recovery uncrypt功能解析(bootable/recovery/uncrypt/uncrypt.cpp)

我们通常对一个文件可以直接读写操作，或者普通的分区(没有文件系统)也是一样，直接对/dev/block/boot直接读写，就可以获取里面的数据内容了。

当我们在ota升级的时候，把升级包下载到cache/data分区，然后进入recovery系统后，把cache/data分区mount之后，即可从对应的分区获取zip升级包升级了， 前提是我们需要挂载对应的分区cache或者data，这样才能给读升级包升级，如果不挂载分区，我们能给直接从/dev/block/data获取升级包升级吗？

这就是我们今天讨论的主题，不挂载data分区，如何从/dev/block/data获取升级包升级， 这个依赖bootable/recovery/uncrypt/uncrypt.cpp下面的代码实现了，我们通过获取update.zip升级包， 是如何在/dev/block/data存储的。 我们知道了update.zip如何在/dev/block/data存储的，那么就可以直接从/dev/block/data读取升级包升级了。下面对uncrypt.cpp源码分析：

static constexpr int WINDOW_SIZE = 5;
static constexpr int FIBMAP_RETRY_LIMIT = 3;

// uncrypt provides three services: SETUP_BCB, CLEAR_BCB and UNCRYPT.
//
// SETUP_BCB and CLEAR_BCB services use socket communication and do not rely
// on /cache partitions. They will handle requests to reboot into recovery
// (for applying updates for non-A/B devices, or factory resets for all
// devices).
//
// UNCRYPT service still needs files on /cache partition (UNCRYPT_PATH_FILE
// and CACHE_BLOCK_MAP). It will be working (and needed) only for non-A/B
// devices, on which /cache partitions always exist.
static const std::string CACHE_BLOCK_MAP = "/cache/recovery/block.map";
static const std::string UNCRYPT_PATH_FILE = "/cache/recovery/uncrypt_file";
static const std::string UNCRYPT_STATUS = "/cache/recovery/uncrypt_status";
static const std::string UNCRYPT_SOCKET = "uncrypt";

WINDOW_SIZE = 5; 每次当有5个block size大小的数据，就写一次。

FIBMAP_RETRY_LIMIT = 3;  调用 ioctl(fd, FIBMAP, block) 尝试的次数。

CACHE_BLOCK_MAP = "/cache/recovery/block.map"  关于升级包的存储信息及稀疏块列表的描述文件。

UNCRYPT_PATH_FILE = "/cache/recovery/uncrypt_file";  存储原始升级包的路径。

UNCRYPT_STATUS = "/cache/recovery/uncrypt_status";  对升级包uncrypt操作的状态结果。

UNCRYPT_SOCKET = "uncrypt";    使用 /dev/socket/uncrypt 通信

static int write_at_offset(unsigned char* buffer, size_t size, int wfd, off64_t offset) {
    if (TEMP_FAILURE_RETRY(lseek64(wfd, offset, SEEK_SET)) == -1) {
        PLOG(ERROR) << "error seeking to offset " << offset;
        return -1;
    }
    if (!android::base::WriteFully(wfd, buffer, size)) {
        PLOG(ERROR) << "error writing offset " << offset;
        return -1;
    }
    return 0;
}

写长度为size的buffer数据到wfd偏移offset地方

static void add_block_to_ranges(std::vector<int>& ranges, int new_block) {
    if (!ranges.empty() && new_block == ranges.back()) {
        // If the new block comes immediately after the current range,
        // all we have to do is extend the current range.
        ++ranges.back();
    } else {
        // We need to start a new range.
        ranges.push_back(new_block);
        ranges.push_back(new_block + 1);
    }
}

生成升级包的block块的稀疏列表， 比如1001 1004， 如果new block为1004， 则稀疏范围为1001 1005， 如果new block非1004，比如为1120， 则稀疏列表为 1001 1004， 1120 1121。

1001 1004表示为1001 1002 1003三个block，不包含1004

static struct fstab* read_fstab() {
    fstab = fs_mgr_read_fstab_default();
    if (!fstab) {
        LOG(ERROR) << "failed to read default fstab";
        return NULL;
    }

    return fstab;
}

读取分区挂载表

static const char* find_block_device(const char* path, bool* encryptable, bool* encrypted, bool *f2fs_fs) {
    // Look for a volume whose mount point is the prefix of path and
    // return its block device.  Set encrypted if it's currently
    // encrypted.

    // ensure f2fs_fs is set to 0 first.
    if (f2fs_fs)
        *f2fs_fs = false;
    for (int i = 0; i < fstab->num_entries; ++i) {
        struct fstab_rec* v = &fstab->recs[i];
        if (!v->mount_point) {
            continue;
        }
        int len = strlen(v->mount_point);
        if (strncmp(path, v->mount_point, len) == 0 &&
            (path[len] == '/' || path[len] == 0)) {
            *encrypted = false;
            *encryptable = false;
            if (fs_mgr_is_encryptable(v) || fs_mgr_is_file_encrypted(v)) {
                *encryptable = true;
                if (android::base::GetProperty("ro.crypto.state", "") == "encrypted") {
                    *encrypted = true;
                }
            }
            if (f2fs_fs && strcmp(v->fs_type, "f2fs") == 0)
                *f2fs_fs = true;
            return v->blk_device;
        }
    }

    return NULL;
}

通过升级包路径（/data/xxx_ota_20180823.zip）获取升级包对应的device（/dev/block/data）,并且通过解析fstab判断（data）分区是否加密，*encrypted = true; 是否支持加密， *encryptable = true;

static bool write_status_to_socket(int status, int socket) {
    // If socket equals -1, uncrypt is in debug mode without socket communication.
    // Skip writing and return success.
    if (socket == -1) {
        return true;
    }
    int status_out = htonl(status);
    return android::base::WriteFully(socket, &status_out, sizeof(int));
}

通过socket保存uncrypt status

// Parse uncrypt_file to find the update package name.
static bool find_uncrypt_package(const std::string& uncrypt_path_file, std::string* package_name) {
    CHECK(package_name != nullptr);
    std::string uncrypt_path;
    if (!android::base::ReadFileToString(uncrypt_path_file, &uncrypt_path)) {
        PLOG(ERROR) << "failed to open \"" << uncrypt_path_file << "\"";
        return false;
    }

    // Remove the trailing '\n' if present.
    *package_name = android::base::Trim(uncrypt_path);
    return true;
}

通过读取/cache/recovery/uncrypt_file 获取原始升级包名字

static int retry_fibmap(const int fd, const char* name, int* block, const int head_block) {
    CHECK(block != nullptr);
    for (size_t i = 0; i < FIBMAP_RETRY_LIMIT; i++) {
        if (fsync(fd) == -1) {
            PLOG(ERROR) << "failed to fsync \"" << name << "\"";
            return kUncryptFileSyncError;
        }
        if (ioctl(fd, FIBMAP, block) != 0) {
            PLOG(ERROR) << "failed to find block " << head_block;
            return kUncryptIoctlError;
        }
        if (*block != 0) {
            return kUncryptNoError;
        }
        sleep(1);
    }
    LOG(ERROR) << "fibmap of " << head_block << "always returns 0";
    return kUncryptIoctlError;
}

通过 ioctl(fd, FIBMAP, block) 调用，获取升级包的每个block的数据，在 /dev/block/data的实际存储数据的block对应的索引。尝试三次后返回失败。

static int produce_block_map(const char* path, const char* map_file, const char* blk_dev,
                             bool encrypted, bool f2fs_fs, int socket) {
    std::string err;
    if (!android::base::RemoveFileIfExists(map_file, &err)) {
        LOG(ERROR) << "failed to remove the existing map file " << map_file << ": " << err;
        return kUncryptFileRemoveError;
    }
    std::string tmp_map_file = std::string(map_file) + ".tmp";
    android::base::unique_fd mapfd(open(tmp_map_file.c_str(),
                                        O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR));
    if (mapfd == -1) {
        PLOG(ERROR) << "failed to open " << tmp_map_file;
        return kUncryptFileOpenError;
    }

    // Make sure we can write to the socket.
    if (!write_status_to_socket(0, socket)) {
        LOG(ERROR) << "failed to write to socket " << socket;
        return kUncryptSocketWriteError;
    }

    struct stat sb;
    if (stat(path, &sb) != 0) {
        LOG(ERROR) << "failed to stat " << path;
        return kUncryptFileStatError;
    }

    LOG(INFO) << " block size: " << sb.st_blksize << " bytes";

    int blocks = ((sb.st_size-1) / sb.st_blksize) + 1;
    LOG(INFO) << "  file size: " << sb.st_size << " bytes, " << blocks << " blocks";

    std::vector<int> ranges;

    std::string s = android::base::StringPrintf("%s\n%" PRId64 " %" PRId64 "\n",
                       blk_dev, static_cast<int64_t>(sb.st_size),
                       static_cast<int64_t>(sb.st_blksize));
    if (!android::base::WriteStringToFd(s, mapfd)) {
        PLOG(ERROR) << "failed to write " << tmp_map_file;
        return kUncryptWriteError;
    }

    std::vector<std::vector<unsigned char>> buffers;
    if (encrypted) {
        buffers.resize(WINDOW_SIZE, std::vector<unsigned char>(sb.st_blksize));
    }
    int head_block = 0;
    int head = 0, tail = 0;

    android::base::unique_fd fd(open(path, O_RDONLY));
    if (fd == -1) {
        PLOG(ERROR) << "failed to open " << path << " for reading";
        return kUncryptFileOpenError;
    }

    android::base::unique_fd wfd;
    if (encrypted) {
        wfd.reset(open(blk_dev, O_WRONLY));
        if (wfd == -1) {
            PLOG(ERROR) << "failed to open " << blk_dev << " for writing";
            return kUncryptBlockOpenError;
        }
    }

#ifndef F2FS_IOC_SET_DONTMOVE
#ifndef F2FS_IOCTL_MAGIC
#define F2FS_IOCTL_MAGIC		0xf5
#endif
#define F2FS_IOC_SET_DONTMOVE		_IO(F2FS_IOCTL_MAGIC, 13)
#endif
    if (f2fs_fs && ioctl(fd, F2FS_IOC_SET_DONTMOVE) < 0) {
        PLOG(ERROR) << "Failed to set non-movable file for f2fs: " << path << " on " << blk_dev;
        return kUncryptIoctlError;
    }

    off64_t pos = 0;
    int last_progress = 0;
    while (pos < sb.st_size) {
        // Update the status file, progress must be between [0, 99].
        int progress = static_cast<int>(100 * (double(pos) / double(sb.st_size)));
        if (progress > last_progress) {
            last_progress = progress;
            write_status_to_socket(progress, socket);
        }

        if ((tail+1) % WINDOW_SIZE == head) {
            // write out head buffer
            int block = head_block;
            if (ioctl(fd, FIBMAP, &block) != 0) {
                PLOG(ERROR) << "failed to find block " << head_block;
                return kUncryptIoctlError;
            }

            if (block == 0) {
                LOG(ERROR) << "failed to find block " << head_block << ", retrying";
                int error = retry_fibmap(fd, path, &block, head_block);
                if (error != kUncryptNoError) {
                    return error;
                }
            }

            add_block_to_ranges(ranges, block);
            if (encrypted) {
                if (write_at_offset(buffers[head].data(), sb.st_blksize, wfd,
                                    static_cast<off64_t>(sb.st_blksize) * block) != 0) {
                    return kUncryptWriteError;
                }
            }
            head = (head + 1) % WINDOW_SIZE;
            ++head_block;
        }

        // read next block to tail
        if (encrypted) {
            size_t to_read = static_cast<size_t>(
                    std::min(static_cast<off64_t>(sb.st_blksize), sb.st_size - pos));
            if (!android::base::ReadFully(fd, buffers[tail].data(), to_read)) {
                PLOG(ERROR) << "failed to read " << path;
                return kUncryptReadError;
            }
            pos += to_read;
        } else {
            // If we're not encrypting; we don't need to actually read
            // anything, just skip pos forward as if we'd read a
            // block.
            pos += sb.st_blksize;
        }
        tail = (tail+1) % WINDOW_SIZE;
    }

    while (head != tail) {
        // write out head buffer
        int block = head_block;
        if (ioctl(fd, FIBMAP, &block) != 0) {
            PLOG(ERROR) << "failed to find block " << head_block;
            return kUncryptIoctlError;
        }

        if (block == 0) {
            LOG(ERROR) << "failed to find block " << head_block << ", retrying";
            int error = retry_fibmap(fd, path, &block, head_block);
            if (error != kUncryptNoError) {
                return error;
            }
        }

        add_block_to_ranges(ranges, block);
        if (encrypted) {
            if (write_at_offset(buffers[head].data(), sb.st_blksize, wfd,
                                static_cast<off64_t>(sb.st_blksize) * block) != 0) {
                return kUncryptWriteError;
            }
        }
        head = (head + 1) % WINDOW_SIZE;
        ++head_block;
    }

    if (!android::base::WriteStringToFd(
            android::base::StringPrintf("%zu\n", ranges.size() / 2), mapfd)) {
        PLOG(ERROR) << "failed to write " << tmp_map_file;
        return kUncryptWriteError;
    }
    for (size_t i = 0; i < ranges.size(); i += 2) {
        if (!android::base::WriteStringToFd(
                android::base::StringPrintf("%d %d\n", ranges[i], ranges[i+1]), mapfd)) {
            PLOG(ERROR) << "failed to write " << tmp_map_file;
            return kUncryptWriteError;
        }
    }

    if (fsync(mapfd) == -1) {
        PLOG(ERROR) << "failed to fsync \"" << tmp_map_file << "\"";
        return kUncryptFileSyncError;
    }
    if (close(mapfd.release()) == -1) {
        PLOG(ERROR) << "failed to close " << tmp_map_file;
        return kUncryptFileCloseError;
    }

    if (encrypted) {
        if (fsync(wfd) == -1) {
            PLOG(ERROR) << "failed to fsync \"" << blk_dev << "\"";
            return kUncryptFileSyncError;
        }
        if (close(wfd.release()) == -1) {
            PLOG(ERROR) << "failed to close " << blk_dev;
            return kUncryptFileCloseError;
        }
    }

    if (rename(tmp_map_file.c_str(), map_file) == -1) {
        PLOG(ERROR) << "failed to rename " << tmp_map_file << " to " << map_file;
        return kUncryptFileRenameError;
    }
    // Sync dir to make rename() result written to disk.
    std::string file_name = map_file;
    std::string dir_name = dirname(&file_name[0]);
    android::base::unique_fd dfd(open(dir_name.c_str(), O_RDONLY | O_DIRECTORY));
    if (dfd == -1) {
        PLOG(ERROR) << "failed to open dir " << dir_name;
        return kUncryptFileOpenError;
    }
    if (fsync(dfd) == -1) {
        PLOG(ERROR) << "failed to fsync " << dir_name;
        return kUncryptFileSyncError;
    }
    if (close(dfd.release()) == -1) {
        PLOG(ERROR) << "failed to close " << dir_name;
        return kUncryptFileCloseError;
    }
    return 0;
}

这个是最核心的函数了，主要就是通过这个函数来完成稀疏列表的生成，我们先看下函数的参数：

const char* path：  升级包路径，eg：/data/xxxx.zip

const char* map_file： map文件， eg：/cache/recovery/block.map

const char* blk_dev:    device设备， eg： /dev/block/data

bool encrypted:  是否加密

bool f2fs_fs： 是否是f2fs

int socket： socket句柄

把升级包/data/xxxx.zip生成稀疏的描述文件，保存在/cache/recovery/block.map， 即本函数的目的。

函数代码比较多，从上至下，主要的功能如下：

（1）删除/cache/recovery/block.map, 新建/cache/recovery/block.map.tmp文件

（2）确认对socket句柄对应的/dev/socket/uncrypt 有写的权限

（3）确认升级包存在

（4）block.map第一行保存为：/dev/block/data

第二行保存为：352268727 4096    （升级包大小， block大小）

（5）申请 5个block size大小的buffer空间。

（6）打开升级包（/data/xxxx.zip），句柄为fd, 打开device /dev/block/data,句柄为wfd。

（7）循环按照block size大小，通过偏移指定的block，获取每个block数据在device的实际block索引，保存升级包的实际存储block的稀疏列表。 如果data分区是加密的，那么每次获取每个block实际索引时，读取解密后的block数据到buffer， 每当有5个block数据时，然后把buffer数据写到实际的对应的索引block里。这样实际索引的block里存储的就是解密后的数据。

（8）最后把不足5个block数据的buffer写到对应的实际的block中去，这样稀疏列表包含的block中保存的就是解密后的升级包数据。

（9）把稀疏列表写到/cache/recovery/block.map.tmp

（10）关闭相关所有的句柄，/cache/recovery/block.map.tmp重名为/cache/recovery/block.map，fsync数据同步到磁盘。

static int uncrypt(const char* input_path, const char* map_file, const int socket) {
    LOG(INFO) << "update package is \"" << input_path << "\"";

    // Turn the name of the file we're supposed to convert into an absolute path, so we can find
    // what filesystem it's on.
    char path[PATH_MAX+1];
    if (realpath(input_path, path) == nullptr) {
        PLOG(ERROR) << "failed to convert \"" << input_path << "\" to absolute path";
        return kUncryptRealpathFindError;
    }

    bool encryptable;
    bool encrypted;
    bool f2fs_fs;
    const char* blk_dev = find_block_device(path, &encryptable, &encrypted, &f2fs_fs);
    if (blk_dev == nullptr) {
        LOG(ERROR) << "failed to find block device for " << path;
        return kUncryptBlockDeviceFindError;
    }

    // If the filesystem it's on isn't encrypted, we only produce the
    // block map, we don't rewrite the file contents (it would be
    // pointless to do so).
    LOG(INFO) << "encryptable: " << (encryptable ? "yes" : "no");
    LOG(INFO) << "  encrypted: " << (encrypted ? "yes" : "no");

    // Recovery supports installing packages from 3 paths: /cache,
    // /data, and /sdcard.  (On a particular device, other locations
    // may work, but those are three we actually expect.)
    //
    // On /data we want to convert the file to a block map so that we
    // can read the package without mounting the partition.  On /cache
    // and /sdcard we leave the file alone.
    if (strncmp(path, "/data/", 6) == 0) {
        LOG(INFO) << "writing block map " << map_file;
        return produce_block_map(path, map_file, blk_dev, encrypted, f2fs_fs, socket);
    }

    return 0;
}

uncrypt的函数接口:

（1）获取升级包的绝对路径

（2）通过升级包路径，获取升级包存储的device（/dev/block/data）

（3）判断路径，如果存储在/data 分区，则调用produce_block_map函数生成block.map

static void log_uncrypt_error_code(UncryptErrorCode error_code) {
    if (!android::base::WriteStringToFile(android::base::StringPrintf(
            "uncrypt_error: %d\n", error_code), UNCRYPT_STATUS)) {
        PLOG(WARNING) << "failed to write to " << UNCRYPT_STATUS;
    }
}

把uncrypt的错误code写到/cache/recovery/uncrypt_status

static bool uncrypt_wrapper(const char* input_path, const char* map_file, const int socket) {
    // Initialize the uncrypt error to kUncryptErrorPlaceholder.
    log_uncrypt_error_code(kUncryptErrorPlaceholder);

    std::string package;
    if (input_path == nullptr) {
        if (!find_uncrypt_package(UNCRYPT_PATH_FILE, &package)) {
            write_status_to_socket(-1, socket);
            // Overwrite the error message.
            log_uncrypt_error_code(kUncryptPackageMissingError);
            return false;
        }
        input_path = package.c_str();
    }
    CHECK(map_file != nullptr);

    auto start = std::chrono::system_clock::now();
    int status = uncrypt(input_path, map_file, socket);
    std::chrono::duration<double> duration = std::chrono::system_clock::now() - start;
    int count = static_cast<int>(duration.count());

    std::string uncrypt_message = android::base::StringPrintf("uncrypt_time: %d\n", count);
    if (status != 0) {
        // Log the time cost and error code if uncrypt fails.
        uncrypt_message += android::base::StringPrintf("uncrypt_error: %d\n", status);
        if (!android::base::WriteStringToFile(uncrypt_message, UNCRYPT_STATUS)) {
            PLOG(WARNING) << "failed to write to " << UNCRYPT_STATUS;
        }

        write_status_to_socket(-1, socket);
        return false;
    }

    if (!android::base::WriteStringToFile(uncrypt_message, UNCRYPT_STATUS)) {
        PLOG(WARNING) << "failed to write to " << UNCRYPT_STATUS;
    }

    write_status_to_socket(100, socket);

    return true;
}

uncrypt功能的入口函数， 根据 input_path 指定路径的升级包（如果input_path为空， 读取/cache/recovery/uncrypt_file），生成map_file文件。

static bool clear_bcb(const int socket) {
    std::string err;
    if (!clear_bootloader_message(&err)) {
        LOG(ERROR) << "failed to clear bootloader message: " << err;
        write_status_to_socket(-1, socket);
        return false;
    }
    write_status_to_socket(100, socket);
    return true;
}

static bool setup_bcb(const int socket) {
    // c5. receive message length
    int length;
    if (!android::base::ReadFully(socket, &length, 4)) {
        PLOG(ERROR) << "failed to read the length";
        return false;
    }
    length = ntohl(length);

    // c7. receive message
    std::string content;
    content.resize(length);
    if (!android::base::ReadFully(socket, &content[0], length)) {
        PLOG(ERROR) << "failed to read the message";
        return false;
    }
    LOG(INFO) << "  received command: [" << content << "] (" << content.size() << ")";
    std::vector<std::string> options = android::base::Split(content, "\n");
    std::string wipe_package;
    for (auto& option : options) {
        if (android::base::StartsWith(option, "--wipe_package=")) {
            std::string path = option.substr(strlen("--wipe_package="));
            if (!android::base::ReadFileToString(path, &wipe_package)) {
                PLOG(ERROR) << "failed to read " << path;
                return false;
            }
            option = android::base::StringPrintf("--wipe_package_size=%zu", wipe_package.size());
        }
    }

    // c8. setup the bcb command
    std::string err;
    if (!write_bootloader_message(options, &err)) {
        LOG(ERROR) << "failed to set bootloader message: " << err;
        write_status_to_socket(-1, socket);
        return false;
    }
    if (!wipe_package.empty() && !write_wipe_package(wipe_package, &err)) {
        PLOG(ERROR) << "failed to set wipe package: " << err;
        write_status_to_socket(-1, socket);
        return false;
    }
    // c10. send "100" status
    write_status_to_socket(100, socket);
    return true;
}

uncrypt --clear-bcb  清除bcb数据

uncrypt --setup-bcb 设置bcb数据

static void usage(const char* exename) {
    fprintf(stderr, "Usage of %s:\n", exename);
    fprintf(stderr, "%s [<package_path> <map_file>]  Uncrypt ota package.\n", exename);
    fprintf(stderr, "%s --clear-bcb  Clear BCB data in misc partition.\n", exename);
    fprintf(stderr, "%s --setup-bcb  Setup BCB data by command file.\n", exename);
}

int main(int argc, char** argv) {

......

}

usage 与 main 函数就不再解释了，没啥好解释的了，到此uncrypt.cpp所有的功能函数都解释了。

我们使用uncrypt生成一个block.map试试

uncrypt /data/ota.zip /cache/recovery/block.map 

console:/ # cat /cache/recovery/block.map
/dev/block/data
352268727 4096
7
1098851 1098867
38064 38080
38112 38144
38208 38400
43520 63744
65536 98304
100352 133108

即把/data/ota.zip 生成了 /cache/recovery/block.map文件， 通过/cache/recovery/block.map中的block稀疏描述，就可以获取升级包升级了。