tree 1ee547ee6e23db5810a0d98cfd72a55aca2ad0d3
parent 1dcd257a21b5212bcbbc1f6468b903fef8d29231
author Bowgo Tsai <bowgotsai@google.com> 1493982685 +0800
committer Bowgo Tsai <bowgotsai@google.com> 1493995000 +0800

fs_mgr_avb: allow verification error when the device is unlocked

Current AVB flow in fs_mgr doesn't allow verification error even if the
device is unlocked. This makes first stage mount fail when the device
is flashed with a different-sized boot.img because there is verification
error (HASH_MISMATCH) for the boot partition.

Fix this by allowing verification error only when the device is
unlocked. Whether to enable dm-verity for HASHTREE partitions is still
controlled by the HASHTREE_DISABLED flag in the top-level vbmeta.

Bug: 37985430
Test: First stage mount /vendor with AVB on a device.
      Check dm-verity is enabled on /vendor.
Test: Unlock device, flash a different-sized boot.img. Boot device and check
      dm-verity is still enabled on /vendor.
Test: First stage mount /vendor with AVB on a device with HASHTREE_DISABLED
      is set on the top-level vbmeta, check dm-verity is not enable on /vendor.

Change-Id: I709431bc1c37e4f86133d171cee8e90621cdb857