", fstab_filename);
+        goto out;
+    }
+
+    for (i = 0; i < fstab->num_entries; i++) {
+        if (!fs_mgr_is_verified(&fstab->recs[i])) {
+            continue;
+        }
+
+        rc = load_verity_state(&fstab->recs[i], mode);
+        if (rc < 0) {
+            continue;
+        }
+
+        /* if any of the verified partitions are in logging mode, return */
+        if (*mode == VERITY_MODE_LOGGING) {
+            rc = 0;
+            goto out;
+        }
+    }
+
+    /* if there were multiple partitions, all in non-logging mode, return the
+     * state of the last one */
+    rc = 0;
+
+out:
+    if (fstab) {
+        fs_mgr_free_fstab(fstab);
+    }
+
+    return rc;
+}
+
 int fs_mgr_update_verity_state(fs_mgr_verity_state_callback callback)
 {
     _Alignas(struct dm_ioctl) char buffer[DM_BUF_SIZE];
     char fstab_filename[PROPERTY_VALUE_MAX + sizeof(FSTAB_PREFIX)];
     char *mount_point;
     char propbuf[PROPERTY_VALUE_MAX];
-    char state_loc[PROPERTY_VALUE_MAX];
     char *status;
     int fd = -1;
     int i;
@@ -606,10 +723,6 @@ int fs_mgr_update_verity_state(fs_mgr_verity_state_callback callback)
     struct dm_ioctl *io = (struct dm_ioctl *) buffer;
     struct fstab *fstab = NULL;
 
-    if (get_verity_state_location(state_loc, &offset) < 0) {
-        goto out;
-    }
-
     fd = TEMP_FAILURE_RETRY(open("/dev/device-mapper", O_RDWR | O_CLOEXEC));
 
     if (fd == -1) {
@@ -632,6 +745,11 @@ int fs_mgr_update_verity_state(fs_mgr_verity_state_callback callback)
             continue;
         }
 
+        if (metadata_find(fstab->recs[i].verity_loc, VERITY_STATE_TAG,
+                sizeof(struct verity_state), &offset) < 0) {
+            continue;
+        }
+
         mount_point = basename(fstab->recs[i].mount_point);
         verity_ioctl_init(io, mount_point, 0);
 
@@ -644,7 +762,8 @@ int fs_mgr_update_verity_state(fs_mgr_verity_state_callback callback)
         status = &buffer[io->data_start + sizeof(struct dm_target_spec)];
 
         if (*status == 'C') {
-            rc = write_verity_state(state_loc, offset, VERITY_MODE_LOGGING);
+            rc = write_verity_state(fstab->recs[i].verity_loc, offset,
+                    VERITY_MODE_LOGGING);
 
             if (rc == -1) {
                 goto out;
@@ -732,8 +851,12 @@ int fs_mgr_setup_verity(struct fstab_rec *fstab) {
         goto out;
     }
 
-    if (fs_mgr_load_verity_state(&mode) < 0) {
-        mode = VERITY_MODE_RESTART; /* default dm-verity mode */
+    if (load_verity_state(fstab, &mode) < 0) {
+        /* if accessing or updating the state failed, switch to the default
+         * safe mode. This makes sure the device won't end up in an endless
+         * restart loop, and no corrupted data will be exposed to userspace
+         * without a warning. */
+        mode = VERITY_MODE_EIO;
     }
 
     INFO("Enabling dm-verity for %s (mode %d)\n",  mount_point, mode);
diff --git a/fs_mgr/include/fs_mgr.h b/fs_mgr/include/fs_mgr.h
index d2c8fff..ad8a8fc 100644
--- a/fs_mgr/include/fs_mgr.h
+++ b/fs_mgr/include/fs_mgr.h
@@ -36,7 +36,8 @@ enum verity_mode {
     VERITY_MODE_EIO = 0,
     VERITY_MODE_LOGGING = 1,
     VERITY_MODE_RESTART = 2,
-    VERITY_MODE_LAST = VERITY_MODE_RESTART
+    VERITY_MODE_LAST = VERITY_MODE_RESTART,
+    VERITY_MODE_DEFAULT = VERITY_MODE_RESTART
 };
 
 /*