summaryrefslogtreecommitdiffstats
path: root/tests/component (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-11-06tests: Add a testcase for updater overrun while patching.Tao Bao1-80/+85
For any patching command, the resulting data should always exactly fill up the given target range. Test: Run recovery_component_test on marlin. Change-Id: Ib3cc1fc5c11094e2eab3fe370753db51c7c4135c
2018-11-05updater: Error out on underrun during patching.Tao Bao1-0/+42
Test: Run recovery_component_test on marlin. Change-Id: If23baf42aeacb48500edabc2eadd2e7119a848da
2018-10-31Refactor the code to check the metadataTianjie Xu1-16/+264
The two functions check_wipe_package() and check_newer_ab_build() were using the same flow; and checked the same device properties against the metadata file in the package. These properties include: ota_type, pre-device, and serial number. Therefore, we can consolidate the checks to a single function; and continue to check the fingerprint and timestamp only for AB updates. This change also addresses the need to accept multiple serial number in the wipe package. Bug: 118401208 Test: unit tests pass Change-Id: Ia6bc48fb6effcae059a2ff2cf71764b4136b4c00
2018-10-29Clean up the zipfile creation in InstallTestTianjie Xu1-99/+40
Consolidate them into a static function. Test: unit tests pass Change-Id: If05b62215940b221fc499d779eedc5079f68a060
2018-10-25Remove the load_keys functionTianjie Xu1-75/+9
This function is used to parse the result of dumpKeys. It's no longer needed as we are now parsing the public keys from the zipfile. Bug: 116655889 Test: unit tests pass Change-Id: I817906e451664058c644f4329ff499bbe4587ebb
2018-10-25Add sanity check when loading public keys for OTA packageTianjie Xu1-0/+32
For RSA keys, check if it has a 2048 bits modulus, and its public exponent is 3 or 65537. For EC keys, check if the field size is 256 bits for its curve. Bug: 116655889 Test: unit tests pass Change-Id: I5c00f4d2b61c98c434f0b49db232155d5d0770ec
2018-10-18Load X509 keys from ziparchiveTianjie Xu1-7/+84
Add a function to parse the zip archive and load the certificate from all the zip entries with the suffix "x509.pem". Bug: 116655889 Test: unittests pass Change-Id: I93bf7aef7462c0623e89fc2d466d7af2d3a758bc
2018-10-12Add function to load the key from x509.pem fileTianjie Xu1-0/+84
We used to convert a pem certificate file to some intermediate plain text format; and parse that format under recovery mode. This is uncessary since the x509.pem can be directly parsed with openssl functions. Add the function to load the public key from one x509.pem file and corresponding unit tests. And we will add more cls to extract the pem files from otacert.zip later. Bug: 116655889 Test: verify package with 5 supported certficate versions Change-Id: Ibc6c696c534567f005db75143cc4ef8d4bdea6a0
2018-10-05Compare the fingerprint before reading the partitionTianjie Xu1-15/+87
The update_verifier now compares the fingerprint of a partition before performing the blocks read. If the fingerprint of the current system property mismatches the one embedded in the care_map, verification of this partition will be skipped. This is useful for the possible system only updates in the future. Bug: 114778109 Test: unit tests pass Change-Id: Iea309148a05109b5810dfb533d94260d77ab8540
2018-09-21Refactor update_verifier into a classTianjie Xu1-23/+40
The refactor separates out the parsing of care_map and the actual verification of the partitions. Moreover, it skips the verification in case of a format error in the care map. Also, the parsing of care_map now uses the suffix of the file to tell if it has the protobuf format or the plain text format. Bug: 115740187 Test: unit test pass Change-Id: I7aa32004db02af1deb7bfdc6f5bd7921eb7883e5
2018-08-31applypatch: Refactor applypatch().Tao Bao1-43/+36
applypatch() was initially designed for file-based OTA, operating on individual files. It was later extended to allow patching eMMC targets as a whole, in favor of block-based updates. As we have deprecated file-based OTA since Oreo, part of the code in applypatch() has become obsolete. This CL refactors the related functions, by removing the obsolete logic and focusing on eMMC targets. Since this CL substantially changes applypatch APIs, it adds new functions to avoid unintentionally mixing them together. In particular, it removes `applypatch()`, `applypatch_check()`, `applypatch_flash()`, and adds `PatchPartition()`, `PatchPartitionCheck()`, `FlashPartition()` and `CheckPartition()`. It also replaces the old Edify functions `apply_patch()` and `apply_patch_check()` with `patch_partition()` and `patch_partition_check()` respectively. This CL requires matching changes to OTA generation script (in the same topic). Bug: 110106408 Test: Run recovery_unit_test and recovery_component_test on marlin. Test: `m dist` with non-A/B target. Verify /system/bin/install-recovery.sh on device. Test: `m dist` with non-A/B target using BOARD_USES_FULL_RECOVERY_IMAGE. Verify /system/bin/install-recovery.sh on device. Test: Install an incremental OTA with the new updater and scripts. Change-Id: Ia34a90114bb227f4216eb478c22dc98c8194cb7f
2018-08-28Remove otafaultTianjie Xu1-1/+1
Now it's less beneficial to inject I/O faults since we don't see many of them. Remove the library that mocks I/O failures. And switch to android::base I/O when possible. Bug: 113032079 Test: unit tests pass Change-Id: I9f2a92b7ba80f4da6ff9e2abc27f2680138f942c
2018-08-20tests: Remove {old,new}.file.Tao Bao1-1/+1
They serve the same purpose as {boot,recovery}.img, except that they're not structured to be imgdiff'd. Remove the two files and replace all the uses with {boot,recovery}.img instead. Bug: 110106408 Test: Run recovery_{unit,component}_test on marlin. Change-Id: I8e71187d5b0c142ad932f33717f6fae364b43abc
2018-08-17updater: Add TransferList class.Tao Bao1-10/+12
This would be the top-level class that represents and holds the info parsed from a transfer list file. Bug: 112151972 Test: Run recovery_unit_test and recovery_component_test on marlin. Change-Id: I83b54df9d1411542eeeb8ef4a2db167e97f989c3
2018-08-15tests: Move to Android.bp.Tao Bao1-3/+2
Also separate libupdater_defaults out to be shareable. It turns out the `data` property in `cc_test` doesn't follow symlinks as LOCAL_TEST_DATA does in Android.mk. This CL creates a filegroup in top-level Android.bp in order to pick up the testdata for ResourcesTest. Test: `mmma -j bootable/recovery` with aosp_marlin-userdebug Test: Run recovery_{unit,component,manual}_test on marlin. Test: Run recovery_host_test. Change-Id: I4532ab25aeb83c0b0baa8051d5fe34ba7b910a35
2018-08-14Track the change to update_engine_sideload path.Tao Bao1-1/+1
Bug: 112494634 Test: Build and boot into recovery image on taimen. Verify that `Apply updates from ADB` keeps working. Test: Run recovery_component_test on marlin. Change-Id: I9ee8834053fda79a4fd77bfa83eab3cc51a90dff
2018-08-13tests: Create res-testdata for testdata pickup.Tao Bao1-4/+5
It doesn't change the functionality of the test, but allows easier conversion to Soong. Test: Run recovery_component_test on marlin. Change-Id: Ic7419dc86c6b220531ae44e49ab4657394a5d7fa
2018-08-06Add an updater function to compute hash treeTianjie Xu1-0/+81
The new command is part of the transfer.list and allows us to compute the hash tree on non-ab devices. The required arguments for the hash_tree computation are: hash_tree_ranges source_ranges hash_algorithm salt_hex root_hash Bug: 25170618 Test: unit tests pass; run simulator with compute_hash_tree Change-Id: I8ff0d582cc8adabb8a060db7845f38b35b28e62c
2018-07-25Add proto3 support for care_mapTianjie Xu1-19/+94
Switching to the protobuf format helps to make the care_map more extensible. As we have such plans in the future, add the support to parse the protobuf message in the update_verifier. Bug: 77867897 Test: unit tests pass, update_verifier successfully verifies a care_map.pb Change-Id: I9fe83cb4dd3cc8d6fd0260f2a47338fe142d3938
2018-07-20applypatch: Change applypatch command-line arguments.Tao Bao1-191/+107
This applies to the standalone applypatch executable (/system/bin/applypatch on device). This executable is only used when installing (via patching or flashing) a recovery image on non-A/B device. This CL removes the support for patching non-eMMC targets from applypatch that has been deprecated as part of file-based OTA. For patching eMMC targets, it also drops the support for accepting multiple patches (not useful, since the source file must be fixed). This CL needs the matching change in the same topic, which writes the script of "/system/bin/install-recovery.sh". Note that this CL doesn't chanage the applypatch API signatures, in order to minimize the CL size. *BEFORE* usage: /system/bin/applypatch [-b <bonus-file>] <src-file> <tgt-file> <tgt-sha1> <tgt-size> [<src-sha1>:<patch> ...] or /system/bin/applypatch -c <file> [<sha1> ...] or /system/bin/applypatch -l Filenames may be of the form EMMC:<partition>:<len_1>:<sha1_1>:<len_2>:<sha1_2>:... to specify reading from or writing to an EMMC partition. *AFTER* Usage: check mode applypatch --check EMMC:<target-file>:<target-size>:<target-sha1> flash mode applypatch --flash <source-file> --target EMMC:<target-file>:<target-size>:<target-sha1> patch mode applypatch [--bonus <bonus-file>] --patch <patch-file> --target EMMC:<target-file>:<target-size>:<target-sha1> --source EMMC:<source-file>:<source-size>:<source-sha1> show license applypatch --license Bug: 110106408 Test: Run recovery_component_test and recovery_unit_test on marlin. Test: Build a non-A/B target that has /system/bin/install-recovery.sh. Verify that it installs recovery image successfully. Test: Build a non-A/B target that has /system/bin/install-recovery.sh in flashing mode. Verify that it installs recovery image successfully. Change-Id: I71f9a71fb457e6f663e0b5511946949e65b4b78c
2018-07-11Remove the debug code for bspatch flakinessTianjie Xu1-66/+2
We already know the flakiness happens in bspatch, and the issue is tracked in b/80193170. Bug: 67849209 Test: unit tests pass Change-Id: Ib4772b8f2f0225125096fe7407d083b5bb542cfb
2018-07-10updater: Let read_file() return Value::Type::STRING.Tao Bao1-0/+23
It used to return a Value blob to be consumed by sha1_check() (which has been deprecated). Currently there's no other generic updater function that works with BLOB Values. This CL changes read_file() to return a string Value to make it more useful (e.g. allowing equality check). Test: Run recovery_component_test and recovery_unit_test on marlin. Change-Id: Iba986ba649030112babefe898f26aa9ffe69eeb7
2018-07-10edify: Rename parse_string to ParseString and let it take std::string.Tao Bao2-69/+66
Also simplify the helper function expect() in {edify,updater}_test.cpp. Test: Run recovery_component_test on marlin. Change-Id: If54febba4b5013f6d71546318a1ca6b635204ac8
2018-07-10edify: Remove VAL_INVALID and move ValueType into Value class.Tao Bao1-2/+2
Test: mmma -j bootable/recovery Test: Run recovery_component_test and recovery_unit_test on marlin. Change-Id: I4b240e3e771c387b9694be9c0f2f74e0265ab4cb
2018-07-10applypatch: Restrict applypatch_check to eMMC targets.Tao Bao1-1/+3
Also fix an error-pone behavior in previous code when verifying an eMMC target. As long as it loads the partition content successfully according to the SHAs embedded in the filename, it shouldn't further check against the SHAs given in the second argument. Because the loaded contents relate to a specific partition size. For example: apply_patch_check( "EMMC:/boot.img:src_size:src_hash:tgt_size:tgt_hash", "src_hash"); Assume "/boot.img" already has the desired hash of "tgt_hash", the previous code would give wrong verification result. The issue can be addressed by additionally listing "tgt_hash" as one of the desired SHAs (or by applying this CL). Bug: 110106408 Test: Run recovery_unit_test and recovery_component_test on marlin. Change-Id: I8daafdbecd083f687e24d563ab089caa25667633
2018-07-09updater: Remove the support for sha1_check().Tao Bao1-33/+28
The matching edify function has been removed from EdifyGenerator [1]. In theory device-specific releasetools script may still use this function, but it no longer looks useful. Because a) we should use range_sha1() when asserting the SHA-1 hash of a block device; b) we should look into the contents when asserting a text file. [1] https://android-review.googlesource.com/c/platform/build/+/714104 Test: Run recovery_component_test on marlin. Test: Code search shows no active user. Change-Id: Id39439101534fb89cf8c5cea80a4b758c8a1a60d
2018-07-07updater: Add ABORT command.Tao Bao1-3/+10
This will be used for testing purpose only, replacing the previously used "fail", to intentionally abort an update. As we're separating the logic between commands parsing and execution, "abort" needs to be considered as a valid command during the parsing. Test: recovery_unit_test and recovery_component_test on marlin. Change-Id: I47c41c423e62c41cc8515fd92f3c5959be08da02
2018-07-06tests: Split unit tests out of component/applypatch_test.cpp.Tao Bao1-268/+4
... into unit/applypatch_test.cpp. And rename the file to component/applypatch_modes_test.cpp. Bug: 110106408 Test: Run recovery_unit_test and recovery_component_test on marlin. Change-Id: Ic23c4f054baa2fa0d5e8ea2fcffd22572f1f112e
2018-06-19Drop the dependency on AB_OTA_UPDATER flag.Tao Bao1-89/+85
This shortens the gap between A/B and non-A/B builds, by replacing the dependency on build-time flag with runtime detection instead. It also allows building and testing both paths regardless of the target OTA type. The size increase to /sbin/recovery looks negligible (< 0.01%). - marlin: increased from 2084928 to 2085024; - angler: increased from 2084776 to 2084896. Test: Run recovery_component_test on angler and marlin. Test: Sideload an A/B OTA package on marlin. Test: Sideload a non-A/B OTA package on angler. Change-Id: I1d927d1ede9713fb42f73b4fe324aa5705ee6f99
2018-06-07updater: Remove the redundant check on line count.Tao Bao1-2/+21
Test: recovery_component_test on marlin. Change-Id: I2ac2bd47469d1aec8a97a8c4ed0fe80ffd65c95b
2018-06-04tests: Add ResumableUpdaterTest.Tao Bao1-0/+227
This is a stress test that instantiates multiple testcases that interrupt a BBOTA update at every transfer command. Each testcase asserts the last_command_file after the interruption, verifies the update resumability, then resumes the update and asserts the updated image. The transfer list in the testcase covers most of the transfer commands (stash/free/move/bsdiff/zero/new), as well as some special pattern like having duplicate stash ids. This CL also addresses one issue in the updater code, by resetting the stash_map before each run. The stash map should be valid only per block_image_verify/block_image_update run. Having leftover may cause issue in subsequent runs, in particular when calling block_image_verify after a previous run of block_image_{update,verify}. Test: Run recovery_component_test on marlin. Change-Id: I6f9a0368d194a754ce41a9c9819c6d5be2657248
2018-05-25tests: Setup last_command_file for UpdaterTest.Tao Bao1-13/+15
Otherwise tests may interfere with each other by using the same / default location. Test: Run recovery_component_test on marlin. Change-Id: I6b0455489f2fdce819009964dd92bfd9bfeb06ef
2018-05-24Convert deflate image chunks to raw if the raw data is smallerTianjie Xu1-32/+75
The imgpatch will fail on empty deflates because the bspatch won't call the sink function if the target length is zero. Instead of compressing an empty string, it's cleaner to not generate such empty deflate chunks in the patch. Therefore, we can just convert the chunk type to raw if the target length is smaller than the patch data. Also adjust some unit tests and add the testdata gzipped_source & gzipped_target. These two files are ~1K each and are generated by gzipping two slightly different regular files. Bug: 79265132 Test: unit tests pass, imgpatch applys successfully on the given src/tgt Change-Id: I6bfff3251918137f6762a6f9e9551642371a1124
2018-05-24tests: Refactor the common lines in UpdaterTest.Tao Bao1-286/+182
Move the common codes into RunBlockImageUpdate(). Also clean up the partition updated marker after running each test. Test: Run recovery_component_test on marlin. Change-Id: Id4302e4da4c664231b737a1e83d2e164ef58ed97
2018-05-04otautil: Rename dir/sys/thermal utils.Tao Bao2-3/+3
Test: mmma -j bootable/recovery Change-Id: I32ab98549e91f993364306e4a88dc654221b3869
2018-04-26Rename CacheLocation to Paths.Tao Bao2-13/+12
We have a general need for overriding more paths (e.g. "/tmp"), mostly for testing purpose. Rename CacheLocation to Paths, and use that to manage TEMPORARY_{INSTALL,LOG}_FILE. Test: mmma -j bootable/recovery Test: recovery_component_test Change-Id: Ia8ce8e5695df37ca434f13ac4d3206de1e8e9396
2018-04-26Dump the uncompressed data's SHA1 to debug flaky testsTianjie Xu1-2/+52
Dump the SHA1 of the uncompressed data in applypatch to confirm if we are at least doing the bspatch part correctly. (I expect so since the actual length of the uncompressed data matches the expected length). Also try to decompress the deflate chunk inside the recovery image for these two flacky tests. In theory, there shouldn't be randomness in zlib; so we would know if we process the data wrongly if the deflate fails to decompress. Bug: 67849209 Test: recovery_component_test Change-Id: Id947522153b1eeb0d10d161298a96fb045f92018
2018-04-24Dump debug information for apply_patch unit testsTianjie Xu1-1/+12
The apply patch test should have a deterministic way to append patch data. Add debug logs to dump the length and SHA1 of each step to further track down the flakiness. Also redirect the debug logging to stdout in case the logcat becomes too chatty. Bug: 67849209 Test: Run recovery_component_test Change-Id: I42bafef2d9dee599719ae57840b3d8c00d243ebd
2018-04-20Make update_verifier generic across verified boot versions.Tao Bao1-5/+4
This allows the update_verifier in a general system image to work across devices that have different verified boot versions (i.e. not supported / verified boot 1.0 / verified boot 2.0 / disabled). Bug: 78283982 Test: Run recovery_component_test on both of marlin and walleye. Test: Generate an OTA that has this CL. Install this OTA and check the update_verifier log during the post-reboot verification, on both of marlin (VB 1.0) and walleye (VB 2.0). Test: Build and flash walleye image with verified boot disabled. Check that update_verifier marks the slot as successfully booted. Change-Id: I828d87d59f911786531f774ffcf9b2ad7c2ca007
2018-04-19applypatch: Dump patch info on mismatching patching result.Tao Bao1-0/+5
After splitting the previously flaky ApplyPatchModesTest#PatchModeEmmcTarget tests, PatchModeEmmcTargetWithMultiplePatches now becomes the sole victim. This CL dumps additional info to narrow down the cause. Bug: 67849209 Test: `recovery_component_test` on marlin. Test: It dumps additional info after using corrupt bonus.file. Change-Id: Ic5436de457cc882a51d03f49d5cee70077f7d3df
2018-04-16tests: Move ResourcesTest into component test.Tao Bao1-0/+120
Although the tests were initially written for checking the validity of the text images, it doesn't hurt to run them continuously as part of the component test (recovery_manual_test requires reboots during the run, due to the nature of the tests of recovery-{refresh,persist}). This also allows detecting breaking changes to libminui or libpng. There's a catch that the ResourcesTest won't be triggered via `atest`, as the res-* testdata won't be picked up via AndroidTest.xml. Explored a few options but not addressing that in this CL: - `atest` is not fully working in AOSP yet (missing support in tools/tradefederation/core/atest/atest.py). - `atest` doesn't allow specifying the testdata with path in the 'push' option. - It won't fail the test run though, as ResourcesTest will skip the tests automatically when it finds no text image file. - APCT and manual `adb sync data` are not affected, and I don't see an active user of `atest` other than a tool for manual test invocation. - Unrelated to this CL, `atest` doesn't seem to work well with recovery_component_test or recovery_unit_test while we have both of them in one AndroidTest.xml. It randomly triggers only one of them, despite of the given test name. When splitting AndroidTest.xml into two, it tends to pick up the wrong testdata subdir and gives wrong results. Test: Run recovery_manual_test and recovery_component_test on marlin. Change-Id: I3a237499a7770356e14085674bc8b9cb4551db85
2018-04-13Remove the old log files if cache space is insufficient for OTATianjie Xu1-0/+129
We set the limit of the max stash size to 80% of cache size. But the cache space can still be insufficient for the update if the log files occupy a large chunk of /cache. So remove the old logs for now to make room for the update. Bug: 77528881 Test: unit tests pass Change-Id: Ia8bcb0ace11f8164ad9290bfb360e08e31d282cb
2018-03-23update_verifier: Support verifying product partition.Tao Bao1-2/+1
We have added the support for building /product partition in build system (the CL in [1]), where /product is an optional partition that contains system files. This CL adds the matching support if /product needs to be verified during A/B OTA (i.e. listed in care_map file). [1]: commit b7735d81054002961b681f4bdf296d4de2701135, https://android-review.googlesource.com/c/platform/build/+/598454 Bug: 63974895 Test: Run update_verifier test on walleye. Change-Id: Ia1c35e9583b8e66c98a4495b1f81a5ea7e65036f (cherry picked from commit ec2e8c6c1ef3cbafa129ade95abca3203e062b5f)
2018-03-23update_verifier: Support verifying product partition.Tao Bao1-2/+1
We have added the support for building /product partition in build system (the CL in [1]), where /product is an optional partition that contains system files. This CL adds the matching support if /product needs to be verified during A/B OTA (i.e. listed in care_map file). [1]: commit b7735d81054002961b681f4bdf296d4de2701135, https://android-review.googlesource.com/c/platform/build/+/598454 Bug: 63974895 Test: Run update_verifier test on walleye. Change-Id: Ia1c35e9583b8e66c98a4495b1f81a5ea7e65036f
2018-03-20tests: Split ApplyPatchModesTest.PatchModeEmmcTarget.Tao Bao1-45/+74
We have been seeing flakiness in continuous test, but unable to reproduce locally. Break it down into smaller units to narrow down the cause. Bug: 67849209 Test: Run recovery_component_test on marlin. Change-Id: Ia24b0c5d137bad27d502575fcd18d3ca9c9828b6
2018-03-20tests: Add ApplyPatchModesTest.PatchModeEmmcTargetWithBsdiffPatch test.Tao Bao1-0/+51
/system/bin/applypatch on device is expected to work with bsdiff based recovery-from-boot patch automatically. Adding a test to ensure that's always the case. Bug: 72731506 Test: Run recovery_component_test on marlin. Change-Id: I56283cd3ce7cf0215cc3bb3619b206fa01d552c4 Merged-In: I56283cd3ce7cf0215cc3bb3619b206fa01d552c4 (cherry picked from commit d612b23dfd58dbe5059ba53d8fd13cbb343b177c)
2018-03-13tests: Add ApplyPatchModesTest.PatchModeEmmcTargetWithBsdiffPatch test.Tao Bao1-0/+51
/system/bin/applypatch on device is expected to work with bsdiff based recovery-from-boot patch automatically. Adding a test to ensure that's always the case. Bug: 72731506 Test: Run recovery_component_test on marlin. Change-Id: I56283cd3ce7cf0215cc3bb3619b206fa01d552c4
2018-02-28Add a singleton CacheLocation to replace the hard coded locationsTianjie Xu2-9/+17
This class allows us to set the following locations dynamically: cache_temp_source, last_command_file, stash_directory_base. In the updater's main function, we reset the values of these variables to their default locations in /cache; while we can set them to temp files in unit tests or host simulation. Test: unit tests pass Change-Id: I528652650caa41373617ab055d41b1f1a4ec0f87
2018-02-23Remove the assumption of target chunk size in imgdiffTianjie Xu1-0/+101
In the split mode of imgdiff, we used to assume that the size of a split target chunk is always greater than the blocksize i.e. 4096. This may lead to the following assertion failure: I0221 04:57:33.451323 818464 common.py:205 imgdiff F 02-21 04:57:33 821203 821203 imgdiff.cpp:999] Check failed: tgt_size >= BLOCK_SIZE (tgt_size=476, BLOCK_SIZE=4096) This CL removes the assumption and handles the edge cases. Test: generate and verify the incremental update for TFs in the bug; unit test passes Bug: 73757557 Bug: 73711365 Change-Id: Iadbb4ee658995f5856cd488f3793980881a59620
2018-02-07Log the last command to cacheTianjie Xu1-0/+217
When performing an update, save the index and cmdline of the current command into the last command file if this command writes to the stash either explicitly of implicitly. This mitigates the overhead to update the last command file for every command. I ran a simple test on angler and the time to update 1000 times is ~2.3 seconds. Upon resuming an update, read the saved index first; then 1. In verification mode, check if all commands before the saved index have already produced the expected target blocks. If not, delete the last command file so that we will later resume the update from the start of the transfer list. 2. In update mode, skip all commands before the saved index. Therefore, we can avoid deleting stashes with duplicate id unintentionally; and also speed up the update. If an update succeeds or is unresumable, delete the last command file. Bug: 69858743 Test: Unittest passed, apply a failed update with invalid cmd on angler and check the last_command content, apply a failed update with invalid source hash and last_command is deleted. Change-Id: Ib60ba1e3c6d111d9f33097759b17dbcef97a37bf
2017-11-04Clean up fuse_sideload and add a testcase.Tao Bao1-4/+66
This CL mainly changes: a) moving the interface in struct provider_vtab to std::function; b) code cleanup, such as moving the declaration closer to the uses, using explicit type conversion. Test: recovery_component_test Test: minadbd_test Test: Sideload a package on marlin. Change-Id: Id0e3c70f1ada54a4cd985b54c84438c23ed4687e
2017-11-03Switch to bionic gtest in bootable/recoveryTianjie Xu3-235/+135
We encountered segfaults in Imgdiff host tests due to the failure to reset states of getopt. The problem can be solved by switching to use bionic's gtest where a new process is forked for each test. Also modify the recovery_component_test to make sure it runs in parallel. Changes include: 1. Merge the writes to misc partition into one single test. 2. Change the hard coded location "/cache/saved.file" into a configurable variable. Bug: 67849209 Test: recovery tests pass Change-Id: I165d313f32b83393fb7922c5078636ac40b50bc2
2017-11-02tests: Clean up the files in TemporaryDir.Tao Bao1-5/+9
~TemporaryDir() calls rmdir(2) directly, which works with empty directories only. Test: Run recovery_host_test; No leftover on host. Test; Run recovery_component_test on marlin; No leftover on device. Change-Id: Ib510efb16eeda61b34161e2b386499e6cb79a4ca
2017-11-01Fix the size mismatch in imgdiffTianjie Xu1-50/+27
As we construct the deflate entries of the target zip file with random data, the total size of the zip file may vary from case to case. This leads to occasional failures in the split test for deflate large apk files. This CL fixes the issue by adding two static zip files in the testdata instead of generating them dynamically. Bug: 67849209 Test: run the deflate_large_test repeatedly Change-Id: Iaeffad9205adefa10c9f62f9f088c33c4360a650
2017-10-26tests: Take the ownership of the FD when calling fdopen.Tao Bao2-29/+29
To avoid closing the same FD twice. Test: recovery_component_test && recovery_host_test Change-Id: I95195be8109101081410e9224efda535b2560e72
2017-10-24Use SuffixArrayIndexInterface opaque type instead of the underlying data pointer.Alex Deymo1-1/+1
bsdiff interface is changing such that it hides the suffix array pointer from the public interface. This allows to use a different suffix array data size depending on the input size, running much faster in the normal case. Bug: 34220646 Test: `make checkbuild`; Ran an incremental update generation on a non-A/B device. Change-Id: I78e766da56cf28bc7774b8c8e58527bc11d919fb
2017-10-20Finish the new data receiver when update failsTianjie Xu1-87/+133
The thread to receive new data may still be alive after we exit PerformBlockImageUpdate() upon failures. This caused memory corruption when we run the unittest repeatedly. Set the receiver_available flag to false and make sure the receiver exits when the update fails. Bug: 65430057 Test: unittests passed with tsan Change-Id: Icb232d13fb96c78262249ffbd29cdbe5b77f1fce
2017-10-16otautil: Move RangeSet implementation into rangeset.cpp.Tao Bao1-0/+1
Since it has grown much larger, users of the header shouldn't compile and carry their full copies. Also add missing header includes in imgdiff.cpp and imgdiff_test.cpp. Test: mmma bootable/recovery Test: recovery_unit_test; recovery_component_test; recovery_host_test Change-Id: I88ca54171765e5606ab0d61580fbc1ada578fd7d
2017-10-11Move rangeset.h and print_sha1.h into otautil.Tao Bao2-2/+2
Also drop the "bootable/recovery" path in LOCAL_C_INCLUDES from applypatch modules. Test: lunch aosp_{angler,bullhead,fugu,dragon,sailfish}-userdebug; mmma bootable/recovery Change-Id: Idd602a796894f971ee4f8fa3eafe36c42d9de986
2017-10-09Revert "Revert "Move error_code.h into otautil.""Tao Bao1-1/+1
This reverts commit 26436d6d6010d5323349af7e119ff8f34f85c40c to re-land "Move error_code.h into otautil.". This way it stops requiring relative path ".." in LOCAL_C_INCLUDES (uncrypt and edify). Soong doesn't accept non-local ".." in "local_include_dirs". This CL needs to land with device-specific module changes (e.g. adding the dependency on libotautil). Test: lunch aosp_{angler,bullhead,dragon,fugu,sailfish}-userdebug; mmma bootable/recovery Change-Id: If193241801af2dae73eccd31ce57cd2b81c9fd96
2017-10-05Revert "Move error_code.h into otautil."Tao Bao1-1/+1
This reverts commit 623fe7e701d5d0fb17082d1ced14498af1b44e5b. Reason for revert: Need to address device-specific modules. Change-Id: Ib7a4191e7f193dfff49b02d3de76dda856800251
2017-10-04Move error_code.h into otautil.Tao Bao1-1/+1
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES (uncrypt and edify). Soong doesn't accept non-local ".." in "local_include_dirs". Test: mmma bootable/recovery Change-Id: Ia4649789cef2aaeb2785483660e9ea5a8b389c62
2017-09-21Output split information for imgdiff when handling large apksTianjie Xu1-8/+40
Add a mandatory option in imgdiff to write the split info (i.e. patch_size, tgt_size, src_ranges) to file when handling large apks. Therefore, the caller of imgdiff can create split transfers based on the info. Bug: 63542719 Test: unit tests pass Change-Id: I853d55d1f999fd576474faa81077f7307f4d856d
2017-09-13Fix the dangling pointer when setting up arguments of imgdiffTianjie Xu1-6/+9
Test: unit tests pass Change-Id: If884e805ccd4df73671ab3436eb90860786ff6c9
2017-09-11Close cmd_pipe properly after updater test finishesTianjie Xu1-8/+14
Otherwise the test may fail after a large number of iterations due to file open failure. Bug: 65430057 Test: run recovery_component_test on sailfish for 2000 iterations. Change-Id: I0d456284d6064467038911d63eade95740cbec2c
2017-09-06Improve imgdiff for large zip filesTianjie Xu1-5/+334
Due to the cache size limit for OTA generation, we used to split large zip files linearly into pieces and do bsdiff on them. As a result, i) we lose the advantage of imgdiff; ii) if there's an accidental order change of some huge files inside the zip, we'll create an insanely large patch. This patch splits the src&tgt more smartly based on the zip entry_name. If the entry_name is empty or no matching source is found for a target chunk, we'll skip adding its source and later do a bsdiff against the whole split source image (this rarely happens in our use cases except for the metadata inside a ziparchive). After the split, the target pieces are continuous and block aligned, while the sources pieces are mutually exclusive. (Some of the source blocks may not be used if there's no matching entry_name in the target.) Then we will generate patches accordingly between each split image pairs. Afterwards, if we apply imgpatch to each pair of split source/target images and add up the patched result, we can get back the original target image. For example: Input: [src_image, tgt_image] Split: [src-0,tgt-0; src-1,tgt-1, src-2,tgt-2] Diff: [ patch-0; patch-1; patch-2] Patch: [(src-0,patch-0)=tgt-0; (src-1,patch-1)=tgt-1; (src-2,patch-2)=tgt-2;] Append: [tgt-0 + tgt-1 + tgt-2 = tgt_image] Peformance: For the small package in b/34220646, we decrease the patch size of chrome.apk dramatically from 30M to 400K due to the order change of two big .so files. On two versions of angler, I also observe decent patch size decrease. For chrome.apk, we reduced the size from 5.9M to 3.2M; and for vevlet.apk from 8.0M to 6.5M. Bug: 34220646 Test: recovery component test && apply imgdiff & imgpatch on two chrome.apk Change-Id: I145d802984fa805efbbac9d01a2e64d82ef9728b
2017-08-29Turn on -Wall for recovery modulesTianjie Xu1-8/+0
Turn on -Wall for all modules. Also remove the obsolete file_cmp() in apply_patch test and now() in wear_ui. The only exception is lib_edify due to the unused functions in the intermediate cpp files generated from the lex files. It will be handled in a seperate CL. Bug: 64939312 Test: mma, unit tests pass Change-Id: Ic53f76b60b6401ab20db3d98130d674c08e3702f
2017-08-22Allow comparison against multi serial nums for A/B packageTianjie Xu1-13/+58
The metadata file now can have multiple serial numbers in the format: serialno=serialno1|serialno2|serialno3 ... Verifier will pass the check if the device serial number matches any of these numbers. Bug: 64802465 Test: Create a metadata file with 1000 numbers and sideload in sailfish. The checker detects both match and mismatch cases. Change-Id: I3f12b75e15f4179df260778e37f4563d65db0fa8
2017-07-24tests: Add a test to cover legacy care_map.txt handling.Tao Bao1-0/+13
This is to cover the code added by commit 5a1dee01df3af346729b5791606b72d59b8e9815, where an O update_verifier should not reject N care_map.txt. Bug: 63544345 Test: recovery_component_test passes on marlin. Change-Id: Ia944e16cba3cc635098b3ffd92842d725b570fec (cherry picked from commit c319613e06f996aed32da3a1c3e93bf9b04ffa95)
2017-07-24tests: Add a test to cover legacy care_map.txt handling.Tao Bao1-0/+13
This is to cover the code added by commit 5a1dee01df3af346729b5791606b72d59b8e9815, where an O update_verifier should not reject N care_map.txt. Bug: 63544345 Test: recovery_component_test passes on marlin. Change-Id: Ia944e16cba3cc635098b3ffd92842d725b570fec
2017-07-22Fix a case when brotli writer fails to write last few blocks of dataTianjie Xu1-4/+15
receive_new_data may exit too early if the zip processor has sent all the raw data. As a result, the last few 'new' commands will fail even though the brotli decoder has more output in its buffer. Restruct the code so that 'NewThreadInfo' owns the decoder state solely; and receive_brotli_new_data is responsible for the decompression. Also reduce the test data size to 100 blocks to avoid the test timeout. Bug: 63802629 Test: recovery_component_test. on bullhead, apply full updates with and w/o brotli compressed entries, apply an incremental update. Change-Id: Id429b2c2f31951897961525609fa12c3657216b7 (cherry picked from commit 6ed175d5412deeaec9691f85757e45452407b8e3)
2017-07-21Fix a case when brotli writer fails to write last few blocks of dataTianjie Xu1-4/+15
receive_new_data may exit too early if the zip processor has sent all the raw data. As a result, the last few 'new' commands will fail even though the brotli decoder has more output in its buffer. Restruct the code so that 'NewThreadInfo' owns the decoder state solely; and receive_brotli_new_data is responsible for the decompression. Also reduce the test data size to 100 blocks to avoid the test timeout. Bug: 63802629 Test: recovery_component_test. on bullhead, apply full updates with and w/o brotli compressed entries, apply an incremental update. Change-Id: I9442f2536b74e48dbf7eeb062a8539c82c6dab47
2017-07-19Fix the android-cloexec-* warnings in bootable/recoveryTianjie Xu1-2/+2
Add the O_CLOEXEC or 'e' accordingly. Bug: 63510015 Test: recovery tests pass Change-Id: I7094bcc6af22c9687eb535116b2ca6a59178b303
2017-07-08Add support to decompress brotli compressed new dataTianjie Xu1-0/+67
Add a new writer that can decode the brotli-compressed system/vendor new data stored in the OTA zip. Brotli generally gives better compression rate at the cost of slightly increased time consumption. The patch.dat is already compressed by BZ; so there's no point to further compress it. For the given 1.9G bullhead system image: Size: 875M -> 787M; ~10% reduction of package size. Time: 147s -> 153s; ~4% increase of the block_image_update execution time. (I guess I/O takes much longer time than decompression.) Also it takes 4 minutes to compress the system image on my local machine, 3 more minutes than zip. Test: recovery tests pass && apply a full OTA with brotli compressed system/vendor.new.dat on bullhead Change-Id: I232335ebf662a9c55579ca073ad45265700a621e
2017-07-07Fix a rare failure for imgdiff when random data equals gzip headerTianjie Xu1-0/+33
In a rare case, a random chunk will pass both the gzip header check and the inflation process; but fail the uncompressed length check in the footer. This leads to a imgdiff failure. So, we should treat this chunk as 'normal' instead of 'inflated' while generating the patch. Bug: 63334984 Test: imgdiff generates patch successfully on previous failing images. Change-Id: Ice84f22d3653bce9756bda91e70528c0d2f264a0
2017-06-23Remove the obsolete package_extract_dir() testTianjie Xu1-96/+0
package_extract_dir() was removed in go/aog/402383, and the corresponding UpdaterTest should be removed as well. Bug: 62918308 Test: mma && code search Change-Id: Ibe9c473a5d41d2fa4d26abca5684e71b104891b0
2017-06-23update_verifier: Support AVB.David Zeuthen1-1/+1
When using AVB, PRODUCT_SUPPORTS_VERITY is not set so check for BOARD_ENABLE_AVB as well. Also AVB sets up the root filesystem as 'vroot' so map that to 'system' since this is what is expected. Managed to test at least that the code is at least compiled in: $ fastboot --set-active=_a Setting current slot to 'a'... OKAY [ 0.023s] finished. total time: 0.023s $ fastboot reboot rebooting... finished. total time: 0.050s $ adb wait-for-device $ adb logcat |grep update_verifier 03-04 05:28:56.773 630 630 I /system/bin/update_verifier: Started with arg 1: nonencrypted 03-04 05:28:56.776 630 630 I /system/bin/update_verifier: Booting slot 0: isSlotMarkedSuccessful=0 03-04 05:28:56.776 630 630 W /system/bin/update_verifier: Failed to open /data/ota_package/care_map.txt: No such file or directory 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Marked slot 0 as booted successfully. 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Leaving update_verifier. Bug: 62464819 Test: Manually tested on device using AVB bootloader. Merged-In: I13c0fe1cc5d0f397e36f5e62fcc05c8dfee5fd85 Change-Id: I2834b17688053411e7b904e31df9c83bf904cd56
2017-05-24update_verifier: Support AVB.David Zeuthen1-1/+1
When using AVB, PRODUCT_SUPPORTS_VERITY is not set so check for BOARD_ENABLE_AVB as well. Also AVB sets up the root filesystem as 'vroot' so map that to 'system' since this is what is expected. Managed to test at least that the code is at least compiled in: $ fastboot --set-active=_a Setting current slot to 'a'... OKAY [ 0.023s] finished. total time: 0.023s $ fastboot reboot rebooting... finished. total time: 0.050s $ adb wait-for-device $ adb logcat |grep update_verifier 03-04 05:28:56.773 630 630 I /system/bin/update_verifier: Started with arg 1: nonencrypted 03-04 05:28:56.776 630 630 I /system/bin/update_verifier: Booting slot 0: isSlotMarkedSuccessful=0 03-04 05:28:56.776 630 630 W /system/bin/update_verifier: Failed to open /data/ota_package/care_map.txt: No such file or directory 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Marked slot 0 as booted successfully. 03-04 05:28:56.788 630 630 I /system/bin/update_verifier: Leaving update_verifier. Bug: None Test: Manually tested on device using AVB bootloader. Change-Id: I13c0fe1cc5d0f397e36f5e62fcc05c8dfee5fd85
2017-05-16Print SHA1 of the patch if bsdiff fails with data errorTianjie Xu1-0/+39
This will help us to identify the patch corruption. Meanwhile fix a wrong size parameter passed to bspatch. (patch->data.size() into patch->data.size() - patch_offset). Also remove the only usage of "ApplyBSDiffPatchMem()" and inline its Sink function for simplicity. Bug: 37855643 Test: Prints SHA1 for corrupted patch in imgdiff_test. Change-Id: Ibf2db8c08b0ded1409bb7c91a3547a6bf99c601d
2017-05-08Add a binary path param to update_binary_command().Tao Bao1-10/+74
This allows writing native tests for non-A/B update_binary_command(). Prior to this CL, it was extracting the updater to a hard-coded location (/tmp/update_binary) that's not available under the test environment. Test: recovery_component_test on angler and marlin respectively. Test: Sideload OTA packages on angler and marlin respectively. Change-Id: I78b9cc211d90c0a16a84e94e339b65759300e2a8
2017-05-03fuse_sideload: Change the minimal block size to 4096.Tao Bao1-2/+17
run_fuse_sideload() is passing the block size as the max_read option, so it will only handle a request that involves at most two blocks at a time. However, the minimal allowed value was set to 1024 prior to this CL, which is inconsistent with the kernel code (fs/fuse/inode.c) that sets it to the greater of 4096 and the passed-in max_read option. This would fail the calls with a block size / max_read less than 4096 due to the wrongly computed block indices. Note that we didn't observe real issue in practice, because we have been using 64 KiB block sizes for both of adb and sdcard sideload calls. The issue only shows up in my local CL (to come later) that uses 1024 block size in run_fuse_sideload() tests. Test: recovery_component_test Test: adb sideload with the new recovery image on angler Change-Id: Id9f0cfea13d0d193dcb7cd41a1553a23739545f2
2017-05-02Move sysMapFile and sysReleaseMap into MemMapping class.Tao Bao2-3/+3
Test: recovery_component_test Test: recovery_unit_test Test: Apply an OTA on angler. Change-Id: I7170f03e4ce1fe06184ca1d7bcce0a695f33ac4d
2017-04-27Separate libupdate_verifier module and add testcases.Tao Bao1-0/+83
Enable -Wall and expose verify_image() for testing purpose. Test: mmma bootable/recovery Test: recovery_component_test Change-Id: I1ee1db2a775bafdc1112e25a1bc7194d8d6aee4f
2017-04-26applypatch: Remove the obsolete support for "applypatch -s".Tao Bao1-14/+0
The SpaceMode (applypatch -s) was used in amend script (cupcake) only, which has been removed since commit 9ce2ebf5d300eba5f6086583b0941ef68a3e4b42 (platform/build). The later (and current) edify script uses apply_patch_space(). Note that other modes (PatchMode, CheckMode) of applypatch executable are mostly used by install-recovery.sh script. Test: No active user of "applypatch -s". Test: recovery_component_test Change-Id: I1d689b7fedd3884077e88ed1d6c22f7a2198859d
2017-04-24Add more tests for verify_package_compatibility().Tao Bao1-0/+84
This now covers the actual calls to libvintf, and asserts we're getting identical results through verify_package_compatibility() and by calling libvintf directly. We were missing the coverage and introduced the double free bug (fixed by commit f978278995d02a58e311fe017bdbb2c3702dd3bc). Bug: 37413730 Test: recovery_component_test passes. Test: recovery_component_test fails w/o commit f978278995d02a58e311fe017bdbb2c3702dd3bc. Change-Id: If5195ea1c583fd7c440a1de289da82145e80e23c (cherry picked from commit f2784b6a43e54ed67bc30ac456f66f11bd16bc74)
2017-04-21tests: Remove obsolete classes in applypatch_test.Tao Bao1-49/+2
ApplyPatchFullTest and ApplyPatchDoubleCacheTest were used for defining testcases for file-based OTA. The testcases have already been removed by commit 40e144dae877654f75e65242535036058ea48f58. This CL removes the obsolete class defnitions. Bug: 37559618 Test: recovery_component_test on angler and marlin respectively. Change-Id: I3f4f1dfc8580cf010365e671de256f68bbc0d99a
2017-04-20Add more tests for verify_package_compatibility().Tao Bao1-0/+84
This now covers the actual calls to libvintf, and asserts we're getting identical results through verify_package_compatibility() and by calling libvintf directly. We were missing the coverage and introduced the double free bug (fixed by commit f978278995d02a58e311fe017bdbb2c3702dd3bc). Bug: 37413730 Test: recovery_component_test passes. Test: recovery_component_test fails w/o commit f978278995d02a58e311fe017bdbb2c3702dd3bc. Change-Id: If5195ea1c583fd7c440a1de289da82145e80e23c
2017-04-19Add tests for read_metadata_from_package().Tao Bao1-0/+50
Test: recovery_component_test Change-Id: I672a6a4f101c72e82b9f25f165dccd1c9520627b
2017-04-19Add tests for update_binary_command().Tao Bao1-0/+87
Expose update_binary_command() through private/install.h for testing purpose. Also make minor clean-ups to install.cpp: a) adding more verbose logging on ExtractToMemory failures; b) update_binary_command() taking std::string instead of const char*; c) moving a few macro and global constants into update_binary_command(). Bug: 37300957 Test: recovery_component_test on marlin Test: Build new recovery and adb sideload on angler and sailfish. Change-Id: Ib2d9068af3fee038f01c90940ccaeb0a7da374fc Merged-In: Ib2d9068af3fee038f01c90940ccaeb0a7da374fc (cherry picked from commit bc4b1fe4c4305ebf0fbfc891b9b508c14b5c8ef8)
2017-04-18Add tests for update_binary_command().Tao Bao1-0/+87
Expose update_binary_command() through private/install.h for testing purpose. Also make minor clean-ups to install.cpp: a) adding more verbose logging on ExtractToMemory failures; b) update_binary_command() taking std::string instead of const char*; c) moving a few macro and global constants into update_binary_command(). Bug: 37300957 Test: recovery_component_test on marlin Test: Build new recovery and adb sideload on angler and sailfish. Change-Id: Ib2d9068af3fee038f01c90940ccaeb0a7da374fc
2017-04-13Verify the package compatibility with libvintf.Tao Bao1-0/+57
verify_package_compatibility() is added to parse the compatibility entry (compatibility.zip) in a given OTA package. If entry is present, the information is sent to libvintf to check the compatibility. This CL doesn't actually call libvintf, since the API there is not available yet. Bug: 36597505 Test: Doesn't break the install with existing packages (i.e. w/o the compatibility entry). Test: recovery_component_test Change-Id: I3903ffa5f6ba33a5c0d761602ade6290c6752596 (cherry picked from commit 62e0bc7586077b3bde82759fb34b51b982cea20f)
2017-04-12Verify the package compatibility with libvintf.Tao Bao1-0/+57
verify_package_compatibility() is added to parse the compatibility entry (compatibility.zip) in a given OTA package. If entry is present, the information is sent to libvintf to check the compatibility. This CL doesn't actually call libvintf, since the API there is not available yet. Bug: 36597505 Test: Doesn't break the install with existing packages (i.e. w/o the compatibility entry). Test: recovery_component_test Change-Id: I3903ffa5f6ba33a5c0d761602ade6290c6752596
2017-04-08Abort the update if there's not enough new dataTianjie Xu1-0/+66
Right now the update stuck in a deadlock if there's less new data than expection. Add some checkers and abort the update if such case happens. Also add a corresponding test. Bug: 36787146 Test: update aborts correctly on bullhead && recovery_component_test passes Change-Id: I914e4a2a4cf157b99ef2fc65bd21c6981e38ca47
2017-04-05tests: Use get_bootloader_message_blk_device() to find /misc.Tao Bao2-6/+4
Since commit fb00d82f32446804f7149bc6846dcc580cf0db1d has added get_bootloader_message_blk_device() as an API, switch the tests-local implementation to it. Test: recovery_component_test on angler. Test: recovery_component_test on a local build that doesn't have /misc. Change-Id: I4f5f542cb9ef58292c587a677da73d8822db7262
2017-03-29Fix the bad merge (duplicate tests).Tao Bao1-45/+0
Test: mmma bootable/recovery Change-Id: I909164fed84fb17a7e1cb2427cb88208a69dc052
2017-03-28tests: Add a test for --wipe_ab into UncryptTest.Tao Bao1-103/+82
Also factor out the common parts in {setup,clear}_bcb into a separate function. Test: recovery_component_test Change-Id: I7b95cced925c8135e020dcb791ca2425d4f28449
2017-03-28applypatch: Let Apply{BSDiff,Image}Patch accept std::function.Tao Bao1-56/+24
Test: mmma bootable/recovery system/update_engine Test: recovery_component_test Change-Id: I93c2caa87bf94a53509bb37f98f2c02bcadb6f5c
2017-03-28applypatch: Change the ssize_t length parameters to size_t.Tao Bao1-1/+1
Mostly for applypatch family APIs like ApplyBSDiffPatch() and ApplyImagePatch(). Changing to size_t doesn't indicate they would necessarily work with very large size_t (e.g. > ssize_t), just similar to write(2). But otherwise accepting negative length doesn't make much sense. Also change the return type of SinkFn from ssize_t to size_t. Callers tell a successful sink by comparing the number of written bytes against the desired value. Negative return values like -1 are not needed. This also makes it consistent with bsdiff::bspatch interface. Test: recovery_component_test Test: Apply an incremental with the new updater. Change-Id: I7ff1615203a5c9854134f75d019e266f4ea6e714
2017-03-28tests: Construct two bad packages at runtime for VerifierTest.Tao Bao1-3/+46
For the BadPackage tests from VerifierTest: one alters the footer, and the other alters the metadata. Move the two tests to be based on otasigned_v3.zip (they're based on otasigned_v1.zip previously). Also construct the testdata files dynamically (to save the space and for better readability). Test: recovery_component_test Change-Id: I7604d563f8b4fa0c55fec8730c063384158e3abc (cherry picked from commit 217d9f98595076f344746bffdafb4314191f3e1b)
2017-03-28tests: Construct two bad packages at runtime for VerifierTest.Tao Bao1-3/+46
For the BadPackage tests from VerifierTest: one alters the footer, and the other alters the metadata. Move the two tests to be based on otasigned_v3.zip (they're based on otasigned_v1.zip previously). Also construct the testdata files dynamically (to save the space and for better readability). Test: recovery_component_test Change-Id: I7604d563f8b4fa0c55fec8730c063384158e3abc
2017-03-27tests: Construct signature-boundary.zip at runtime.Tao Bao1-2/+18
Test: Observe the same failure with recovery_component_test ("signature start: 65535 is larger than comment size: 0"). Change-Id: I98c357b5df2fa4caa9d8eed63af2e945ed99f18a
2017-03-23updater: Fix the broken case for apply_patch_check().Tao Bao1-0/+49
It's valid to provide only 1 argument to apply_patch_check(). We shouldn't fail the argument parsing. Bug: 36541737 Test: recovery_component_test passes. Test: recovery_component_test captures the failure without the fix. Test: The previously failed update applies successfully. Change-Id: Iee4c54ed33b877fc4885945b085341ec5c64f663
2017-03-22Remove malloc in edify functionsTianjie Xu2-3/+5
And switch them to std::vector & std::unique_ptr Bug: 32117870 Test: recovery tests passed on sailfish Change-Id: I5a45951c4bdf895be311d6d760e52e7a1b0798c3
2017-03-18Add testcases for load_keys().Tao Bao1-0/+57
Test: recovery_component_test passes. Change-Id: I6276b59981c87c50736d69d4af7647c8ed892965
2017-03-17Drop the dependency on 'ui' in verify_file().Tao Bao1-105/+46
verify_file() has a dependency on the global variable of 'ui' for posting the verification progress, which requires the users of libverifier to provide a UI instance. This CL adds an optional argument to verify_file() so that it can post the progress through the provided callback function. As a result, we can drop the MockUI class in verifier_test.cpp. Test: recovery_component_test passes. Test: verify_file() posts progress update when installing an OTA. Change-Id: I8b87d0f0d99777ea755d33d6dbbe2b6d44243bf1 (cherry picked from commit 5e535014dd7961fbf812abeaa27f3339775031f1)
2017-03-17Drop the dependency on 'ui' in verify_file().Tao Bao1-104/+45
verify_file() has a dependency on the global variable of 'ui' for posting the verification progress, which requires the users of libverifier to provide a UI instance. This CL adds an optional argument to verify_file() so that it can post the progress through the provided callback function. As a result, we can drop the MockUI class in verifier_test.cpp. Test: recovery_component_test passes. Test: verify_file() posts progress update when installing an OTA. Change-Id: I8b87d0f0d99777ea755d33d6dbbe2b6d44243bf1
2017-03-17Add a test to perform block_image_updateTianjie Xu1-5/+115
Add the following tests: stash src bspatch stashed_src tgt free stashed_src (expected a successful update) stash src free stashed_src fail_the_update (expected stashed_src freed) Bug: 36242722 Test: Test identified unfreed stashes correctly. Change-Id: I5a136e8dc31774367972fbfe8c63cbc1ddb3a113
2017-03-16More cleanup to imgdiff & imgpatchTianjie Xu1-4/+5
Also remove the utils in applypatch and replace them with the corresponding libbase functions. Test: recovery tests pass. Change-Id: I77254c141bd3e7d3d6894c23b60e866009516f81
2017-03-16applypatch: Drop the support for patching non-EMMC targets.Tao Bao1-124/+0
Patching regular files is used in file-based OTA only, which has become obsolete. Bug: 35853185 Test: Apply an incremental that patches the boot.img. Test: /system/bin/install-recovery.sh works. Test: recovery_component_test passes. Change-Id: Id44e42c4bc63f2162ecc8a6df1cb528b7ae6b0a9
2017-03-13updater: Remove some obsoleted functions for file-based OTA.Tao Bao1-113/+0
This CL removes the updater support for delete(), symlink(), rename(), set_metadata() and set_metadata_recursive(). Such functions have been removed from the generation script in commit f388104eaacd05cfa075d6478369e1d0df5ddbf3 (platform/build). Note: This CL also removes delete_recursive() which seems to have never been supported in generation script. Bug: 35853185 Test: recovery_component_test passes. Change-Id: I51e1ec946fa73761118fa1eaa082423df6d588e9
2017-03-07Refractor the code for imgdiffTianjie Xu1-0/+56
Put ImageChunk and some helper functions into a class. Also switch to using std::vector instead of malloc. Bug: 18606652 Test: imgdiff_test passed on host. Also generate a complete incremental OTA package. The file content is the same and time consumption is similar. Change-Id: Id603ada4e130ef521218400761a119001a86ca79
2017-03-03Fix an error on bootloadermessager test teardownTianjie Xu1-2/+4
The test should not clear bcb during teardown on devices without /misc. Bug: 35712836 Test: The test tears down without errors after /misc removed from the fstab. Change-Id: I42df89feb18fac5a435cd17eef97a6bad0f44545
2017-03-03Recovery Test: add SideloadTest to test FUSE support on targetWei Wang1-0/+21
FUSE FS is required in recovery sideload functionalites. This CL is to add a native test to flag when FUSE is not supported in the device kernel. Bug: 35768196 Test: mma, run recovery_component_test on marlin and pass all Change-Id: I43b6dbee658010df56ba4d4b0e91baa7fd1c4480
2017-03-01Skip BootloaderMessageTest, UncryptTest for devices without /miscTianjie Xu2-3/+61
Skip these two tests if /misc partition is not found in fstab. Bug: 35712836 Test: Both test skip correctly if there's no /misc in fstab.${hardware}. Change-Id: I38417a8677030229a335e43eaef85ae70c4e0845
2017-01-06tests: Add testcase for show_progress() and set_progress().Tao Bao1-0/+50
Test: recovery_component_test passes. Change-Id: I4f00d0171cf86699e9ce747d07d7d44a01906e81
2017-01-04recovery: Fix the broken UI text.Tao Bao1-32/+38
UI text is broken (doesn't show any text during FDR) due to commit d530449e54bd327e9c26209ffa0490c6508afe6c, which reordered the calls to RecoveryUI::SetLocale() and RecoveryUI::Init(). Because Init() uses the locale info to load the localized texts (from images), the locale must be set prior to that via SetLocale(). This CL refactors Init() to take the locale parameter, and removes the odd SetLocale() API. Bug: 34029338 Test: 'Run graphics test' under recovery. Change-Id: I620394a3d4e3705e9af5a1f6299285d143ae1b01
2016-12-28imgdiff: Fix an edge case that leads to infinite loop.Tao Bao1-0/+80
When the input image ends with the magic value sequence of 0x1f, 0x8b, 0x0b (optionally with 0x00), the image parsing code will be stuck in an infinite loop. Test: recovery_component_test passes. Change-Id: Ie3629dfdc41360387b19cc3e0359c95ae4fb998e
2016-12-20Add tests for imgdiff.Tao Bao1-0/+448
Factor out libimgdiff static library for testing purpose. This CL adds the imgdiff tests on host and on target both (similar to libimgpatch). In practice, we only need imgdiff binary on host, and libimgpatch on target. But they should build and pass tests on both platforms. Test: recovery_host_test passes; recovery_component_test passes. Change-Id: I0eafb7faf727cdf70066310e845af6ee245d4f60
2016-12-17Add a checker for signature boundary in verifierTianjie Xu1-1/+2
The 'signature_start' variable marks the location of the signature from the end of a zip archive. And a boundary check is missing where 'signature_start' should be within the EOCD comment field. This causes problems when sideloading a malicious package. Also add a corresponding test. Bug: 31914369 Test: Verification fails correctly when sideloading recovery_test.zip on angler. Change-Id: I6ea96bf04dac5d8d4d6719e678d504f957b4d5c1
2016-12-15Add update_bootloader_message() to fix two-step OTAs.Tao Bao1-0/+26
This is a retry of commit 7e31f421a514da09b90e46dbd642a5e9b16e0003. Commit bd56f1590c967205dc45eb2ec298aa8d2aacb740 switches to calling write_bootloader_message(<options>) in get_args(), which unintentionally resets the stage field thus breaks two-step OTAs. This CL adds update_bootloader_message(<options>), which only sets the command field (to "boot-recovery") and the recovery field (with the specified options). Bug: 33534933 Test: Apply a two-step package. Test: recovery_component_test passes. Change-Id: Ie0b1ed4053d2d3c97d9cb84310d616b28fcfc72e
2016-12-15tests: Add tests for bootloader_message.Tao Bao1-0/+139
Test: recovery_component_test passes. Change-Id: Ib9aa2ffd6b018546223c76b7424f4ba355f5b088
2016-12-14Add tests for setup-bcb and clear-bcb via uncrypt.Tao Bao1-0/+174
Bug: http://b/33534933 Test: recovery_component_test passes (and fails on buggy build due to the CL in [1]). [1]: commit 7e31f421a514da09b90e46dbd642a5e9b16e0003 Change-Id: I120498048ec1db8f9fcbb3cf135c05d3a48cfcdf
2016-12-13Add a stub recovery UI.Sen Jiang1-1/+1
This allows recovery to work on devices without screen. The stub recovery UI does nothing except print to stdout. Test: write 'recovery\n--wipe_data\n--reason=wipe_data_from_ota\n' to misc and boot to recovery on a device without screen. Bug: 33175036 Change-Id: Icde698aa2e2e29f4b3d0532dfd3c6a939ac2bc63
2016-11-22tests: Add testcases for EMMC targets.Tao Bao1-31/+144
There're two types of targets in applypatch: regular files and EMMC targets. We have two sets of functions to handle them respectively. This CL adds testcases to use "EMMC:filename:size:sha1" as the target name, which triggers the code path for patching EMMC targets. Bug: 33034669 Test: recovery_component_test passes. Change-Id: I8f10c6c8d2c1fb083f06a83de91d9e23cb41fb6d
2016-11-18updater: Refactor set_stage() and get_stage() functions.Tao Bao1-0/+59
Add read_bootloader_message_from() and write_bootloader_message_to() to allow specifying the BCB device (/misc). Also add testcases for set_stage() and get_stage(). Test: recovery_component_test passes. Test: Build a recovery image and apply a two-step OTA package. Change-Id: If5ab06a1aaaea168d2a9e5dd63c07c0a3190e4ae
2016-11-18updater: Add testcase for package_extract_dir().Tao Bao1-0/+96
Test: recovery_component_test passes. Change-Id: I3af4707bc42c7331ca961be8b967a53de82ea25b
2016-11-17updater: Add "write_value()" function.Tao Bao1-0/+33
write_value(value, filename) writes 'value' to 'filename'. It can be used to tune device settings when applying an OTA package. For example, write_value("960000", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq"). Bug: 32463933 Test: recovery_component_test passes. Test: Apply an OTA package that contains a call to write_value(), and check the result. Change-Id: Ib009ecb8a45a94353f10c59e2383fe1f49796e35
2016-11-16updater: Fix the wrong return value for package_extract_file().Tao Bao1-17/+75
'bool success = ExtractEntryToFile()' gives opposite result. Fix the issue and add testcases. Change the one-argument version of package_extract_file() to explicitly abort for non-existent zip entry. Note that this is NOT changing the behavior. Prior to this CL, it aborts from Evaluate() function, by giving a general cause code. Now it returns kPackageExtractFileFailure. BUg: 32903624 Test: recovery_component_test works. Change-Id: I7a273e9c0d9aaaf8c472b2c778f7b8d90362c24f (cherry picked from commit ef0eb3b01b66fbbc97908667a3dd1e02d710cbb7)
2016-11-15updater: Fix the wrong return value for package_extract_file().Tao Bao1-17/+75
'bool success = ExtractEntryToFile()' gives opposite result. Fix the issue and add testcases. Change the one-argument version of package_extract_file() to explicitly abort for non-existent zip entry. Note that this is NOT changing the behavior. Prior to this CL, it aborts from Evaluate() function, by giving a general cause code. Now it returns kPackageExtractFileFailure. BUg: 32903624 Test: recovery_component_test works. Change-Id: I7a273e9c0d9aaaf8c472b2c778f7b8d90362c24f
2016-11-09updater: Add more testcase for symlink().Tao Bao1-6/+39
Clean up SymlinkFn() a bit. Also clean up the temp files created when running the tests; otherwise non-empty TemporaryDir won't be removed. Test: recovery_component_test passes. Change-Id: Id3844abebd168c40125c4dcec54e6ef680a83c3a
2016-11-08Make make_parent() to take const argumentTianjie Xu1-0/+22
Switch to use const std::string; and add corresponding tests. Bug: 32649858 Test: Component tests pass Change-Id: I640f3ec81f1481fa91aa310f8d4d96dac9649cb9
2016-11-04updater: Add a testcase for RenameFn().Tao Bao1-0/+29
Test: recovery_component_test passes. Change-Id: Iba5a0fdf6c79e2bed6b30b8fc19a306c1ab29d8a
2016-11-04updater: Fix a bug in DeleteFn().Tao Bao1-0/+33
Also add a testcase for delete() function. Test: recovery_component_test passes. Change-Id: I064d1ad4693c3ed339d0a69eabadd08a61a2ea86
2016-11-03updater: Fix an off-by-1 bug in file_getprop().Tao Bao1-0/+50
Also add a testcase for file_getprop(). Test: recovery_component_test passes. Change-Id: I8eb2f9a5702b43997ac9f4b29665eea087b1c146
2016-11-03tests: Set up testdata path for continuous native tests.Tao Bao2-16/+2
continuous_native_tests expects the testdata under DATA/ in continuous_native_tests.zip. This CL packs a copy of the testdata into continuous_native_tests.zip as DATA/nativetest/recovery/testdata (via LOCAL_PICKUP_FILES). This CL also removes the extra copy for nativetest64. Testdata will always stay at /data/nativetest/recovery/testdata, even for 64-bit version. Otherwise we will unnecessarily get four copies (two for data/ and another two for DATA/). Bug: 32123241 Test: mmma bootable/recovery && adb sync data. On bullhead, /data/nativetest/recovery_component_test/recovery_component_test works; /data/nativetest64/recovery_component_test/recovery_component_test works. Test: m continuous_native_test; DATA/nativetest/recovery/testdata exists. Change-Id: Ifefa0309de7af23c77654e8e450848ca2da218c2
2016-11-01applypatch: Add testcases for applypatch executable.Tao Bao1-256/+322
Refactor applypatch/main.cpp into libapplypatch_modes so that we can add testcases. Some changes to applypatch/main.cpp: - Replace char** argv with const char**; - Use android::base::Split() to split ":"; - Use android::base::ParseUInt(). Bug: 32383590 Test: Unit tests pass, install-recovery.sh works. Change-Id: I44e7bfa5ab717d439ea1d0ee9ddb7b2c40bb95a4
2016-10-29applypatch: Switch the parameter of Value** to std::vector.Tao Bao1-126/+138
Test: Unit tests and install-recovery.sh pass on angler and dragon. Change-Id: I328e6554edca667cf850f5584ebf1ac211e3d4d1
2016-10-19Add a unit test for applypatch_checkTianjie Xu1-0/+5
If no sha1 is specified, applypatch_check should pass as long as the file content loads successfully. Add a unit case acccordingly. Test: Unit tests passed Bug: 32243751 Change-Id: I8c013be67c197d2935e11cf6acc59fb9b943cfd9
2016-10-18Replace minzip with libziparchiveTianjie Xu1-1/+2
Clean up the duplicated codes that handle the zip files in bootable/recovery; and rename the library of the remaining utility functions to libotautil. Test: Update package installed successfully on angler. Bug: 19472796 Change-Id: Iea8962fcf3004473cb0322b6bb3a9ea3ca7f679e
2016-10-15Change StringValue to use std::stringTianjie Xu3-81/+67
Changing the field of 'Value' in edify to std::string from char*. Meanwhile cleaning up the users of 'Value' and switching them to cpp style. Test: compontent tests passed. Bug: 31713288 Change-Id: Iec5a7d601b1e4ca40935bf1c70d325dafecec235
2016-10-13edify: Some clean-ups to libedify.Tao Bao2-6/+23
- Remove dead declarations in expr.h: SetError(), GetError(), ClearError(). - Remove the declaration of Build() out of expr.h. - Use std::unordered_map to implement RegisterFunction() and FindFunction(); kill FinishRegistration(). - Add a testcase for calling unknown functions. Test: mmma bootable/recovery; recovery_component_test passes. Change-Id: I9af6825ae677f92b22d716a4a5682f58522af03b
2016-10-11updater: Kill the duplicate PrintSha1() in install.cpp.Tao Bao1-7/+36
Also add a testcase for sha1_check(). Test: mmma bootable/recovery; recovery_component_test passes. Change-Id: I4d06d551a771aec84e460148544f68b247a7e721
2016-10-11Refactor libupdater into a seperate module.Tao Bao1-0/+71
So that we can write native tests for updater functions. This CL adds a testcase for getprop() function. Test: mmma bootable/recovery; Run recovery_component_test on device. Change-Id: Iff4c1ff63c5c71aded2f9686fed6b71cc298c228
2016-10-05edify: Move State.script and State.errmsg to std::string.Tao Bao1-6/+1
This way we kill a few strdup() and free() calls. Test: 1. recovery_component_test still passes; 2. Applying an update with the new updater works; 3. The error code in a script with abort("E310: xyz") is recorded into last_install correctly. Change-Id: Ibda4da5937346e058a0d7cc81764d6f02920010a (cherry picked from commit 59dcb9cbea8fb70ab933fd10d35582b08cd13f37)
2016-10-04edify: Move State.script and State.errmsg to std::string.Tao Bao1-6/+1
This way we kill a few strdup() and free() calls. Test: 1. recovery_component_test still passes; 2. Applying an update with the new updater works; 3. The error code in a script with abort("E310: xyz") is recorded into last_install correctly. Change-Id: Ibda4da5937346e058a0d7cc81764d6f02920010a
2016-10-04edify: Move the testcases to gtest.Tao Bao1-0/+156
Now they live in tests/component/edify_test.cpp. Also rename edify/main.cpp to edify/edify_parser.cpp. It becomes a host-side debugging tool that validates the input edify script. However, it supports edify builtin functions only and doesn't recognize the ones defined via updater. Test: recovery_component_test passes on device. Change-Id: Ib94a787bf15098a9cc078d256b6a6dc96ff12b2e
2016-08-26Fix clang-tidy warnings in bootable/recovery.Chih-Hung Hsieh1-1/+1
* Use const reference type for read-only parameters. Bug: 30407689 * Use faster overloaded string find function. Bug: 30411878 * Add parentheses around macro parameters. Bug: 28705665 Test: build with WITH_TIDY=1 Change-Id: I4e8e5748bfa4ae89871f1fb5fa4624d372530d75
2016-08-01Clean up verifier testcases.Tao Bao1-41/+26
A Certificate is a pair of an RSAPublicKey and a particular hash. So v1 and v3 differ in the hash algorithm (SHA-1 vs SHA-256), similarly for v2 and v4. In verifier testcases, we used to load v1/v2 keys with an explicit argument of "sha256" to test the v3/v4 keys. This CL switches to loading v3/v4 keys directly and lets load_keys() to handle that, which is the actual flow we use in practice. Also remove the "fallback to v1 key" in the testcases, which is not the actual behavior. Bug: 30415901 Test: Run the verifier_test component test on device. Change-Id: I3a2baa64826f1b6c4c367a560090df384c4521bb
2016-04-29Add ability to show "installing security update"Tianjie Xu1-0/+1
Add a new command "--security" to boot commands. If this command is observed as part of BCB, choose a different background text picture for installing stage in recovery UI. As a result, users will see "installing security update" instead of "installing system update" when applying a security update package. Bug: 27837319 Change-Id: I2e2253a124993ecc24804fa1ee0b918ac96837c5
2016-04-14Use BoringSSL instead of mincrypt to speed up package verification.Elliott Hughes1-108/+23
This changes the verification code in bootable/recovery to use BoringSSL instead of mincrypt. Cherry-pick of 452df6d99c81c4eeee3d2c7b2171901e8b7bc54a, with merge conflict resolution, extra logging in verifier.cpp, and an increase in the hash chunk size from 4KiB to 1MiB. Bug: http://b/28135231 Change-Id: I1ed7efd52223dd6f6a4629cad187cbc383d5aa84
2016-04-06Convert recovery to use BoringSSL instead of mincrypt.Mattias Nissler1-108/+23
This changes the verification code in bootable/recovery to use BoringSSL instead of mincrypt. Change-Id: I37b37d84b22e81c32ac180cd1240c02150ddf3a7
2016-03-12Port applypatch.sh tests to recovery_component_testsJed Estep2-6/+393
Bug: 27135282 Change-Id: If53682b591397ddfdb84860a3779b612904d4489
2016-02-22Fix verifier test base testdata directory after merge conflictJed Estep1-1/+1
Change-Id: I7ffba0be5a6befc875ce59b51a008c1892e7d34b
2016-02-05Change on-device directory for recovery test dataJed Estep1-1/+1
Test data needs to go outside the gtest module. Change-Id: Ic444ca838cbafa651ec97ff8730129da84fafc09
2016-02-05verifier_test: Suppress the unused parameter warnings.Tao Bao1-8/+9
Change-Id: I51fec30114c0a31efc9c2ac8472654baf8bb3e84
2016-02-04Refactor existing tests to use gtestJed Estep1-0/+267
Bug: 26962907 Change-Id: I5f80636af1740badeff7d08193f08e23f4e4fee1