From 71c6c50d0da1f32dd18a749797e88de2358c5ba1 Mon Sep 17 00:00:00 2001
From: nkk71 <nkk71x@gmail.com>
Date: Thu, 5 Jan 2017 23:55:05 +0200
Subject: crypto: Use system's vold for decryption

  If TWRP crypto fails to decrypt partition, mount the system
  partition and use system's own vold to attempt decryption.
  This provides a fallback for proprietary OEM encryption as well as
  encryption methods which TWRP hasn't been updated for.

  Requirements in device tree:
  * fstab.{ro.hardware} in device/recovery/root
    The fstab does not need to be complete, but it does need the
    data partition and the encryption entries.

  * 'TW_CRYPTO_USE_SYSTEM_VOLD := true' in BoardConfig
  or
  * 'TW_CRYPTO_USE_SYSTEM_VOLD := <list of services>'

  Notes:
  * Setting the flag to 'true' will just use system's vdc+vold
    or
  * Setting the flag with additional services, will also start them
    prior to attempting vdc+vold decryption, eg: for qualcomm based
    devices you usually need 'TW_CRYPTO_USE_SYSTEM_VOLD := qseecomd'

  * For each service listed an additional import will be automatically
    added to the vold_decrypt.rc file in the form of
    init.recovery.vold_decrypt.{service}.rc
    You will need to add any not already existing .rc files in
    your device/recovery/root folder.

  * The service names specified in the vold_decrypt.{service}.rc files
    have to be named 'sys_{service}'
    eg: 'service sys_qseecomd /system/bin/qseecomd'

  * Any service already existing in TWRP as {service} or sbin{service} will
    be stopped and restarted as needed.

  * You can override the default init.recovery.vold_decrypt.rc file(s)
    by placing same named ones in your device/recovery/root folder.
    If you do, you'll need to manually add the needed imports.

  * If /vendor and /firmware folders are temporarily moved and symlinked
    to the folders and files in the system partition, the properties
    'vold_decrypt.symlinked_vendor' and 'vold_decrypt.symlinked_firmware'
    will be set to 1.
    This allows for additional control in the .rc files for any extra
    actions (symlinks, cp files, etc) that may be needed for decryption
    by using: on property:vold_decrypt.symlinked_vendor=1 and/or
    on property:vold_decrypt.symlinked_firmware=1 triggers.

  Debug mode: 'TW_CRYPTO_SYSTEM_VOLD_DEBUG := true' in BoardConfig
  * Specifying this flag, will enable strace on init and vdc, which will
    create separate log files in /tmp for every process created, allowing
    for detailed analysis of which services and files are being accessed.
  * Note that enabling strace will expose the password in the logs!!
  * You need to manually add strace to your build.

Thanks to @Captain_Throwback for co-authoring and testing.

Tested successfully on HTC devices:
M8 (KK through MM), M9 (MM and N), A9 (N), 10 (N), Bolt (N),
Desire 626s (MM), U Ultra (N)

HTC One X9 (MTK device)

And by Nikolay Jeliazkov on: Xiaomi Mi Max

Change-Id: I4d22ab55baf6a2a50adde2e4c1c510c142714227
---
 partitionmanager.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'partitionmanager.cpp')

diff --git a/partitionmanager.cpp b/partitionmanager.cpp
index c1b857ca9..8aceec268 100644
--- a/partitionmanager.cpp
+++ b/partitionmanager.cpp
@@ -65,6 +65,9 @@ extern "C" {
 	#ifdef TW_INCLUDE_FBE
 		#include "crypto/ext4crypt/Decrypt.h"
 	#endif
+	#ifdef TW_CRYPTO_USE_SYSTEM_VOLD
+		#include "crypto/vold_decrypt/vold_decrypt.h"
+	#endif
 #endif
 
 #ifdef AB_OTA_UPDATER
@@ -1569,6 +1572,12 @@ int TWPartitionManager::Decrypt_Device(string Password) {
 			pwret = WEXITSTATUS(status) ? -1 : 0;
 	}
 
+#ifdef TW_CRYPTO_USE_SYSTEM_VOLD
+	if (pwret != 0) {
+		pwret = vold_decrypt(Password);
+	}
+#endif // TW_CRYPTO_USE_SYSTEM_VOLD
+
 	// Unmount any partitions that were needed for decrypt
 	for (iter = Partitions.begin(); iter != Partitions.end(); iter++) {
 		if ((*iter)->Mount_To_Decrypt) {
-- 
cgit v1.2.3