diff options
Diffstat (limited to 'lib/avb/libavb/avb_slot_verify.h')
| -rw-r--r-- | lib/avb/libavb/avb_slot_verify.h | 102 |
1 files changed, 20 insertions, 82 deletions
diff --git a/lib/avb/libavb/avb_slot_verify.h b/lib/avb/libavb/avb_slot_verify.h index 08b11fc..d644a44 100644 --- a/lib/avb/libavb/avb_slot_verify.h +++ b/lib/avb/libavb/avb_slot_verify.h @@ -49,20 +49,19 @@ typedef enum { AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX, AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED, - AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA, - AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION + AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA } AvbSlotVerifyResult; /* Get a textual representation of |result|. */ const char* avb_slot_verify_result_to_string(AvbSlotVerifyResult result); /* Maximum number of rollback index locations supported. */ -#define AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS 32 +#define AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS 4 /* AvbPartitionData contains data loaded from partitions when using * avb_slot_verify(). The |partition_name| field contains the name of - * the partition (without A/B suffix), |data| points to the loaded - * data which is |data_size| bytes long. + * the partition, |data| points to the loaded data which is + * |data_size| bytes long. * * Note that this is strictly less than the partition size - it's only * the image stored there, not the entire partition nor any of the @@ -74,26 +73,6 @@ typedef struct { size_t data_size; } AvbPartitionData; -/* AvbVBMetaData contains a vbmeta struct loaded from a partition when - * using avb_slot_verify(). The |partition_name| field contains the - * name of the partition (without A/B suffix), |vbmeta_data| points to - * the loaded data which is |vbmeta_size| bytes long. - * - * The |verify_result| field contains the result of - * avb_vbmeta_image_verify() on the data. This is guaranteed to be - * AVB_VBMETA_VERIFY_RESULT_OK for all vbmeta images if - * avb_slot_verify() returns AVB_SLOT_VERIFY_RESULT_OK. - * - * You can use avb_descriptor_get_all(), avb_descriptor_foreach(), and - * avb_vbmeta_image_header_to_host_byte_order() with this data. - */ -typedef struct { - char* partition_name; - uint8_t* vbmeta_data; - size_t vbmeta_size; - AvbVBMetaVerifyResult verify_result; -} AvbVBMetaData; - /* AvbSlotVerifyData contains data needed to boot a particular slot * and is returned by avb_slot_verify() if partitions in a slot are * successfully verified. @@ -105,20 +84,17 @@ typedef struct { * The |ab_suffix| field is the copy of the of |ab_suffix| field * passed to avb_slot_verify(). It is the A/B suffix of the slot. * - * The VBMeta images that were checked are available in the - * |vbmeta_images| field. The field |num_vbmeta_images| contains the - * number of elements in this array. The first element - - * vbmeta_images[0] - is guaranteed to be from the partition with the - * top-level vbmeta struct. This is usually the "vbmeta" partition in - * the requested slot but if there is no "vbmeta" partition it can - * also be the "boot" partition. - * * The partitions loaded and verified from from the slot are * accessible in the |loaded_partitions| array. The field * |num_loaded_partitions| contains the number of elements in this * array. The order of partitions in this array may not necessarily be * the same order as in the passed-in |requested_partitions| array. * + * The verified vbmeta image in the 'vbmeta' partition of the slot is + * accessible from the |vbmeta_data| field and is of length + * |vbmeta_size| bytes. You can use this data with + * e.g. avb_descriptor_get_all(). + * * Rollback indexes for the verified slot are stored in the * |rollback_indexes| field. Note that avb_slot_verify() will NEVER * modify stored_rollback_index[n] locations e.g. it will never use @@ -130,48 +106,34 @@ typedef struct { * The |cmdline| field is a NUL-terminated string in UTF-8 resulting * from concatenating all |AvbKernelCmdlineDescriptor| and then * performing proper substitution of the variables - * $(ANDROID_SYSTEM_PARTUUID), $(ANDROID_BOOT_PARTUUID), and - * $(ANDROID_VBMETA_PARTUUID) using the + * $(ANDROID_SYSTEM_PARTUUID) and $(ANDROID_BOOT_PARTUUID) using the * get_unique_guid_for_partition() operation in |AvbOps|. * * Additionally, the |cmdline| field will have the following kernel * command-line options set: * - * androidboot.vbmeta.device_state: set to "locked" or "unlocked" + * androidboot.avb.device_state: set to "locked" or "unlocked" * depending on the result of the result of AvbOps's * read_is_unlocked() function. * - * androidboot.vbmeta.{hash_alg, size, digest}: Will be set to - * the digest of all images in |vbmeta_images|. - * - * androidboot.vbmeta.device: This is set to the value - * PARTUUID=$(ANDROID_VBMETA_PARTUUID) before substitution so it - * will end up pointing to the vbmeta partition for the verified - * slot. If there is no vbmeta partition it will point to the boot - * partition of the verified slot. - * - * androidboot.vbmeta.avb_version: This is set to the decimal value - * of AVB_VERSION_MAJOR followed by a dot followed by the decimal - * value of AVB_VERSION_MINOR, for example "1.0" or "1.4". This - * version number represents the vbmeta file format version - * supported by libavb copy used in the boot loader. This is not - * necessarily the same version number of the on-disk metadata for - * the slot that was verified. + * androidboot.slot_suffix: If |ab_suffix| as passed into + * avb_slot_verify() is non-empty, this variable will be set to its + * value. * - * Note that androidboot.slot_suffix is not set in |cmdline| - you - * will have to pass this command-line option yourself. + * androidboot.vbmeta.{hash_alg, size, digest}: Will be set to + * the digest of the vbmeta image. * * This struct may grow in the future without it being considered an * ABI break. */ typedef struct { char* ab_suffix; - AvbVBMetaData* vbmeta_images; - size_t num_vbmeta_images; + uint8_t* vbmeta_data; + size_t vbmeta_size; AvbPartitionData* loaded_partitions; size_t num_loaded_partitions; char* cmdline; - uint64_t rollback_indexes[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS]; + uint64_t rollback_indexes[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_SLOTS]; } AvbSlotVerifyData; /* Frees a |AvbSlotVerifyData| including all data it points to. */ @@ -195,26 +157,7 @@ void avb_slot_verify_data_free(AvbSlotVerifyData* data); * If |out_data| is not NULL, it will be set to a newly allocated * |AvbSlotVerifyData| struct containing all the data needed to * actually boot the slot. This data structure should be freed with - * avb_slot_verify_data_free() when you are done with it. See below - * for when this is returned. - * - * If |allow_verification_error| is false this function will bail out - * as soon as an error is encountered and |out_data| is set only if - * AVB_SLOT_VERIFY_RESULT_OK is returned. - * - * Otherwise if |allow_verification_error| is true the function will - * continue verification efforts and |out_data| is also set if - * AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED, - * AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION, or - * AVB_SLOT_VERIFY_RESULT_ERROR_ROLLBACK_INDEX is returned. It is - * undefined which error is returned if more than one distinct error - * is encountered. It is guaranteed that AVB_SLOT_VERIFY_RESULT_OK is - * returned if, and only if, there are no errors. This mode is needed - * to boot valid but unverified slots when the device is unlocked. - * - * Also note that |out_data| is never set if - * AVB_SLOT_VERIFY_RESULT_ERROR_OOM, AVB_SLOT_VERIFY_RESULT_ERROR_IO, - * or AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA is returned. + * avb_slot_verify_data_free() when you are done with it. * * AVB_SLOT_VERIFY_RESULT_OK is returned if everything is verified * correctly and all public keys are accepted. @@ -239,15 +182,10 @@ void avb_slot_verify_data_free(AvbSlotVerifyData* data); * * AVB_SLOT_VERIFY_RESULT_ERROR_INVALID_METADATA is returned if some * of the metadata is invalid or inconsistent. - * - * AVB_SLOT_VERIFY_RESULT_ERROR_UNSUPPORTED_VERSION is returned if - * some of the metadata requires a newer version of libavb than what - * is in use. */ AvbSlotVerifyResult avb_slot_verify(AvbOps* ops, const char* const* requested_partitions, const char* ab_suffix, - bool allow_verification_error, AvbSlotVerifyData** out_data); #ifdef __cplusplus |