| /* |
| * Copyright (C) 2022 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <getopt.h> |
| #include <unistd.h> |
| |
| #include <android-base/file.h> |
| #include <android-base/logging.h> |
| #include <android-base/properties.h> |
| #include <android-base/strings.h> |
| #include <android-base/unique_fd.h> |
| #include <bootloader_message/bootloader_message.h> |
| |
| #include <functional> |
| #include <iostream> |
| |
| void AddItem(std::string* s, const char* item) { |
| if (!s->empty()) *s += ","; |
| *s += item; |
| } |
| |
| bool CheckAndUnset(uint32_t& mode, uint32_t mask) { |
| bool is_set = mode & mask; |
| mode &= ~mask; |
| return is_set; |
| } |
| |
| bool UpdateProp(const char* prop_name, const misc_memtag_message& m) { |
| uint32_t mode = m.memtag_mode; |
| std::string prop_str; |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_MEMTAG)) AddItem(&prop_str, "memtag"); |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_MEMTAG_ONCE)) AddItem(&prop_str, "memtag-once"); |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_MEMTAG_KERNEL)) AddItem(&prop_str, "memtag-kernel"); |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_MEMTAG_KERNEL_ONCE)) |
| AddItem(&prop_str, "memtag-kernel-once"); |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_MEMTAG_OFF)) AddItem(&prop_str, "memtag-off"); |
| if (CheckAndUnset(mode, MISC_MEMTAG_MODE_FORCED)) AddItem(&prop_str, "forced"); |
| if (prop_str.empty()) prop_str = "none"; |
| if (android::base::GetProperty(prop_name, "") != prop_str) |
| android::base::SetProperty(prop_name, prop_str); |
| if (mode) { |
| LOG(ERROR) << "MTE mode in misc message contained unknown bits: " << mode |
| << ". Ignoring and setting " << prop_name << " to " << prop_str; |
| } |
| return mode == 0; |
| } |
| |
| void PrintUsage(const char* progname) { |
| std::cerr |
| << "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" |
| "!!! YOU PROBABLY DO NOT NEED TO USE THIS !!!\n" |
| "!!! USE THE `arm64.memtag.bootctl` SYSTEM PROPERTY INSTEAD. !!!\n" |
| "!!! This program is an implementation detail that is used !!!\n" |
| "!!! by the system to apply MTE settings. !!!\n" |
| "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" |
| "\n" |
| << "USAGE: " << progname |
| << "\n" |
| " [-s PROPERTY_NAME]\n" |
| " [-f PROPERTY_NAME]\n" |
| " [none,][memtag,][memtag-once,][memtag-kernel,][memtag-kernel-once,][memtag-off,]\n" |
| " [default|force_on|force_off]\n" |
| " [-t PATH_TO_FAKE_MISC_PARTITION]\n" |
| |
| "OPTIONS:\n" |
| " -s PROPERTY_NAME\n" |
| " Sets the system property 'PROPERTY_NAME' to the new MTE mode (if provided), or to\n" |
| " the current value from the /misc partition.\n" |
| " -f PROPERTY_NAME\n" |
| " Used in combination with -s without a new MTE mode and sets the system property\n" |
| " 'PROPERTY_NAME' to 1 after reading the current value from the /misc partition\n" |
| " [none,][memtag,][memtag-once,][memtag-kernel,][memtag-kernel-once,][memtag-off,]\n" |
| " A set of MTE options to be applied, if provided. Multiple options may be\n" |
| " specified as a ','-delimited list, e.g. 'memtag,memtag-kernel'.\n" |
| " The options are described below:\n" |
| " - none: default settings for MTE for the product will be applied on next\n" |
| " reboot.\n" |
| " - memtag: MTE is persistently enabled in userspace upon the next reboot.\n" |
| " - memtag-once: MTE is enabled in userspace, only for the next reboot.\n" |
| " - memtag-kernel: MTE is persistently enabled in the kernel upon the next \n" |
| " reboot.\n" |
| " - memtag-kernel-once: MTE is enabled in the kernel, only for the next reboot.\n" |
| " - memtag-off: MTE is persistently disabled in both userspace and kernel upon \n" |
| " the next reboot.\n" |
| " - forced: the current state is the result of force_on or force_off in the next\n" |
| " argument. When the next argument is set back to \"default\", the\n" |
| " state will be cleared.\n" |
| " [default|force_on|force_off]\n" |
| " An alternative method of configuring the MTE options to be applied, if provided.\n" |
| " This control is generally to be used by device_config only, and it overwrites\n" |
| " the previously described settings that are expected to be utilized by the user.\n" |
| " The options are described below:\n" |
| " - default: This flag is not overwriting the MTE mode, and so the setting\n" |
| " should be inherited from the userspace controls (if present), or the\n" |
| " default value from the bootloader's ROM.\n" |
| " - force_on: MTE is persistently enabled in userspace, overwriting the userspace\n" |
| " setting.\n" |
| " - force_off: MTE is persistently disabled in userspace and the kernel, \n" |
| " overwriting the userspace setting.\n"; |
| } |
| |
| int StringToMode(const char* value) { |
| int memtag_mode = 0; |
| for (const auto& field : android::base::Split(value, ",")) { |
| if (field == "memtag") { |
| memtag_mode |= MISC_MEMTAG_MODE_MEMTAG; |
| } else if (field == "memtag-once") { |
| memtag_mode |= MISC_MEMTAG_MODE_MEMTAG_ONCE; |
| } else if (field == "memtag-kernel") { |
| memtag_mode |= MISC_MEMTAG_MODE_MEMTAG_KERNEL; |
| } else if (field == "memtag-kernel-once") { |
| memtag_mode |= MISC_MEMTAG_MODE_MEMTAG_KERNEL_ONCE; |
| } else if (field == "memtag-off") { |
| memtag_mode |= MISC_MEMTAG_MODE_MEMTAG_OFF; |
| } else if (field == "forced") { |
| memtag_mode |= MISC_MEMTAG_MODE_FORCED; |
| } else if (field != "none") { |
| LOG(ERROR) << "Unknown value for mode: " << field; |
| return -1; |
| } |
| } |
| return memtag_mode; |
| } |
| |
| // Handles the override flag and applies it to the memtag message. |
| // The logic is as follows: |
| // If the override changes the configuration (i.e., if MTE was not enabled |
| // through MODE_MEMTAG and the override is force_on, or MTE was not |
| // disabled through MEMTAG_OFF and the override is force_off), the MTE |
| // state is considered FORCED. In that case, if the override gets reset |
| // to "default" (i.e. no override), the default state of memtag config |
| // is restored. The theory for this is that disabling the override should |
| // only keep the non-default state if it has been active throughout the |
| // override, not restore it if it had been dormant for the duration of the |
| // override. |
| // |
| // State machine diagrams of the MTE state and the effect of override below: |
| // |
| // default,force_off |
| // ┌───┐ |
| // │ │ |
| // ┌──┴───▼───┐ |
| // │memtag-off│ |
| // └─────┬────┘ |
| // │ |
| // force_on │ ┌────┐ |
| // │ │ │ force_on |
| // force_off┌───────▼───┴─┐ │ |
| // ┌────────┤memtag,forced│◄─┘ |
| // │ └▲─────────┬──┘ |
| // force_off │ │ │ |
| // ┌────┐ │ force_on│ │ default |
| // │ │ │ │ │ |
| // │ ┌─┴────▼─────────┴┐ ┌▼──────┐ |
| // └─►│memtag-off,forced├───────►none │ |
| // └─────────────────┘default└───────┘ |
| // |
| // |
| // |
| // default,force_on |
| // ┌───┐ |
| // │ │ |
| // ┌──┴───▼───┐ |
| // │memtag │ |
| // └─────┬────┘ |
| // │ |
| // force_off│ ┌────┐ |
| // │ │ │ force_off |
| // force_on ┌───────┴───────┴─┐ │ |
| // ┌────────┤memtag-off,forced◄──┘ |
| // │ └▲─────────┬──────┘ |
| // force_on │ │ │ |
| // ┌────┐ │force_off│ │ default |
| // │ │ │ │ │ |
| // │ ┌─┴────▼─────────┴┐ ┌▼──────┐ |
| // └─►│memtag,forced ├───────►none │ |
| // └─────────────────┘default└───────┘ |
| // |
| // |
| // |
| // default |
| // ┌───┐ |
| // │ │ |
| // force_off ┌──┴───▼───┐ |
| // ┌─────────────┤none │ |
| // │ └─────┬────┘ |
| // │ │ |
| // │ force_on │ ┌────┐ |
| // │ │ │ │ force_on |
| // │ force_off┌───────▼───┴─┐ │ |
| // │ ┌────────┤memtag,forced│◄─┘ |
| // │ │ └▲─────────┬──┘ |
| // force_off│ │ │ │ |
| // ┌────┐ │ │ force_on│ │ default |
| // │ │ │ │ │ │ |
| // │ ┌─┴─▼──▼─────────┴┐ ┌▼──────┐ |
| // └─►│memtag-off,forced├───────►none │ |
| // └─────────────────┘default└───────┘ |
| bool HandleOverride(const std::string& override_value, misc_memtag_message* m) { |
| if (override_value == "force_off") { |
| // If the force_off override is active, only allow MEMTAG_MODE_MEMTAG_ONCE. |
| if ((m->memtag_mode & MISC_MEMTAG_MODE_MEMTAG_OFF) == 0) { |
| m->memtag_mode |= MISC_MEMTAG_MODE_FORCED; |
| } |
| m->memtag_mode |= MISC_MEMTAG_MODE_MEMTAG_OFF; |
| m->memtag_mode &= ~MISC_MEMTAG_MODE_MEMTAG; |
| } else if (override_value == "force_on") { |
| if ((m->memtag_mode & MISC_MEMTAG_MODE_MEMTAG) == 0) { |
| m->memtag_mode |= MISC_MEMTAG_MODE_FORCED; |
| } |
| m->memtag_mode |= MISC_MEMTAG_MODE_MEMTAG; |
| m->memtag_mode &= ~MISC_MEMTAG_MODE_MEMTAG_OFF; |
| } else if (override_value.empty() || override_value == "default") { |
| // The mode changed from forced_on or forced_off to default, which means we |
| // restore the normal state. |
| if (m->memtag_mode & MISC_MEMTAG_MODE_FORCED) { |
| m->memtag_mode &= ~MISC_MEMTAG_MODE_MEMTAG; |
| m->memtag_mode &= ~MISC_MEMTAG_MODE_MEMTAG_OFF; |
| m->memtag_mode &= ~MISC_MEMTAG_MODE_FORCED; |
| } |
| } else { |
| return false; |
| } |
| return true; |
| } |
| |
| int DoSetProp(const std::function<bool(misc_memtag_message*, std::string*)>& read_memtag_message, |
| const char* set_prop) { |
| // -s <property> is given on its own. This means we want to read the state |
| // of the misc partition into the property. |
| std::string err; |
| misc_memtag_message m = {}; |
| if (!read_memtag_message(&m, &err)) { |
| LOG(ERROR) << "Failed to read memtag message: " << err; |
| return 1; |
| } |
| if (m.magic != MISC_MEMTAG_MAGIC_HEADER || m.version != MISC_MEMTAG_MESSAGE_VERSION) { |
| // This should not fail by construction. |
| CHECK(UpdateProp(set_prop, {})); |
| // This is an expected case, as the partition gets initialized to all zero. |
| return 0; |
| } |
| // Unlike above, setting the system property here can fail if the misc partition |
| // was corrupted by another program (e.g. the bootloader). |
| return UpdateProp(set_prop, m) ? 0 : 1; |
| } |
| |
| int main(int argc, char** argv) { |
| const char* set_prop = nullptr; |
| const char* flag_prop = nullptr; |
| int opt; |
| std::function<bool(misc_memtag_message*, std::string*)> read_memtag_message = |
| ReadMiscMemtagMessage; |
| std::function<bool(const misc_memtag_message&, std::string*)> write_memtag_message = |
| WriteMiscMemtagMessage; |
| |
| android::base::unique_fd fake_partition_fd; |
| while ((opt = getopt(argc, argv, "s:t:f:")) != -1) { |
| switch (opt) { |
| case 's': |
| // Set property in argument to state of misc partition. If given by |
| // itself, sets the property to the current state. We do this on device |
| // boot, |
| // |
| // Otherwise, applies new state and then sets property to newly applied |
| // state. |
| set_prop = optarg; |
| break; |
| case 'f': |
| flag_prop = optarg; |
| break; |
| case 't': { |
| // Use different fake misc partition for testing. |
| const char* filename = optarg; |
| fake_partition_fd.reset(open(filename, O_RDWR | O_CLOEXEC)); |
| int raw_fd = fake_partition_fd.get(); |
| CHECK_NE(raw_fd, -1); |
| CHECK_NE(ftruncate(raw_fd, sizeof(misc_memtag_message)), -1); |
| read_memtag_message = [raw_fd](misc_memtag_message* m, std::string*) { |
| CHECK(android::base::ReadFully(raw_fd, m, sizeof(*m))); |
| return true; |
| }; |
| write_memtag_message = [raw_fd](const misc_memtag_message& m, std::string*) { |
| CHECK(android::base::WriteFully(raw_fd, &m, sizeof(m))); |
| return true; |
| }; |
| break; |
| } |
| default: |
| PrintUsage(argv[0]); |
| return 1; |
| } |
| } |
| |
| const char* value = optind < argc ? argv[optind++] : nullptr; |
| const char* override_value = optind < argc ? argv[optind++] : nullptr; |
| |
| if ((optind != argc) || // Unknown argument. |
| (value && flag_prop) || // -f is only valid when no value given |
| (!value && !set_prop)) { // value must be given if -s is not |
| PrintUsage(argv[0]); |
| return 1; |
| } |
| |
| if (!value && set_prop) { |
| int ret = DoSetProp(read_memtag_message, set_prop); |
| if (flag_prop) { |
| android::base::SetProperty(flag_prop, "1"); |
| } |
| return ret; |
| } |
| |
| CHECK(value); |
| |
| misc_memtag_message m = {.version = MISC_MEMTAG_MESSAGE_VERSION, |
| .magic = MISC_MEMTAG_MAGIC_HEADER}; |
| int memtag_mode = StringToMode(value); |
| bool valid_value = memtag_mode != -1; |
| m.memtag_mode = valid_value ? memtag_mode : 0; |
| |
| bool valid_override = true; |
| if (override_value) valid_override = HandleOverride(override_value, &m); |
| |
| if (!valid_value && !valid_override) { |
| return 1; |
| } |
| std::string err; |
| if (!write_memtag_message(m, &err)) { |
| LOG(ERROR) << "Failed to apply mode: " << value << ", override: " << override_value << err; |
| return 1; |
| } else { |
| const char* parse_error = ""; |
| const char* verb = "Applied"; |
| if (!valid_value) { |
| parse_error = " (invalid mode)"; |
| verb = "Partially applied"; |
| } else if (!valid_override) { |
| // else if because we bail out if both are false above. |
| parse_error = " (invalid override)"; |
| verb = "Partially applied"; |
| } |
| LOG(INFO) << verb << " mode: " << value << ", " |
| << "override: " << (override_value ? override_value : "") << parse_error; |
| // Because all the bits in memtag_mode were set above, this should never fail. |
| if (set_prop) CHECK(UpdateProp(set_prop, m)); |
| return !valid_value || !valid_override; |
| } |
| } |
