前言
在看本文之前,请乖乖的答应我去看这个专利最开始的几篇,先知道一下AVB是什么东西,用在什么场景。再来看这个是怎么使用的。
没有规律的撸撸AVB代码:AVB中CPP到C
今天有点头晕,老早就溜了,回来闲着无事,便记录一下最近学习AVB的东西。
之前在这个专栏里写了很多的东西,也转载记录了一些前辈的优秀博客,这里自己最近也在看代码,于是就再来梳理一下。
之前也有涉及到源码,或者有涉及到应用,总是将两者拆分开的。于是这里记录一个小点,AVB怎么用。你要去跟踪的时候你的打印应该加在哪里?
那么废话不多说,跟着老习惯,自顶向下分为应用层+实现层
1、应用层
应用层的东西就是展示android是怎么用到AVB的,以及它是怎么使用的。
那么这里我们从以下几个问题?
1、AVB哪里用的?
1、Stage one
这个我之前在文章多次提到过,AVB的校验本质上分为两个阶段。
在bootloader中,需要校验分区的函数变量:
// Library/avb/VerifiedBoot.c
static CHAR8 *avb_verify_partition_name[] = {
"boot",
"dtbo",
"vbmeta",
"recovery",
"vendor_boot"
};
从上面的变量可以知道,在bootloader中,可能需要校验上面的5个分区。
为什么说是可能?因为最终的校验是需要根据vbmeta分区来决定的。
解析vbmeta镜像:
avbtool info_image --image vbmeta.img > vbmeta.img.info
Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 4032 bytes
Public key (sha1): 2e22ae4a46cf9db9c24ab74cee91fa005ccb30e4
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: vbmeta_system
Rollback Index Location: 2
Public key (sha1): fc92d9cba0628858d846fb9a18a7af72b05d7dc8
...
Hash descriptor:
Image Size: 59932672 bytes
Hash Algorithm: sha256
Partition Name: boot
Salt: e691366c1c43ee5e23b342d65555ad8cfbadf77118dceb77e240c8e7d3e63ea6
Digest: 239648eb41f5a491c7c4d6b51b52a533bd9da98ba8800f58a0957f7341dd1686
Flags: 0
Hash descriptor:
Image Size: 740733 bytes
Hash Algorithm: sha256
Partition Name: dtbo
Salt: d445a36d8154a774589dd51c49029ee388ecaac28212c8c6899f45dc5a51dbcf
Digest: cac0bd59091464292bc83d6f1193afb1520c12a3849f2673ad3160bb951acf6d
Flags: 0
Hash descriptor:
Image Size: 1916928 bytes
Hash Algorithm: sha256
Partition Name: vendor_boot
Salt: 5f7b7c3592142d4f3645d7e675fb7865915e52e8b361ba330fccf00aeb1c4028
Digest: cf153ab9df9a5c34024417ea2b0b4dfd716d01ba9cd2d5bcf964fe7e25cdd802
Flags: 0
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 864256 bytes
Tree Offset: 864256
Tree Size: 12288 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 876544
FEC size: 8192 bytes
Hash Algorithm: sha1
Partition Name: odm
Salt: b6e1f57ae6939659355e83ad7fa57feb6b5eb15a3d16b96752f43cdc14918708
Root Digest: da99875b16661e72eec81d05d58dffdf09fe228d
Flags: 0
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 1002233856 bytes
Tree Offset: 1002233856
Tree Size: 7897088 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 1010130944
FEC size: 7987200 bytes
Hash Algorithm: sha1
Partition Name: vendor
Salt: b6e1f57ae6939659355e83ad7fa57feb6b5eb15a3d16b96752f43cdc14918708
Root Digest: 336bd4885da274ae0de38b32b899f7b6169e676f
Flags: 0
通过vbmeta.img.info可以知道,bootloader中需要校验 vbmeta、boot 、dtbo、vendor_boot四个分区。
当然这些都是可以自己设置的,比如说你的产品的boot\dtbo等有些分区你觉得不想用AVB的方式,你把这些分区放到SecureBoot启动链中去校验也可以的。
2、Stage two
init阶段的avb校验,可以通过dts和fstab确定需要校验的分区。
android {
compatible = "android,firmware";
vbmeta {
compatible = "android,vbmeta";
parts = "vbmeta,boot,system,vendor,dtbo";
};
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc/1d84000.ufshc/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,discard";
fsmgr_flags = "wait,slotselect,avb";
status = "ok";
};
};
};
具体的看一下这篇—>Android AVB的校验宏观的两个阶段
这个部分你需要知道的就是这两步是哪两步,以及这两步是可以自己定义校验哪些分区的。
那么下面就需要看看AVB这个玩意在代码中是怎么使用的呢?
2、AVB怎么用的?
怎么要看干了什么?
1、设备检测
如果说AVB只是校验了镜像就真的有点肤浅了哈!!!
如果你有看过之前的AVB的流程图。
就这个图,就知道这个里面涉及到了四个操作:
(详细的内容:【Uboot阶段AVB2.0校验流程】)
-
1、Device Lock设备上锁
-
2、Valid Os found-检察vbmeta.img是否合法
-
3、Was the root of trust set by the user
-
4、Update rollback
那这个里面我就知道了有自定义的东西,要实现这些功能,就移植libavb库到UBOOT或者UEFI中,然后实现avb_ops.c中的几个接口就可以了:
文件:libavb/avb_ops.h
AvbIOResult (*read_from_partition)(AvbOps* ops,
const char *partition,
int64_t offset,
size_t num_bytes,
void* buffer,
size_t* out_num_read);
AvbIOResult (*read_rollback_index)(AvbOps* ops,
size_t rollback_index_location,
uint64_t* out_rollback_index);
AvbIOResult (*write_rollback_index)(AvbOps* ops,
size_t rollback_index_location,
uint64_t rollback_index);
AvbIOResult (*validate_vbmeta_public_key)(AvbOps* ops,
const uint8_t* public_key_data,
size_t public_key_length,
const uint8_t* public_key_metadata,
size_t public_key_metadata_length,
bool* out_is_trusted);
完整版(推荐阅读这个,接口上面有注释,英语较为薄弱的可以借助翻译,弄懂接口和结构体的含义)
/*
* Copyright (C) 2016 The Android Open Source Project
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use, copy,
* modify, merge, publish, distribute, sublicense, and/or sell copies
* of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
#if !defined(AVB_INSIDE_LIBAVB_H) && !defined(AVB_COMPILATION)
#error "Never include this file directly, include libavb.h instead."
#endif
#ifndef AVB_OPS_H_
#define AVB_OPS_H_
#include "avb_sysdeps.h"
#ifdef __cplusplus
extern "C" {
#endif
/* Well-known names of named persistent values. */
#define AVB_NPV_PERSISTENT_DIGEST_PREFIX "avb.persistent_digest."
#define AVB_NPV_MANAGED_VERITY_MODE "avb.managed_verity_mode"
/* Return codes used for I/O operations.
*
* AVB_IO_RESULT_OK is returned if the requested operation was
* successful.
*
* AVB_IO_RESULT_ERROR_IO is returned if the underlying hardware (disk
* or other subsystem) encountered an I/O error.
*
* AVB_IO_RESULT_ERROR_OOM is returned if unable to allocate memory.
*
* AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION is returned if the requested
* partition does not exist.
*
* AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION is returned if the
* range of bytes requested to be read or written is outside the range
* of the partition.
*
* AVB_IO_RESULT_ERROR_NO_SUCH_VALUE is returned if a named persistent value
* does not exist.
*
* AVB_IO_RESULT_ERROR_INVALID_VALUE_SIZE is returned if a named persistent
* value size is not supported or does not match the expected size.
*
* AVB_IO_RESULT_ERROR_INSUFFICIENT_SPACE is returned if a buffer is too small
* for the requested operation.
*/
typedef enum {
AVB_IO_RESULT_OK,
AVB_IO_RESULT_ERROR_OOM,
AVB_IO_RESULT_ERROR_IO,
AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION,
AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION,
AVB_IO_RESULT_ERROR_NO_SUCH_VALUE,
AVB_IO_RESULT_ERROR_INVALID_VALUE_SIZE,
AVB_IO_RESULT_ERROR_INSUFFICIENT_SPACE,
} AvbIOResult;
struct AvbOps;
typedef struct AvbOps AvbOps;
/* Forward-declaration of operations in libavb_ab. */
struct AvbABOps;
/* Forward-declaration of operations in libavb_atx. */
struct AvbAtxOps;
/* High-level operations/functions/methods that are platform
* dependent.
*
* Operations may be added in the future so when implementing it
* always make sure to zero out sizeof(AvbOps) bytes of the struct to
* ensure that unimplemented operations are set to NULL.
*/
struct AvbOps {
/* This pointer can be used by the application/bootloader using
* libavb and is typically used in each operation to get a pointer
* to platform-specific resources. It cannot be used by libraries.
*/
void* user_data;
/* If libavb_ab is used, this should point to the
* AvbABOps. Otherwise it must be set to NULL.
*/
struct AvbABOps* ab_ops;
/* If libavb_atx is used, this should point to the
* AvbAtxOps. Otherwise it must be set to NULL.
*/
struct AvbAtxOps* atx_ops;
/* Reads |num_bytes| from offset |offset| from partition with name
* |partition| (NUL-terminated UTF-8 string). If |offset| is
* negative, its absolute value should be interpreted as the number
* of bytes from the end of the partition.
*
* This function returns AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION if
* there is no partition with the given name,
* AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION if the requested
* |offset| is outside the partition, and AVB_IO_RESULT_ERROR_IO if
* there was an I/O error from the underlying I/O subsystem. If the
* operation succeeds as requested AVB_IO_RESULT_OK is returned and
* the data is available in |buffer|.
*
* The only time partial I/O may occur is if reading beyond the end
* of the partition. In this case the value returned in
* |out_num_read| may be smaller than |num_bytes|.
*/
AvbIOResult (*read_from_partition)(AvbOps* ops,
const char* partition,
int64_t offset,
size_t num_bytes,
void* buffer,
size_t* out_num_read);
/* Gets the starting pointer of a partition that is pre-loaded in memory, and
* save it to |out_pointer|. The preloaded partition is expected to be
* |num_bytes|, where the actual preloaded byte count is returned in
* |out_num_bytes_preloaded|. |out_num_bytes_preloaded| must be no larger than
* |num_bytes|.
*
* This provides an alternative way to access a partition that is preloaded
* into memory without a full memory copy. When this function pointer is not
* set (has value NULL), or when the |out_pointer| is set to NULL as a result,
* |read_from_partition| will be used as the fallback. This function is mainly
* used for accessing the entire partition content to calculate its hash.
*
* Preloaded partition data must outlive the lifespan of the
* |AvbSlotVerifyData| structure that |avb_slot_verify| outputs.
*/
AvbIOResult (*get_preloaded_partition)(AvbOps* ops,
const char* partition,
size_t num_bytes,
uint8_t** out_pointer,
size_t* out_num_bytes_preloaded);
/* Writes |num_bytes| from |bffer| at offset |offset| to partition
* with name |partition| (NUL-terminated UTF-8 string). If |offset|
* is negative, its absolute value should be interpreted as the
* number of bytes from the end of the partition.
*
* This function returns AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION if
* there is no partition with the given name,
* AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION if the requested
* byterange goes outside the partition, and AVB_IO_RESULT_ERROR_IO
* if there was an I/O error from the underlying I/O subsystem. If
* the operation succeeds as requested AVB_IO_RESULT_OK is
* returned.
*
* This function never does any partial I/O, it either transfers all
* of the requested bytes or returns an error.
*/
AvbIOResult (*write_to_partition)(AvbOps* ops,
const char* partition,
int64_t offset,
size_t num_bytes,
const void* buffer);
/* Checks if the given public key used to sign the 'vbmeta'
* partition is trusted. Boot loaders typically compare this with
* embedded key material generated with 'avbtool
* extract_public_key'.
*
* The public key is in the array pointed to by |public_key_data|
* and is of |public_key_length| bytes.
*
* If there is no public key metadata (set with the avbtool option
* --public_key_metadata) then |public_key_metadata| will be set to
* NULL. Otherwise this field points to the data which is
* |public_key_metadata_length| bytes long.
*
* If AVB_IO_RESULT_OK is returned then |out_is_trusted| is set -
* true if trusted or false if untrusted.
*
* NOTE: If AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION is passed to
* avb_slot_verify() then this operation is never used. Instead, the
* validate_public_key_for_partition() operation is used
*/
AvbIOResult (*validate_vbmeta_public_key)(AvbOps* ops,
const uint8_t* public_key_data,
size_t public_key_length,
const uint8_t* public_key_metadata,
size_t public_key_metadata_length,
bool* out_is_trusted);
/* Gets the rollback index corresponding to the location given by
* |rollback_index_location|. The value is returned in
* |out_rollback_index|. Returns AVB_IO_RESULT_OK if the rollback
* index was retrieved, otherwise an error code.
*
* A device may have a limited amount of rollback index locations (say,
* one or four) so may error out if |rollback_index_location| exceeds
* this number.
*/
AvbIOResult (*read_rollback_index)(AvbOps* ops,
size_t rollback_index_location,
uint64_t* out_rollback_index);
/* Sets the rollback index corresponding to the location given by
* |rollback_index_location| to |rollback_index|. Returns
* AVB_IO_RESULT_OK if the rollback index was set, otherwise an
* error code.
*
* A device may have a limited amount of rollback index locations (say,
* one or four) so may error out if |rollback_index_location| exceeds
* this number.
*/
AvbIOResult (*write_rollback_index)(AvbOps* ops,
size_t rollback_index_location,
uint64_t rollback_index);
/* Gets whether the device is unlocked. The value is returned in
* |out_is_unlocked| (true if unlocked, false otherwise). Returns
* AVB_IO_RESULT_OK if the state was retrieved, otherwise an error
* code.
*/
AvbIOResult (*read_is_device_unlocked)(AvbOps* ops, bool* out_is_unlocked);
/* Gets the unique partition GUID for a partition with name in
* |partition| (NUL-terminated UTF-8 string). The GUID is copied as
* a string into |guid_buf| of size |guid_buf_size| and will be NUL
* terminated. The string must be lower-case and properly
* hyphenated. For example:
*
* 527c1c6d-6361-4593-8842-3c78fcd39219
*
* Returns AVB_IO_RESULT_OK on success, otherwise an error code.
*/
AvbIOResult (*get_unique_guid_for_partition)(AvbOps* ops,
const char* partition,
char* guid_buf,
size_t guid_buf_size);
/* Gets the size of a partition with the name in |partition|
* (NUL-terminated UTF-8 string). Returns the value in
* |out_size_num_bytes|.
*
* If the partition doesn't exist the AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION
* error code should be returned.
*
* Returns AVB_IO_RESULT_OK on success, otherwise an error code.
*/
AvbIOResult (*get_size_of_partition)(AvbOps* ops,
const char* partition,
uint64_t* out_size_num_bytes);
/* Reads a persistent value corresponding to the given |name|. The value is
* returned in |out_buffer| which must point to |buffer_size| bytes. On
* success |out_num_bytes_read| contains the number of bytes read into
* |out_buffer|. If AVB_IO_RESULT_ERROR_INSUFFICIENT_SPACE is returned,
* |out_num_bytes_read| contains the number of bytes that would have been read
* which can be used to allocate a buffer.
*
* The |buffer_size| may be zero and the |out_buffer| may be NULL, but if
* |out_buffer| is NULL then |buffer_size| *must* be zero.
*
* Returns AVB_IO_RESULT_OK on success, otherwise an error code.
*
* If the value does not exist, is not supported, or is not populated, returns
* AVB_IO_RESULT_ERROR_NO_SUCH_VALUE. If |buffer_size| is smaller than the
* size of the stored value, returns AVB_IO_RESULT_ERROR_INSUFFICIENT_SPACE.
*
* This operation is currently only used to support persistent digests or the
* AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO hashtree error mode. If a
* device does not use one of these features this function pointer can be set
* to NULL.
*/
AvbIOResult (*read_persistent_value)(AvbOps* ops,
const char* name,
size_t buffer_size,
uint8_t* out_buffer,
size_t* out_num_bytes_read);
/* Writes a persistent value corresponding to the given |name|. The value is
* supplied in |value| which must point to |value_size| bytes. Any existing
* value with the same name is overwritten. If |value_size| is zero, future
* calls to |read_persistent_value| will return
* AVB_IO_RESULT_ERROR_NO_SUCH_VALUE.
*
* Returns AVB_IO_RESULT_OK on success, otherwise an error code.
*
* If the value |name| is not supported, returns
* AVB_IO_RESULT_ERROR_NO_SUCH_VALUE. If the |value_size| is not supported,
* returns AVB_IO_RESULT_ERROR_INVALID_VALUE_SIZE.
*
* This operation is currently only used to support persistent digests or the
* AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO hashtree error mode. If a
* device does not use one of these features this function pointer can be set
* to NULL.
*/
AvbIOResult (*write_persistent_value)(AvbOps* ops,
const char* name,
size_t value_size,
const uint8_t* value);
/* Like validate_vbmeta_public_key() but for when the flag
* AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION is being used. The name of the
* partition to get the public key for is passed in |partition_name|.
*
* Also returns the rollback index location to use for the partition, in
* |out_rollback_index_location|.
*
* Returns AVB_IO_RESULT_OK on success, otherwise an error code.
*/
AvbIOResult (*validate_public_key_for_partition)(
AvbOps* ops,
const char* partition,
const uint8_t* public_key_data,
size_t public_key_length,
const uint8_t* public_key_metadata,
size_t public_key_metadata_length,
bool* out_is_trusted,
uint32_t* out_rollback_index_location);
};
#ifdef __cplusplus
}
#endif
#endif /* AVB_OPS_H_ */
2、镜像检查
这个你肯定不陌生,这也是其的关键部分。
其实在前面引用层那里,有个关键词**“可能”**,这个是很关键的。就我自己接触的,其实两个阶段不是分的那么界限的明显。为什么那么分是因为有的分区很大,如果等待校验好了再启动肯定很慢,所以有部分就放在整过系统启动之后去后面校验。(verdo\userdata等)
如果是在UBoot里面去实现校验,我觉得代码是比较好移植和阅读的,因为都是C语言。
但是在我们加载kernel,然后进入到了init进程后,那么事情就会稍微复杂点。
init会在第一阶段进行校验,为后面的挂载分区做准备,需要校验的我们前面知道在这个阶段是在fstab中配置的。
整个的逻辑详细参考:【AVB源码学习(三):AVB2.0 Init阶段安全启动流程】
这里面详细的展开了内容,我这里就不再重复,我使用一个图展示一下调用关系:
这是init阶段,main函数是main.cpp里面的main函数。
(IsDtVbmetaCompatible是检查kernel dtsi中是否有配置类似如下格式的数据(前面说了借助于dts或者rootfs中的fstab配置))
下面来看看FirstStageMountVBootV2函数:
这三个函数完成AVB的校验,其中InitAvbHandle:AVB调用exterlan/avb/libavb库完成分区的校验。下面就到了实现层,这些调用的内容到底是什么?
2、实现层
1、AVB的实现
上面应用层以及调到实现了吗?其实还没,这里我留了一点小尾巴,方便这下面的串联起来。
继续整个图:
(想看源码的友友可以看这篇详细的blog:【AVB源码学习(四):AVB2.0-libavb库介绍1】)
这里就到了我们的AVB的源码实现,在android中进行的avb校验都是在这里进行的。
如果你想要跟踪一些校验的流程,那么可以在avb_slot_verify.c文件里进行一些打印,就会在校验的时候打出你想要的信息
2、AVB的源码目录
根据场景需要使用到的一半就是上面的五个文件夹。
我理解libavb应该是下面几个的基础,然后_ab是适配AB系统;_atx可能是针对设备集群(百度的,有知道的友友麻烦补充一下);_user应该是提供一些可以在用户态操作AVB的接口。
所以基础的还是得看libavb目录
1、libavb
3、小结
以上就是我再看了前辈们的优秀blog,以及源码,大概梳理了一下思路。
可能有很多我觉得逻辑清晰的地方你觉得不通,欢迎在评论区指正,一定要看看【这个专栏】其他的文章再来看这篇,才会对你有贯穿整过流程的效果吧。
大家好好注意防护、戴好口罩!!!
AVB源码的链接:https://android.googlesource.com/platform/external/avb/+/master/libavb/