Gitiles
Code Review Sign In
review.blissroms.org / treble_patches / a76b726775ebda9724ee0788ddf6d60a7044901f / . / patches / system / vold / 0008-Revert-vold-Add-Hardware-FDE-feature.patch
blob: 7c33769f65f33108ffaf6d859bc74a7706cf48a7 [file] [log] [blame]
Jackeagle1cba4132018-12-19 17:08:24 +0100[diff] [blame]1From fb99aa2057ddf1c6477777bc02aa4c0d54513a0c Mon Sep 17 00:00:00 2001
2From: Jackeagle <jackeagle102@gmail.com>
3Date: Wed, 19 Dec 2018 17:02:25 +0100
4Subject: [PATCH 8/8] Revert "vold: Add Hardware FDE feature"
5
6This reverts commit 3585008ea98f4a1caf69d10c32a02e1169eeb248.
7---
8 Android.bp | 8 -
9 VoldNativeService.cpp | 4 +-
10 VoldNativeService.h | 2 +-
11 binder/android/os/IVold.aidl | 2 +-
12 cryptfs.cpp | 637 +++--------------------------------
13 cryptfs.h | 10 +-
14 6 files changed, 49 insertions(+), 614 deletions(-)
15
16diff --git a/Android.bp b/Android.bp
17index ffb139e..48dfaaf 100644
18--- a/Android.bp
19+++ b/Android.bp
20@@ -140,11 +140,6 @@ cc_library_static {
21 "libarcobbvolume",
22 ],
23 },
24- device_support_hwfde: {
25- cflags: ["-DCONFIG_HW_DISK_ENCRYPTION"],
26- header_libs: ["libcryptfs_hw_headers"],
27- shared_libs: ["libcryptfs_hw"],
28- },
29 },
30 }
31
32@@ -164,9 +159,6 @@ cc_binary {
33 "libarcobbvolume",
34 ],
35 },
36- device_support_hwfde: {
37- shared_libs: ["libcryptfs_hw"],
38- },
39 },
40 init_rc: [
41 "vold.rc",
42diff --git a/VoldNativeService.cpp b/VoldNativeService.cpp
43index 6d6c6ec..81523c6 100644
44--- a/VoldNativeService.cpp
45+++ b/VoldNativeService.cpp
46@@ -581,11 +581,11 @@ binder::Status VoldNativeService::fdeEnable(int32_t passwordType,
47 }
48
49 binder::Status VoldNativeService::fdeChangePassword(int32_t passwordType,
50- const std::string& currentPassword, const std::string& password) {
51+ const std::string& password) {
52 ENFORCE_UID(AID_SYSTEM);
53 ACQUIRE_CRYPT_LOCK;
54
55- return translate(cryptfs_changepw(passwordType, currentPassword.c_str(), password.c_str()));
56+ return translate(cryptfs_changepw(passwordType, password.c_str()));
57 }
58
59 binder::Status VoldNativeService::fdeVerifyPassword(const std::string& password) {
60diff --git a/VoldNativeService.h b/VoldNativeService.h
61index da8c660..2e90101 100644
62--- a/VoldNativeService.h
63+++ b/VoldNativeService.h
64@@ -82,7 +82,7 @@ public:
65 binder::Status fdeEnable(int32_t passwordType,
66 const std::string& password, int32_t encryptionFlags);
67 binder::Status fdeChangePassword(int32_t passwordType,
68- const std::string& currentPassword, const std::string& password);
69+ const std::string& password);
70 binder::Status fdeVerifyPassword(const std::string& password);
71 binder::Status fdeGetField(const std::string& key, std::string* _aidl_return);
72 binder::Status fdeSetField(const std::string& key, const std::string& value);
73diff --git a/binder/android/os/IVold.aidl b/binder/android/os/IVold.aidl
74index 9f5b21a..f386889 100644
75--- a/binder/android/os/IVold.aidl
76+++ b/binder/android/os/IVold.aidl
77@@ -65,7 +65,7 @@ interface IVold {
78 void fdeRestart();
79 int fdeComplete();
80 void fdeEnable(int passwordType, @utf8InCpp String password, int encryptionFlags);
81- void fdeChangePassword(int passwordType, @utf8InCpp String currentPassword, @utf8InCpp String password);
82+ void fdeChangePassword(int passwordType, @utf8InCpp String password);
83 void fdeVerifyPassword(@utf8InCpp String password);
84 @utf8InCpp String fdeGetField(@utf8InCpp String key);
85 void fdeSetField(@utf8InCpp String key, @utf8InCpp String value);
86diff --git a/cryptfs.cpp b/cryptfs.cpp
87index 3452fe3..5a061bb 100644
88--- a/cryptfs.cpp
89+++ b/cryptfs.cpp
90@@ -63,9 +63,6 @@
91 #include "Keymaster.h"
92 #include "android-base/properties.h"
93 #include <bootloader_message/bootloader_message.h>
94-#ifdef CONFIG_HW_DISK_ENCRYPTION
95-#include <cryptfs_hw.h>
96-#endif
97 extern "C" {
98 #include <crypto_scrypt.h>
99 }
100@@ -87,7 +84,6 @@ static_assert(INTERMEDIATE_BUF_SIZE == SCRYPT_LEN,
101
102 #define KEY_IN_FOOTER "footer"
103
104-#define DEFAULT_HEX_PASSWORD "64656661756c745f70617373776f7264"
105 #define DEFAULT_PASSWORD "default_password"
106
107 #define CRYPTO_BLOCK_DEVICE "userdata"
108@@ -103,7 +99,6 @@ static_assert(INTERMEDIATE_BUF_SIZE == SCRYPT_LEN,
109 #define RSA_KEY_SIZE_BYTES (RSA_KEY_SIZE / 8)
110 #define RSA_EXPONENT 0x10001
111 #define KEYMASTER_CRYPTFS_RATE_LIMIT 1 // Maximum one try per second
112-#define KEY_LEN_BYTES 16
113
114 #define RETRY_MOUNT_ATTEMPTS 10
115 #define RETRY_MOUNT_DELAY_SECONDS 1
116@@ -117,151 +112,6 @@ static char *saved_mount_point;
117 static int master_key_saved = 0;
118 static struct crypt_persist_data *persist_data = NULL;
119
120-static int previous_type;
121-
122-#ifdef CONFIG_HW_DISK_ENCRYPTION
123-static int scrypt_keymaster(const char *passwd, const unsigned char *salt,
124- unsigned char *ikey, void *params);
125-static void convert_key_to_hex_ascii(const unsigned char *master_key,
126- unsigned int keysize, char *master_key_ascii);
127-static int put_crypt_ftr_and_key(struct crypt_mnt_ftr *crypt_ftr);
128-static int test_mount_hw_encrypted_fs(struct crypt_mnt_ftr* crypt_ftr,
129- const char *passwd, const char *mount_point, const char *label);
130-int cryptfs_changepw_hw_fde(int crypt_type, const char *currentpw,
131- const char *newpw);
132-int cryptfs_check_passwd_hw(char *passwd);
133-int cryptfs_get_master_key(struct crypt_mnt_ftr* ftr, const char* password,
134- unsigned char* master_key);
135-
136-static void convert_key_to_hex_ascii_for_upgrade(const unsigned char *master_key,
137- unsigned int keysize, char *master_key_ascii)
138-{
139- unsigned int i, a;
140- unsigned char nibble;
141-
142- for (i = 0, a = 0; i < keysize; i++, a += 2) {
143- /* For each byte, write out two ascii hex digits */
144- nibble = (master_key[i] >> 4) & 0xf;
145- master_key_ascii[a] = nibble + (nibble > 9 ? 0x57 : 0x30);
146-
147- nibble = master_key[i] & 0xf;
148- master_key_ascii[a + 1] = nibble + (nibble > 9 ? 0x57 : 0x30);
149- }
150-
151- /* Add the null termination */
152- master_key_ascii[a] = '\0';
153-}
154-
155-static int get_keymaster_hw_fde_passwd(const char* passwd, unsigned char* newpw,
156- unsigned char* salt,
157- const struct crypt_mnt_ftr *ftr)
158-{
159- /* if newpw updated, return 0
160- * if newpw not updated return -1
161- */
162- int rc = -1;
163-
164- if (should_use_keymaster()) {
165- if (scrypt_keymaster(passwd, salt, newpw, (void*)ftr)) {
166- SLOGE("scrypt failed");
167- } else {
168- rc = 0;
169- }
170- }
171-
172- return rc;
173-}
174-
175-static int verify_hw_fde_passwd(const char *passwd, struct crypt_mnt_ftr* crypt_ftr)
176-{
177- unsigned char newpw[32] = {0};
178- int key_index;
179- if (get_keymaster_hw_fde_passwd(passwd, newpw, crypt_ftr->salt, crypt_ftr))
180- key_index = set_hw_device_encryption_key(passwd,
181- (char*) crypt_ftr->crypto_type_name);
182- else
183- key_index = set_hw_device_encryption_key((const char*)newpw,
184- (char*) crypt_ftr->crypto_type_name);
185- return key_index;
186-}
187-
188-static int verify_and_update_hw_fde_passwd(const char *passwd,
189- struct crypt_mnt_ftr* crypt_ftr)
190-{
191- char* new_passwd = NULL;
192- unsigned char newpw[32] = {0};
193- int key_index = -1;
194- int passwd_updated = -1;
195- int ascii_passwd_updated = (crypt_ftr->flags & CRYPT_ASCII_PASSWORD_UPDATED);
196-
197- key_index = verify_hw_fde_passwd(passwd, crypt_ftr);
198- if (key_index < 0) {
199- ++crypt_ftr->failed_decrypt_count;
200-
201- if (ascii_passwd_updated) {
202- SLOGI("Ascii password was updated");
203- } else {
204- /* Code in else part would execute only once:
205- * When device is upgraded from L->M release.
206- * Once upgraded, code flow should never come here.
207- * L release passed actual password in hex, so try with hex
208- * Each nible of passwd was encoded as a byte, so allocate memory
209- * twice of password len plus one more byte for null termination
210- */
211- if (crypt_ftr->crypt_type == CRYPT_TYPE_DEFAULT) {
212- new_passwd = (char*)malloc(strlen(DEFAULT_HEX_PASSWORD) + 1);
213- if (new_passwd == NULL) {
214- SLOGE("System out of memory. Password verification incomplete");
215- goto out;
216- }
217- strlcpy(new_passwd, DEFAULT_HEX_PASSWORD, strlen(DEFAULT_HEX_PASSWORD) + 1);
218- } else {
219- new_passwd = (char*)malloc(strlen(passwd) * 2 + 1);
220- if (new_passwd == NULL) {
221- SLOGE("System out of memory. Password verification incomplete");
222- goto out;
223- }
224- convert_key_to_hex_ascii_for_upgrade((const unsigned char*)passwd,
225- strlen(passwd), new_passwd);
226- }
227- key_index = set_hw_device_encryption_key((const char*)new_passwd,
228- (char*) crypt_ftr->crypto_type_name);
229- if (key_index >=0) {
230- crypt_ftr->failed_decrypt_count = 0;
231- SLOGI("Hex password verified...will try to update with Ascii value");
232- /* Before updating password, tie that with keymaster to tie with ROT */
233-
234- if (get_keymaster_hw_fde_passwd(passwd, newpw,
235- crypt_ftr->salt, crypt_ftr)) {
236- passwd_updated = update_hw_device_encryption_key(new_passwd,
237- passwd, (char*)crypt_ftr->crypto_type_name);
238- } else {
239- passwd_updated = update_hw_device_encryption_key(new_passwd,
240- (const char*)newpw, (char*)crypt_ftr->crypto_type_name);
241- }
242-
243- if (passwd_updated >= 0) {
244- crypt_ftr->flags |= CRYPT_ASCII_PASSWORD_UPDATED;
245- SLOGI("Ascii password recorded and updated");
246- } else {
247- SLOGI("Passwd verified, could not update...Will try next time");
248- }
249- } else {
250- ++crypt_ftr->failed_decrypt_count;
251- }
252- free(new_passwd);
253- }
254- } else {
255- if (!ascii_passwd_updated)
256- crypt_ftr->flags |= CRYPT_ASCII_PASSWORD_UPDATED;
257- }
258-out:
259- // update footer before leaving
260- put_crypt_ftr_and_key(crypt_ftr);
261- return key_index;
262-}
263-#endif
264-
265 /* Should we use keymaster? */
266 static int keymaster_check_compatibility()
267 {
268@@ -1150,36 +1000,16 @@ static int load_crypto_mapping_table(struct crypt_mnt_ftr *crypt_ftr,
269 tgt->status = 0;
270 tgt->sector_start = 0;
271 tgt->length = crypt_ftr->fs_size;
272+ strlcpy(tgt->target_type, "crypt", DM_MAX_TYPE_NAME);
273+
274 crypt_params = buffer + sizeof(struct dm_ioctl) + sizeof(struct dm_target_spec);
275+ convert_key_to_hex_ascii(master_key, crypt_ftr->keysize, master_key_ascii);
276+
277 buff_offset = crypt_params - buffer;
278 SLOGI("Extra parameters for dm_crypt: %s\n", extra_params);
279-
280-#ifdef CONFIG_HW_DISK_ENCRYPTION
281- if(is_hw_disk_encryption((char*)crypt_ftr->crypto_type_name)) {
282- strlcpy(tgt->target_type, "req-crypt",DM_MAX_TYPE_NAME);
283- if (is_ice_enabled())
284- convert_key_to_hex_ascii(master_key, sizeof(int), master_key_ascii);
285- else
286- convert_key_to_hex_ascii(master_key, crypt_ftr->keysize, master_key_ascii);
287- }
288- else {
289- convert_key_to_hex_ascii(master_key, crypt_ftr->keysize, master_key_ascii);
290- strlcpy(tgt->target_type, "crypt", DM_MAX_TYPE_NAME);
291- }
292- snprintf(crypt_params, sizeof(buffer) - buff_offset, "%s %s 0 %s 0 %s 0",
293- crypt_ftr->crypto_type_name, master_key_ascii,
294- real_blk_name, extra_params);
295-
296- SLOGI("target_type = %s", tgt->target_type);
297- SLOGI("real_blk_name = %s, extra_params = %s", real_blk_name, extra_params);
298-#else
299- convert_key_to_hex_ascii(master_key, crypt_ftr->keysize, master_key_ascii);
300- strlcpy(tgt->target_type, "crypt", DM_MAX_TYPE_NAME);
301 snprintf(crypt_params, sizeof(buffer) - buff_offset, "%s %s 0 %s 0 %s",
302 crypt_ftr->crypto_type_name, master_key_ascii, real_blk_name,
303 extra_params);
304-#endif
305-
306 crypt_params += strlen(crypt_params) + 1;
307 crypt_params = (char *) (((unsigned long)crypt_params + 7) & ~8); /* Align to an 8 byte boundary */
308 tgt->next = crypt_params - buffer;
309@@ -1199,6 +1029,7 @@ static int load_crypto_mapping_table(struct crypt_mnt_ftr *crypt_ftr,
310 }
311 }
312
313+
314 static int get_dm_crypt_version(int fd, const char *name, int *version)
315 {
316 char buffer[DM_CRYPT_BUF_SIZE];
317@@ -1218,11 +1049,7 @@ static int get_dm_crypt_version(int fd, const char *name, int *version)
318 */
319 v = (struct dm_target_versions *) &buffer[sizeof(struct dm_ioctl)];
320 while (v->next) {
321-#ifdef CONFIG_HW_DISK_ENCRYPTION
322- if (! strcmp(v->name, "crypt") || ! strcmp(v->name, "req-crypt")) {
323-#else
324 if (! strcmp(v->name, "crypt")) {
325-#endif
326 /* We found the crypt driver, return the version, and get out */
327 version[0] = v->version[0];
328 version[1] = v->version[1];
329@@ -1235,7 +1062,6 @@ static int get_dm_crypt_version(int fd, const char *name, int *version)
330 return -1;
331 }
332
333-#ifndef CONFIG_HW_DISK_ENCRYPTION
334 static std::string extra_params_as_string(const std::vector<std::string>& extra_params_vec) {
335 if (extra_params_vec.empty()) return "";
336 std::string extra_params = std::to_string(extra_params_vec.size());
337@@ -1245,7 +1071,6 @@ static std::string extra_params_as_string(const std::vector<std::string>& extra_
338 }
339 return extra_params;
340 }
341-#endif
342
343 static int create_crypto_blk_dev(struct crypt_mnt_ftr* crypt_ftr, const unsigned char* master_key,
344 const char* real_blk_name, char* crypto_blk_name, const char* name,
345@@ -1258,13 +1083,7 @@ static int create_crypto_blk_dev(struct crypt_mnt_ftr* crypt_ftr, const unsigned
346 int retval = -1;
347 int version[3];
348 int load_count;
349-#ifdef CONFIG_HW_DISK_ENCRYPTION
350- char encrypted_state[PROPERTY_VALUE_MAX] = {0};
351- char progress[PROPERTY_VALUE_MAX] = {0};
352- const char *extra_params;
353-#else
354 std::vector<std::string> extra_params_vec;
355-#endif
356
357 if ((fd = open("/dev/device-mapper", O_RDWR | O_CLOEXEC)) < 0) {
358 SLOGE("Cannot open device-mapper\n");
359@@ -1289,45 +1108,6 @@ static int create_crypto_blk_dev(struct crypt_mnt_ftr* crypt_ftr, const unsigned
360 minor = (io->dev & 0xff) | ((io->dev >> 12) & 0xfff00);
361 snprintf(crypto_blk_name, MAXPATHLEN, "/dev/block/dm-%u", minor);
362
363-#ifdef CONFIG_HW_DISK_ENCRYPTION
364- if(is_hw_disk_encryption((char*)crypt_ftr->crypto_type_name)) {
365- /* Set fde_enabled if either FDE completed or in-progress */
366- property_get("ro.crypto.state", encrypted_state, ""); /* FDE completed */
367- property_get("vold.encrypt_progress", progress, ""); /* FDE in progress */
368- if (!strcmp(encrypted_state, "encrypted") || strcmp(progress, "")) {
369- if (is_ice_enabled()) {
370- if (flags & CREATE_CRYPTO_BLK_DEV_FLAGS_ALLOW_ENCRYPT_OVERRIDE)
371- extra_params = "fde_enabled ice allow_encrypt_override";
372- else
373- extra_params = "fde_enabled ice";
374- } else {
375- if (flags & CREATE_CRYPTO_BLK_DEV_FLAGS_ALLOW_ENCRYPT_OVERRIDE)
376- extra_params = "fde_enabled allow_encrypt_override";
377- else
378- extra_params = "fde_enabled";
379- }
380- } else {
381- if (flags & CREATE_CRYPTO_BLK_DEV_FLAGS_ALLOW_ENCRYPT_OVERRIDE)
382- extra_params = "fde_enabled allow_encrypt_override";
383- else
384- extra_params = "fde_enabled";
385- }
386- } else {
387- extra_params = "";
388- if (! get_dm_crypt_version(fd, name, version)) {
389- /* Support for allow_discards was added in version 1.11.0 */
390- if ((version[0] >= 2) || ((version[0] == 1) && (version[1] >= 11))) {
391- if (flags & CREATE_CRYPTO_BLK_DEV_FLAGS_ALLOW_ENCRYPT_OVERRIDE)
392- extra_params = "2 allow_discards allow_encrypt_override";
393- else
394- extra_params = "1 allow_discards";
395- SLOGI("Enabling support for allow_discards in dmcrypt.\n");
396- }
397- }
398- }
399- load_count = load_crypto_mapping_table(crypt_ftr, master_key, real_blk_name, name, fd,
400- extra_params);
401-#else
402 if (!get_dm_crypt_version(fd, name, version)) {
403 /* Support for allow_discards was added in version 1.11.0 */
404 if ((version[0] >= 2) || ((version[0] == 1) && (version[1] >= 11))) {
405@@ -1339,7 +1119,6 @@ static int create_crypto_blk_dev(struct crypt_mnt_ftr* crypt_ftr, const unsigned
406 }
407 load_count = load_crypto_mapping_table(crypt_ftr, master_key, real_blk_name, name, fd,
408 extra_params_as_string(extra_params_vec).c_str());
409-#endif
410 if (load_count < 0) {
411 SLOGE("Cannot load dm-crypt mapping table.\n");
412 goto errout;
413@@ -1468,8 +1247,7 @@ static int scrypt_keymaster(const char *passwd, const unsigned char *salt,
414 static int encrypt_master_key(const char *passwd, const unsigned char *salt,
415 const unsigned char *decrypted_master_key,
416 unsigned char *encrypted_master_key,
417- struct crypt_mnt_ftr *crypt_ftr,
418- bool create_keymaster_key)
419+ struct crypt_mnt_ftr *crypt_ftr)
420 {
421 unsigned char ikey[INTERMEDIATE_BUF_SIZE] = { 0 };
422 EVP_CIPHER_CTX e_ctx;
423@@ -1481,7 +1259,7 @@ static int encrypt_master_key(const char *passwd, const unsigned char *salt,
424
425 switch (crypt_ftr->kdf_type) {
426 case KDF_SCRYPT_KEYMASTER:
427- if (create_keymaster_key && keymaster_create_key(crypt_ftr)) {
428+ if (keymaster_create_key(crypt_ftr)) {
429 SLOGE("keymaster_create_key failed");
430 return -1;
431 }
432@@ -1651,13 +1429,13 @@ static int create_encrypted_random_key(const char *passwd, unsigned char *master
433 close(fd);
434
435 /* Now encrypt it with the password */
436- return encrypt_master_key(passwd, salt, key_buf, master_key, crypt_ftr, true);
437+ return encrypt_master_key(passwd, salt, key_buf, master_key, crypt_ftr);
438 }
439
440 int wait_and_unmount(const char *mountpoint, bool kill)
441 {
442 int i, err, rc;
443-#define WAIT_UNMOUNT_COUNT 200
444+#define WAIT_UNMOUNT_COUNT 20
445
446 /* Now umount the tmpfs filesystem */
447 for (i=0; i<WAIT_UNMOUNT_COUNT; i++) {
448@@ -1674,18 +1452,18 @@ int wait_and_unmount(const char *mountpoint, bool kill)
449
450 err = errno;
451
452- /* If allowed, be increasingly aggressive before the last 2 seconds */
453+ /* If allowed, be increasingly aggressive before the last two retries */
454 if (kill) {
455- if (i == (WAIT_UNMOUNT_COUNT - 30)) {
456+ if (i == (WAIT_UNMOUNT_COUNT - 3)) {
457 SLOGW("sending SIGHUP to processes with open files\n");
458 android::vold::KillProcessesWithOpenFiles(mountpoint, SIGTERM);
459- } else if (i == (WAIT_UNMOUNT_COUNT - 20)) {
460+ } else if (i == (WAIT_UNMOUNT_COUNT - 2)) {
461 SLOGW("sending SIGKILL to processes with open files\n");
462 android::vold::KillProcessesWithOpenFiles(mountpoint, SIGKILL);
463 }
464 }
465
466- usleep(100000);
467+ sleep(1);
468 }
469
470 if (i < WAIT_UNMOUNT_COUNT) {
471@@ -1852,17 +1630,6 @@ static int cryptfs_restart_internal(int restart_main)
472 cryptfs_reboot(RebootType::reboot);
473 }
474 } else {
475-#ifdef CONFIG_HW_DISK_ENCRYPTION
476- if (--retries) {
477- sleep(RETRY_MOUNT_DELAY_SECONDS);
478- } else {
479- SLOGE("Failed to mount decrypted data");
480- cryptfs_set_corrupt();
481- cryptfs_trigger_restart_min_framework();
482- SLOGI("Started framework to offer wipe");
483- return -1;
484- }
485-#else
486 SLOGE("Failed to mount decrypted data");
487 cryptfs_set_corrupt();
488 cryptfs_trigger_restart_min_framework();
489@@ -1871,7 +1638,6 @@ static int cryptfs_restart_internal(int restart_main)
490 SLOGE("Failed to setexeccon");
491 }
492 return -1;
493-#endif
494 }
495 }
496 if (setexeccon(NULL)) {
497@@ -1966,66 +1732,6 @@ static int do_crypto_complete(const char *mount_point)
498 return CRYPTO_COMPLETE_ENCRYPTED;
499 }
500
501-#ifdef CONFIG_HW_DISK_ENCRYPTION
502-static int test_mount_hw_encrypted_fs(struct crypt_mnt_ftr* crypt_ftr,
503- const char *passwd, const char *mount_point, const char *label)
504-{
505- /* Allocate enough space for a 256 bit key, but we may use less */
506- unsigned char decrypted_master_key[32];
507- char crypto_blkdev[MAXPATHLEN];
508- char real_blkdev[MAXPATHLEN];
509- unsigned int orig_failed_decrypt_count;
510- int rc = 0;
511-
512- SLOGD("crypt_ftr->fs_size = %lld\n", crypt_ftr->fs_size);
513- orig_failed_decrypt_count = crypt_ftr->failed_decrypt_count;
514-
515- fs_mgr_get_crypt_info(fstab_default, 0, real_blkdev, sizeof(real_blkdev));
516-
517- int key_index = 0;
518- if(is_hw_disk_encryption((char*)crypt_ftr->crypto_type_name)) {
519- key_index = verify_and_update_hw_fde_passwd(passwd, crypt_ftr);
520- if (key_index < 0) {
521- rc = crypt_ftr->failed_decrypt_count;
522- goto errout;
523- }
524- else {
525- if (is_ice_enabled()) {
526- if (create_crypto_blk_dev(crypt_ftr, (unsigned char*)&key_index,
527- real_blkdev, crypto_blkdev, label, 0)) {
528- SLOGE("Error creating decrypted block device");
529- rc = -1;
530- goto errout;
531- }
532- } else {
533- if (create_crypto_blk_dev(crypt_ftr, decrypted_master_key,
534- real_blkdev, crypto_blkdev, label, 0)) {
535- SLOGE("Error creating decrypted block device");
536- rc = -1;
537- goto errout;
538- }
539- }
540- }
541- }
542-
543- if (rc == 0) {
544- crypt_ftr->failed_decrypt_count = 0;
545- if (orig_failed_decrypt_count != 0) {
546- put_crypt_ftr_and_key(crypt_ftr);
547- }
548-
549- /* Save the name of the crypto block device
550- * so we can mount it when restarting the framework. */
551- property_set("ro.crypto.fs_crypto_blkdev", crypto_blkdev);
552- master_key_saved = 1;
553- }
554-
555- errout:
556- return rc;
557-}
558-#endif
559-
560-
561 static int test_mount_encrypted_fs(struct crypt_mnt_ftr* crypt_ftr,
562 const char *passwd, const char *mount_point, const char *label)
563 {
564@@ -2132,7 +1838,7 @@ static int test_mount_encrypted_fs(struct crypt_mnt_ftr* crypt_ftr,
565
566 if (upgrade) {
567 rc = encrypt_master_key(passwd, crypt_ftr->salt, saved_master_key,
568- crypt_ftr->master_key, crypt_ftr, true);
569+ crypt_ftr->master_key, crypt_ftr);
570 if (!rc) {
571 rc = put_crypt_ftr_and_key(crypt_ftr);
572 }
573@@ -2229,66 +1935,6 @@ int check_unmounted_and_get_ftr(struct crypt_mnt_ftr* crypt_ftr)
574 return 0;
575 }
576
577-#ifdef CONFIG_HW_DISK_ENCRYPTION
578-int cryptfs_check_passwd_hw(const char* passwd)
579-{
580- struct crypt_mnt_ftr crypt_ftr;
581- int rc;
582- unsigned char master_key[KEY_LEN_BYTES];
583-
584- /* get key */
585- if (get_crypt_ftr_and_key(&crypt_ftr)) {
586- SLOGE("Error getting crypt footer and key");
587- return -1;
588- }
589-
590- /*
591- * in case of manual encryption (from GUI), the encryption is done with
592- * default password
593- */
594- if (crypt_ftr.flags & CRYPT_FORCE_COMPLETE) {
595- /* compare scrypted_intermediate_key with stored scrypted_intermediate_key
596- * which was created with actual password before reboot.
597- */
598- rc = cryptfs_get_master_key(&crypt_ftr, passwd, master_key);
599- if (rc) {
600- SLOGE("password doesn't match");
601- rc = ++crypt_ftr.failed_decrypt_count;
602- put_crypt_ftr_and_key(&crypt_ftr);
603- return rc;
604- }
605-
606- rc = test_mount_hw_encrypted_fs(&crypt_ftr, DEFAULT_PASSWORD,
607- DATA_MNT_POINT, CRYPTO_BLOCK_DEVICE);
608-
609- if (rc) {
610- SLOGE("Default password did not match on reboot encryption");
611- return rc;
612- }
613-
614- crypt_ftr.flags &= ~CRYPT_FORCE_COMPLETE;
615- put_crypt_ftr_and_key(&crypt_ftr);
616- rc = cryptfs_changepw(crypt_ftr.crypt_type, DEFAULT_PASSWORD, passwd);
617- if (rc) {
618- SLOGE("Could not change password on reboot encryption");
619- return rc;
620- }
621- } else
622- rc = test_mount_hw_encrypted_fs(&crypt_ftr, passwd,
623- DATA_MNT_POINT, CRYPTO_BLOCK_DEVICE);
624-
625- if (crypt_ftr.crypt_type != CRYPT_TYPE_DEFAULT) {
626- cryptfs_clear_password();
627- password = strdup(passwd);
628- struct timespec now;
629- clock_gettime(CLOCK_BOOTTIME, &now);
630- password_expiry_time = now.tv_sec + password_max_age_seconds;
631- }
632-
633- return rc;
634-}
635-#endif
636-
637 int cryptfs_check_passwd(const char *passwd)
638 {
639 SLOGI("cryptfs_check_passwd");
640@@ -2306,14 +1952,8 @@ int cryptfs_check_passwd(const char *passwd)
641 return rc;
642 }
643
644-#ifdef CONFIG_HW_DISK_ENCRYPTION
645- if (is_hw_disk_encryption((char*)crypt_ftr.crypto_type_name))
646- return cryptfs_check_passwd_hw(passwd);
647-#endif
648-
649 rc = test_mount_encrypted_fs(&crypt_ftr, passwd,
650 DATA_MNT_POINT, CRYPTO_BLOCK_DEVICE);
651-
652 if (rc) {
653 SLOGE("Password did not match");
654 return rc;
655@@ -2334,7 +1974,7 @@ int cryptfs_check_passwd(const char *passwd)
656
657 crypt_ftr.flags &= ~CRYPT_FORCE_COMPLETE;
658 put_crypt_ftr_and_key(&crypt_ftr);
659- rc = cryptfs_changepw(crypt_ftr.crypt_type, DEFAULT_PASSWORD, passwd);
660+ rc = cryptfs_changepw(crypt_ftr.crypt_type, passwd);
661 if (rc) {
662 SLOGE("Could not change password on reboot encryption");
663 return rc;
664@@ -2384,24 +2024,6 @@ int cryptfs_verify_passwd(const char *passwd)
665 /* If the device has no password, then just say the password is valid */
666 rc = 0;
667 } else {
668-#ifdef CONFIG_HW_DISK_ENCRYPTION
669- if(is_hw_disk_encryption((char*)crypt_ftr.crypto_type_name)) {
670- if (verify_hw_fde_passwd(passwd, &crypt_ftr) >= 0)
671- rc = 0;
672- else
673- rc = -1;
674- } else {
675- decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr, 0, 0);
676- if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) {
677- /* They match, the password is correct */
678- rc = 0;
679- } else {
680- /* If incorrect, sleep for a bit to prevent dictionary attacks */
681- sleep(1);
682- rc = 1;
683- }
684- }
685-#else
686 decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr, 0, 0);
687 if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) {
688 /* They match, the password is correct */
689@@ -2411,7 +2033,6 @@ int cryptfs_verify_passwd(const char *passwd)
690 sleep(1);
691 rc = 1;
692 }
693-#endif
694 }
695
696 return rc;
697@@ -2535,12 +2156,6 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
698 off64_t previously_encrypted_upto = 0;
699 bool rebootEncryption = false;
700 bool onlyCreateHeader = false;
701-#ifdef CONFIG_HW_DISK_ENCRYPTION
702- unsigned char newpw[32];
703- int key_index = 0;
704-#endif
705- int index = 0;
706-
707 int fd = -1;
708
709 if (get_crypt_ftr_and_key(&crypt_ftr) == 0) {
710@@ -2645,6 +2260,30 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
711 fclose(breadcrumb);
712 }
713
714+ /* Do extra work for a better UX when doing the long inplace encryption */
715+ if (!onlyCreateHeader) {
716+ /* Now that /data is unmounted, we need to mount a tmpfs
717+ * /data, set a property saying we're doing inplace encryption,
718+ * and restart the framework.
719+ */
720+ if (fs_mgr_do_tmpfs_mount(DATA_MNT_POINT)) {
721+ goto error_shutting_down;
722+ }
723+ /* Tells the framework that inplace encryption is starting */
724+ property_set("vold.encrypt_progress", "0");
725+
726+ /* restart the framework. */
727+ /* Create necessary paths on /data */
728+ prep_data_fs();
729+
730+ /* Ugh, shutting down the framework is not synchronous, so until it
731+ * can be fixed, this horrible hack will wait a moment for it all to
732+ * shut down before proceeding. Without it, some devices cannot
733+ * restart the graphics services.
734+ */
735+ sleep(2);
736+ }
737+
738 /* Start the actual work of making an encrypted filesystem */
739 /* Initialize a crypt_mnt_ftr for the partition */
740 if (previously_encrypted_upto == 0 && !rebootEncryption) {
741@@ -2668,11 +2307,7 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
742 crypt_ftr.flags |= CRYPT_INCONSISTENT_STATE;
743 }
744 crypt_ftr.crypt_type = crypt_type;
745-#ifdef CONFIG_HW_DISK_ENCRYPTION
746- strlcpy((char *)crypt_ftr.crypto_type_name, "aes-xts", MAX_CRYPTO_TYPE_NAME_LEN);
747-#else
748 strlcpy((char *)crypt_ftr.crypto_type_name, cryptfs_get_crypto_name(), MAX_CRYPTO_TYPE_NAME_LEN);
749-#endif
750
751 /* Make an encrypted master key */
752 if (create_encrypted_random_key(onlyCreateHeader ? DEFAULT_PASSWORD : passwd,
753@@ -2687,7 +2322,7 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
754 unsigned char encrypted_fake_master_key[MAX_KEY_LEN];
755 memset(fake_master_key, 0, sizeof(fake_master_key));
756 encrypt_master_key(passwd, crypt_ftr.salt, fake_master_key,
757- encrypted_fake_master_key, &crypt_ftr, true);
758+ encrypted_fake_master_key, &crypt_ftr);
759 }
760
761 /* Write the key to the end of the partition */
762@@ -2708,57 +2343,12 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
763 }
764 }
765
766- /* When encryption triggered from settings, encryption starts after reboot.
767- So set the encryption key when the actual encryption starts.
768- */
769-#ifdef CONFIG_HW_DISK_ENCRYPTION
770- if (previously_encrypted_upto == 0) {
771- if (!rebootEncryption)
772- clear_hw_device_encryption_key();
773-
774- if (get_keymaster_hw_fde_passwd(
775- onlyCreateHeader ? DEFAULT_PASSWORD : passwd,
776- newpw, crypt_ftr.salt, &crypt_ftr))
777- key_index = set_hw_device_encryption_key(
778- onlyCreateHeader ? DEFAULT_PASSWORD : passwd,
779- (char*)crypt_ftr.crypto_type_name);
780- else
781- key_index = set_hw_device_encryption_key((const char*)newpw,
782- (char*) crypt_ftr.crypto_type_name);
783- if (key_index < 0)
784- goto error_shutting_down;
785-
786- crypt_ftr.flags |= CRYPT_ASCII_PASSWORD_UPDATED;
787- put_crypt_ftr_and_key(&crypt_ftr);
788- }
789-#endif
790-
791 if (onlyCreateHeader) {
792 sleep(2);
793 cryptfs_reboot(RebootType::reboot);
794- } else {
795- /* Do extra work for a better UX when doing the long inplace encryption */
796- /* Now that /data is unmounted, we need to mount a tmpfs
797- * /data, set a property saying we're doing inplace encryption,
798- * and restart the framework.
799- */
800- if (fs_mgr_do_tmpfs_mount(DATA_MNT_POINT)) {
801- goto error_shutting_down;
802- }
803- /* Tells the framework that inplace encryption is starting */
804- property_set("vold.encrypt_progress", "0");
805-
806- /* restart the framework. */
807- /* Create necessary paths on /data */
808- prep_data_fs();
809-
810- /* Ugh, shutting down the framework is not synchronous, so until it
811- * can be fixed, this horrible hack will wait a moment for it all to
812- * shut down before proceeding. Without it, some devices cannot
813- * restart the graphics services.
814- */
815- sleep(2);
816+ }
817
818+ if (!no_ui || rebootEncryption) {
819 /* startup service classes main and late_start */
820 property_set("vold.decrypt", "trigger_restart_min_framework");
821 SLOGD("Just triggered restart_min_framework\n");
822@@ -2771,17 +2361,8 @@ int cryptfs_enable_internal(int crypt_type, const char* passwd, int no_ui) {
823 }
824
825 decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr, 0, 0);
826-#ifdef CONFIG_HW_DISK_ENCRYPTION
827- if (is_hw_disk_encryption((char*)crypt_ftr.crypto_type_name) && is_ice_enabled())
828- create_crypto_blk_dev(&crypt_ftr, (unsigned char*)&key_index, real_blkdev, crypto_blkdev,
829- CRYPTO_BLOCK_DEVICE, 0);
830- else
831- create_crypto_blk_dev(&crypt_ftr, decrypted_master_key, real_blkdev, crypto_blkdev,
832- CRYPTO_BLOCK_DEVICE, 0);
833-#else
834 create_crypto_blk_dev(&crypt_ftr, decrypted_master_key, real_blkdev, crypto_blkdev,
835 CRYPTO_BLOCK_DEVICE, 0);
836-#endif
837
838 /* If we are continuing, check checksums match */
839 rc = 0;
840@@ -2915,7 +2496,7 @@ int cryptfs_enable_default(int no_ui) {
841 return cryptfs_enable_internal(CRYPT_TYPE_DEFAULT, DEFAULT_PASSWORD, no_ui);
842 }
843
844-int cryptfs_changepw(int crypt_type, const char *currentpw, const char *newpw)
845+int cryptfs_changepw(int crypt_type, const char *newpw)
846 {
847 if (e4crypt_is_native()) {
848 SLOGE("cryptfs_changepw not valid for file encryption");
849@@ -2942,28 +2523,6 @@ int cryptfs_changepw(int crypt_type, const char *currentpw, const char *newpw)
850 return -1;
851 }
852
853-#ifdef CONFIG_HW_DISK_ENCRYPTION
854- if(is_hw_disk_encryption((char*)crypt_ftr.crypto_type_name))
855- return cryptfs_changepw_hw_fde(crypt_type, currentpw, newpw);
856- else {
857- crypt_ftr.crypt_type = crypt_type;
858-
859- rc = encrypt_master_key(crypt_type == CRYPT_TYPE_DEFAULT ?
860- DEFAULT_PASSWORD : newpw,
861- crypt_ftr.salt,
862- saved_master_key,
863- crypt_ftr.master_key,
864- &crypt_ftr, false);
865- if (rc) {
866- SLOGE("Encrypt master key failed: %d", rc);
867- return -1;
868- }
869- /* save the key */
870- put_crypt_ftr_and_key(&crypt_ftr);
871-
872- return 0;
873- }
874-#else
875 crypt_ftr.crypt_type = crypt_type;
876
877 rc = encrypt_master_key(crypt_type == CRYPT_TYPE_DEFAULT ? DEFAULT_PASSWORD
878@@ -2971,7 +2530,7 @@ int cryptfs_changepw(int crypt_type, const char *currentpw, const char *newpw)
879 crypt_ftr.salt,
880 saved_master_key,
881 crypt_ftr.master_key,
882- &crypt_ftr, false);
883+ &crypt_ftr);
884 if (rc) {
885 SLOGE("Encrypt master key failed: %d", rc);
886 return -1;
887@@ -2979,57 +2538,8 @@ int cryptfs_changepw(int crypt_type, const char *currentpw, const char *newpw)
888 /* save the key */
889 put_crypt_ftr_and_key(&crypt_ftr);
890
891- return 0;
892-#endif
893-}
894-
895-#ifdef CONFIG_HW_DISK_ENCRYPTION
896-int cryptfs_changepw_hw_fde(int crypt_type, const char *currentpw, const char *newpw)
897-{
898- struct crypt_mnt_ftr crypt_ftr;
899- int rc;
900- int previous_type;
901-
902- /* get key */
903- if (get_crypt_ftr_and_key(&crypt_ftr)) {
904- SLOGE("Error getting crypt footer and key");
905- return -1;
906- }
907-
908- previous_type = crypt_ftr.crypt_type;
909- int rc1;
910- unsigned char tmp_curpw[32] = {0};
911- rc1 = get_keymaster_hw_fde_passwd(crypt_ftr.crypt_type == CRYPT_TYPE_DEFAULT ?
912- DEFAULT_PASSWORD : currentpw, tmp_curpw,
913- crypt_ftr.salt, &crypt_ftr);
914-
915- crypt_ftr.crypt_type = crypt_type;
916-
917- int ret, rc2;
918- unsigned char tmp_newpw[32] = {0};
919-
920- rc2 = get_keymaster_hw_fde_passwd(crypt_type == CRYPT_TYPE_DEFAULT ?
921- DEFAULT_PASSWORD : newpw , tmp_newpw,
922- crypt_ftr.salt, &crypt_ftr);
923-
924- if (is_hw_disk_encryption((char*)crypt_ftr.crypto_type_name)) {
925- ret = update_hw_device_encryption_key(
926- rc1 ? (previous_type == CRYPT_TYPE_DEFAULT ? DEFAULT_PASSWORD : currentpw) : (const char*)tmp_curpw,
927- rc2 ? (crypt_type == CRYPT_TYPE_DEFAULT ? DEFAULT_PASSWORD : newpw): (const char*)tmp_newpw,
928- (char*)crypt_ftr.crypto_type_name);
929- if (ret) {
930- SLOGE("Error updating device encryption hardware key ret %d", ret);
931- return -1;
932- } else {
933- SLOGI("Encryption hardware key updated");
934- }
935- }
936-
937- /* save the key */
938- put_crypt_ftr_and_key(&crypt_ftr);
939 return 0;
940 }
941-#endif
942
943 static unsigned int persist_get_max_entries(int encrypted) {
944 struct crypt_mnt_ftr crypt_ftr;
945@@ -3432,62 +2942,3 @@ int cryptfs_isConvertibleToFBE()
946 struct fstab_rec* rec = fs_mgr_get_entry_for_mount_point(fstab_default, DATA_MNT_POINT);
947 return fs_mgr_is_convertible_to_fbe(rec) ? 1 : 0;
948 }
949-
950-int cryptfs_create_default_ftr(struct crypt_mnt_ftr* crypt_ftr, __attribute__((unused))int key_length)
951-{
952- if (cryptfs_init_crypt_mnt_ftr(crypt_ftr)) {
953- SLOGE("Failed to initialize crypt_ftr");
954- return -1;
955- }
956-
957- if (create_encrypted_random_key(DEFAULT_PASSWORD, crypt_ftr->master_key,
958- crypt_ftr->salt, crypt_ftr)) {
959- SLOGE("Cannot create encrypted master key\n");
960- return -1;
961- }
962-
963- //crypt_ftr->keysize = key_length / 8;
964- return 0;
965-}
966-
967-int cryptfs_get_master_key(struct crypt_mnt_ftr* ftr, const char* password,
968- unsigned char* master_key)
969-{
970- int rc;
971-
972- unsigned char* intermediate_key = 0;
973- size_t intermediate_key_size = 0;
974-
975- if (password == 0 || *password == 0) {
976- password = DEFAULT_PASSWORD;
977- }
978-
979- rc = decrypt_master_key(password, master_key, ftr, &intermediate_key,
980- &intermediate_key_size);
981-
982- if (rc) {
983- SLOGE("Can't calculate intermediate key");
984- return rc;
985- }
986-
987- int N = 1 << ftr->N_factor;
988- int r = 1 << ftr->r_factor;
989- int p = 1 << ftr->p_factor;
990-
991- unsigned char scrypted_intermediate_key[sizeof(ftr->scrypted_intermediate_key)];
992-
993- rc = crypto_scrypt(intermediate_key, intermediate_key_size,
994- ftr->salt, sizeof(ftr->salt), N, r, p,
995- scrypted_intermediate_key,
996- sizeof(scrypted_intermediate_key));
997-
998- free(intermediate_key);
999-
1000- if (rc) {
1001- SLOGE("Can't scrypt intermediate key");
1002- return rc;
1003- }
1004-
1005- return memcmp(scrypted_intermediate_key, ftr->scrypted_intermediate_key,
1006- intermediate_key_size);
1007-}
1008diff --git a/cryptfs.h b/cryptfs.h
1009index d8923db..d6c7dc5 100644
1010--- a/cryptfs.h
1011+++ b/cryptfs.h
1012@@ -66,14 +66,6 @@
1013 complete. On next cryptkeeper entry, match
1014 the password. If it matches fix the master
1015 key and remove this flag. */
1016-#ifdef CONFIG_HW_DISK_ENCRYPTION
1017-/* This flag is used to transition from L->M upgrade. L release passed
1018- * a byte for every nible of user password while M release is passing
1019- * ascii value of user password.
1020- * Random flag value is chosen so that it does not conflict with other use cases
1021- */
1022-#define CRYPT_ASCII_PASSWORD_UPDATED 0x1000
1023-#endif
1024
1025 /* Allowed values for type in the structure below */
1026 #define CRYPT_TYPE_PASSWORD 0 /* master_key is encrypted with a password
1027@@ -241,7 +233,7 @@ int cryptfs_check_passwd(const char* pw);
1028 int cryptfs_verify_passwd(const char* pw);
1029 int cryptfs_restart(void);
1030 int cryptfs_enable(int type, const char* passwd, int no_ui);
1031-int cryptfs_changepw(int type, const char *currentpw, const char* newpw);
1032+int cryptfs_changepw(int type, const char* newpw);
1033 int cryptfs_enable_default(int no_ui);
1034 int cryptfs_setup_ext_volume(const char* label, const char* real_blkdev, const unsigned char* key,
1035 char* out_crypto_blkdev);
1036--
10372.17.1
1038