Why?
----
It was always my intention to write avbroot in a compiled language.
Python was a stop-gap solution since it was possible to use the various
tools and parsers from AOSP to make the initial prototyping and
implementation easier. However, doing so required a whole lot of hacks
since nearly all of the Python modules we use were intended to be used
as executables, not libraries, and they were definitely not meant to be
used outside of AOSP's code base.
Although the dependencies on AOSP code have been reduced over time,
working on the Python code is still frustrating. The majority of the
modules we use from both the standard library and external dependencies
are lacking type annotations. All of the Python language servers and
type checker tools I've used choked on them. There have been serveral
avbroot bugs in the past that wouldn't have happened with any
statically typed language.
The catalyst for me working on this recently was dealing with some
python-protobuf versions that wouldn't work with AOSP's pregenerated
protobuf bindings. When parsing protobuf messages, it would fail
with obscure runtime type errors. I need my projects to not feel
frustrating or else I'll just get burnt out.
Hence, the Rust rewrite. With fewer hacks this time! avbroot no longer
has any dependencies on external tools like openssl. I'll be providing
precompiled binaries for the three major desktop OS's, built by GitHub
Actions. avbroot will also be versioned now, starting at 2.0.0.
Whats new?
----------
* A new `avbroot ota verify` subcommand has been added to check that all
OTA and AVB related components have been properly hashed and signed.
This works for all OTA images, including stock ones.
* A couple new `avbroot avb` subcommands have been added for dumping
vbmeta header/footer information and verifying AVB signatures. These
are roughly equivalent to avbtool's `info_image` and `verify_image`
subcommands, though avbroot is about an order of magnitude faster than
the latter.
* A new set of `avbroot boot` subcommands have been added for packing
and unpacking boot images. It supports Android v0-v4 images and vendor
v3-v4 images. Repacking is lossless even when using deprecated fields,
like the boot image v4 VTS signature.
* A new `avbroot ramdisk` subcommand has been added for inspecting
the CPIO structure of ramdisks.
* A new set of `avbroot key` subcommands have been added for generating
signing keys so that it's no longer necessary to install openssl and
avbtool (though of course, keys generated by other tools remain fully
compatible).
* Since avbroot has a ton of CLI options, a new `avbroot completion`
subcommand has been added for generating tab-completion configs for
various shells (eg. bash, zsh, fish, powershell).
What was removed?
-----------------
Nothing :) The `patch` and `extract` subcommands have been moved under
`avbroot ota` and the `magisk-info` subcommand has been moved under
`avbroot boot`, but there are compatibility shims in place to keep all
the old commands working.
The command-line interface will remain backwards compatible for as long
as possible, even with new major releases. The Rust API, however, has no
backwards compatibility guarantees. I currently don't intend for
avbroot's "library" components to be used anywhere outside of Custota
and avbroot itself.
Performance
-----------
Due to having better access to low-level APIs (especially `pread` and
`pwrite`), nearly everything that can be multithreaded in avbroot is now
multithreaded. In addition, during the patching operation, everything
is done entirely in memory without temp files and the maximum memory
usage is still about 100MB lower than with the Python implementation.
The new implementation is bottlenecked by how fast a single CPU core can
calculate 3 SHA256 hashes of overlapping regions spanning the majority
of the OTA file. About 90% of the CPU time is spent calculating SHA256
hashes and another 5% or so performing XZ-compression.
Some numbers:
* Patching should take roughly 40%-70% of the time it took before.
* Extracting with `--all` should take roughly 10%-30% of the time it
took before.
Folks with x86_64 CPUs supporting SHA-NI extensions (eg. Intel 11th gen
and newer) should see even bigger improvements.
Reproducibility
---------------
The new implementation's output files are bit-for-bit identical when the
inputs are the same. However, they do not exactly match what the Python
implementation produced.
* The zip entries, aside from `metadata` and `metadata.pb`, are written
in sorted order.
* All zip entries are stored without compression.
* All zip entries are stored without additional metadata (eg.
modification timestamp).
* The OTA certificate, both in the OTA zip and in the recovery ramdisk's
`otacerts.zip`, goes through deserialization + serialization before
being written. Text in the certificate file before the header and
after the footer will be stripped out.
* The protobuf structures (payload header and OTA metadata) are
serialized differently. Protobuf has more than one way to encode the
same messages "on the wire". The Rust quick_protobuf library
serializes messages a bit differently than python-protobuf, but the
outputs are mutually compatible.
* XZ compression of modified partition images in the payload is now done
at compression level 0 instead of 6. This reduces the patching time by
several seconds at the cost of a couple MiB increase in file size.
* Ramdisks are now compressed with standard LZ4 instead of LZ4HC (high
compression mode). For our use case, the difference is <100 KiB, but
using standard LZ4 allows us to use a pure-Rust LZ4 library and makes
the compression step much faster.
* Older ramdisks compressed with gzip are slightly different due to a
different gzip implementation being used (flate2 vs. zlib). The two
implementations structure the gzip frames slightly differently, but
the output is identical when decompressed.
* Magisk's config file in the ramdisk (`.backup/.magisk`) will have the
`SHA1` field set to all zeros. This allows avbroot to keep track of
less information during patching for better performance. The field is
only used for Magisk's uninstall feature, which can't ever be used in
a locked bootloader setup anyway.
Misc
----
While working on the new `avbroot ota verify` subcommand, I found that
the `ossi` stock image (OnePlus 10 Pro) used in avbroot's tests has an
invalid vbmeta hash for the `odm` partition. I thought it was an avbroot
bug, but AOSP's avbtool reports the same invalid hash too. If that image
actually boots, then I'm not sure AVB can be trusted on those devices...
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit adds support for replacing any partition image within
the payload with a custom image. This is useful, for example, to add a
custom kernel to an OTA, which may involve partitions that wouldn't
normally be touched (eg. `vendor_dlkm`).
Any image specified via `--replace` will have its corresponding
descriptor in the vbmeta image updated. This is handled recursively. For
example, replacing `vendor_dlkm` would update both `vbmeta_vendor` and
`vbmeta`. This requires all vbmeta images to be extracted during the
patching process so that a complete dependency graph can be computed.
The performance hit in doing so is negligible, but does require the
checksums of the stripped images to be updated for the tests.
Fixes: #102
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are 3 levels of warnings:
* Level 0: Warnings that don't affect booting
* Mismatched `id` or `os_version` fields
* Level 1: Warnings that may affect booting
* Mismatched `cmdline` or `extra_cmdline` fields
* Unexpected addition of `kernel`, `second`, `recovery_dtbo`, `dtb`,
or `bootconfig`
* Level 2: Warnings that are very likely to affect booting
* All other mismatched, added, or removed fields
By default, any warning of level 1 or higher is treated as a fatal
error. Each time `--ignore-prepatched-compat` is passed in, the
permitted warning level is increased.
Fixes: #108
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The module helps reduce the chance of OEM unlocking being disabled,
whether by the user or by some OS's initial setup wizard. It works by
running some Java code at boot, which connects to the `OemLockService`
binder service and calls `setOemUnlockAllowedByUser(true)`, the same as
what the Settings app does.
Fixes: #8
Issue: #84
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Unlike the prior RULESDEVICE, PREINITDEVICE uses a block device name
since the rdev major/minor is not guaranteed to remain the same across
reboots. This commit completely drops support for RULESDEVICE (25207
through 25210) since it never made it to a stable Magisk release.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Newer Magisk versions no longer try to autodetect a writable ext4
partition for storing SELinux rules during boot. Instead, the block
device is detected during boot image patching and is stored in the
ramdisk's `.backup/.magisk` as `makedev(rdev_maj, rdev_min)`.
This unfortunately complicates the patching process for avbroot. Even if
we replicate Magisk's algorithm for finding a suitable partition,
there's no way to find the block device's rdev for it with the
information contained in the OTA package. This is the first change that
adds a hard dependency on information only attainable from a running
device.
For these newer Magisk versions, the user will have to patch the boot
image once in the Magisk app (must be on the target device) and then run
`avbroot magisk-info` to show the computed device ID. Then, avbroot can
use this during patching via `--magisk-rules-device`. If the user's
device is unable to run the Magisk app prior to patching (eg.
unbootable), they'll have to go through the patching process twice, once
with `--ignore-magisk-warnings` and a second time with the proper device
ID specified.
When using `--ignore-magisk-warnings`, root still works, but there will
be subtle issues, like certain modules failing to load.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Some Android builds ship with a root vbmeta image with flags that
disable AVB completely. This commit adds a new check for these flags so
that the patching process will fail and also adds a new
`--clear-vbmeta-flags` option for forcibly setting the flags to 0.
Issue: #60
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is useful for folks who want to apply the Magisk root patch
themselves via the Magisk app or use KernelSU. When `--prepatched` is
used, avbroot will skip the root patch, but still apply the otacerts
patch.
To help protect against accidental use of the wrong boot image, avbroot
will only accept a prepatched image if all the header fields and section
types match the original image. The only exception is the number of
ramdisks, which is allowed to increase (Magisk may create a ramdisk in
an image that didn't originally have one).
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
openssl does not support reading the passphrase from file descriptors on
Windows. Using an environment variable is the next best option.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit reimplements the magiskboot patching process natively in
Python. By doing so, avbroot gains cross platform support and there's no
longer a need to execute an Android binary on a non-Android Linux system,
which had pitfalls that already had to be worked around.
Boot images and cpio archives are handled by new custom parsers added to
avbroot. Legacy lz4 compression is done by a wrapper around the python
lz4 library (a new dependency). Gzip compression is handled natively by
python. Other compression methods and OEM-specific boot image formats
are not supported because devices that use the modern Android A/B OTA
scheme do not use those.
Output files are still bit-for-bit reproducible across runs, but they
are different from what prior avbroot commits produced:
* avbroot's cpio writer follows GNU cpio and libarchive's behavior of
setting the mode field to 0 in the trailer entry. magiskboot sets the
mode to 0o755.
* When patching a vendor boot v4 image, the ramdisk table entries are
now updated correctly. Prior vendor boot images were only bootable
because:
* the image only contained a single ramdisk
* the single ramdisk shrunk in size, stayed the same, or grew little
enough to not exceed a page boundary
* the bootloader is lenient in validating boot image fields
magiskboot does not handle vendor boot v4 images correctly, but it
doesn't need to just for the regular root patch. avbroot made use of
it in an unsupported way to patch vendor boot ramdisks.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Clarify boot image partitions. It is no longer the case that only
`boot` and `vendor_boot` are patched.
* Describe how to check if an OTA file is A/B.
* Remove mentions of signapk now that avbroot signs zips itself.
* Minor grammar changes.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
With this commit, avbroot now performs the entire OTA signing process
itself. This removes the 4 full .zip builds needed for signing before,
which means that avbroot can now do the full patching process in a
single pass.
Since signapk is no longer needed, the java dependency has been dropped.
This also means that avbroot no longer depends on glibc-based Linux
distros, which was the case before due to signapk's conscrypt
dependency.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Apply OTA certificate patch to the boot image if no `vendor_boot`
image exists.
* Only manually decompress ramdisk cpio archives if the boot image
header version is 4. `magiskboot` automatically decompresses older
header versions.
Fixes: #5
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
This is more secure and reliable compared to forcibly enabling fastbootd
in recovery. All of the normal AVB and OTA update flows are preserved,
except with the user's custom keys.
Signed-off-by: Andrew Gunnerson <chillermillerlong@hotmail.com>
Andrew Gunnerson