4 files changed, 135 insertions, 72 deletions

diff --git a/update_verifier/Android.bp b/update_verifier/Android.bp
index 7a860a149..1b84619af 100644
--- a/update_verifier/Android.bp
+++ b/update_verifier/Android.bp
@@ -15,9 +15,8 @@
 cc_defaults {
     name: "update_verifier_defaults",
 
-    cflags: [
-        "-Wall",
-        "-Werror",
+    defaults: [
+        "recovery_defaults",
     ],
 
     local_include_dirs: [
diff --git a/update_verifier/care_map.proto b/update_verifier/care_map.proto
index 442ddd4a9..15d3afa83 100644
--- a/update_verifier/care_map.proto
+++ b/update_verifier/care_map.proto
@@ -16,7 +16,7 @@
 
 syntax = "proto3";
 
-package UpdateVerifier;
+package recovery_update_verifier;
 option optimize_for = LITE_RUNTIME;
 
 message CareMap {
diff --git a/update_verifier/include/update_verifier/update_verifier.h b/update_verifier/include/update_verifier/update_verifier.h
index 534384e1d..bdfabed0c 100644
--- a/update_verifier/include/update_verifier/update_verifier.h
+++ b/update_verifier/include/update_verifier/update_verifier.h
@@ -16,17 +16,45 @@
 
 #pragma once
 
+#include <map>
 #include <string>
+#include <vector>
 
-int update_verifier(int argc, char** argv);
+#include "otautil/rangeset.h"
+
+// The update verifier performs verification upon the first boot to a new slot on A/B devices.
+// During the verification, it reads all the blocks in the care_map. And if a failure happens,
+// it rejects the current boot and triggers a fallback.
 
-// Returns true to indicate a passing verification (or the error should be ignored); Otherwise
-// returns false on fatal errors, where we should reject the current boot and trigger a fallback.
-// This function tries to process the care_map.txt as protobuf message; and falls back to use the
-// plain text format if the parse failed.
-//
 // Note that update_verifier should be backward compatible to not reject care_map.txt from old
 // releases, which could otherwise fail to boot into the new release. For example, we've changed
 // the care_map format between N and O. An O update_verifier would fail to work with N care_map.txt.
 // This could be a result of sideloading an O OTA while the device having a pending N update.
-bool verify_image(const std::string& care_map_name);
+int update_verifier(int argc, char** argv);
+
+// The UpdateVerifier parses the content in the care map, and continues to verify the
+// partitions by reading the cared blocks if there's no format error in the file. Otherwise,
+// it should skip the verification to avoid bricking the device.
+class UpdateVerifier {
+ public:
+  // This function tries to process the care_map.pb as protobuf message; and falls back to use
+  // care_map.txt if the pb format file doesn't exist. If the parsing succeeds, put the result of
+  // the pair <partition_name, ranges> into the |partition_map_|.
+  bool ParseCareMap(const std::string& file_name = "");
+
+  // Verifies the new boot by reading all the cared blocks for partitions in |partition_map_|.
+  bool VerifyPartitions();
+
+ private:
+  // Parses the legacy care_map.txt in plain text format.
+  bool ParseCareMapPlainText(const std::string& content);
+
+  // Finds all the dm-enabled partitions, and returns a map of <partition_name, block_device>.
+  std::map<std::string, std::string> FindDmPartitions();
+
+  // Returns true if we successfully read the blocks in |ranges| of the |dm_block_device|.
+  bool ReadBlocks(const std::string partition_name, const std::string& dm_block_device,
+                  const RangeSet& ranges);
+
+  std::map<std::string, RangeSet> partition_map_;
+};
diff --git a/update_verifier/update_verifier.cpp b/update_verifier/update_verifier.cpp
index 5e5aa1819..6e86ac9d3 100644
--- a/update_verifier/update_verifier.cpp
+++ b/update_verifier/update_verifier.cpp
@@ -48,8 +48,6 @@
 
 #include <algorithm>
 #include <future>
-#include <string>
-#include <vector>
 
 #include <android-base/file.h>
 #include <android-base/logging.h>
@@ -61,7 +59,6 @@
 #include <cutils/android_reboot.h>
 
 #include "care_map.pb.h"
-#include "otautil/rangeset.h"
 
 using android::sp;
 using android::hardware::boot::V1_0::IBootControl;
@@ -76,29 +73,25 @@ static int dm_name_filter(const dirent* de) {
   return 0;
 }
 
-static bool read_blocks(const std::string& partition, const std::string& range_str) {
-  if (partition != "system" && partition != "vendor" && partition != "product") {
-    LOG(ERROR) << "Invalid partition name \"" << partition << "\"";
-    return false;
-  }
-  // Iterate the content of "/sys/block/dm-X/dm/name". If it matches one of "system", "vendor" or
-  // "product", then dm-X is a dm-wrapped device for that target. We will later read all the
-  // ("cared") blocks from "/dev/block/dm-X" to ensure the target partition's integrity.
+// Iterate the content of "/sys/block/dm-X/dm/name" and find all the dm-wrapped block devices.
+// We will later read all the ("cared") blocks from "/dev/block/dm-X" to ensure the target
+// partition's integrity.
+std::map<std::string, std::string> UpdateVerifier::FindDmPartitions() {
   static constexpr auto DM_PATH_PREFIX = "/sys/block/";
   dirent** namelist;
   int n = scandir(DM_PATH_PREFIX, &namelist, dm_name_filter, alphasort);
   if (n == -1) {
     PLOG(ERROR) << "Failed to scan dir " << DM_PATH_PREFIX;
-    return false;
+    return {};
   }
   if (n == 0) {
-    LOG(ERROR) << "dm block device not found for " << partition;
-    return false;
+    LOG(ERROR) << "No dm block device found.";
+    return {};
   }
 
   static constexpr auto DM_PATH_SUFFIX = "/dm/name";
   static constexpr auto DEV_PATH = "/dev/block/";
-  std::string dm_block_device;
+  std::map<std::string, std::string> dm_block_devices;
   while (n--) {
     std::string path = DM_PATH_PREFIX + std::string(namelist[n]->d_name) + DM_PATH_SUFFIX;
     std::string content;
@@ -110,33 +103,18 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
       if (dm_block_name == "vroot") {
         dm_block_name = "system";
       }
-      if (dm_block_name == partition) {
-        dm_block_device = DEV_PATH + std::string(namelist[n]->d_name);
-        while (n--) {
-          free(namelist[n]);
-        }
-        break;
-      }
+
+      dm_block_devices.emplace(dm_block_name, DEV_PATH + std::string(namelist[n]->d_name));
     }
     free(namelist[n]);
   }
   free(namelist);
 
-  if (dm_block_device.empty()) {
-    LOG(ERROR) << "Failed to find dm block device for " << partition;
-    return false;
-  }
-
-  // For block range string, first integer 'count' equals 2 * total number of valid ranges,
-  // followed by 'count' number comma separated integers. Every two integers reprensent a
-  // block range with the first number included in range but second number not included.
-  // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150).
-  RangeSet ranges = RangeSet::Parse(range_str);
-  if (!ranges) {
-    LOG(ERROR) << "Error parsing RangeSet string " << range_str;
-    return false;
-  }
+  return dm_block_devices;
+}
 
+bool UpdateVerifier::ReadBlocks(const std::string partition_name,
+                                const std::string& dm_block_device, const RangeSet& ranges) {
   // RangeSet::Split() splits the ranges into multiple groups with same number of blocks (except for
   // the last group).
   size_t thread_num = std::thread::hardware_concurrency() ?: 4;
@@ -144,10 +122,10 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
 
   std::vector<std::future<bool>> threads;
   for (const auto& group : groups) {
-    auto thread_func = [&group, &dm_block_device, &partition]() {
+    auto thread_func = [&group, &dm_block_device, &partition_name]() {
       android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dm_block_device.c_str(), O_RDONLY)));
       if (fd.get() == -1) {
-        PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition;
+        PLOG(ERROR) << "Error reading " << dm_block_device << " for partition " << partition_name;
         return false;
       }
 
@@ -155,9 +133,7 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
       std::vector<uint8_t> buf(1024 * kBlockSize);
 
       size_t block_count = 0;
-      for (const auto& range : group) {
-        size_t range_start = range.first;
-        size_t range_end = range.second;
+      for (const auto& [range_start, range_end] : group) {
         if (lseek64(fd.get(), static_cast<off64_t>(range_start) * kBlockSize, SEEK_SET) == -1) {
           PLOG(ERROR) << "lseek to " << range_start << " failed";
           return false;
@@ -190,72 +166,130 @@ static bool read_blocks(const std::string& partition, const std::string& range_s
   return ret;
 }
 
-static bool process_care_map_plain_text(const std::string& care_map_contents) {
+bool UpdateVerifier::VerifyPartitions() {
+  auto dm_block_devices = FindDmPartitions();
+  if (dm_block_devices.empty()) {
+    LOG(ERROR) << "No dm-enabled block device is found.";
+    return false;
+  }
+
+  for (const auto& [partition_name, ranges] : partition_map_) {
+    if (dm_block_devices.find(partition_name) == dm_block_devices.end()) {
+      LOG(ERROR) << "Failed to find dm block device for " << partition_name;
+      return false;
+    }
+
+    if (!ReadBlocks(partition_name, dm_block_devices.at(partition_name), ranges)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+bool UpdateVerifier::ParseCareMapPlainText(const std::string& content) {
   // care_map file has up to six lines, where every two lines make a pair. Within each pair, the
   // first line has the partition name (e.g. "system"), while the second line holds the ranges of
   // all the blocks to verify.
-  std::vector<std::string> lines =
-      android::base::Split(android::base::Trim(care_map_contents), "\n");
+  auto lines = android::base::Split(android::base::Trim(content), "\n");
   if (lines.size() != 2 && lines.size() != 4 && lines.size() != 6) {
-    LOG(ERROR) << "Invalid lines in care_map: found " << lines.size()
-               << " lines, expecting 2 or 4 or 6 lines.";
+    LOG(WARNING) << "Invalid lines in care_map: found " << lines.size()
+                 << " lines, expecting 2 or 4 or 6 lines.";
     return false;
   }
 
   for (size_t i = 0; i < lines.size(); i += 2) {
+    const std::string& partition_name = lines[i];
+    const std::string& range_str = lines[i + 1];
     // We're seeing an N care_map.txt. Skip the verification since it's not compatible with O
     // update_verifier (the last few metadata blocks can't be read via device mapper).
-    if (android::base::StartsWith(lines[i], "/dev/block/")) {
+    if (android::base::StartsWith(partition_name, "/dev/block/")) {
       LOG(WARNING) << "Found legacy care_map.txt; skipped.";
-      return true;
+      return false;
     }
-    if (!read_blocks(lines[i], lines[i+1])) {
+
+    // For block range string, first integer 'count' equals 2 * total number of valid ranges,
+    // followed by 'count' number comma separated integers. Every two integers reprensent a
+    // block range with the first number included in range but second number not included.
+    // For example '4,64536,65343,74149,74150' represents: [64536,65343) and [74149,74150).
+    RangeSet ranges = RangeSet::Parse(range_str);
+    if (!ranges) {
+      LOG(WARNING) << "Error parsing RangeSet string " << range_str;
       return false;
     }
+
+    partition_map_.emplace(partition_name, ranges);
   }
 
   return true;
 }
 
-bool verify_image(const std::string& care_map_name) {
+bool UpdateVerifier::ParseCareMap(const std::string& file_name) {
+  partition_map_.clear();
+
+  std::string care_map_name = file_name;
+  if (care_map_name.empty()) {
+    std::string care_map_prefix = "/data/ota_package/care_map";
+    care_map_name = care_map_prefix + ".pb";
+    if (access(care_map_name.c_str(), R_OK) == -1) {
+      LOG(WARNING) << care_map_name
+                   << " doesn't exist, falling back to read the care_map in plain text format.";
+      care_map_name = care_map_prefix + ".txt";
+    }
+  }
+
   android::base::unique_fd care_map_fd(TEMP_FAILURE_RETRY(open(care_map_name.c_str(), O_RDONLY)));
   // If the device is flashed before the current boot, it may not have care_map.txt in
   // /data/ota_package. To allow the device to continue booting in this situation, we should
   // print a warning and skip the block verification.
   if (care_map_fd.get() == -1) {
     PLOG(WARNING) << "Failed to open " << care_map_name;
-    return true;
+    return false;
   }
 
   std::string file_content;
   if (!android::base::ReadFdToString(care_map_fd.get(), &file_content)) {
-    PLOG(ERROR) << "Failed to read " << care_map_name;
+    PLOG(WARNING) << "Failed to read " << care_map_name;
     return false;
   }
 
   if (file_content.empty()) {
-    LOG(ERROR) << "Unexpected empty care map";
+    LOG(WARNING) << "Unexpected empty care map";
     return false;
   }
 
-  UpdateVerifier::CareMap care_map;
-  // Falls back to use the plain text version if we cannot parse the file as protobuf message.
+  if (android::base::EndsWith(care_map_name, ".txt")) {
+    return ParseCareMapPlainText(file_content);
+  }
+
+  recovery_update_verifier::CareMap care_map;
   if (!care_map.ParseFromString(file_content)) {
-    return process_care_map_plain_text(file_content);
+    LOG(WARNING) << "Failed to parse " << care_map_name << " in protobuf format.";
+    return false;
   }
 
   for (const auto& partition : care_map.partitions()) {
     if (partition.name().empty()) {
-      LOG(ERROR) << "Unexpected empty partition name.";
+      LOG(WARNING) << "Unexpected empty partition name.";
       return false;
     }
     if (partition.ranges().empty()) {
-      LOG(ERROR) << "Unexpected block ranges for partition " << partition.name();
+      LOG(WARNING) << "Unexpected block ranges for partition " << partition.name();
       return false;
     }
-    if (!read_blocks(partition.name(), partition.ranges())) {
+    RangeSet ranges = RangeSet::Parse(partition.ranges());
+    if (!ranges) {
+      LOG(WARNING) << "Error parsing RangeSet string " << partition.ranges();
       return false;
     }
+
+    // TODO(xunchang) compare the fingerprint of the partition.
+    partition_map_.emplace(partition.name(), ranges);
+  }
+
+  if (partition_map_.empty()) {
+    LOG(WARNING) << "No partition to verify";
+    return false;
   }
 
   return true;
@@ -308,8 +342,10 @@ int update_verifier(int argc, char** argv) {
     }
 
     if (!skip_verification) {
-      static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt";
-      if (!verify_image(CARE_MAP_FILE)) {
+      UpdateVerifier verifier;
+      if (!verifier.ParseCareMap()) {
+        LOG(WARNING) << "Failed to parse the care map file, skipping verification";
+      } else if (!verifier.VerifyPartitions()) {
         LOG(ERROR) << "Failed to verify all blocks in care map file.";
         return reboot_device();
       }