Full-stack integrity: check vdex contents.

For priv-apps, if a vdex on /data has dex code, it must
be because the APK has compressed dex code.

Fall back to APK if not.

For test convenience, update --copy-dex-files to also
take a "always" variant.

bug: 30972906
Test: 677-fsi

Change-Id: I49f0eab46650145316a86de2971a3b9c140bcff7

1 files changed, 14 insertions, 1 deletions

diff --git a/runtime/oat_file_assistant.cc b/runtime/oat_file_assistant.cc
index 0170073e29..6bf05b77a8 100644
--- a/runtime/oat_file_assistant.cc
+++ b/runtime/oat_file_assistant.cc
@@ -515,6 +515,18 @@ OatFileAssistant::OatStatus OatFileAssistant::GivenOatFileStatus(const OatFile&
     VLOG(oat) << "Image checksum test skipped for compiler filter " << current_compiler_filter;
   }
 
+  // zip_file_only_contains_uncompressed_dex_ is only set during fetching the dex checksums.
+  DCHECK(required_dex_checksums_attempted_);
+  if (only_load_system_executable_ &&
+      !LocationIsOnSystem(file.GetLocation().c_str()) &&
+      file.ContainsDexCode() &&
+      zip_file_only_contains_uncompressed_dex_) {
+    LOG(ERROR) << "Not loading "
+               << dex_location_
+               << ": oat file has dex code, but APK has uncompressed dex code";
+    return kOatDexOutOfDate;
+  }
+
   if (CompilerFilter::IsAotCompilationEnabled(current_compiler_filter)) {
     if (!file.IsPic()) {
       const ImageInfo* image_info = GetImageInfo();
@@ -879,7 +891,8 @@ const std::vector<uint32_t>* OatFileAssistant::GetRequiredDexChecksums() {
     if (dex_file_loader.GetMultiDexChecksums(dex_location_.c_str(),
                                              &cached_required_dex_checksums_,
                                              &error_msg,
-                                             zip_fd_)) {
+                                             zip_fd_,
+                                             &zip_file_only_contains_uncompressed_dex_)) {
       required_dex_checksums_found_ = true;
       has_original_dex_files_ = true;
     } else {