From 48318f333a1fee20ee4cfe57f1839e9c294429a1 Mon Sep 17 00:00:00 2001 From: Andrew Gunnerson Date: Wed, 28 Jun 2023 19:28:17 -0400 Subject: [PATCH] Add support for ignoring boot image checks for --prepatched There are 3 levels of warnings: * Level 0: Warnings that don't affect booting * Mismatched `id` or `os_version` fields * Level 1: Warnings that may affect booting * Mismatched `cmdline` or `extra_cmdline` fields * Unexpected addition of `kernel`, `second`, `recovery_dtbo`, `dtb`, or `bootconfig` * Level 2: Warnings that are very likely to affect booting * All other mismatched, added, or removed fields By default, any warning of level 1 or higher is treated as a fatal error. Each time `--ignore-prepatched-compat` is passed in, the permitted warning level is increased. Fixes: #108 Signed-off-by: Andrew Gunnerson --- README.md | 2 +- avbroot/boot.py | 53 +++++++++++++++++++++++++++++++++++++------------ avbroot/main.py | 30 ++++++++++++++++++++-------- 3 files changed, 63 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index 65d5e89..6a4e120 100644 --- a/README.md +++ b/README.md @@ -260,7 +260,7 @@ avbroot can replace the boot image with a prepatched image instead of applying t For KernelSU, also pass in `--boot-partition @gki_kernel` for both the `patch` and `extract` commands. avbroot defaults to Magisk's semantics where the boot image containing the GKI ramdisk is needed, whereas KernelSU requires the boot image containing the GKI kernel. This only affects devices launching with Android 13, where the GKI kernel and ramdisk are in different partitions (`boot` vs. `init_boot`), but it is safe and recommended to always use this option for KernelSU. -Note that avbroot will validate that the prepatched image is compatible with the original. If, for example, the header fields do not match or a boot image section is missing, then the patching process will abort. This check is not foolproof, but should help protect against accidental use of the wrong boot image. +Note that avbroot will validate that the prepatched image is compatible with the original. If, for example, the header fields do not match or a boot image section is missing, then the patching process will abort. The checks are not foolproof, but should help protect against accidental use of the wrong boot image. To bypass a somewhat "safe" subset of the checks, use `--ignore-prepatched-compat`. To ignore all checks (strongly discouraged!), pass it in twice. ### Skipping root patches diff --git a/avbroot/boot.py b/avbroot/boot.py index 8e17ca7..d4e9caf 100644 --- a/avbroot/boot.py +++ b/avbroot/boot.py @@ -292,11 +292,16 @@ class PrepatchedImage(BootImagePatch): be higher than the original image. ''' + MIN_LEVEL = 0 + MAX_LEVEL = 2 + VERSION_REGEX = re.compile( b'Linux version (\d+\.\d+).\d+-(android\d+)-(\d+)-') - def __init__(self, prepatched): + def __init__(self, prepatched, fatal_level, warning_fn): self.prepatched = prepatched + self.fatal_level = fatal_level + self.warning_fn = warning_fn def patch(self, image_file, boot_image): with open(self.prepatched, 'r+b') as f: @@ -305,40 +310,62 @@ def patch(self, image_file, boot_image): old_header = boot_image.to_dict() new_header = prepatched_image.to_dict() - errors = [] + # Level 0: Warnings that don't affect booting + # Level 1: Warnings that may affect booting + # Level 2: Warnings that are very likely to affect booting + issues = [[], [], []] for k in new_header.keys() - old_header.keys(): - errors.append(f'{k} header field was added') + issues[2].append(f'{k} header field was added') for k in old_header.keys() - new_header.keys(): - errors.append(f'{k} header field was removed') + issues[2].append(f'{k} header field was removed') for k in old_header.keys() & new_header.keys(): if old_header[k] != new_header[k]: - errors.append(f'{k} header field was changed: ' - f'{old_header[k]} -> {new_header[k]}') + if k in ('id', 'os_version'): + level = 0 + elif k in ('cmdline', 'extra_cmdline'): + level = 1 + else: + level = 2 + + issues[level].append(f'{k} header field was changed: ' + f'{old_header[k]} -> {new_header[k]}') for attr in 'kernel', 'second', 'recovery_dtbo', 'dtb', 'bootconfig': original_val = getattr(boot_image, attr) prepatched_val = getattr(prepatched_image, attr) if original_val is None and prepatched_val is not None: - errors.append(f'{attr} section was added') + issues[1].append(f'{attr} section was added') elif original_val is not None and prepatched_val is None: - errors.append(f'{attr} section was removed') + issues[2].append(f'{attr} section was removed') if len(prepatched_image.ramdisks) < len(boot_image.ramdisks): - errors.append('Number of ramdisk sections decreased: ' - f'{len(boot_image.ramdisks)} -> ' - f'{len(prepatched_image.ramdisks)}') + issues[2].append('Number of ramdisk sections decreased: ' + f'{len(boot_image.ramdisks)} -> ' + f'{len(prepatched_image.ramdisks)}') if boot_image.kernel is not None: old_kmi = self._get_kmi_version(boot_image) new_kmi = self._get_kmi_version(prepatched_image) if old_kmi != new_kmi: - errors.append('Kernel module interface version changed: ' - f'{old_kmi} -> {new_kmi}') + issues[2].append('Kernel module interface version changed: ' + f'{old_kmi} -> {new_kmi}') + + warnings = [e for i in range(self.MIN_LEVEL, + min(self.MAX_LEVEL + 1, self.fatal_level)) + for e in issues[i]] + errors = [e for i in range(max(self.MIN_LEVEL, self.fatal_level), + self.MAX_LEVEL + 1) + for e in issues[i]] + + if warnings: + self.warning_fn('The prepatched boot image may not be compatible ' + 'with the original:\n' + + '\n'.join(f'- {w}' for w in warnings)) if errors: raise ValueError('The prepatched boot image is not compatible ' diff --git a/avbroot/main.py b/avbroot/main.py index 0de47b0..67fa82d 100644 --- a/avbroot/main.py +++ b/avbroot/main.py @@ -355,7 +355,11 @@ def patch_subcommand(args): else: raise e else: - root_patch = boot.PrepatchedImage(args.prepatched) + root_patch = boot.PrepatchedImage( + args.prepatched, + args.ignore_prepatched_compat + 1, + print_warning, + ) # Get passphrases for keys passphrase_avb = openssl.prompt_passphrase( @@ -542,6 +546,12 @@ def parse_args(argv=None): action='store_true', help='Ignore Magisk compatibility/version warnings', ) + patch.add_argument( + '--ignore-prepatched-compat', + default=0, + action='count', + help='Ignore compatibility issues with prepatched boot images', + ) patch.add_argument( '--clear-vbmeta-flags', @@ -595,13 +605,17 @@ def parse_args(argv=None): args = parser.parse_args(args=argv) - if args.subcommand == 'patch' and args.magisk is None: - if args.magisk_preinit_device: - parser.error('--magisk-preinit-device requires --magisk') - elif args.magisk_random_seed: - parser.error('--magisk-random-seed requires --magisk') - elif args.ignore_magisk_warnings: - parser.error('--ignore-magisk-warnings requires --magisk') + if args.subcommand == 'patch': + if args.magisk is None: + if args.magisk_preinit_device: + parser.error('--magisk-preinit-device requires --magisk') + elif args.magisk_random_seed: + parser.error('--magisk-random-seed requires --magisk') + elif args.ignore_magisk_warnings: + parser.error('--ignore-magisk-warnings requires --magisk') + elif args.prepatched is None: + if args.ignore_prepatched_compat: + parser.error('--ignore-prepatched-compat requires --prepatched') return args