commit 00e5d8f98aaffbc3e277d18bc3e08ab0508f9c0a
author Sandeep Patil <sspatil@google.com> Wed Jun 21 12:58:31 2017 -0700
committer Tom Cherry <tomcherry@google.com> Wed Jun 21 17:01:48 2017 -0700
tree 3d1e03500526a4ba1c40cfcead0c1de7197353cf
parent 6020f10a6b6e8e3fb9493784fcf8fb22407bc928

fs_mgr: differentiate if fs_mgr_set_verity() was skipped or disabled

In case of non-secure builds (eng variant) fs_mgr_setup_verity() skips
verity checks regardless of fstab options. This is slightly different
than 'adb disable-verity' where it would first read the verity metadata
to check if verity is disabled.

So, this change adds a new return value of FS_MGR_SETUP_VERITY_SKIPPED
instead of piggy backing on the FS_MGR_SETUP_VERITY_DISABLED.

Bug: 62864413
Test: Boot sailfish

Merged-In: I42bf2bdce0ecb18b4c3b568e2bc96bf1590dfb35
Change-Id: I42bf2bdce0ecb18b4c3b568e2bc96bf1590dfb35
Signed-off-by: Sandeep Patil <sspatil@google.com>
(cherry picked from commit 95366e97ddff7fcfc095481f69bbd7f699715c99)

fs_mgr/fs_mgr.cpp

diff --git a/fs_mgr/fs_mgr.cpp b/fs_mgr/fs_mgr.cpp
index d0332bc..255d70c 100644
--- a/fs_mgr/fs_mgr.cpp
+++ b/fs_mgr/fs_mgr.cpp
@@ -859,7 +859,9 @@
             }
         } else if ((fstab->recs[i].fs_mgr_flags & MF_VERIFY) && is_device_secure()) {
             int rc = fs_mgr_setup_verity(&fstab->recs[i], true);
-            if (__android_log_is_debuggable() && rc == FS_MGR_SETUP_VERITY_DISABLED) {
+            if (__android_log_is_debuggable() &&
+                    (rc == FS_MGR_SETUP_VERITY_DISABLED ||
+                     rc == FS_MGR_SETUP_VERITY_SKIPPED)) {
                 LINFO << "Verity disabled";
             } else if (rc != FS_MGR_SETUP_VERITY_SUCCESS) {
                 LERROR << "Could not set up verified partition, skipping!";
@@ -1077,7 +1079,9 @@
             }
         } else if ((fstab->recs[i].fs_mgr_flags & MF_VERIFY) && is_device_secure()) {
             int rc = fs_mgr_setup_verity(&fstab->recs[i], true);
-            if (__android_log_is_debuggable() && rc == FS_MGR_SETUP_VERITY_DISABLED) {
+            if (__android_log_is_debuggable() &&
+                    (rc == FS_MGR_SETUP_VERITY_DISABLED ||
+                     rc == FS_MGR_SETUP_VERITY_SKIPPED)) {
                 LINFO << "Verity disabled";
             } else if (rc != FS_MGR_SETUP_VERITY_SUCCESS) {
                 LERROR << "Could not set up verified partition, skipping!";

fs_mgr/fs_mgr_verity.cpp

diff --git a/fs_mgr/fs_mgr_verity.cpp b/fs_mgr/fs_mgr_verity.cpp
index 5fa10bc..8904995 100644
--- a/fs_mgr/fs_mgr_verity.cpp
+++ b/fs_mgr/fs_mgr_verity.cpp
@@ -738,7 +738,7 @@
     // setup is needed at all.
     if (!is_device_secure()) {
         LINFO << "Verity setup skipped for " << mount_point;
-        return FS_MGR_SETUP_VERITY_SUCCESS;
+        return FS_MGR_SETUP_VERITY_SKIPPED;
     }
 
     if (fec_open(&f, fstab->blk_device, O_RDONLY, FEC_VERITY_DISABLE,

fs_mgr/include/fs_mgr.h

diff --git a/fs_mgr/include/fs_mgr.h b/fs_mgr/include/fs_mgr.h
index 02a22db..e033d47 100644
--- a/fs_mgr/include/fs_mgr.h
+++ b/fs_mgr/include/fs_mgr.h
@@ -146,6 +146,7 @@
 
 int fs_mgr_do_format(struct fstab_rec *fstab, bool reserve_footer);
 
+#define FS_MGR_SETUP_VERITY_SKIPPED  (-3)
 #define FS_MGR_SETUP_VERITY_DISABLED (-2)
 #define FS_MGR_SETUP_VERITY_FAIL (-1)
 #define FS_MGR_SETUP_VERITY_SUCCESS 0

init/init_first_stage.cpp

diff --git a/init/init_first_stage.cpp b/init/init_first_stage.cpp
index 0f2b1f3..dbd6e05 100644
--- a/init/init_first_stage.cpp
+++ b/init/init_first_stage.cpp
@@ -286,13 +286,17 @@
 bool FirstStageMountVBootV1::SetUpDmVerity(fstab_rec* fstab_rec) {
     if (fs_mgr_is_verified(fstab_rec)) {
         int ret = fs_mgr_setup_verity(fstab_rec, false /* wait_for_verity_dev */);
-        if (ret == FS_MGR_SETUP_VERITY_DISABLED) {
-            LOG(INFO) << "Verity disabled for '" << fstab_rec->mount_point << "'";
-        } else if (ret == FS_MGR_SETUP_VERITY_SUCCESS) {
+        switch (ret) {
+        case FS_MGR_SETUP_VERITY_SKIPPED:
+        case FS_MGR_SETUP_VERITY_DISABLED:
+            LOG(INFO) << "Verity disabled/skipped for '" << fstab_rec->mount_point << "'";
+            break;
+        case FS_MGR_SETUP_VERITY_SUCCESS:
             // The exact block device name (fstab_rec->blk_device) is changed to "/dev/block/dm-XX".
             // Needs to create it because ueventd isn't started in init first stage.
             InitVerityDevice(fstab_rec->blk_device);
-        } else {
+            break;
+        default:
             return false;
         }
     }