[PATCH v2 2/2] bootstd: android: Allow boot with AVB failures when unlocked

[Julien Masson]

On Thu 23 Jan 2025 at 14:40, Mattijs Korpershoek <mkorpershoek at baylibre.com> wrote:

> When the bootloader is UNLOCKED, it should be possible to boot Android
> even if AVB reports verification errors [1].
> 
> This allows developers to flash modified partitions on
> userdebug/engineering builds.
> 
> Developers can do so on unlocked devices with:
> $ fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img
> 
> In such case, bootmeth_android refuses to boot.
> 
> Allow the boot to continue when the device is UNLOCKED and AVB reports
> verification errors.
> 
> [1] https://source.android.com/docs/security/features/verifiedboot/boot-flow#unlocked-devices
> Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android")
> Signed-off-by: Mattijs Korpershoek <mkorpershoek at baylibre.com>
> ---
>  boot/bootmeth_android.c | 37 ++++++++++++++++++++++++-------------
>  1 file changed, 24 insertions(+), 13 deletions(-)
> 
> diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
> index 2cd167f80280801618a317a65e93a10e70a0d9ee..dc9aad1633bb7a6d577013bfa0f939343f2e066b 100644
> --- a/boot/bootmeth_android.c
> +++ b/boot/bootmeth_android.c
> @@ -407,17 +407,26 @@ static int run_avb_verification(struct bootflow *bflow)
>  				 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE,
>  				 &out_data);
>  
> -	if (result != AVB_SLOT_VERIFY_RESULT_OK) {
> -		printf("Verification failed, reason: %s\n",
> -		       str_avb_slot_error(result));
> -		avb_slot_verify_data_free(out_data);
> -		return log_msg_ret("avb verify", -EIO);
> -	}
> -
> -	if (unlocked)
> -		boot_state = AVB_ORANGE;
> -	else
> +	if (!unlocked) {
> +		/* When device is locked, we only accept AVB_SLOT_VERIFY_RESULT_OK */
> +		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
> +			printf("Verification failed, reason: %s\n",
> +			       str_avb_slot_error(result));
> +			avb_slot_verify_data_free(out_data);
> +			return log_msg_ret("avb verify", -EIO);
> +		}
>  		boot_state = AVB_GREEN;
> +	} else {
> +		/* When device is unlocked, we also accept verification errors */
> +		if (result != AVB_SLOT_VERIFY_RESULT_OK &&
> +		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
> +			printf("Unlocked verification failed, reason: %s\n",
> +			       str_avb_slot_error(result));
> +			avb_slot_verify_data_free(out_data);
> +			return log_msg_ret("avb verify unlocked", -EIO);
> +		}
> +		boot_state = AVB_ORANGE;
> +	}
>  
>  	extra_args = avb_set_state(avb_ops, boot_state);
>  	if (extra_args) {
> @@ -427,9 +436,11 @@ static int run_avb_verification(struct bootflow *bflow)
>  			goto free_out_data;
>  	}
>  
> -	ret = avb_append_commandline(bflow, out_data->cmdline);
> -	if (ret < 0)
> -		goto free_out_data;
> +	if (result == AVB_SLOT_VERIFY_RESULT_OK) {
> +		ret = avb_append_commandline(bflow, out_data->cmdline);
> +		if (ret < 0)
> +			goto free_out_data;
> +	}
>  
>  	return 0;
>  
> 
> -- 
> 2.47.1
> 

Reviewed-by: Julien Masson <jmasson at baylibre.com>