BackupManagerService.java revision fc637c168efff18ad9252c65a231e5c62d228df8
1/* 2 * Copyright (C) 2009 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17package com.android.server.backup; 18 19import static android.app.backup.BackupManagerMonitor.EXTRA_LOG_EVENT_PACKAGE_NAME; 20import static android.app.backup.BackupManagerMonitor.EXTRA_LOG_EVENT_PACKAGE_VERSION; 21import static android.app.backup.BackupManagerMonitor.EXTRA_LOG_OLD_VERSION; 22import static android.app.backup.BackupManagerMonitor.EXTRA_LOG_POLICY_ALLOW_APKS; 23import static android.app.backup.BackupManagerMonitor.EXTRA_LOG_MANIFEST_PACKAGE_NAME; 24import static android.app.backup.BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT; 25import static android.app.backup.BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY; 26import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_VERSION_OF_BACKUP_OLDER; 27import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_FULL_RESTORE_SIGNATURE_MISMATCH; 28import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_SYSTEM_APP_NO_AGENT; 29import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_FULL_RESTORE_ALLOW_BACKUP_FALSE; 30import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_APK_NOT_INSTALLED; 31import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_CANNOT_RESTORE_WITHOUT_APK; 32import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_MISSING_SIGNATURE; 33import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_EXPECTED_DIFFERENT_PACKAGE; 34import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_RESTORE_ANY_VERSION; 35import static android.app.backup.BackupManagerMonitor.LOG_EVENT_ID_VERSIONS_MATCH; 36import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_BACKUP_IN_FOREGROUND; 37 38import android.app.ActivityManager; 39import android.app.AlarmManager; 40import android.app.AppGlobals; 41import android.app.ApplicationThreadConstants; 42import android.app.IActivityManager; 43import android.app.IBackupAgent; 44import android.app.PackageInstallObserver; 45import android.app.PendingIntent; 46import android.app.backup.BackupAgent; 47import android.app.backup.BackupDataInput; 48import android.app.backup.BackupDataOutput; 49import android.app.backup.BackupManager; 50import android.app.backup.BackupManagerMonitor; 51import android.app.backup.BackupProgress; 52import android.app.backup.BackupTransport; 53import android.app.backup.FullBackup; 54import android.app.backup.FullBackupDataOutput; 55import android.app.backup.IBackupManager; 56import android.app.backup.IBackupManagerMonitor; 57import android.app.backup.IBackupObserver; 58import android.app.backup.IFullBackupRestoreObserver; 59import android.app.backup.IRestoreObserver; 60import android.app.backup.IRestoreSession; 61import android.app.backup.ISelectBackupTransportCallback; 62import android.app.backup.RestoreDescription; 63import android.app.backup.RestoreSet; 64import android.app.backup.SelectBackupTransportCallback; 65import android.content.ActivityNotFoundException; 66import android.content.BroadcastReceiver; 67import android.content.ComponentName; 68import android.content.ContentResolver; 69import android.content.Context; 70import android.content.Intent; 71import android.content.IntentFilter; 72import android.content.ServiceConnection; 73import android.content.pm.ApplicationInfo; 74import android.content.pm.IPackageDataObserver; 75import android.content.pm.IPackageDeleteObserver; 76import android.content.pm.IPackageManager; 77import android.content.pm.PackageInfo; 78import android.content.pm.PackageManager; 79import android.content.pm.PackageManager.NameNotFoundException; 80import android.content.pm.Signature; 81import android.database.ContentObserver; 82import android.net.Uri; 83import android.os.PowerSaveState; 84import android.os.Binder; 85import android.os.Build; 86import android.os.Bundle; 87import android.os.Environment; 88import android.os.Environment.UserEnvironment; 89import android.os.Handler; 90import android.os.HandlerThread; 91import android.os.IBinder; 92import android.os.Looper; 93import android.os.Message; 94import android.os.ParcelFileDescriptor; 95import android.os.PowerManager; 96import android.os.Process; 97import android.os.RemoteException; 98import android.os.SELinux; 99import android.os.ServiceManager; 100import android.os.SystemClock; 101import android.os.UserHandle; 102import android.os.WorkSource; 103import android.os.storage.IStorageManager; 104import android.os.storage.StorageManager; 105import android.provider.Settings; 106import android.system.ErrnoException; 107import android.system.Os; 108import android.text.TextUtils; 109import android.util.AtomicFile; 110import android.util.EventLog; 111import android.util.Log; 112import android.util.Pair; 113import android.util.Slog; 114import android.util.SparseArray; 115import android.util.StringBuilderPrinter; 116 117import com.android.internal.annotations.GuardedBy; 118import com.android.internal.backup.IBackupTransport; 119import com.android.internal.backup.IObbBackupService; 120import com.android.internal.util.DumpUtils; 121import com.android.server.AppWidgetBackupBridge; 122import com.android.server.EventLogTags; 123import com.android.server.SystemConfig; 124import com.android.server.SystemService; 125import com.android.server.backup.PackageManagerBackupAgent.Metadata; 126import com.android.server.power.BatterySaverPolicy.ServiceType; 127 128import libcore.io.IoUtils; 129 130import java.io.BufferedInputStream; 131import java.io.BufferedOutputStream; 132import java.io.ByteArrayInputStream; 133import java.io.ByteArrayOutputStream; 134import java.io.DataInputStream; 135import java.io.DataOutputStream; 136import java.io.EOFException; 137import java.io.File; 138import java.io.FileDescriptor; 139import java.io.FileInputStream; 140import java.io.FileNotFoundException; 141import java.io.FileOutputStream; 142import java.io.IOException; 143import java.io.InputStream; 144import java.io.OutputStream; 145import java.io.PrintWriter; 146import java.io.RandomAccessFile; 147import java.security.InvalidAlgorithmParameterException; 148import java.security.InvalidKeyException; 149import java.security.Key; 150import java.security.MessageDigest; 151import java.security.NoSuchAlgorithmException; 152import java.security.SecureRandom; 153import java.security.spec.InvalidKeySpecException; 154import java.security.spec.KeySpec; 155import java.text.SimpleDateFormat; 156import java.util.ArrayDeque; 157import java.util.ArrayList; 158import java.util.Arrays; 159import java.util.Collections; 160import java.util.Date; 161import java.util.HashMap; 162import java.util.HashSet; 163import java.util.Iterator; 164import java.util.List; 165import java.util.Map.Entry; 166import java.util.Objects; 167import java.util.Queue; 168import java.util.Random; 169import java.util.Set; 170import java.util.TreeMap; 171import java.util.concurrent.CountDownLatch; 172import java.util.concurrent.TimeUnit; 173import java.util.concurrent.atomic.AtomicBoolean; 174import java.util.concurrent.atomic.AtomicInteger; 175import java.util.concurrent.atomic.AtomicLong; 176import java.util.zip.Deflater; 177import java.util.zip.DeflaterOutputStream; 178import java.util.zip.InflaterInputStream; 179 180import javax.crypto.BadPaddingException; 181import javax.crypto.Cipher; 182import javax.crypto.CipherInputStream; 183import javax.crypto.CipherOutputStream; 184import javax.crypto.IllegalBlockSizeException; 185import javax.crypto.NoSuchPaddingException; 186import javax.crypto.SecretKey; 187import javax.crypto.SecretKeyFactory; 188import javax.crypto.spec.IvParameterSpec; 189import javax.crypto.spec.PBEKeySpec; 190import javax.crypto.spec.SecretKeySpec; 191 192public class BackupManagerService implements BackupManagerServiceInterface { 193 194 private static final String TAG = "BackupManagerService"; 195 static final boolean DEBUG = true; 196 static final boolean MORE_DEBUG = false; 197 static final boolean DEBUG_SCHEDULING = MORE_DEBUG || true; 198 199 // File containing backup-enabled state. Contains a single byte; 200 // nonzero == enabled. File missing or contains a zero byte == disabled. 201 static final String BACKUP_ENABLE_FILE = "backup_enabled"; 202 203 // System-private key used for backing up an app's widget state. Must 204 // begin with U+FFxx by convention (we reserve all keys starting 205 // with U+FF00 or higher for system use). 206 static final String KEY_WIDGET_STATE = "\uffed\uffedwidget"; 207 208 // Historical and current algorithm names 209 static final String PBKDF_CURRENT = "PBKDF2WithHmacSHA1"; 210 static final String PBKDF_FALLBACK = "PBKDF2WithHmacSHA1And8bit"; 211 212 // Name and current contents version of the full-backup manifest file 213 // 214 // Manifest version history: 215 // 216 // 1 : initial release 217 static final String BACKUP_MANIFEST_FILENAME = "_manifest"; 218 static final int BACKUP_MANIFEST_VERSION = 1; 219 220 // External archive format version history: 221 // 222 // 1 : initial release 223 // 2 : no format change per se; version bump to facilitate PBKDF2 version skew detection 224 // 3 : introduced "_meta" metadata file; no other format change per se 225 // 4 : added support for new device-encrypted storage locations 226 // 5 : added support for key-value packages 227 static final int BACKUP_FILE_VERSION = 5; 228 static final String BACKUP_FILE_HEADER_MAGIC = "ANDROID BACKUP\n"; 229 static final int BACKUP_PW_FILE_VERSION = 2; 230 static final String BACKUP_METADATA_FILENAME = "_meta"; 231 static final int BACKUP_METADATA_VERSION = 1; 232 static final int BACKUP_WIDGET_METADATA_TOKEN = 0x01FFED01; 233 234 static final int TAR_HEADER_LONG_RADIX = 8; 235 static final int TAR_HEADER_OFFSET_FILESIZE = 124; 236 static final int TAR_HEADER_LENGTH_FILESIZE = 12; 237 static final int TAR_HEADER_OFFSET_MODTIME = 136; 238 static final int TAR_HEADER_LENGTH_MODTIME = 12; 239 static final int TAR_HEADER_OFFSET_MODE = 100; 240 static final int TAR_HEADER_LENGTH_MODE = 8; 241 static final int TAR_HEADER_OFFSET_PATH_PREFIX = 345; 242 static final int TAR_HEADER_LENGTH_PATH_PREFIX = 155; 243 static final int TAR_HEADER_OFFSET_PATH = 0; 244 static final int TAR_HEADER_LENGTH_PATH = 100; 245 static final int TAR_HEADER_OFFSET_TYPE_CHAR = 156; 246 247 static final boolean COMPRESS_FULL_BACKUPS = true; // should be true in production 248 249 static final String SETTINGS_PACKAGE = "com.android.providers.settings"; 250 static final String SHARED_BACKUP_AGENT_PACKAGE = "com.android.sharedstoragebackup"; 251 static final String SERVICE_ACTION_TRANSPORT_HOST = "android.backup.TRANSPORT_HOST"; 252 253 // Retry interval for clear/init when the transport is unavailable 254 private static final long TRANSPORT_RETRY_INTERVAL = 1 * AlarmManager.INTERVAL_HOUR; 255 256 private static final String RUN_BACKUP_ACTION = "android.app.backup.intent.RUN"; 257 private static final String RUN_INITIALIZE_ACTION = "android.app.backup.intent.INIT"; 258 private static final int MSG_RUN_BACKUP = 1; 259 private static final int MSG_RUN_ADB_BACKUP = 2; 260 private static final int MSG_RUN_RESTORE = 3; 261 private static final int MSG_RUN_CLEAR = 4; 262 private static final int MSG_RUN_INITIALIZE = 5; 263 private static final int MSG_RUN_GET_RESTORE_SETS = 6; 264 private static final int MSG_RESTORE_SESSION_TIMEOUT = 8; 265 private static final int MSG_FULL_CONFIRMATION_TIMEOUT = 9; 266 private static final int MSG_RUN_ADB_RESTORE = 10; 267 private static final int MSG_RETRY_INIT = 11; 268 private static final int MSG_RETRY_CLEAR = 12; 269 private static final int MSG_WIDGET_BROADCAST = 13; 270 private static final int MSG_RUN_FULL_TRANSPORT_BACKUP = 14; 271 private static final int MSG_REQUEST_BACKUP = 15; 272 private static final int MSG_SCHEDULE_BACKUP_PACKAGE = 16; 273 private static final int MSG_BACKUP_OPERATION_TIMEOUT = 17; 274 private static final int MSG_RESTORE_OPERATION_TIMEOUT = 18; 275 276 // backup task state machine tick 277 static final int MSG_BACKUP_RESTORE_STEP = 20; 278 static final int MSG_OP_COMPLETE = 21; 279 280 // Timeout interval for deciding that a bind or clear-data has taken too long 281 static final long TIMEOUT_INTERVAL = 10 * 1000; 282 283 // Timeout intervals for agent backup & restore operations 284 static final long TIMEOUT_BACKUP_INTERVAL = 30 * 1000; 285 static final long TIMEOUT_FULL_BACKUP_INTERVAL = 5 * 60 * 1000; 286 static final long TIMEOUT_SHARED_BACKUP_INTERVAL = 30 * 60 * 1000; 287 static final long TIMEOUT_RESTORE_INTERVAL = 60 * 1000; 288 static final long TIMEOUT_RESTORE_FINISHED_INTERVAL = 30 * 1000; 289 290 // User confirmation timeout for a full backup/restore operation. It's this long in 291 // order to give them time to enter the backup password. 292 static final long TIMEOUT_FULL_CONFIRMATION = 60 * 1000; 293 294 // How long between attempts to perform a full-data backup of any given app 295 static final long MIN_FULL_BACKUP_INTERVAL = 1000 * 60 * 60 * 24; // one day 296 297 // If an app is busy when we want to do a full-data backup, how long to defer the retry. 298 // This is fuzzed, so there are two parameters; backoff_min + Rand[0, backoff_fuzz) 299 static final long BUSY_BACKOFF_MIN_MILLIS = 1000 * 60 * 60; // one hour 300 static final int BUSY_BACKOFF_FUZZ = 1000 * 60 * 60 * 2; // two hours 301 302 Context mContext; 303 private PackageManager mPackageManager; 304 IPackageManager mPackageManagerBinder; 305 private IActivityManager mActivityManager; 306 private PowerManager mPowerManager; 307 private AlarmManager mAlarmManager; 308 private IStorageManager mStorageManager; 309 310 IBackupManager mBackupManagerBinder; 311 312 private final TransportManager mTransportManager; 313 314 boolean mEnabled; // access to this is synchronized on 'this' 315 boolean mProvisioned; 316 boolean mAutoRestore; 317 PowerManager.WakeLock mWakelock; 318 HandlerThread mHandlerThread; 319 BackupHandler mBackupHandler; 320 PendingIntent mRunBackupIntent, mRunInitIntent; 321 BroadcastReceiver mRunBackupReceiver, mRunInitReceiver; 322 // map UIDs to the set of participating packages under that UID 323 final SparseArray<HashSet<String>> mBackupParticipants 324 = new SparseArray<HashSet<String>>(); 325 // set of backup services that have pending changes 326 class BackupRequest { 327 public String packageName; 328 329 BackupRequest(String pkgName) { 330 packageName = pkgName; 331 } 332 333 public String toString() { 334 return "BackupRequest{pkg=" + packageName + "}"; 335 } 336 } 337 // Backups that we haven't started yet. Keys are package names. 338 HashMap<String,BackupRequest> mPendingBackups 339 = new HashMap<String,BackupRequest>(); 340 341 // Pseudoname that we use for the Package Manager metadata "package" 342 static final String PACKAGE_MANAGER_SENTINEL = "@pm@"; 343 344 // locking around the pending-backup management 345 final Object mQueueLock = new Object(); 346 347 // The thread performing the sequence of queued backups binds to each app's agent 348 // in succession. Bind notifications are asynchronously delivered through the 349 // Activity Manager; use this lock object to signal when a requested binding has 350 // completed. 351 final Object mAgentConnectLock = new Object(); 352 IBackupAgent mConnectedAgent; 353 volatile boolean mBackupRunning; 354 volatile boolean mConnecting; 355 volatile long mLastBackupPass; 356 357 // For debugging, we maintain a progress trace of operations during backup 358 static final boolean DEBUG_BACKUP_TRACE = true; 359 final List<String> mBackupTrace = new ArrayList<String>(); 360 361 // A similar synchronization mechanism around clearing apps' data for restore 362 final Object mClearDataLock = new Object(); 363 volatile boolean mClearingData; 364 365 @GuardedBy("mPendingRestores") 366 private boolean mIsRestoreInProgress; 367 @GuardedBy("mPendingRestores") 368 private final Queue<PerformUnifiedRestoreTask> mPendingRestores = new ArrayDeque<>(); 369 370 ActiveRestoreSession mActiveRestoreSession; 371 372 // Watch the device provisioning operation during setup 373 ContentObserver mProvisionedObserver; 374 375 // The published binder is actually to a singleton trampoline object that calls 376 // through to the proper code. This indirection lets us turn down the heavy 377 // implementation object on the fly without disturbing binders that have been 378 // cached elsewhere in the system. 379 static Trampoline sInstance; 380 static Trampoline getInstance() { 381 // Always constructed during system bringup, so no need to lazy-init 382 return sInstance; 383 } 384 385 public static final class Lifecycle extends SystemService { 386 387 public Lifecycle(Context context) { 388 super(context); 389 sInstance = new Trampoline(context); 390 } 391 392 @Override 393 public void onStart() { 394 publishBinderService(Context.BACKUP_SERVICE, sInstance); 395 } 396 397 @Override 398 public void onUnlockUser(int userId) { 399 if (userId == UserHandle.USER_SYSTEM) { 400 sInstance.initialize(userId); 401 402 // Migrate legacy setting 403 if (!backupSettingMigrated(userId)) { 404 if (DEBUG) { 405 Slog.i(TAG, "Backup enable apparently not migrated"); 406 } 407 final ContentResolver r = sInstance.mContext.getContentResolver(); 408 final int enableState = Settings.Secure.getIntForUser(r, 409 Settings.Secure.BACKUP_ENABLED, -1, userId); 410 if (enableState >= 0) { 411 if (DEBUG) { 412 Slog.i(TAG, "Migrating enable state " + (enableState != 0)); 413 } 414 writeBackupEnableState(enableState != 0, userId); 415 Settings.Secure.putStringForUser(r, 416 Settings.Secure.BACKUP_ENABLED, null, userId); 417 } else { 418 if (DEBUG) { 419 Slog.i(TAG, "Backup not yet configured; retaining null enable state"); 420 } 421 } 422 } 423 424 try { 425 sInstance.setBackupEnabled(readBackupEnableState(userId)); 426 } catch (RemoteException e) { 427 // can't happen; it's a local object 428 } 429 } 430 } 431 } 432 433 class ProvisionedObserver extends ContentObserver { 434 public ProvisionedObserver(Handler handler) { 435 super(handler); 436 } 437 438 public void onChange(boolean selfChange) { 439 final boolean wasProvisioned = mProvisioned; 440 final boolean isProvisioned = deviceIsProvisioned(); 441 // latch: never unprovision 442 mProvisioned = wasProvisioned || isProvisioned; 443 if (MORE_DEBUG) { 444 Slog.d(TAG, "Provisioning change: was=" + wasProvisioned 445 + " is=" + isProvisioned + " now=" + mProvisioned); 446 } 447 448 synchronized (mQueueLock) { 449 if (mProvisioned && !wasProvisioned && mEnabled) { 450 // we're now good to go, so start the backup alarms 451 if (MORE_DEBUG) Slog.d(TAG, "Now provisioned, so starting backups"); 452 KeyValueBackupJob.schedule(mContext); 453 scheduleNextFullBackupJob(0); 454 } 455 } 456 } 457 } 458 459 class RestoreGetSetsParams { 460 public IBackupTransport transport; 461 public ActiveRestoreSession session; 462 public IRestoreObserver observer; 463 public IBackupManagerMonitor monitor; 464 465 RestoreGetSetsParams(IBackupTransport _transport, ActiveRestoreSession _session, 466 IRestoreObserver _observer, IBackupManagerMonitor _monitor) { 467 transport = _transport; 468 session = _session; 469 observer = _observer; 470 monitor = _monitor; 471 } 472 } 473 474 class RestoreParams { 475 public IBackupTransport transport; 476 public String dirName; 477 public IRestoreObserver observer; 478 public IBackupManagerMonitor monitor; 479 public long token; 480 public PackageInfo pkgInfo; 481 public int pmToken; // in post-install restore, the PM's token for this transaction 482 public boolean isSystemRestore; 483 public String[] filterSet; 484 485 /** 486 * Restore a single package; no kill after restore 487 */ 488 RestoreParams(IBackupTransport _transport, String _dirName, IRestoreObserver _obs, 489 IBackupManagerMonitor _monitor, long _token, PackageInfo _pkg) { 490 transport = _transport; 491 dirName = _dirName; 492 observer = _obs; 493 monitor = _monitor; 494 token = _token; 495 pkgInfo = _pkg; 496 pmToken = 0; 497 isSystemRestore = false; 498 filterSet = null; 499 } 500 501 /** 502 * Restore at install: PM token needed, kill after restore 503 */ 504 RestoreParams(IBackupTransport _transport, String _dirName, IRestoreObserver _obs, 505 IBackupManagerMonitor _monitor, long _token, String _pkgName, int _pmToken) { 506 transport = _transport; 507 dirName = _dirName; 508 observer = _obs; 509 monitor = _monitor; 510 token = _token; 511 pkgInfo = null; 512 pmToken = _pmToken; 513 isSystemRestore = false; 514 filterSet = new String[] { _pkgName }; 515 } 516 517 /** 518 * Restore everything possible. This is the form that Setup Wizard or similar 519 * restore UXes use. 520 */ 521 RestoreParams(IBackupTransport _transport, String _dirName, IRestoreObserver _obs, 522 IBackupManagerMonitor _monitor, long _token) { 523 transport = _transport; 524 dirName = _dirName; 525 observer = _obs; 526 monitor = _monitor; 527 token = _token; 528 pkgInfo = null; 529 pmToken = 0; 530 isSystemRestore = true; 531 filterSet = null; 532 } 533 534 /** 535 * Restore some set of packages. Leave this one up to the caller to specify 536 * whether it's to be considered a system-level restore. 537 */ 538 RestoreParams(IBackupTransport _transport, String _dirName, IRestoreObserver _obs, 539 IBackupManagerMonitor _monitor, long _token, 540 String[] _filterSet, boolean _isSystemRestore) { 541 transport = _transport; 542 dirName = _dirName; 543 observer = _obs; 544 monitor = _monitor; 545 token = _token; 546 pkgInfo = null; 547 pmToken = 0; 548 isSystemRestore = _isSystemRestore; 549 filterSet = _filterSet; 550 } 551 } 552 553 class ClearParams { 554 public IBackupTransport transport; 555 public PackageInfo packageInfo; 556 557 ClearParams(IBackupTransport _transport, PackageInfo _info) { 558 transport = _transport; 559 packageInfo = _info; 560 } 561 } 562 563 class ClearRetryParams { 564 public String transportName; 565 public String packageName; 566 567 ClearRetryParams(String transport, String pkg) { 568 transportName = transport; 569 packageName = pkg; 570 } 571 } 572 573 // Parameters used by adbBackup() and adbRestore() 574 class AdbParams { 575 public ParcelFileDescriptor fd; 576 public final AtomicBoolean latch; 577 public IFullBackupRestoreObserver observer; 578 public String curPassword; // filled in by the confirmation step 579 public String encryptPassword; 580 581 AdbParams() { 582 latch = new AtomicBoolean(false); 583 } 584 } 585 586 class AdbBackupParams extends AdbParams { 587 public boolean includeApks; 588 public boolean includeObbs; 589 public boolean includeShared; 590 public boolean doWidgets; 591 public boolean allApps; 592 public boolean includeSystem; 593 public boolean doCompress; 594 public boolean includeKeyValue; 595 public String[] packages; 596 597 AdbBackupParams(ParcelFileDescriptor output, boolean saveApks, boolean saveObbs, 598 boolean saveShared, boolean alsoWidgets, boolean doAllApps, boolean doSystem, 599 boolean compress, boolean doKeyValue, String[] pkgList) { 600 fd = output; 601 includeApks = saveApks; 602 includeObbs = saveObbs; 603 includeShared = saveShared; 604 doWidgets = alsoWidgets; 605 allApps = doAllApps; 606 includeSystem = doSystem; 607 doCompress = compress; 608 includeKeyValue = doKeyValue; 609 packages = pkgList; 610 } 611 } 612 613 class AdbRestoreParams extends AdbParams { 614 AdbRestoreParams(ParcelFileDescriptor input) { 615 fd = input; 616 } 617 } 618 619 class BackupParams { 620 public IBackupTransport transport; 621 public String dirName; 622 public ArrayList<String> kvPackages; 623 public ArrayList<String> fullPackages; 624 public IBackupObserver observer; 625 public IBackupManagerMonitor monitor; 626 public boolean userInitiated; 627 public boolean nonIncrementalBackup; 628 629 BackupParams(IBackupTransport transport, String dirName, ArrayList<String> kvPackages, 630 ArrayList<String> fullPackages, IBackupObserver observer, 631 IBackupManagerMonitor monitor,boolean userInitiated, boolean nonIncrementalBackup) { 632 this.transport = transport; 633 this.dirName = dirName; 634 this.kvPackages = kvPackages; 635 this.fullPackages = fullPackages; 636 this.observer = observer; 637 this.monitor = monitor; 638 this.userInitiated = userInitiated; 639 this.nonIncrementalBackup = nonIncrementalBackup; 640 } 641 } 642 643 // Bookkeeping of in-flight operations for timeout etc. purposes. The operation 644 // token is the index of the entry in the pending-operations list. 645 static final int OP_PENDING = 0; 646 static final int OP_ACKNOWLEDGED = 1; 647 static final int OP_TIMEOUT = -1; 648 649 // Waiting for backup agent to respond during backup operation. 650 static final int OP_TYPE_BACKUP_WAIT = 0; 651 652 // Waiting for backup agent to respond during restore operation. 653 static final int OP_TYPE_RESTORE_WAIT = 1; 654 655 // An entire backup operation spanning multiple packages. 656 private static final int OP_TYPE_BACKUP = 2; 657 658 class Operation { 659 int state; 660 final BackupRestoreTask callback; 661 final int type; 662 663 Operation(int initialState, BackupRestoreTask callbackObj, int type) { 664 state = initialState; 665 callback = callbackObj; 666 this.type = type; 667 } 668 } 669 670 /** 671 * mCurrentOperations contains the list of currently active operations. 672 * 673 * If type of operation is OP_TYPE_WAIT, it are waiting for an ack or timeout. 674 * An operation wraps a BackupRestoreTask within it. 675 * It's the responsibility of this task to remove the operation from this array. 676 * 677 * A BackupRestore task gets notified of ack/timeout for the operation via 678 * BackupRestoreTask#handleCancel, BackupRestoreTask#operationComplete and notifyAll called 679 * on the mCurrentOpLock. {@link BackupManagerService#waitUntilOperationComplete(int)} is 680 * used in various places to 'wait' for notifyAll and detect change of pending state of an 681 * operation. So typically, an operation will be removed from this array by: 682 * - BackupRestoreTask#handleCancel and 683 * - BackupRestoreTask#operationComplete OR waitUntilOperationComplete. Do not remove at both 684 * these places because waitUntilOperationComplete relies on the operation being present to 685 * determine its completion status. 686 * 687 * If type of operation is OP_BACKUP, it is a task running backups. It provides a handle to 688 * cancel backup tasks. 689 */ 690 @GuardedBy("mCurrentOpLock") 691 final SparseArray<Operation> mCurrentOperations = new SparseArray<Operation>(); 692 final Object mCurrentOpLock = new Object(); 693 final Random mTokenGenerator = new Random(); 694 final AtomicInteger mNextToken = new AtomicInteger(); 695 696 final SparseArray<AdbParams> mAdbBackupRestoreConfirmations = new SparseArray<AdbParams>(); 697 698 // Where we keep our journal files and other bookkeeping 699 File mBaseStateDir; 700 File mDataDir; 701 File mJournalDir; 702 File mJournal; 703 704 // Backup password, if any, and the file where it's saved. What is stored is not the 705 // password text itself; it's the result of a PBKDF2 hash with a randomly chosen (but 706 // persisted) salt. Validation is performed by running the challenge text through the 707 // same PBKDF2 cycle with the persisted salt; if the resulting derived key string matches 708 // the saved hash string, then the challenge text matches the originally supplied 709 // password text. 710 private final SecureRandom mRng = new SecureRandom(); 711 private String mPasswordHash; 712 private File mPasswordHashFile; 713 private int mPasswordVersion; 714 private File mPasswordVersionFile; 715 private byte[] mPasswordSalt; 716 717 // Configuration of PBKDF2 that we use for generating pw hashes and intermediate keys 718 static final int PBKDF2_HASH_ROUNDS = 10000; 719 static final int PBKDF2_KEY_SIZE = 256; // bits 720 static final int PBKDF2_SALT_SIZE = 512; // bits 721 static final String ENCRYPTION_ALGORITHM_NAME = "AES-256"; 722 723 // Keep a log of all the apps we've ever backed up, and what the 724 // dataset tokens are for both the current backup dataset and 725 // the ancestral dataset. 726 private File mEverStored; 727 HashSet<String> mEverStoredApps = new HashSet<String>(); 728 729 static final int CURRENT_ANCESTRAL_RECORD_VERSION = 1; // increment when the schema changes 730 File mTokenFile; 731 Set<String> mAncestralPackages = null; 732 long mAncestralToken = 0; 733 long mCurrentToken = 0; 734 735 // Persistently track the need to do a full init 736 static final String INIT_SENTINEL_FILE_NAME = "_need_init_"; 737 HashSet<String> mPendingInits = new HashSet<String>(); // transport names 738 739 // Round-robin queue for scheduling full backup passes 740 static final int SCHEDULE_FILE_VERSION = 1; // current version of the schedule file 741 class FullBackupEntry implements Comparable<FullBackupEntry> { 742 String packageName; 743 long lastBackup; 744 745 FullBackupEntry(String pkg, long when) { 746 packageName = pkg; 747 lastBackup = when; 748 } 749 750 @Override 751 public int compareTo(FullBackupEntry other) { 752 if (lastBackup < other.lastBackup) return -1; 753 else if (lastBackup > other.lastBackup) return 1; 754 else return 0; 755 } 756 } 757 758 File mFullBackupScheduleFile; 759 // If we're running a schedule-driven full backup, this is the task instance doing it 760 761 @GuardedBy("mQueueLock") 762 PerformFullTransportBackupTask mRunningFullBackupTask; 763 764 @GuardedBy("mQueueLock") 765 ArrayList<FullBackupEntry> mFullBackupQueue; 766 767 // Utility: build a new random integer token. The low bits are the ordinal of the 768 // operation for near-time uniqueness, and the upper bits are random for app- 769 // side unpredictability. 770 @Override 771 public int generateRandomIntegerToken() { 772 int token = mTokenGenerator.nextInt(); 773 if (token < 0) token = -token; 774 token &= ~0xFF; 775 token |= (mNextToken.incrementAndGet() & 0xFF); 776 return token; 777 } 778 779 // High level policy: apps are generally ineligible for backup if certain conditions apply 780 public static boolean appIsEligibleForBackup(ApplicationInfo app, PackageManager pm) { 781 // 1. their manifest states android:allowBackup="false" 782 if ((app.flags&ApplicationInfo.FLAG_ALLOW_BACKUP) == 0) { 783 return false; 784 } 785 786 // 2. they run as a system-level uid but do not supply their own backup agent 787 if ((app.uid < Process.FIRST_APPLICATION_UID) && (app.backupAgentName == null)) { 788 return false; 789 } 790 791 // 3. it is the special shared-storage backup package used for 'adb backup' 792 if (app.packageName.equals(BackupManagerService.SHARED_BACKUP_AGENT_PACKAGE)) { 793 return false; 794 } 795 796 // 4. it is an "instant" app 797 if (app.isInstantApp()) { 798 return false; 799 } 800 801 // Everything else checks out; the only remaining roadblock would be if the 802 // package were disabled 803 return !appIsDisabled(app, pm); 804 } 805 806 // Checks if the app is in a stopped state. This is not part of the general "eligible for 807 // backup?" check because we *do* still need to restore data to apps in this state (e.g. 808 // newly-installing ones) 809 private static boolean appIsStopped(ApplicationInfo app) { 810 return ((app.flags & ApplicationInfo.FLAG_STOPPED) != 0); 811 } 812 813 private static boolean appIsDisabled(ApplicationInfo app, PackageManager pm) { 814 switch (pm.getApplicationEnabledSetting(app.packageName)) { 815 case PackageManager.COMPONENT_ENABLED_STATE_DISABLED: 816 case PackageManager.COMPONENT_ENABLED_STATE_DISABLED_USER: 817 case PackageManager.COMPONENT_ENABLED_STATE_DISABLED_UNTIL_USED: 818 return true; 819 820 default: 821 return false; 822 } 823 } 824 825 /* does *not* check overall backup eligibility policy! */ 826 private static boolean appGetsFullBackup(PackageInfo pkg) { 827 if (pkg.applicationInfo.backupAgentName != null) { 828 // If it has an agent, it gets full backups only if it says so 829 return (pkg.applicationInfo.flags & ApplicationInfo.FLAG_FULL_BACKUP_ONLY) != 0; 830 } 831 832 // No agent or fullBackupOnly="true" means we do indeed perform full-data backups for it 833 return true; 834 } 835 836 /* adb backup: is this app only capable of doing key/value? We say otherwise if 837 * the app has a backup agent and does not say fullBackupOnly, 838 */ 839 private static boolean appIsKeyValueOnly(PackageInfo pkg) { 840 return !appGetsFullBackup(pkg); 841 } 842 843 /* 844 * Construct a backup agent instance for the metadata pseudopackage. This is a 845 * process-local non-lifecycle agent instance, so we manually set up the context 846 * topology for it. 847 */ 848 PackageManagerBackupAgent makeMetadataAgent() { 849 PackageManagerBackupAgent pmAgent = new PackageManagerBackupAgent(mPackageManager); 850 pmAgent.attach(mContext); 851 pmAgent.onCreate(); 852 return pmAgent; 853 } 854 855 /* 856 * Same as above but with the explicit package-set configuration. 857 */ 858 PackageManagerBackupAgent makeMetadataAgent(List<PackageInfo> packages) { 859 PackageManagerBackupAgent pmAgent = 860 new PackageManagerBackupAgent(mPackageManager, packages); 861 pmAgent.attach(mContext); 862 pmAgent.onCreate(); 863 return pmAgent; 864 } 865 866 // ----- Asynchronous backup/restore handler thread ----- 867 868 private class BackupHandler extends Handler { 869 public BackupHandler(Looper looper) { 870 super(looper); 871 } 872 873 public void handleMessage(Message msg) { 874 875 switch (msg.what) { 876 case MSG_RUN_BACKUP: 877 { 878 mLastBackupPass = System.currentTimeMillis(); 879 880 IBackupTransport transport = mTransportManager.getCurrentTransportBinder(); 881 if (transport == null) { 882 Slog.v(TAG, "Backup requested but no transport available"); 883 synchronized (mQueueLock) { 884 mBackupRunning = false; 885 } 886 mWakelock.release(); 887 break; 888 } 889 890 // snapshot the pending-backup set and work on that 891 ArrayList<BackupRequest> queue = new ArrayList<BackupRequest>(); 892 File oldJournal = mJournal; 893 synchronized (mQueueLock) { 894 // Do we have any work to do? Construct the work queue 895 // then release the synchronization lock to actually run 896 // the backup. 897 if (mPendingBackups.size() > 0) { 898 for (BackupRequest b: mPendingBackups.values()) { 899 queue.add(b); 900 } 901 if (DEBUG) Slog.v(TAG, "clearing pending backups"); 902 mPendingBackups.clear(); 903 904 // Start a new backup-queue journal file too 905 mJournal = null; 906 907 } 908 } 909 910 // At this point, we have started a new journal file, and the old 911 // file identity is being passed to the backup processing task. 912 // When it completes successfully, that old journal file will be 913 // deleted. If we crash prior to that, the old journal is parsed 914 // at next boot and the journaled requests fulfilled. 915 boolean staged = true; 916 if (queue.size() > 0) { 917 // Spin up a backup state sequence and set it running 918 try { 919 String dirName = transport.transportDirName(); 920 PerformBackupTask pbt = new PerformBackupTask(transport, dirName, queue, 921 oldJournal, null, null, Collections.<String>emptyList(), false, 922 false /* nonIncremental */); 923 Message pbtMessage = obtainMessage(MSG_BACKUP_RESTORE_STEP, pbt); 924 sendMessage(pbtMessage); 925 } catch (Exception e) { 926 // unable to ask the transport its dir name -- transient failure, since 927 // the above check succeeded. Try again next time. 928 Slog.e(TAG, "Transport became unavailable attempting backup" 929 + " or error initializing backup task", e); 930 staged = false; 931 } 932 } else { 933 Slog.v(TAG, "Backup requested but nothing pending"); 934 staged = false; 935 } 936 937 if (!staged) { 938 // if we didn't actually hand off the wakelock, rewind until next time 939 synchronized (mQueueLock) { 940 mBackupRunning = false; 941 } 942 mWakelock.release(); 943 } 944 break; 945 } 946 947 case MSG_BACKUP_RESTORE_STEP: 948 { 949 try { 950 BackupRestoreTask task = (BackupRestoreTask) msg.obj; 951 if (MORE_DEBUG) Slog.v(TAG, "Got next step for " + task + ", executing"); 952 task.execute(); 953 } catch (ClassCastException e) { 954 Slog.e(TAG, "Invalid backup task in flight, obj=" + msg.obj); 955 } 956 break; 957 } 958 959 case MSG_OP_COMPLETE: 960 { 961 try { 962 Pair<BackupRestoreTask, Long> taskWithResult = 963 (Pair<BackupRestoreTask, Long>) msg.obj; 964 taskWithResult.first.operationComplete(taskWithResult.second); 965 } catch (ClassCastException e) { 966 Slog.e(TAG, "Invalid completion in flight, obj=" + msg.obj); 967 } 968 break; 969 } 970 971 case MSG_RUN_ADB_BACKUP: 972 { 973 // TODO: refactor full backup to be a looper-based state machine 974 // similar to normal backup/restore. 975 AdbBackupParams params = (AdbBackupParams)msg.obj; 976 PerformAdbBackupTask task = new PerformAdbBackupTask(params.fd, 977 params.observer, params.includeApks, params.includeObbs, 978 params.includeShared, params.doWidgets, params.curPassword, 979 params.encryptPassword, params.allApps, params.includeSystem, 980 params.doCompress, params.includeKeyValue, params.packages, params.latch); 981 (new Thread(task, "adb-backup")).start(); 982 break; 983 } 984 985 case MSG_RUN_FULL_TRANSPORT_BACKUP: 986 { 987 PerformFullTransportBackupTask task = (PerformFullTransportBackupTask) msg.obj; 988 (new Thread(task, "transport-backup")).start(); 989 break; 990 } 991 992 case MSG_RUN_RESTORE: 993 { 994 RestoreParams params = (RestoreParams)msg.obj; 995 Slog.d(TAG, "MSG_RUN_RESTORE observer=" + params.observer); 996 997 PerformUnifiedRestoreTask task = new PerformUnifiedRestoreTask(params.transport, 998 params.observer, params.monitor, params.token, params.pkgInfo, 999 params.pmToken, params.isSystemRestore, params.filterSet); 1000 1001 synchronized (mPendingRestores) { 1002 if (mIsRestoreInProgress) { 1003 if (DEBUG) { 1004 Slog.d(TAG, "Restore in progress, queueing."); 1005 } 1006 mPendingRestores.add(task); 1007 // This task will be picked up and executed when the the currently running 1008 // restore task finishes. 1009 } else { 1010 if (DEBUG) { 1011 Slog.d(TAG, "Starting restore."); 1012 } 1013 mIsRestoreInProgress = true; 1014 Message restoreMsg = obtainMessage(MSG_BACKUP_RESTORE_STEP, task); 1015 sendMessage(restoreMsg); 1016 } 1017 } 1018 break; 1019 } 1020 1021 case MSG_RUN_ADB_RESTORE: 1022 { 1023 // TODO: refactor full restore to be a looper-based state machine 1024 // similar to normal backup/restore. 1025 AdbRestoreParams params = (AdbRestoreParams)msg.obj; 1026 PerformAdbRestoreTask task = new PerformAdbRestoreTask(params.fd, 1027 params.curPassword, params.encryptPassword, 1028 params.observer, params.latch); 1029 (new Thread(task, "adb-restore")).start(); 1030 break; 1031 } 1032 1033 case MSG_RUN_CLEAR: 1034 { 1035 ClearParams params = (ClearParams)msg.obj; 1036 (new PerformClearTask(params.transport, params.packageInfo)).run(); 1037 break; 1038 } 1039 1040 case MSG_RETRY_CLEAR: 1041 { 1042 // reenqueues if the transport remains unavailable 1043 ClearRetryParams params = (ClearRetryParams)msg.obj; 1044 clearBackupData(params.transportName, params.packageName); 1045 break; 1046 } 1047 1048 case MSG_RUN_INITIALIZE: 1049 { 1050 HashSet<String> queue; 1051 1052 // Snapshot the pending-init queue and work on that 1053 synchronized (mQueueLock) { 1054 queue = new HashSet<String>(mPendingInits); 1055 mPendingInits.clear(); 1056 } 1057 1058 (new PerformInitializeTask(queue)).run(); 1059 break; 1060 } 1061 1062 case MSG_RETRY_INIT: 1063 { 1064 synchronized (mQueueLock) { 1065 recordInitPendingLocked(msg.arg1 != 0, (String)msg.obj); 1066 mAlarmManager.set(AlarmManager.RTC_WAKEUP, System.currentTimeMillis(), 1067 mRunInitIntent); 1068 } 1069 break; 1070 } 1071 1072 case MSG_RUN_GET_RESTORE_SETS: 1073 { 1074 // Like other async operations, this is entered with the wakelock held 1075 RestoreSet[] sets = null; 1076 RestoreGetSetsParams params = (RestoreGetSetsParams)msg.obj; 1077 try { 1078 sets = params.transport.getAvailableRestoreSets(); 1079 // cache the result in the active session 1080 synchronized (params.session) { 1081 params.session.mRestoreSets = sets; 1082 } 1083 if (sets == null) EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 1084 } catch (Exception e) { 1085 Slog.e(TAG, "Error from transport getting set list: " + e.getMessage()); 1086 } finally { 1087 if (params.observer != null) { 1088 try { 1089 params.observer.restoreSetsAvailable(sets); 1090 } catch (RemoteException re) { 1091 Slog.e(TAG, "Unable to report listing to observer"); 1092 } catch (Exception e) { 1093 Slog.e(TAG, "Restore observer threw: " + e.getMessage()); 1094 } 1095 } 1096 1097 // Done: reset the session timeout clock 1098 removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 1099 sendEmptyMessageDelayed(MSG_RESTORE_SESSION_TIMEOUT, TIMEOUT_RESTORE_INTERVAL); 1100 1101 mWakelock.release(); 1102 } 1103 break; 1104 } 1105 1106 case MSG_BACKUP_OPERATION_TIMEOUT: 1107 case MSG_RESTORE_OPERATION_TIMEOUT: 1108 { 1109 Slog.d(TAG, "Timeout message received for token=" + Integer.toHexString(msg.arg1)); 1110 handleCancel(msg.arg1, false); 1111 break; 1112 } 1113 1114 case MSG_RESTORE_SESSION_TIMEOUT: 1115 { 1116 synchronized (BackupManagerService.this) { 1117 if (mActiveRestoreSession != null) { 1118 // Client app left the restore session dangling. We know that it 1119 // can't be in the middle of an actual restore operation because 1120 // the timeout is suspended while a restore is in progress. Clean 1121 // up now. 1122 Slog.w(TAG, "Restore session timed out; aborting"); 1123 mActiveRestoreSession.markTimedOut(); 1124 post(mActiveRestoreSession.new EndRestoreRunnable( 1125 BackupManagerService.this, mActiveRestoreSession)); 1126 } 1127 } 1128 break; 1129 } 1130 1131 case MSG_FULL_CONFIRMATION_TIMEOUT: 1132 { 1133 synchronized (mAdbBackupRestoreConfirmations) { 1134 AdbParams params = mAdbBackupRestoreConfirmations.get(msg.arg1); 1135 if (params != null) { 1136 Slog.i(TAG, "Full backup/restore timed out waiting for user confirmation"); 1137 1138 // Release the waiter; timeout == completion 1139 signalAdbBackupRestoreCompletion(params); 1140 1141 // Remove the token from the set 1142 mAdbBackupRestoreConfirmations.delete(msg.arg1); 1143 1144 // Report a timeout to the observer, if any 1145 if (params.observer != null) { 1146 try { 1147 params.observer.onTimeout(); 1148 } catch (RemoteException e) { 1149 /* don't care if the app has gone away */ 1150 } 1151 } 1152 } else { 1153 Slog.d(TAG, "couldn't find params for token " + msg.arg1); 1154 } 1155 } 1156 break; 1157 } 1158 1159 case MSG_WIDGET_BROADCAST: 1160 { 1161 final Intent intent = (Intent) msg.obj; 1162 mContext.sendBroadcastAsUser(intent, UserHandle.SYSTEM); 1163 break; 1164 } 1165 1166 case MSG_REQUEST_BACKUP: 1167 { 1168 BackupParams params = (BackupParams)msg.obj; 1169 if (MORE_DEBUG) { 1170 Slog.d(TAG, "MSG_REQUEST_BACKUP observer=" + params.observer); 1171 } 1172 ArrayList<BackupRequest> kvQueue = new ArrayList<>(); 1173 for (String packageName : params.kvPackages) { 1174 kvQueue.add(new BackupRequest(packageName)); 1175 } 1176 mBackupRunning = true; 1177 mWakelock.acquire(); 1178 1179 PerformBackupTask pbt = new PerformBackupTask(params.transport, params.dirName, 1180 kvQueue, null, params.observer, params.monitor, params.fullPackages, true, 1181 params.nonIncrementalBackup); 1182 Message pbtMessage = obtainMessage(MSG_BACKUP_RESTORE_STEP, pbt); 1183 sendMessage(pbtMessage); 1184 break; 1185 } 1186 1187 case MSG_SCHEDULE_BACKUP_PACKAGE: 1188 { 1189 String pkgName = (String)msg.obj; 1190 if (MORE_DEBUG) { 1191 Slog.d(TAG, "MSG_SCHEDULE_BACKUP_PACKAGE " + pkgName); 1192 } 1193 dataChangedImpl(pkgName); 1194 break; 1195 } 1196 } 1197 } 1198 } 1199 1200 // ----- Debug-only backup operation trace ----- 1201 void addBackupTrace(String s) { 1202 if (DEBUG_BACKUP_TRACE) { 1203 synchronized (mBackupTrace) { 1204 mBackupTrace.add(s); 1205 } 1206 } 1207 } 1208 1209 void clearBackupTrace() { 1210 if (DEBUG_BACKUP_TRACE) { 1211 synchronized (mBackupTrace) { 1212 mBackupTrace.clear(); 1213 } 1214 } 1215 } 1216 1217 // ----- Main service implementation ----- 1218 1219 public BackupManagerService(Context context, Trampoline parent) { 1220 mContext = context; 1221 mPackageManager = context.getPackageManager(); 1222 mPackageManagerBinder = AppGlobals.getPackageManager(); 1223 mActivityManager = ActivityManager.getService(); 1224 1225 mAlarmManager = (AlarmManager) context.getSystemService(Context.ALARM_SERVICE); 1226 mPowerManager = (PowerManager) context.getSystemService(Context.POWER_SERVICE); 1227 mStorageManager = IStorageManager.Stub.asInterface(ServiceManager.getService("mount")); 1228 1229 mBackupManagerBinder = Trampoline.asInterface(parent.asBinder()); 1230 1231 // spin up the backup/restore handler thread 1232 mHandlerThread = new HandlerThread("backup", Process.THREAD_PRIORITY_BACKGROUND); 1233 mHandlerThread.start(); 1234 mBackupHandler = new BackupHandler(mHandlerThread.getLooper()); 1235 1236 // Set up our bookkeeping 1237 final ContentResolver resolver = context.getContentResolver(); 1238 mProvisioned = Settings.Global.getInt(resolver, 1239 Settings.Global.DEVICE_PROVISIONED, 0) != 0; 1240 mAutoRestore = Settings.Secure.getInt(resolver, 1241 Settings.Secure.BACKUP_AUTO_RESTORE, 1) != 0; 1242 1243 mProvisionedObserver = new ProvisionedObserver(mBackupHandler); 1244 resolver.registerContentObserver( 1245 Settings.Global.getUriFor(Settings.Global.DEVICE_PROVISIONED), 1246 false, mProvisionedObserver); 1247 1248 // If Encrypted file systems is enabled or disabled, this call will return the 1249 // correct directory. 1250 mBaseStateDir = new File(Environment.getDataDirectory(), "backup"); 1251 mBaseStateDir.mkdirs(); 1252 if (!SELinux.restorecon(mBaseStateDir)) { 1253 Slog.e(TAG, "SELinux restorecon failed on " + mBaseStateDir); 1254 } 1255 1256 // This dir on /cache is managed directly in init.rc 1257 mDataDir = new File(Environment.getDownloadCacheDirectory(), "backup_stage"); 1258 1259 mPasswordVersion = 1; // unless we hear otherwise 1260 mPasswordVersionFile = new File(mBaseStateDir, "pwversion"); 1261 if (mPasswordVersionFile.exists()) { 1262 FileInputStream fin = null; 1263 DataInputStream in = null; 1264 try { 1265 fin = new FileInputStream(mPasswordVersionFile); 1266 in = new DataInputStream(fin); 1267 mPasswordVersion = in.readInt(); 1268 } catch (IOException e) { 1269 Slog.e(TAG, "Unable to read backup pw version"); 1270 } finally { 1271 try { 1272 if (in != null) in.close(); 1273 if (fin != null) fin.close(); 1274 } catch (IOException e) { 1275 Slog.w(TAG, "Error closing pw version files"); 1276 } 1277 } 1278 } 1279 1280 mPasswordHashFile = new File(mBaseStateDir, "pwhash"); 1281 if (mPasswordHashFile.exists()) { 1282 FileInputStream fin = null; 1283 DataInputStream in = null; 1284 try { 1285 fin = new FileInputStream(mPasswordHashFile); 1286 in = new DataInputStream(new BufferedInputStream(fin)); 1287 // integer length of the salt array, followed by the salt, 1288 // then the hex pw hash string 1289 int saltLen = in.readInt(); 1290 byte[] salt = new byte[saltLen]; 1291 in.readFully(salt); 1292 mPasswordHash = in.readUTF(); 1293 mPasswordSalt = salt; 1294 } catch (IOException e) { 1295 Slog.e(TAG, "Unable to read saved backup pw hash"); 1296 } finally { 1297 try { 1298 if (in != null) in.close(); 1299 if (fin != null) fin.close(); 1300 } catch (IOException e) { 1301 Slog.w(TAG, "Unable to close streams"); 1302 } 1303 } 1304 } 1305 1306 // Alarm receivers for scheduled backups & initialization operations 1307 mRunBackupReceiver = new RunBackupReceiver(); 1308 IntentFilter filter = new IntentFilter(); 1309 filter.addAction(RUN_BACKUP_ACTION); 1310 context.registerReceiver(mRunBackupReceiver, filter, 1311 android.Manifest.permission.BACKUP, null); 1312 1313 mRunInitReceiver = new RunInitializeReceiver(); 1314 filter = new IntentFilter(); 1315 filter.addAction(RUN_INITIALIZE_ACTION); 1316 context.registerReceiver(mRunInitReceiver, filter, 1317 android.Manifest.permission.BACKUP, null); 1318 1319 Intent backupIntent = new Intent(RUN_BACKUP_ACTION); 1320 backupIntent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY); 1321 mRunBackupIntent = PendingIntent.getBroadcast(context, MSG_RUN_BACKUP, backupIntent, 0); 1322 1323 Intent initIntent = new Intent(RUN_INITIALIZE_ACTION); 1324 backupIntent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY); 1325 mRunInitIntent = PendingIntent.getBroadcast(context, MSG_RUN_INITIALIZE, initIntent, 0); 1326 1327 // Set up the backup-request journaling 1328 mJournalDir = new File(mBaseStateDir, "pending"); 1329 mJournalDir.mkdirs(); // creates mBaseStateDir along the way 1330 mJournal = null; // will be created on first use 1331 1332 // Set up the various sorts of package tracking we do 1333 mFullBackupScheduleFile = new File(mBaseStateDir, "fb-schedule"); 1334 initPackageTracking(); 1335 1336 // Build our mapping of uid to backup client services. This implicitly 1337 // schedules a backup pass on the Package Manager metadata the first 1338 // time anything needs to be backed up. 1339 synchronized (mBackupParticipants) { 1340 addPackageParticipantsLocked(null); 1341 } 1342 1343 // Set up our transport options and initialize the default transport 1344 // TODO: Don't create transports that we don't need to? 1345 SystemConfig systemConfig = SystemConfig.getInstance(); 1346 Set<ComponentName> transportWhitelist = systemConfig.getBackupTransportWhitelist(); 1347 1348 String transport = Settings.Secure.getString(context.getContentResolver(), 1349 Settings.Secure.BACKUP_TRANSPORT); 1350 if (TextUtils.isEmpty(transport)) { 1351 transport = null; 1352 } 1353 String currentTransport = transport; 1354 if (DEBUG) Slog.v(TAG, "Starting with transport " + currentTransport); 1355 1356 mTransportManager = new TransportManager(context, transportWhitelist, currentTransport, 1357 mTransportBoundListener, mHandlerThread.getLooper()); 1358 mTransportManager.registerAllTransports(); 1359 1360 // Now that we know about valid backup participants, parse any 1361 // leftover journal files into the pending backup set 1362 mBackupHandler.post(() -> parseLeftoverJournals()); 1363 1364 // Power management 1365 mWakelock = mPowerManager.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "*backup*"); 1366 } 1367 1368 private class RunBackupReceiver extends BroadcastReceiver { 1369 public void onReceive(Context context, Intent intent) { 1370 if (RUN_BACKUP_ACTION.equals(intent.getAction())) { 1371 synchronized (mQueueLock) { 1372 if (mPendingInits.size() > 0) { 1373 // If there are pending init operations, we process those 1374 // and then settle into the usual periodic backup schedule. 1375 if (MORE_DEBUG) Slog.v(TAG, "Init pending at scheduled backup"); 1376 try { 1377 mAlarmManager.cancel(mRunInitIntent); 1378 mRunInitIntent.send(); 1379 } catch (PendingIntent.CanceledException ce) { 1380 Slog.e(TAG, "Run init intent cancelled"); 1381 // can't really do more than bail here 1382 } 1383 } else { 1384 // Don't run backups now if we're disabled or not yet 1385 // fully set up. 1386 if (mEnabled && mProvisioned) { 1387 if (!mBackupRunning) { 1388 if (DEBUG) Slog.v(TAG, "Running a backup pass"); 1389 1390 // Acquire the wakelock and pass it to the backup thread. it will 1391 // be released once backup concludes. 1392 mBackupRunning = true; 1393 mWakelock.acquire(); 1394 1395 Message msg = mBackupHandler.obtainMessage(MSG_RUN_BACKUP); 1396 mBackupHandler.sendMessage(msg); 1397 } else { 1398 Slog.i(TAG, "Backup time but one already running"); 1399 } 1400 } else { 1401 Slog.w(TAG, "Backup pass but e=" + mEnabled + " p=" + mProvisioned); 1402 } 1403 } 1404 } 1405 } 1406 } 1407 } 1408 1409 private class RunInitializeReceiver extends BroadcastReceiver { 1410 public void onReceive(Context context, Intent intent) { 1411 if (RUN_INITIALIZE_ACTION.equals(intent.getAction())) { 1412 synchronized (mQueueLock) { 1413 if (DEBUG) Slog.v(TAG, "Running a device init"); 1414 1415 // Acquire the wakelock and pass it to the init thread. it will 1416 // be released once init concludes. 1417 mWakelock.acquire(); 1418 1419 Message msg = mBackupHandler.obtainMessage(MSG_RUN_INITIALIZE); 1420 mBackupHandler.sendMessage(msg); 1421 } 1422 } 1423 } 1424 } 1425 1426 private void initPackageTracking() { 1427 if (MORE_DEBUG) Slog.v(TAG, "` tracking"); 1428 1429 // Remember our ancestral dataset 1430 mTokenFile = new File(mBaseStateDir, "ancestral"); 1431 try (DataInputStream tokenStream = new DataInputStream(new BufferedInputStream( 1432 new FileInputStream(mTokenFile)))) { 1433 int version = tokenStream.readInt(); 1434 if (version == CURRENT_ANCESTRAL_RECORD_VERSION) { 1435 mAncestralToken = tokenStream.readLong(); 1436 mCurrentToken = tokenStream.readLong(); 1437 1438 int numPackages = tokenStream.readInt(); 1439 if (numPackages >= 0) { 1440 mAncestralPackages = new HashSet<>(); 1441 for (int i = 0; i < numPackages; i++) { 1442 String pkgName = tokenStream.readUTF(); 1443 mAncestralPackages.add(pkgName); 1444 } 1445 } 1446 } 1447 } catch (FileNotFoundException fnf) { 1448 // Probably innocuous 1449 Slog.v(TAG, "No ancestral data"); 1450 } catch (IOException e) { 1451 Slog.w(TAG, "Unable to read token file", e); 1452 } 1453 1454 // Keep a log of what apps we've ever backed up. Because we might have 1455 // rebooted in the middle of an operation that was removing something from 1456 // this log, we sanity-check its contents here and reconstruct it. 1457 mEverStored = new File(mBaseStateDir, "processed"); 1458 File tempProcessedFile = new File(mBaseStateDir, "processed.new"); 1459 1460 // If we were in the middle of removing something from the ever-backed-up 1461 // file, there might be a transient "processed.new" file still present. 1462 // Ignore it -- we'll validate "processed" against the current package set. 1463 if (tempProcessedFile.exists()) { 1464 tempProcessedFile.delete(); 1465 } 1466 1467 // If there are previous contents, parse them out then start a new 1468 // file to continue the recordkeeping. 1469 if (mEverStored.exists()) { 1470 DataOutputStream temp = null; 1471 DataInputStream in = null; 1472 1473 try { 1474 temp = new DataOutputStream(new BufferedOutputStream(new FileOutputStream( 1475 tempProcessedFile))); 1476 in = new DataInputStream(new BufferedInputStream(new FileInputStream(mEverStored))); 1477 1478 // Loop until we hit EOF 1479 while (true) { 1480 String pkg = in.readUTF(); 1481 try { 1482 // is this package still present? 1483 mPackageManager.getPackageInfo(pkg, 0); 1484 // if we get here then yes it is; remember it 1485 mEverStoredApps.add(pkg); 1486 temp.writeUTF(pkg); 1487 if (MORE_DEBUG) Slog.v(TAG, " + " + pkg); 1488 } catch (NameNotFoundException e) { 1489 // nope, this package was uninstalled; don't include it 1490 if (MORE_DEBUG) Slog.v(TAG, " - " + pkg); 1491 } 1492 } 1493 } catch (EOFException e) { 1494 // Once we've rewritten the backup history log, atomically replace the 1495 // old one with the new one then reopen the file for continuing use. 1496 if (!tempProcessedFile.renameTo(mEverStored)) { 1497 Slog.e(TAG, "Error renaming " + tempProcessedFile + " to " + mEverStored); 1498 } 1499 } catch (IOException e) { 1500 Slog.e(TAG, "Error in processed file", e); 1501 } finally { 1502 try { if (temp != null) temp.close(); } catch (IOException e) {} 1503 try { if (in != null) in.close(); } catch (IOException e) {} 1504 } 1505 } 1506 1507 synchronized (mQueueLock) { 1508 // Resume the full-data backup queue 1509 mFullBackupQueue = readFullBackupSchedule(); 1510 } 1511 1512 // Register for broadcasts about package install, etc., so we can 1513 // update the provider list. 1514 IntentFilter filter = new IntentFilter(); 1515 filter.addAction(Intent.ACTION_PACKAGE_ADDED); 1516 filter.addAction(Intent.ACTION_PACKAGE_REMOVED); 1517 filter.addAction(Intent.ACTION_PACKAGE_CHANGED); 1518 filter.addDataScheme("package"); 1519 mContext.registerReceiver(mBroadcastReceiver, filter); 1520 // Register for events related to sdcard installation. 1521 IntentFilter sdFilter = new IntentFilter(); 1522 sdFilter.addAction(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE); 1523 sdFilter.addAction(Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE); 1524 mContext.registerReceiver(mBroadcastReceiver, sdFilter); 1525 } 1526 1527 private ArrayList<FullBackupEntry> readFullBackupSchedule() { 1528 boolean changed = false; 1529 ArrayList<FullBackupEntry> schedule = null; 1530 List<PackageInfo> apps = 1531 PackageManagerBackupAgent.getStorableApplications(mPackageManager); 1532 1533 if (mFullBackupScheduleFile.exists()) { 1534 FileInputStream fstream = null; 1535 BufferedInputStream bufStream = null; 1536 DataInputStream in = null; 1537 try { 1538 fstream = new FileInputStream(mFullBackupScheduleFile); 1539 bufStream = new BufferedInputStream(fstream); 1540 in = new DataInputStream(bufStream); 1541 1542 int version = in.readInt(); 1543 if (version != SCHEDULE_FILE_VERSION) { 1544 Slog.e(TAG, "Unknown backup schedule version " + version); 1545 return null; 1546 } 1547 1548 final int N = in.readInt(); 1549 schedule = new ArrayList<FullBackupEntry>(N); 1550 1551 // HashSet instead of ArraySet specifically because we want the eventual 1552 // lookups against O(hundreds) of entries to be as fast as possible, and 1553 // we discard the set immediately after the scan so the extra memory 1554 // overhead is transient. 1555 HashSet<String> foundApps = new HashSet<String>(N); 1556 1557 for (int i = 0; i < N; i++) { 1558 String pkgName = in.readUTF(); 1559 long lastBackup = in.readLong(); 1560 foundApps.add(pkgName); // all apps that we've addressed already 1561 try { 1562 PackageInfo pkg = mPackageManager.getPackageInfo(pkgName, 0); 1563 if (appGetsFullBackup(pkg) 1564 && appIsEligibleForBackup(pkg.applicationInfo, mPackageManager)) { 1565 schedule.add(new FullBackupEntry(pkgName, lastBackup)); 1566 } else { 1567 if (DEBUG) { 1568 Slog.i(TAG, "Package " + pkgName 1569 + " no longer eligible for full backup"); 1570 } 1571 } 1572 } catch (NameNotFoundException e) { 1573 if (DEBUG) { 1574 Slog.i(TAG, "Package " + pkgName 1575 + " not installed; dropping from full backup"); 1576 } 1577 } 1578 } 1579 1580 // New apps can arrive "out of band" via OTA and similar, so we also need to 1581 // scan to make sure that we're tracking all full-backup candidates properly 1582 for (PackageInfo app : apps) { 1583 if (appGetsFullBackup(app) 1584 && appIsEligibleForBackup(app.applicationInfo, mPackageManager)) { 1585 if (!foundApps.contains(app.packageName)) { 1586 if (MORE_DEBUG) { 1587 Slog.i(TAG, "New full backup app " + app.packageName + " found"); 1588 } 1589 schedule.add(new FullBackupEntry(app.packageName, 0)); 1590 changed = true; 1591 } 1592 } 1593 } 1594 1595 Collections.sort(schedule); 1596 } catch (Exception e) { 1597 Slog.e(TAG, "Unable to read backup schedule", e); 1598 mFullBackupScheduleFile.delete(); 1599 schedule = null; 1600 } finally { 1601 IoUtils.closeQuietly(in); 1602 IoUtils.closeQuietly(bufStream); 1603 IoUtils.closeQuietly(fstream); 1604 } 1605 } 1606 1607 if (schedule == null) { 1608 // no prior queue record, or unable to read it. Set up the queue 1609 // from scratch. 1610 changed = true; 1611 schedule = new ArrayList<FullBackupEntry>(apps.size()); 1612 for (PackageInfo info : apps) { 1613 if (appGetsFullBackup(info) 1614 && appIsEligibleForBackup(info.applicationInfo, mPackageManager)) { 1615 schedule.add(new FullBackupEntry(info.packageName, 0)); 1616 } 1617 } 1618 } 1619 1620 if (changed) { 1621 writeFullBackupScheduleAsync(); 1622 } 1623 return schedule; 1624 } 1625 1626 Runnable mFullBackupScheduleWriter = new Runnable() { 1627 @Override public void run() { 1628 synchronized (mQueueLock) { 1629 try { 1630 ByteArrayOutputStream bufStream = new ByteArrayOutputStream(4096); 1631 DataOutputStream bufOut = new DataOutputStream(bufStream); 1632 bufOut.writeInt(SCHEDULE_FILE_VERSION); 1633 1634 // version 1: 1635 // 1636 // [int] # of packages in the queue = N 1637 // N * { 1638 // [utf8] package name 1639 // [long] last backup time for this package 1640 // } 1641 int N = mFullBackupQueue.size(); 1642 bufOut.writeInt(N); 1643 1644 for (int i = 0; i < N; i++) { 1645 FullBackupEntry entry = mFullBackupQueue.get(i); 1646 bufOut.writeUTF(entry.packageName); 1647 bufOut.writeLong(entry.lastBackup); 1648 } 1649 bufOut.flush(); 1650 1651 AtomicFile af = new AtomicFile(mFullBackupScheduleFile); 1652 FileOutputStream out = af.startWrite(); 1653 out.write(bufStream.toByteArray()); 1654 af.finishWrite(out); 1655 } catch (Exception e) { 1656 Slog.e(TAG, "Unable to write backup schedule!", e); 1657 } 1658 } 1659 } 1660 }; 1661 1662 private void writeFullBackupScheduleAsync() { 1663 mBackupHandler.removeCallbacks(mFullBackupScheduleWriter); 1664 mBackupHandler.post(mFullBackupScheduleWriter); 1665 } 1666 1667 private void parseLeftoverJournals() { 1668 for (File f : mJournalDir.listFiles()) { 1669 if (mJournal == null || f.compareTo(mJournal) != 0) { 1670 // This isn't the current journal, so it must be a leftover. Read 1671 // out the package names mentioned there and schedule them for 1672 // backup. 1673 DataInputStream in = null; 1674 try { 1675 Slog.i(TAG, "Found stale backup journal, scheduling"); 1676 // Journals will tend to be on the order of a few kilobytes(around 4k), hence, 1677 // setting the buffer size to 8192. 1678 InputStream bufferedInputStream = new BufferedInputStream( 1679 new FileInputStream(f), 8192); 1680 in = new DataInputStream(bufferedInputStream); 1681 while (true) { 1682 String packageName = in.readUTF(); 1683 if (MORE_DEBUG) Slog.i(TAG, " " + packageName); 1684 dataChangedImpl(packageName); 1685 } 1686 } catch (EOFException e) { 1687 // no more data; we're done 1688 } catch (Exception e) { 1689 Slog.e(TAG, "Can't read " + f, e); 1690 } finally { 1691 // close/delete the file 1692 try { if (in != null) in.close(); } catch (IOException e) {} 1693 f.delete(); 1694 } 1695 } 1696 } 1697 } 1698 1699 private SecretKey buildPasswordKey(String algorithm, String pw, byte[] salt, int rounds) { 1700 return buildCharArrayKey(algorithm, pw.toCharArray(), salt, rounds); 1701 } 1702 1703 private SecretKey buildCharArrayKey(String algorithm, char[] pwArray, byte[] salt, int rounds) { 1704 try { 1705 SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm); 1706 KeySpec ks = new PBEKeySpec(pwArray, salt, rounds, PBKDF2_KEY_SIZE); 1707 return keyFactory.generateSecret(ks); 1708 } catch (InvalidKeySpecException e) { 1709 Slog.e(TAG, "Invalid key spec for PBKDF2!"); 1710 } catch (NoSuchAlgorithmException e) { 1711 Slog.e(TAG, "PBKDF2 unavailable!"); 1712 } 1713 return null; 1714 } 1715 1716 private String buildPasswordHash(String algorithm, String pw, byte[] salt, int rounds) { 1717 SecretKey key = buildPasswordKey(algorithm, pw, salt, rounds); 1718 if (key != null) { 1719 return byteArrayToHex(key.getEncoded()); 1720 } 1721 return null; 1722 } 1723 1724 private String byteArrayToHex(byte[] data) { 1725 StringBuilder buf = new StringBuilder(data.length * 2); 1726 for (int i = 0; i < data.length; i++) { 1727 buf.append(Byte.toHexString(data[i], true)); 1728 } 1729 return buf.toString(); 1730 } 1731 1732 private byte[] hexToByteArray(String digits) { 1733 final int bytes = digits.length() / 2; 1734 if (2*bytes != digits.length()) { 1735 throw new IllegalArgumentException("Hex string must have an even number of digits"); 1736 } 1737 1738 byte[] result = new byte[bytes]; 1739 for (int i = 0; i < digits.length(); i += 2) { 1740 result[i/2] = (byte) Integer.parseInt(digits.substring(i, i+2), 16); 1741 } 1742 return result; 1743 } 1744 1745 private byte[] makeKeyChecksum(String algorithm, byte[] pwBytes, byte[] salt, int rounds) { 1746 char[] mkAsChar = new char[pwBytes.length]; 1747 for (int i = 0; i < pwBytes.length; i++) { 1748 mkAsChar[i] = (char) pwBytes[i]; 1749 } 1750 1751 Key checksum = buildCharArrayKey(algorithm, mkAsChar, salt, rounds); 1752 return checksum.getEncoded(); 1753 } 1754 1755 // Used for generating random salts or passwords 1756 private byte[] randomBytes(int bits) { 1757 byte[] array = new byte[bits / 8]; 1758 mRng.nextBytes(array); 1759 return array; 1760 } 1761 1762 boolean passwordMatchesSaved(String algorithm, String candidatePw, int rounds) { 1763 if (mPasswordHash == null) { 1764 // no current password case -- require that 'currentPw' be null or empty 1765 if (candidatePw == null || "".equals(candidatePw)) { 1766 return true; 1767 } // else the non-empty candidate does not match the empty stored pw 1768 } else { 1769 // hash the stated current pw and compare to the stored one 1770 if (candidatePw != null && candidatePw.length() > 0) { 1771 String currentPwHash = buildPasswordHash(algorithm, candidatePw, mPasswordSalt, rounds); 1772 if (mPasswordHash.equalsIgnoreCase(currentPwHash)) { 1773 // candidate hash matches the stored hash -- the password matches 1774 return true; 1775 } 1776 } // else the stored pw is nonempty but the candidate is empty; no match 1777 } 1778 return false; 1779 } 1780 1781 @Override 1782 public boolean setBackupPassword(String currentPw, String newPw) { 1783 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 1784 "setBackupPassword"); 1785 1786 // When processing v1 passwords we may need to try two different PBKDF2 checksum regimes 1787 final boolean pbkdf2Fallback = (mPasswordVersion < BACKUP_PW_FILE_VERSION); 1788 1789 // If the supplied pw doesn't hash to the the saved one, fail. The password 1790 // might be caught in the legacy crypto mismatch; verify that too. 1791 if (!passwordMatchesSaved(PBKDF_CURRENT, currentPw, PBKDF2_HASH_ROUNDS) 1792 && !(pbkdf2Fallback && passwordMatchesSaved(PBKDF_FALLBACK, 1793 currentPw, PBKDF2_HASH_ROUNDS))) { 1794 return false; 1795 } 1796 1797 // Snap up to current on the pw file version 1798 mPasswordVersion = BACKUP_PW_FILE_VERSION; 1799 FileOutputStream pwFout = null; 1800 DataOutputStream pwOut = null; 1801 try { 1802 pwFout = new FileOutputStream(mPasswordVersionFile); 1803 pwOut = new DataOutputStream(pwFout); 1804 pwOut.writeInt(mPasswordVersion); 1805 } catch (IOException e) { 1806 Slog.e(TAG, "Unable to write backup pw version; password not changed"); 1807 return false; 1808 } finally { 1809 try { 1810 if (pwOut != null) pwOut.close(); 1811 if (pwFout != null) pwFout.close(); 1812 } catch (IOException e) { 1813 Slog.w(TAG, "Unable to close pw version record"); 1814 } 1815 } 1816 1817 // Clearing the password is okay 1818 if (newPw == null || newPw.isEmpty()) { 1819 if (mPasswordHashFile.exists()) { 1820 if (!mPasswordHashFile.delete()) { 1821 // Unable to delete the old pw file, so fail 1822 Slog.e(TAG, "Unable to clear backup password"); 1823 return false; 1824 } 1825 } 1826 mPasswordHash = null; 1827 mPasswordSalt = null; 1828 return true; 1829 } 1830 1831 try { 1832 // Okay, build the hash of the new backup password 1833 byte[] salt = randomBytes(PBKDF2_SALT_SIZE); 1834 String newPwHash = buildPasswordHash(PBKDF_CURRENT, newPw, salt, PBKDF2_HASH_ROUNDS); 1835 1836 OutputStream pwf = null, buffer = null; 1837 DataOutputStream out = null; 1838 try { 1839 pwf = new FileOutputStream(mPasswordHashFile); 1840 buffer = new BufferedOutputStream(pwf); 1841 out = new DataOutputStream(buffer); 1842 // integer length of the salt array, followed by the salt, 1843 // then the hex pw hash string 1844 out.writeInt(salt.length); 1845 out.write(salt); 1846 out.writeUTF(newPwHash); 1847 out.flush(); 1848 mPasswordHash = newPwHash; 1849 mPasswordSalt = salt; 1850 return true; 1851 } finally { 1852 if (out != null) out.close(); 1853 if (buffer != null) buffer.close(); 1854 if (pwf != null) pwf.close(); 1855 } 1856 } catch (IOException e) { 1857 Slog.e(TAG, "Unable to set backup password"); 1858 } 1859 return false; 1860 } 1861 1862 @Override 1863 public boolean hasBackupPassword() { 1864 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 1865 "hasBackupPassword"); 1866 1867 return mPasswordHash != null && mPasswordHash.length() > 0; 1868 } 1869 1870 private boolean backupPasswordMatches(String currentPw) { 1871 if (hasBackupPassword()) { 1872 final boolean pbkdf2Fallback = (mPasswordVersion < BACKUP_PW_FILE_VERSION); 1873 if (!passwordMatchesSaved(PBKDF_CURRENT, currentPw, PBKDF2_HASH_ROUNDS) 1874 && !(pbkdf2Fallback && passwordMatchesSaved(PBKDF_FALLBACK, 1875 currentPw, PBKDF2_HASH_ROUNDS))) { 1876 if (DEBUG) Slog.w(TAG, "Backup password mismatch; aborting"); 1877 return false; 1878 } 1879 } 1880 return true; 1881 } 1882 1883 // Maintain persistent state around whether need to do an initialize operation. 1884 // Must be called with the queue lock held. 1885 void recordInitPendingLocked(boolean isPending, String transportName) { 1886 if (MORE_DEBUG) Slog.i(TAG, "recordInitPendingLocked: " + isPending 1887 + " on transport " + transportName); 1888 mBackupHandler.removeMessages(MSG_RETRY_INIT); 1889 1890 try { 1891 IBackupTransport transport = mTransportManager.getTransportBinder(transportName); 1892 if (transport != null) { 1893 String transportDirName = transport.transportDirName(); 1894 File stateDir = new File(mBaseStateDir, transportDirName); 1895 File initPendingFile = new File(stateDir, INIT_SENTINEL_FILE_NAME); 1896 1897 if (isPending) { 1898 // We need an init before we can proceed with sending backup data. 1899 // Record that with an entry in our set of pending inits, as well as 1900 // journaling it via creation of a sentinel file. 1901 mPendingInits.add(transportName); 1902 try { 1903 (new FileOutputStream(initPendingFile)).close(); 1904 } catch (IOException ioe) { 1905 // Something is badly wrong with our permissions; just try to move on 1906 } 1907 } else { 1908 // No more initialization needed; wipe the journal and reset our state. 1909 initPendingFile.delete(); 1910 mPendingInits.remove(transportName); 1911 } 1912 return; // done; don't fall through to the error case 1913 } 1914 } catch (Exception e) { 1915 // transport threw when asked its name; fall through to the lookup-failed case 1916 Slog.e(TAG, "Transport " + transportName + " failed to report name: " 1917 + e.getMessage()); 1918 } 1919 1920 // The named transport doesn't exist or threw. This operation is 1921 // important, so we record the need for a an init and post a message 1922 // to retry the init later. 1923 if (isPending) { 1924 mPendingInits.add(transportName); 1925 mBackupHandler.sendMessageDelayed( 1926 mBackupHandler.obtainMessage(MSG_RETRY_INIT, 1927 (isPending ? 1 : 0), 1928 0, 1929 transportName), 1930 TRANSPORT_RETRY_INTERVAL); 1931 } 1932 } 1933 1934 // Reset all of our bookkeeping, in response to having been told that 1935 // the backend data has been wiped [due to idle expiry, for example], 1936 // so we must re-upload all saved settings. 1937 void resetBackupState(File stateFileDir) { 1938 synchronized (mQueueLock) { 1939 // Wipe the "what we've ever backed up" tracking 1940 mEverStoredApps.clear(); 1941 mEverStored.delete(); 1942 1943 mCurrentToken = 0; 1944 writeRestoreTokens(); 1945 1946 // Remove all the state files 1947 for (File sf : stateFileDir.listFiles()) { 1948 // ... but don't touch the needs-init sentinel 1949 if (!sf.getName().equals(INIT_SENTINEL_FILE_NAME)) { 1950 sf.delete(); 1951 } 1952 } 1953 } 1954 1955 // Enqueue a new backup of every participant 1956 synchronized (mBackupParticipants) { 1957 final int N = mBackupParticipants.size(); 1958 for (int i=0; i<N; i++) { 1959 HashSet<String> participants = mBackupParticipants.valueAt(i); 1960 if (participants != null) { 1961 for (String packageName : participants) { 1962 dataChangedImpl(packageName); 1963 } 1964 } 1965 } 1966 } 1967 } 1968 1969 private TransportManager.TransportBoundListener mTransportBoundListener = 1970 new TransportManager.TransportBoundListener() { 1971 @Override 1972 public boolean onTransportBound(IBackupTransport transport) { 1973 // If the init sentinel file exists, we need to be sure to perform the init 1974 // as soon as practical. We also create the state directory at registration 1975 // time to ensure it's present from the outset. 1976 String name = null; 1977 try { 1978 name = transport.name(); 1979 String transportDirName = transport.transportDirName(); 1980 File stateDir = new File(mBaseStateDir, transportDirName); 1981 stateDir.mkdirs(); 1982 1983 File initSentinel = new File(stateDir, INIT_SENTINEL_FILE_NAME); 1984 if (initSentinel.exists()) { 1985 synchronized (mQueueLock) { 1986 mPendingInits.add(name); 1987 1988 // TODO: pick a better starting time than now + 1 minute 1989 long delay = 1000 * 60; // one minute, in milliseconds 1990 mAlarmManager.set(AlarmManager.RTC_WAKEUP, 1991 System.currentTimeMillis() + delay, mRunInitIntent); 1992 } 1993 } 1994 return true; 1995 } catch (Exception e) { 1996 // the transport threw when asked its file naming prefs; declare it invalid 1997 Slog.w(TAG, "Failed to regiser transport: " + name); 1998 return false; 1999 } 2000 } 2001 }; 2002 2003 // ----- Track installation/removal of packages ----- 2004 BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() { 2005 public void onReceive(Context context, Intent intent) { 2006 if (MORE_DEBUG) Slog.d(TAG, "Received broadcast " + intent); 2007 2008 String action = intent.getAction(); 2009 boolean replacing = false; 2010 boolean added = false; 2011 boolean changed = false; 2012 Bundle extras = intent.getExtras(); 2013 String pkgList[] = null; 2014 if (Intent.ACTION_PACKAGE_ADDED.equals(action) || 2015 Intent.ACTION_PACKAGE_REMOVED.equals(action) || 2016 Intent.ACTION_PACKAGE_CHANGED.equals(action)) { 2017 Uri uri = intent.getData(); 2018 if (uri == null) { 2019 return; 2020 } 2021 String pkgName = uri.getSchemeSpecificPart(); 2022 if (pkgName != null) { 2023 pkgList = new String[] { pkgName }; 2024 } 2025 changed = Intent.ACTION_PACKAGE_CHANGED.equals(action); 2026 2027 // At package-changed we only care about looking at new transport states 2028 if (changed) { 2029 String[] components = 2030 intent.getStringArrayExtra(Intent.EXTRA_CHANGED_COMPONENT_NAME_LIST); 2031 2032 if (MORE_DEBUG) { 2033 Slog.i(TAG, "Package " + pkgName + " changed; rechecking"); 2034 for (int i = 0; i < components.length; i++) { 2035 Slog.i(TAG, " * " + components[i]); 2036 } 2037 } 2038 2039 mTransportManager.onPackageChanged(pkgName, components); 2040 return; // nothing more to do in the PACKAGE_CHANGED case 2041 } 2042 2043 added = Intent.ACTION_PACKAGE_ADDED.equals(action); 2044 replacing = extras.getBoolean(Intent.EXTRA_REPLACING, false); 2045 } else if (Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(action)) { 2046 added = true; 2047 pkgList = intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST); 2048 } else if (Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE.equals(action)) { 2049 added = false; 2050 pkgList = intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST); 2051 } 2052 2053 if (pkgList == null || pkgList.length == 0) { 2054 return; 2055 } 2056 2057 final int uid = extras.getInt(Intent.EXTRA_UID); 2058 if (added) { 2059 synchronized (mBackupParticipants) { 2060 if (replacing) { 2061 // This is the package-replaced case; we just remove the entry 2062 // under the old uid and fall through to re-add. If an app 2063 // just added key/value backup participation, this picks it up 2064 // as a known participant. 2065 removePackageParticipantsLocked(pkgList, uid); 2066 } 2067 addPackageParticipantsLocked(pkgList); 2068 } 2069 // If they're full-backup candidates, add them there instead 2070 final long now = System.currentTimeMillis(); 2071 for (String packageName : pkgList) { 2072 try { 2073 PackageInfo app = mPackageManager.getPackageInfo(packageName, 0); 2074 if (appGetsFullBackup(app) 2075 && appIsEligibleForBackup(app.applicationInfo, mPackageManager)) { 2076 enqueueFullBackup(packageName, now); 2077 scheduleNextFullBackupJob(0); 2078 } else { 2079 // The app might have just transitioned out of full-data into 2080 // doing key/value backups, or might have just disabled backups 2081 // entirely. Make sure it is no longer in the full-data queue. 2082 synchronized (mQueueLock) { 2083 dequeueFullBackupLocked(packageName); 2084 } 2085 writeFullBackupScheduleAsync(); 2086 } 2087 2088 mTransportManager.onPackageAdded(packageName); 2089 2090 } catch (NameNotFoundException e) { 2091 // doesn't really exist; ignore it 2092 if (DEBUG) { 2093 Slog.w(TAG, "Can't resolve new app " + packageName); 2094 } 2095 } 2096 } 2097 2098 // Whenever a package is added or updated we need to update 2099 // the package metadata bookkeeping. 2100 dataChangedImpl(PACKAGE_MANAGER_SENTINEL); 2101 } else { 2102 if (replacing) { 2103 // The package is being updated. We'll receive a PACKAGE_ADDED shortly. 2104 } else { 2105 // Outright removal. In the full-data case, the app will be dropped 2106 // from the queue when its (now obsolete) name comes up again for 2107 // backup. 2108 synchronized (mBackupParticipants) { 2109 removePackageParticipantsLocked(pkgList, uid); 2110 } 2111 } 2112 for (String pkgName : pkgList) { 2113 mTransportManager.onPackageRemoved(pkgName); 2114 } 2115 } 2116 } 2117 }; 2118 2119 // Add the backup agents in the given packages to our set of known backup participants. 2120 // If 'packageNames' is null, adds all backup agents in the whole system. 2121 void addPackageParticipantsLocked(String[] packageNames) { 2122 // Look for apps that define the android:backupAgent attribute 2123 List<PackageInfo> targetApps = allAgentPackages(); 2124 if (packageNames != null) { 2125 if (MORE_DEBUG) Slog.v(TAG, "addPackageParticipantsLocked: #" + packageNames.length); 2126 for (String packageName : packageNames) { 2127 addPackageParticipantsLockedInner(packageName, targetApps); 2128 } 2129 } else { 2130 if (MORE_DEBUG) Slog.v(TAG, "addPackageParticipantsLocked: all"); 2131 addPackageParticipantsLockedInner(null, targetApps); 2132 } 2133 } 2134 2135 private void addPackageParticipantsLockedInner(String packageName, 2136 List<PackageInfo> targetPkgs) { 2137 if (MORE_DEBUG) { 2138 Slog.v(TAG, "Examining " + packageName + " for backup agent"); 2139 } 2140 2141 for (PackageInfo pkg : targetPkgs) { 2142 if (packageName == null || pkg.packageName.equals(packageName)) { 2143 int uid = pkg.applicationInfo.uid; 2144 HashSet<String> set = mBackupParticipants.get(uid); 2145 if (set == null) { 2146 set = new HashSet<>(); 2147 mBackupParticipants.put(uid, set); 2148 } 2149 set.add(pkg.packageName); 2150 if (MORE_DEBUG) Slog.v(TAG, "Agent found; added"); 2151 2152 // Schedule a backup for it on general principles 2153 if (MORE_DEBUG) Slog.i(TAG, "Scheduling backup for new app " + pkg.packageName); 2154 Message msg = mBackupHandler 2155 .obtainMessage(MSG_SCHEDULE_BACKUP_PACKAGE, pkg.packageName); 2156 mBackupHandler.sendMessage(msg); 2157 } 2158 } 2159 } 2160 2161 // Remove the given packages' entries from our known active set. 2162 void removePackageParticipantsLocked(String[] packageNames, int oldUid) { 2163 if (packageNames == null) { 2164 Slog.w(TAG, "removePackageParticipants with null list"); 2165 return; 2166 } 2167 2168 if (MORE_DEBUG) Slog.v(TAG, "removePackageParticipantsLocked: uid=" + oldUid 2169 + " #" + packageNames.length); 2170 for (String pkg : packageNames) { 2171 // Known previous UID, so we know which package set to check 2172 HashSet<String> set = mBackupParticipants.get(oldUid); 2173 if (set != null && set.contains(pkg)) { 2174 removePackageFromSetLocked(set, pkg); 2175 if (set.isEmpty()) { 2176 if (MORE_DEBUG) Slog.v(TAG, " last one of this uid; purging set"); 2177 mBackupParticipants.remove(oldUid); 2178 } 2179 } 2180 } 2181 } 2182 2183 private void removePackageFromSetLocked(final HashSet<String> set, 2184 final String packageName) { 2185 if (set.contains(packageName)) { 2186 // Found it. Remove this one package from the bookkeeping, and 2187 // if it's the last participating app under this uid we drop the 2188 // (now-empty) set as well. 2189 // Note that we deliberately leave it 'known' in the "ever backed up" 2190 // bookkeeping so that its current-dataset data will be retrieved 2191 // if the app is subsequently reinstalled 2192 if (MORE_DEBUG) Slog.v(TAG, " removing participant " + packageName); 2193 set.remove(packageName); 2194 mPendingBackups.remove(packageName); 2195 } 2196 } 2197 2198 // Returns the set of all applications that define an android:backupAgent attribute 2199 List<PackageInfo> allAgentPackages() { 2200 // !!! TODO: cache this and regenerate only when necessary 2201 int flags = PackageManager.GET_SIGNATURES; 2202 List<PackageInfo> packages = mPackageManager.getInstalledPackages(flags); 2203 int N = packages.size(); 2204 for (int a = N-1; a >= 0; a--) { 2205 PackageInfo pkg = packages.get(a); 2206 try { 2207 ApplicationInfo app = pkg.applicationInfo; 2208 if (((app.flags&ApplicationInfo.FLAG_ALLOW_BACKUP) == 0) 2209 || app.backupAgentName == null 2210 || (app.flags&ApplicationInfo.FLAG_FULL_BACKUP_ONLY) != 0) { 2211 packages.remove(a); 2212 } 2213 else { 2214 // we will need the shared library path, so look that up and store it here. 2215 // This is used implicitly when we pass the PackageInfo object off to 2216 // the Activity Manager to launch the app for backup/restore purposes. 2217 app = mPackageManager.getApplicationInfo(pkg.packageName, 2218 PackageManager.GET_SHARED_LIBRARY_FILES); 2219 pkg.applicationInfo.sharedLibraryFiles = app.sharedLibraryFiles; 2220 } 2221 } catch (NameNotFoundException e) { 2222 packages.remove(a); 2223 } 2224 } 2225 return packages; 2226 } 2227 2228 // Called from the backup tasks: record that the given app has been successfully 2229 // backed up at least once. This includes both key/value and full-data backups 2230 // through the transport. 2231 void logBackupComplete(String packageName) { 2232 if (packageName.equals(PACKAGE_MANAGER_SENTINEL)) return; 2233 2234 synchronized (mEverStoredApps) { 2235 if (!mEverStoredApps.add(packageName)) return; 2236 2237 RandomAccessFile out = null; 2238 try { 2239 out = new RandomAccessFile(mEverStored, "rws"); 2240 out.seek(out.length()); 2241 out.writeUTF(packageName); 2242 } catch (IOException e) { 2243 Slog.e(TAG, "Can't log backup of " + packageName + " to " + mEverStored); 2244 } finally { 2245 try { if (out != null) out.close(); } catch (IOException e) {} 2246 } 2247 } 2248 } 2249 2250 // Remove our awareness of having ever backed up the given package 2251 void removeEverBackedUp(String packageName) { 2252 if (DEBUG) Slog.v(TAG, "Removing backed-up knowledge of " + packageName); 2253 if (MORE_DEBUG) Slog.v(TAG, "New set:"); 2254 2255 synchronized (mEverStoredApps) { 2256 // Rewrite the file and rename to overwrite. If we reboot in the middle, 2257 // we'll recognize on initialization time that the package no longer 2258 // exists and fix it up then. 2259 File tempKnownFile = new File(mBaseStateDir, "processed.new"); 2260 RandomAccessFile known = null; 2261 try { 2262 known = new RandomAccessFile(tempKnownFile, "rws"); 2263 mEverStoredApps.remove(packageName); 2264 for (String s : mEverStoredApps) { 2265 known.writeUTF(s); 2266 if (MORE_DEBUG) Slog.v(TAG, " " + s); 2267 } 2268 known.close(); 2269 known = null; 2270 if (!tempKnownFile.renameTo(mEverStored)) { 2271 throw new IOException("Can't rename " + tempKnownFile + " to " + mEverStored); 2272 } 2273 } catch (IOException e) { 2274 // Bad: we couldn't create the new copy. For safety's sake we 2275 // abandon the whole process and remove all what's-backed-up 2276 // state entirely, meaning we'll force a backup pass for every 2277 // participant on the next boot or [re]install. 2278 Slog.w(TAG, "Error rewriting " + mEverStored, e); 2279 mEverStoredApps.clear(); 2280 tempKnownFile.delete(); 2281 mEverStored.delete(); 2282 } finally { 2283 try { if (known != null) known.close(); } catch (IOException e) {} 2284 } 2285 } 2286 } 2287 2288 // Persistently record the current and ancestral backup tokens as well 2289 // as the set of packages with data [supposedly] available in the 2290 // ancestral dataset. 2291 void writeRestoreTokens() { 2292 try { 2293 RandomAccessFile af = new RandomAccessFile(mTokenFile, "rwd"); 2294 2295 // First, the version number of this record, for futureproofing 2296 af.writeInt(CURRENT_ANCESTRAL_RECORD_VERSION); 2297 2298 // Write the ancestral and current tokens 2299 af.writeLong(mAncestralToken); 2300 af.writeLong(mCurrentToken); 2301 2302 // Now write the set of ancestral packages 2303 if (mAncestralPackages == null) { 2304 af.writeInt(-1); 2305 } else { 2306 af.writeInt(mAncestralPackages.size()); 2307 if (DEBUG) Slog.v(TAG, "Ancestral packages: " + mAncestralPackages.size()); 2308 for (String pkgName : mAncestralPackages) { 2309 af.writeUTF(pkgName); 2310 if (MORE_DEBUG) Slog.v(TAG, " " + pkgName); 2311 } 2312 } 2313 af.close(); 2314 } catch (IOException e) { 2315 Slog.w(TAG, "Unable to write token file:", e); 2316 } 2317 } 2318 2319 // What name is this transport registered under...? 2320 private String getTransportName(IBackupTransport transport) { 2321 if (MORE_DEBUG) { 2322 Slog.v(TAG, "Searching for transport name of " + transport); 2323 } 2324 return mTransportManager.getTransportName(transport); 2325 } 2326 2327 // fire off a backup agent, blocking until it attaches or times out 2328 @Override 2329 public IBackupAgent bindToAgentSynchronous(ApplicationInfo app, int mode) { 2330 IBackupAgent agent = null; 2331 synchronized(mAgentConnectLock) { 2332 mConnecting = true; 2333 mConnectedAgent = null; 2334 try { 2335 if (mActivityManager.bindBackupAgent(app.packageName, mode, 2336 UserHandle.USER_OWNER)) { 2337 Slog.d(TAG, "awaiting agent for " + app); 2338 2339 // success; wait for the agent to arrive 2340 // only wait 10 seconds for the bind to happen 2341 long timeoutMark = System.currentTimeMillis() + TIMEOUT_INTERVAL; 2342 while (mConnecting && mConnectedAgent == null 2343 && (System.currentTimeMillis() < timeoutMark)) { 2344 try { 2345 mAgentConnectLock.wait(5000); 2346 } catch (InterruptedException e) { 2347 // just bail 2348 Slog.w(TAG, "Interrupted: " + e); 2349 mConnecting = false; 2350 mConnectedAgent = null; 2351 } 2352 } 2353 2354 // if we timed out with no connect, abort and move on 2355 if (mConnecting == true) { 2356 Slog.w(TAG, "Timeout waiting for agent " + app); 2357 mConnectedAgent = null; 2358 } 2359 if (DEBUG) Slog.i(TAG, "got agent " + mConnectedAgent); 2360 agent = mConnectedAgent; 2361 } 2362 } catch (RemoteException e) { 2363 // can't happen - ActivityManager is local 2364 } 2365 } 2366 if (agent == null) { 2367 try { 2368 mActivityManager.clearPendingBackup(); 2369 } catch (RemoteException e) { 2370 // can't happen - ActivityManager is local 2371 } 2372 } 2373 return agent; 2374 } 2375 2376 // clear an application's data, blocking until the operation completes or times out 2377 void clearApplicationDataSynchronous(String packageName) { 2378 // Don't wipe packages marked allowClearUserData=false 2379 try { 2380 PackageInfo info = mPackageManager.getPackageInfo(packageName, 0); 2381 if ((info.applicationInfo.flags & ApplicationInfo.FLAG_ALLOW_CLEAR_USER_DATA) == 0) { 2382 if (MORE_DEBUG) Slog.i(TAG, "allowClearUserData=false so not wiping " 2383 + packageName); 2384 return; 2385 } 2386 } catch (NameNotFoundException e) { 2387 Slog.w(TAG, "Tried to clear data for " + packageName + " but not found"); 2388 return; 2389 } 2390 2391 ClearDataObserver observer = new ClearDataObserver(); 2392 2393 synchronized(mClearDataLock) { 2394 mClearingData = true; 2395 try { 2396 mActivityManager.clearApplicationUserData(packageName, observer, 0); 2397 } catch (RemoteException e) { 2398 // can't happen because the activity manager is in this process 2399 } 2400 2401 // only wait 10 seconds for the clear data to happen 2402 long timeoutMark = System.currentTimeMillis() + TIMEOUT_INTERVAL; 2403 while (mClearingData && (System.currentTimeMillis() < timeoutMark)) { 2404 try { 2405 mClearDataLock.wait(5000); 2406 } catch (InterruptedException e) { 2407 // won't happen, but still. 2408 mClearingData = false; 2409 } 2410 } 2411 } 2412 } 2413 2414 class ClearDataObserver extends IPackageDataObserver.Stub { 2415 public void onRemoveCompleted(String packageName, boolean succeeded) { 2416 synchronized(mClearDataLock) { 2417 mClearingData = false; 2418 mClearDataLock.notifyAll(); 2419 } 2420 } 2421 } 2422 2423 // Get the restore-set token for the best-available restore set for this package: 2424 // the active set if possible, else the ancestral one. Returns zero if none available. 2425 @Override 2426 public long getAvailableRestoreToken(String packageName) { 2427 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 2428 "getAvailableRestoreToken"); 2429 2430 long token = mAncestralToken; 2431 synchronized (mQueueLock) { 2432 if (mCurrentToken != 0 && mEverStoredApps.contains(packageName)) { 2433 if (MORE_DEBUG) { 2434 Slog.i(TAG, "App in ever-stored, so using current token"); 2435 } 2436 token = mCurrentToken; 2437 } 2438 } 2439 if (MORE_DEBUG) Slog.i(TAG, "getAvailableRestoreToken() == " + token); 2440 return token; 2441 } 2442 2443 @Override 2444 public int requestBackup(String[] packages, IBackupObserver observer, int flags) { 2445 return requestBackup(packages, observer, null, flags); 2446 } 2447 2448 @Override 2449 public int requestBackup(String[] packages, IBackupObserver observer, 2450 IBackupManagerMonitor monitor, int flags) { 2451 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, "requestBackup"); 2452 2453 if (packages == null || packages.length < 1) { 2454 Slog.e(TAG, "No packages named for backup request"); 2455 sendBackupFinished(observer, BackupManager.ERROR_TRANSPORT_ABORTED); 2456 monitor = monitorEvent(monitor, BackupManagerMonitor.LOG_EVENT_ID_NO_PACKAGES, 2457 null, BackupManagerMonitor.LOG_EVENT_CATEGORY_TRANSPORT, null); 2458 throw new IllegalArgumentException("No packages are provided for backup"); 2459 } 2460 2461 IBackupTransport transport = mTransportManager.getCurrentTransportBinder(); 2462 if (transport == null) { 2463 sendBackupFinished(observer, BackupManager.ERROR_TRANSPORT_ABORTED); 2464 monitor = monitorEvent(monitor, BackupManagerMonitor.LOG_EVENT_ID_TRANSPORT_IS_NULL, 2465 null, BackupManagerMonitor.LOG_EVENT_CATEGORY_TRANSPORT, null); 2466 return BackupManager.ERROR_TRANSPORT_ABORTED; 2467 } 2468 2469 ArrayList<String> fullBackupList = new ArrayList<>(); 2470 ArrayList<String> kvBackupList = new ArrayList<>(); 2471 for (String packageName : packages) { 2472 if (PACKAGE_MANAGER_SENTINEL.equals(packageName)) { 2473 kvBackupList.add(packageName); 2474 continue; 2475 } 2476 try { 2477 PackageInfo packageInfo = mPackageManager.getPackageInfo(packageName, 2478 PackageManager.GET_SIGNATURES); 2479 if (!appIsEligibleForBackup(packageInfo.applicationInfo, mPackageManager)) { 2480 sendBackupOnPackageResult(observer, packageName, 2481 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 2482 continue; 2483 } 2484 if (appGetsFullBackup(packageInfo)) { 2485 fullBackupList.add(packageInfo.packageName); 2486 } else { 2487 kvBackupList.add(packageInfo.packageName); 2488 } 2489 } catch (NameNotFoundException e) { 2490 sendBackupOnPackageResult(observer, packageName, 2491 BackupManager.ERROR_PACKAGE_NOT_FOUND); 2492 } 2493 } 2494 EventLog.writeEvent(EventLogTags.BACKUP_REQUESTED, packages.length, kvBackupList.size(), 2495 fullBackupList.size()); 2496 if (MORE_DEBUG) { 2497 Slog.i(TAG, "Backup requested for " + packages.length + " packages, of them: " + 2498 fullBackupList.size() + " full backups, " + kvBackupList.size() + " k/v backups"); 2499 } 2500 2501 String dirName; 2502 try { 2503 dirName = transport.transportDirName(); 2504 } catch (Exception e) { 2505 Slog.e(TAG, "Transport unavailable while attempting backup: " + e.getMessage()); 2506 sendBackupFinished(observer, BackupManager.ERROR_TRANSPORT_ABORTED); 2507 return BackupManager.ERROR_TRANSPORT_ABORTED; 2508 } 2509 2510 boolean nonIncrementalBackup = (flags & BackupManager.FLAG_NON_INCREMENTAL_BACKUP) != 0; 2511 2512 Message msg = mBackupHandler.obtainMessage(MSG_REQUEST_BACKUP); 2513 msg.obj = new BackupParams(transport, dirName, kvBackupList, fullBackupList, observer, 2514 monitor, true, nonIncrementalBackup); 2515 mBackupHandler.sendMessage(msg); 2516 return BackupManager.SUCCESS; 2517 } 2518 2519 // Cancel all running backups. 2520 @Override 2521 public void cancelBackups(){ 2522 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, "cancelBackups"); 2523 if (MORE_DEBUG) { 2524 Slog.i(TAG, "cancelBackups() called."); 2525 } 2526 final long oldToken = Binder.clearCallingIdentity(); 2527 try { 2528 List<Integer> operationsToCancel = new ArrayList<>(); 2529 synchronized (mCurrentOpLock) { 2530 for (int i = 0; i < mCurrentOperations.size(); i++) { 2531 Operation op = mCurrentOperations.valueAt(i); 2532 int token = mCurrentOperations.keyAt(i); 2533 if (op.type == OP_TYPE_BACKUP) { 2534 operationsToCancel.add(token); 2535 } 2536 } 2537 } 2538 for (Integer token : operationsToCancel) { 2539 handleCancel(token, true /* cancelAll */); 2540 } 2541 // We don't want the backup jobs to kick in any time soon. 2542 // Reschedules them to run in the distant future. 2543 KeyValueBackupJob.schedule(mContext, BUSY_BACKOFF_MIN_MILLIS); 2544 FullBackupJob.schedule(mContext, 2 * BUSY_BACKOFF_MIN_MILLIS); 2545 } finally { 2546 Binder.restoreCallingIdentity(oldToken); 2547 } 2548 } 2549 2550 @Override 2551 public void prepareOperationTimeout(int token, long interval, BackupRestoreTask callback, 2552 int operationType) { 2553 if (operationType != OP_TYPE_BACKUP_WAIT && operationType != OP_TYPE_RESTORE_WAIT) { 2554 Slog.wtf(TAG, "prepareOperationTimeout() doesn't support operation " + 2555 Integer.toHexString(token) + " of type " + operationType); 2556 return; 2557 } 2558 if (MORE_DEBUG) Slog.v(TAG, "starting timeout: token=" + Integer.toHexString(token) 2559 + " interval=" + interval + " callback=" + callback); 2560 2561 synchronized (mCurrentOpLock) { 2562 mCurrentOperations.put(token, new Operation(OP_PENDING, callback, operationType)); 2563 Message msg = mBackupHandler.obtainMessage(getMessageIdForOperationType(operationType), 2564 token, 0, callback); 2565 mBackupHandler.sendMessageDelayed(msg, interval); 2566 } 2567 } 2568 2569 private int getMessageIdForOperationType(int operationType) { 2570 switch (operationType) { 2571 case OP_TYPE_BACKUP_WAIT: 2572 return MSG_BACKUP_OPERATION_TIMEOUT; 2573 case OP_TYPE_RESTORE_WAIT: 2574 return MSG_RESTORE_OPERATION_TIMEOUT; 2575 default: 2576 Slog.wtf(TAG, "getMessageIdForOperationType called on invalid operation type: " + 2577 operationType); 2578 return -1; 2579 } 2580 } 2581 2582 private void removeOperation(int token) { 2583 if (MORE_DEBUG) { 2584 Slog.d(TAG, "Removing operation token=" + Integer.toHexString(token)); 2585 } 2586 synchronized (mCurrentOpLock) { 2587 if (mCurrentOperations.get(token) == null) { 2588 Slog.w(TAG, "Duplicate remove for operation. token=" + 2589 Integer.toHexString(token)); 2590 } 2591 mCurrentOperations.remove(token); 2592 } 2593 } 2594 2595 // synchronous waiter case 2596 @Override 2597 public boolean waitUntilOperationComplete(int token) { 2598 if (MORE_DEBUG) Slog.i(TAG, "Blocking until operation complete for " 2599 + Integer.toHexString(token)); 2600 int finalState = OP_PENDING; 2601 Operation op = null; 2602 synchronized (mCurrentOpLock) { 2603 while (true) { 2604 op = mCurrentOperations.get(token); 2605 if (op == null) { 2606 // mysterious disappearance: treat as success with no callback 2607 break; 2608 } else { 2609 if (op.state == OP_PENDING) { 2610 try { 2611 mCurrentOpLock.wait(); 2612 } catch (InterruptedException e) { 2613 } 2614 // When the wait is notified we loop around and recheck the current state 2615 } else { 2616 if (MORE_DEBUG) { 2617 Slog.d(TAG, "Unblocked waiting for operation token=" + 2618 Integer.toHexString(token)); 2619 } 2620 // No longer pending; we're done 2621 finalState = op.state; 2622 break; 2623 } 2624 } 2625 } 2626 } 2627 2628 removeOperation(token); 2629 if (op != null) { 2630 mBackupHandler.removeMessages(getMessageIdForOperationType(op.type)); 2631 } 2632 if (MORE_DEBUG) Slog.v(TAG, "operation " + Integer.toHexString(token) 2633 + " complete: finalState=" + finalState); 2634 return finalState == OP_ACKNOWLEDGED; 2635 } 2636 2637 void handleCancel(int token, boolean cancelAll) { 2638 // Notify any synchronous waiters 2639 Operation op = null; 2640 synchronized (mCurrentOpLock) { 2641 op = mCurrentOperations.get(token); 2642 if (MORE_DEBUG) { 2643 if (op == null) Slog.w(TAG, "Cancel of token " + Integer.toHexString(token) 2644 + " but no op found"); 2645 } 2646 int state = (op != null) ? op.state : OP_TIMEOUT; 2647 if (state == OP_ACKNOWLEDGED) { 2648 // The operation finished cleanly, so we have nothing more to do. 2649 if (DEBUG) { 2650 Slog.w(TAG, "Operation already got an ack." + 2651 "Should have been removed from mCurrentOperations."); 2652 } 2653 op = null; 2654 mCurrentOperations.delete(token); 2655 } else if (state == OP_PENDING) { 2656 if (DEBUG) Slog.v(TAG, "Cancel: token=" + Integer.toHexString(token)); 2657 op.state = OP_TIMEOUT; 2658 // Can't delete op from mCurrentOperations here. waitUntilOperationComplete may be 2659 // called after we receive cancel here. We need this op's state there. 2660 2661 // Remove all pending timeout messages of types OP_TYPE_BACKUP_WAIT and 2662 // OP_TYPE_RESTORE_WAIT. On the other hand, OP_TYPE_BACKUP cannot time out and 2663 // doesn't require cancellation. 2664 if (op.type == OP_TYPE_BACKUP_WAIT || op.type == OP_TYPE_RESTORE_WAIT) { 2665 mBackupHandler.removeMessages(getMessageIdForOperationType(op.type)); 2666 } 2667 } 2668 mCurrentOpLock.notifyAll(); 2669 } 2670 2671 // If there's a TimeoutHandler for this event, call it 2672 if (op != null && op.callback != null) { 2673 if (MORE_DEBUG) { 2674 Slog.v(TAG, " Invoking cancel on " + op.callback); 2675 } 2676 op.callback.handleCancel(cancelAll); 2677 } 2678 } 2679 2680 // ----- Back up a set of applications via a worker thread ----- 2681 2682 enum BackupState { 2683 INITIAL, 2684 RUNNING_QUEUE, 2685 FINAL 2686 } 2687 2688 /** 2689 * This class handles the process of backing up a given list of key/value backup packages. 2690 * Also takes in a list of pending dolly backups and kicks them off when key/value backups 2691 * are done. 2692 * 2693 * Flow: 2694 * If required, backup @pm@. 2695 * For each pending key/value backup package: 2696 * - Bind to agent. 2697 * - Call agent.doBackup() 2698 * - Wait either for cancel/timeout or operationComplete() callback from the agent. 2699 * Start task to perform dolly backups. 2700 * 2701 * There are three entry points into this class: 2702 * - execute() [Called from the handler thread] 2703 * - operationComplete(long result) [Called from the handler thread] 2704 * - handleCancel(boolean cancelAll) [Can be called from any thread] 2705 * These methods synchronize on mCancelLock. 2706 * 2707 * Interaction with mCurrentOperations: 2708 * - An entry for this task is put into mCurrentOperations for the entire lifetime of the 2709 * task. This is useful to cancel the task if required. 2710 * - An ephemeral entry is put into mCurrentOperations each time we are waiting on for 2711 * response from a backup agent. This is used to plumb timeouts and completion callbacks. 2712 */ 2713 class PerformBackupTask implements BackupRestoreTask { 2714 private static final String TAG = "PerformBackupTask"; 2715 2716 private final Object mCancelLock = new Object(); 2717 2718 IBackupTransport mTransport; 2719 ArrayList<BackupRequest> mQueue; 2720 ArrayList<BackupRequest> mOriginalQueue; 2721 File mStateDir; 2722 File mJournal; 2723 BackupState mCurrentState; 2724 List<String> mPendingFullBackups; 2725 IBackupObserver mObserver; 2726 IBackupManagerMonitor mMonitor; 2727 2728 private final PerformFullTransportBackupTask mFullBackupTask; 2729 private final int mCurrentOpToken; 2730 private volatile int mEphemeralOpToken; 2731 2732 // carried information about the current in-flight operation 2733 IBackupAgent mAgentBinder; 2734 PackageInfo mCurrentPackage; 2735 File mSavedStateName; 2736 File mBackupDataName; 2737 File mNewStateName; 2738 ParcelFileDescriptor mSavedState; 2739 ParcelFileDescriptor mBackupData; 2740 ParcelFileDescriptor mNewState; 2741 int mStatus; 2742 boolean mFinished; 2743 final boolean mUserInitiated; 2744 final boolean mNonIncremental; 2745 2746 private volatile boolean mCancelAll; 2747 2748 public PerformBackupTask(IBackupTransport transport, String dirName, 2749 ArrayList<BackupRequest> queue, File journal, IBackupObserver observer, 2750 IBackupManagerMonitor monitor, List<String> pendingFullBackups, 2751 boolean userInitiated, boolean nonIncremental) { 2752 mTransport = transport; 2753 mOriginalQueue = queue; 2754 mQueue = new ArrayList<>(); 2755 mJournal = journal; 2756 mObserver = observer; 2757 mMonitor = monitor; 2758 mPendingFullBackups = pendingFullBackups; 2759 mUserInitiated = userInitiated; 2760 mNonIncremental = nonIncremental; 2761 2762 mStateDir = new File(mBaseStateDir, dirName); 2763 mCurrentOpToken = generateRandomIntegerToken(); 2764 2765 mFinished = false; 2766 2767 synchronized (mCurrentOpLock) { 2768 if (isBackupOperationInProgress()) { 2769 if (DEBUG) { 2770 Slog.d(TAG, "Skipping backup since one is already in progress."); 2771 } 2772 mCancelAll = true; 2773 mFullBackupTask = null; 2774 mCurrentState = BackupState.FINAL; 2775 addBackupTrace("Skipped. Backup already in progress."); 2776 } else { 2777 mCurrentState = BackupState.INITIAL; 2778 CountDownLatch latch = new CountDownLatch(1); 2779 String[] fullBackups = 2780 mPendingFullBackups.toArray(new String[mPendingFullBackups.size()]); 2781 mFullBackupTask = 2782 new PerformFullTransportBackupTask(/*fullBackupRestoreObserver*/ null, 2783 fullBackups, /*updateSchedule*/ false, /*runningJob*/ null, 2784 latch, 2785 mObserver, mMonitor, mUserInitiated); 2786 2787 registerTask(); 2788 addBackupTrace("STATE => INITIAL"); 2789 } 2790 } 2791 } 2792 2793 /** 2794 * Put this task in the repository of running tasks. 2795 */ 2796 private void registerTask() { 2797 synchronized (mCurrentOpLock) { 2798 mCurrentOperations.put(mCurrentOpToken, new Operation(OP_PENDING, this, 2799 OP_TYPE_BACKUP)); 2800 } 2801 } 2802 2803 /** 2804 * Remove this task from repository of running tasks. 2805 */ 2806 private void unregisterTask() { 2807 removeOperation(mCurrentOpToken); 2808 } 2809 2810 // Main entry point: perform one chunk of work, updating the state as appropriate 2811 // and reposting the next chunk to the primary backup handler thread. 2812 @Override 2813 @GuardedBy("mCancelLock") 2814 public void execute() { 2815 synchronized (mCancelLock) { 2816 switch (mCurrentState) { 2817 case INITIAL: 2818 beginBackup(); 2819 break; 2820 2821 case RUNNING_QUEUE: 2822 invokeNextAgent(); 2823 break; 2824 2825 case FINAL: 2826 if (!mFinished) { 2827 finalizeBackup(); 2828 } else { 2829 Slog.e(TAG, "Duplicate finish of K/V pass"); 2830 } 2831 break; 2832 } 2833 } 2834 } 2835 2836 // We're starting a backup pass. Initialize the transport and send 2837 // the PM metadata blob if we haven't already. 2838 void beginBackup() { 2839 if (DEBUG_BACKUP_TRACE) { 2840 clearBackupTrace(); 2841 StringBuilder b = new StringBuilder(256); 2842 b.append("beginBackup: ["); 2843 for (BackupRequest req : mOriginalQueue) { 2844 b.append(' '); 2845 b.append(req.packageName); 2846 } 2847 b.append(" ]"); 2848 addBackupTrace(b.toString()); 2849 } 2850 2851 mAgentBinder = null; 2852 mStatus = BackupTransport.TRANSPORT_OK; 2853 2854 // Sanity check: if the queue is empty we have no work to do. 2855 if (mOriginalQueue.isEmpty() && mPendingFullBackups.isEmpty()) { 2856 Slog.w(TAG, "Backup begun with an empty queue - nothing to do."); 2857 addBackupTrace("queue empty at begin"); 2858 sendBackupFinished(mObserver, BackupManager.SUCCESS); 2859 executeNextState(BackupState.FINAL); 2860 return; 2861 } 2862 2863 // We need to retain the original queue contents in case of transport 2864 // failure, but we want a working copy that we can manipulate along 2865 // the way. 2866 mQueue = (ArrayList<BackupRequest>) mOriginalQueue.clone(); 2867 2868 // When the transport is forcing non-incremental key/value payloads, we send the 2869 // metadata only if it explicitly asks for it. 2870 boolean skipPm = mNonIncremental; 2871 2872 // The app metadata pseudopackage might also be represented in the 2873 // backup queue if apps have been added/removed since the last time 2874 // we performed a backup. Drop it from the working queue now that 2875 // we're committed to evaluating it for backup regardless. 2876 for (int i = 0; i < mQueue.size(); i++) { 2877 if (PACKAGE_MANAGER_SENTINEL.equals(mQueue.get(i).packageName)) { 2878 if (MORE_DEBUG) { 2879 Slog.i(TAG, "Metadata in queue; eliding"); 2880 } 2881 mQueue.remove(i); 2882 skipPm = false; 2883 break; 2884 } 2885 } 2886 2887 if (DEBUG) Slog.v(TAG, "Beginning backup of " + mQueue.size() + " targets"); 2888 2889 File pmState = new File(mStateDir, PACKAGE_MANAGER_SENTINEL); 2890 try { 2891 final String transportName = mTransport.transportDirName(); 2892 EventLog.writeEvent(EventLogTags.BACKUP_START, transportName); 2893 2894 // If we haven't stored package manager metadata yet, we must init the transport. 2895 if (mStatus == BackupTransport.TRANSPORT_OK && pmState.length() <= 0) { 2896 Slog.i(TAG, "Initializing (wiping) backup state and transport storage"); 2897 addBackupTrace("initializing transport " + transportName); 2898 resetBackupState(mStateDir); // Just to make sure. 2899 mStatus = mTransport.initializeDevice(); 2900 2901 addBackupTrace("transport.initializeDevice() == " + mStatus); 2902 if (mStatus == BackupTransport.TRANSPORT_OK) { 2903 EventLog.writeEvent(EventLogTags.BACKUP_INITIALIZE); 2904 } else { 2905 EventLog.writeEvent(EventLogTags.BACKUP_TRANSPORT_FAILURE, "(initialize)"); 2906 Slog.e(TAG, "Transport error in initializeDevice()"); 2907 } 2908 } 2909 2910 if (skipPm) { 2911 Slog.d(TAG, "Skipping backup of package metadata."); 2912 executeNextState(BackupState.RUNNING_QUEUE); 2913 } else { 2914 // The package manager doesn't have a proper <application> etc, but since 2915 // it's running here in the system process we can just set up its agent 2916 // directly and use a synthetic BackupRequest. We always run this pass 2917 // because it's cheap and this way we guarantee that we don't get out of 2918 // step even if we're selecting among various transports at run time. 2919 if (mStatus == BackupTransport.TRANSPORT_OK) { 2920 PackageManagerBackupAgent pmAgent = makeMetadataAgent(); 2921 mStatus = invokeAgentForBackup(PACKAGE_MANAGER_SENTINEL, 2922 IBackupAgent.Stub.asInterface(pmAgent.onBind()), mTransport); 2923 addBackupTrace("PMBA invoke: " + mStatus); 2924 2925 // Because the PMBA is a local instance, it has already executed its 2926 // backup callback and returned. Blow away the lingering (spurious) 2927 // pending timeout message for it. 2928 mBackupHandler.removeMessages(MSG_BACKUP_OPERATION_TIMEOUT); 2929 } 2930 } 2931 2932 if (mStatus == BackupTransport.TRANSPORT_NOT_INITIALIZED) { 2933 // The backend reports that our dataset has been wiped. Note this in 2934 // the event log; the no-success code below will reset the backup 2935 // state as well. 2936 EventLog.writeEvent(EventLogTags.BACKUP_RESET, mTransport.transportDirName()); 2937 } 2938 } catch (Exception e) { 2939 Slog.e(TAG, "Error in backup thread", e); 2940 addBackupTrace("Exception in backup thread: " + e); 2941 mStatus = BackupTransport.TRANSPORT_ERROR; 2942 } finally { 2943 // If we've succeeded so far, invokeAgentForBackup() will have run the PM 2944 // metadata and its completion/timeout callback will continue the state 2945 // machine chain. If it failed that won't happen; we handle that now. 2946 addBackupTrace("exiting prelim: " + mStatus); 2947 if (mStatus != BackupTransport.TRANSPORT_OK) { 2948 // if things went wrong at this point, we need to 2949 // restage everything and try again later. 2950 resetBackupState(mStateDir); // Just to make sure. 2951 // In case of any other error, it's backup transport error. 2952 sendBackupFinished(mObserver, BackupManager.ERROR_TRANSPORT_ABORTED); 2953 executeNextState(BackupState.FINAL); 2954 } 2955 } 2956 } 2957 2958 // Transport has been initialized and the PM metadata submitted successfully 2959 // if that was warranted. Now we process the single next thing in the queue. 2960 void invokeNextAgent() { 2961 mStatus = BackupTransport.TRANSPORT_OK; 2962 addBackupTrace("invoke q=" + mQueue.size()); 2963 2964 // Sanity check that we have work to do. If not, skip to the end where 2965 // we reestablish the wakelock invariants etc. 2966 if (mQueue.isEmpty()) { 2967 if (MORE_DEBUG) Slog.i(TAG, "queue now empty"); 2968 executeNextState(BackupState.FINAL); 2969 return; 2970 } 2971 2972 // pop the entry we're going to process on this step 2973 BackupRequest request = mQueue.get(0); 2974 mQueue.remove(0); 2975 2976 Slog.d(TAG, "starting key/value backup of " + request); 2977 addBackupTrace("launch agent for " + request.packageName); 2978 2979 // Verify that the requested app exists; it might be something that 2980 // requested a backup but was then uninstalled. The request was 2981 // journalled and rather than tamper with the journal it's safer 2982 // to sanity-check here. This also gives us the classname of the 2983 // package's backup agent. 2984 try { 2985 mCurrentPackage = mPackageManager.getPackageInfo(request.packageName, 2986 PackageManager.GET_SIGNATURES); 2987 if (!appIsEligibleForBackup(mCurrentPackage.applicationInfo, mPackageManager)) { 2988 // The manifest has changed but we had a stale backup request pending. 2989 // This won't happen again because the app won't be requesting further 2990 // backups. 2991 Slog.i(TAG, "Package " + request.packageName 2992 + " no longer supports backup; skipping"); 2993 addBackupTrace("skipping - not eligible, completion is noop"); 2994 // Shouldn't happen in case of requested backup, as pre-check was done in 2995 // #requestBackup(), except to app update done concurrently 2996 sendBackupOnPackageResult(mObserver, mCurrentPackage.packageName, 2997 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 2998 executeNextState(BackupState.RUNNING_QUEUE); 2999 return; 3000 } 3001 3002 if (appGetsFullBackup(mCurrentPackage)) { 3003 // It's possible that this app *formerly* was enqueued for key/value backup, 3004 // but has since been updated and now only supports the full-data path. 3005 // Don't proceed with a key/value backup for it in this case. 3006 Slog.i(TAG, "Package " + request.packageName 3007 + " requests full-data rather than key/value; skipping"); 3008 addBackupTrace("skipping - fullBackupOnly, completion is noop"); 3009 // Shouldn't happen in case of requested backup, as pre-check was done in 3010 // #requestBackup() 3011 sendBackupOnPackageResult(mObserver, mCurrentPackage.packageName, 3012 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 3013 executeNextState(BackupState.RUNNING_QUEUE); 3014 return; 3015 } 3016 3017 if (appIsStopped(mCurrentPackage.applicationInfo)) { 3018 // The app has been force-stopped or cleared or just installed, 3019 // and not yet launched out of that state, so just as it won't 3020 // receive broadcasts, we won't run it for backup. 3021 addBackupTrace("skipping - stopped"); 3022 sendBackupOnPackageResult(mObserver, mCurrentPackage.packageName, 3023 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 3024 executeNextState(BackupState.RUNNING_QUEUE); 3025 return; 3026 } 3027 3028 IBackupAgent agent = null; 3029 try { 3030 mWakelock.setWorkSource(new WorkSource(mCurrentPackage.applicationInfo.uid)); 3031 agent = bindToAgentSynchronous(mCurrentPackage.applicationInfo, 3032 ApplicationThreadConstants.BACKUP_MODE_INCREMENTAL); 3033 addBackupTrace("agent bound; a? = " + (agent != null)); 3034 if (agent != null) { 3035 mAgentBinder = agent; 3036 mStatus = invokeAgentForBackup(request.packageName, agent, mTransport); 3037 // at this point we'll either get a completion callback from the 3038 // agent, or a timeout message on the main handler. either way, we're 3039 // done here as long as we're successful so far. 3040 } else { 3041 // Timeout waiting for the agent 3042 mStatus = BackupTransport.AGENT_ERROR; 3043 } 3044 } catch (SecurityException ex) { 3045 // Try for the next one. 3046 Slog.d(TAG, "error in bind/backup", ex); 3047 mStatus = BackupTransport.AGENT_ERROR; 3048 addBackupTrace("agent SE"); 3049 } 3050 } catch (NameNotFoundException e) { 3051 Slog.d(TAG, "Package does not exist; skipping"); 3052 addBackupTrace("no such package"); 3053 mStatus = BackupTransport.AGENT_UNKNOWN; 3054 } finally { 3055 mWakelock.setWorkSource(null); 3056 3057 // If there was an agent error, no timeout/completion handling will occur. 3058 // That means we need to direct to the next state ourselves. 3059 if (mStatus != BackupTransport.TRANSPORT_OK) { 3060 BackupState nextState = BackupState.RUNNING_QUEUE; 3061 mAgentBinder = null; 3062 3063 // An agent-level failure means we reenqueue this one agent for 3064 // a later retry, but otherwise proceed normally. 3065 if (mStatus == BackupTransport.AGENT_ERROR) { 3066 if (MORE_DEBUG) Slog.i(TAG, "Agent failure for " + request.packageName 3067 + " - restaging"); 3068 dataChangedImpl(request.packageName); 3069 mStatus = BackupTransport.TRANSPORT_OK; 3070 if (mQueue.isEmpty()) nextState = BackupState.FINAL; 3071 sendBackupOnPackageResult(mObserver, mCurrentPackage.packageName, 3072 BackupManager.ERROR_AGENT_FAILURE); 3073 } else if (mStatus == BackupTransport.AGENT_UNKNOWN) { 3074 // Failed lookup of the app, so we couldn't bring up an agent, but 3075 // we're otherwise fine. Just drop it and go on to the next as usual. 3076 mStatus = BackupTransport.TRANSPORT_OK; 3077 sendBackupOnPackageResult(mObserver, mCurrentPackage.packageName, 3078 BackupManager.ERROR_PACKAGE_NOT_FOUND); 3079 } else { 3080 // Transport-level failure means we reenqueue everything 3081 revertAndEndBackup(); 3082 nextState = BackupState.FINAL; 3083 } 3084 3085 executeNextState(nextState); 3086 } else { 3087 // success case 3088 addBackupTrace("expecting completion/timeout callback"); 3089 } 3090 } 3091 } 3092 3093 void finalizeBackup() { 3094 addBackupTrace("finishing"); 3095 3096 // Mark packages that we didn't backup (because backup was cancelled, etc.) as needing 3097 // backup. 3098 for (BackupRequest req : mQueue) { 3099 dataChangedImpl(req.packageName); 3100 } 3101 3102 // Either backup was successful, in which case we of course do not need 3103 // this pass's journal any more; or it failed, in which case we just 3104 // re-enqueued all of these packages in the current active journal. 3105 // Either way, we no longer need this pass's journal. 3106 if (mJournal != null && !mJournal.delete()) { 3107 Slog.e(TAG, "Unable to remove backup journal file " + mJournal); 3108 } 3109 3110 // If everything actually went through and this is the first time we've 3111 // done a backup, we can now record what the current backup dataset token 3112 // is. 3113 if ((mCurrentToken == 0) && (mStatus == BackupTransport.TRANSPORT_OK)) { 3114 addBackupTrace("success; recording token"); 3115 try { 3116 mCurrentToken = mTransport.getCurrentRestoreSet(); 3117 writeRestoreTokens(); 3118 } catch (Exception e) { 3119 // nothing for it at this point, unfortunately, but this will be 3120 // recorded the next time we fully succeed. 3121 Slog.e(TAG, "Transport threw reporting restore set: " + e.getMessage()); 3122 addBackupTrace("transport threw returning token"); 3123 } 3124 } 3125 3126 // Set up the next backup pass - at this point we can set mBackupRunning 3127 // to false to allow another pass to fire, because we're done with the 3128 // state machine sequence and the wakelock is refcounted. 3129 synchronized (mQueueLock) { 3130 mBackupRunning = false; 3131 if (mStatus == BackupTransport.TRANSPORT_NOT_INITIALIZED) { 3132 // Make sure we back up everything and perform the one-time init 3133 if (MORE_DEBUG) Slog.d(TAG, "Server requires init; rerunning"); 3134 addBackupTrace("init required; rerunning"); 3135 try { 3136 final String name = mTransportManager.getTransportName(mTransport); 3137 if (name != null) { 3138 mPendingInits.add(name); 3139 } else { 3140 if (DEBUG) { 3141 Slog.w(TAG, "Couldn't find name of transport " + mTransport 3142 + " for init"); 3143 } 3144 } 3145 } catch (Exception e) { 3146 Slog.w(TAG, "Failed to query transport name for init: " + e.getMessage()); 3147 // swallow it and proceed; we don't rely on this 3148 } 3149 clearMetadata(); 3150 backupNow(); 3151 } 3152 } 3153 3154 clearBackupTrace(); 3155 3156 unregisterTask(); 3157 3158 if (!mCancelAll && mStatus == BackupTransport.TRANSPORT_OK && 3159 mPendingFullBackups != null && !mPendingFullBackups.isEmpty()) { 3160 Slog.d(TAG, "Starting full backups for: " + mPendingFullBackups); 3161 // Acquiring wakelock for PerformFullTransportBackupTask before its start. 3162 mWakelock.acquire(); 3163 (new Thread(mFullBackupTask, "full-transport-requested")).start(); 3164 } else if (mCancelAll) { 3165 if (mFullBackupTask != null) { 3166 mFullBackupTask.unregisterTask(); 3167 } 3168 sendBackupFinished(mObserver, BackupManager.ERROR_BACKUP_CANCELLED); 3169 } else { 3170 mFullBackupTask.unregisterTask(); 3171 switch (mStatus) { 3172 case BackupTransport.TRANSPORT_OK: 3173 sendBackupFinished(mObserver, BackupManager.SUCCESS); 3174 break; 3175 case BackupTransport.TRANSPORT_NOT_INITIALIZED: 3176 sendBackupFinished(mObserver, BackupManager.ERROR_TRANSPORT_ABORTED); 3177 break; 3178 case BackupTransport.TRANSPORT_ERROR: 3179 default: 3180 sendBackupFinished(mObserver, BackupManager.ERROR_TRANSPORT_ABORTED); 3181 break; 3182 } 3183 } 3184 mFinished = true; 3185 Slog.i(BackupManagerService.TAG, "K/V backup pass finished."); 3186 // Only once we're entirely finished do we release the wakelock for k/v backup. 3187 mWakelock.release(); 3188 } 3189 3190 // Remove the PM metadata state. This will generate an init on the next pass. 3191 void clearMetadata() { 3192 final File pmState = new File(mStateDir, PACKAGE_MANAGER_SENTINEL); 3193 if (pmState.exists()) pmState.delete(); 3194 } 3195 3196 // Invoke an agent's doBackup() and start a timeout message spinning on the main 3197 // handler in case it doesn't get back to us. 3198 int invokeAgentForBackup(String packageName, IBackupAgent agent, 3199 IBackupTransport transport) { 3200 if (DEBUG) Slog.d(TAG, "invokeAgentForBackup on " + packageName); 3201 addBackupTrace("invoking " + packageName); 3202 3203 File blankStateName = new File(mStateDir, "blank_state"); 3204 mSavedStateName = new File(mStateDir, packageName); 3205 mBackupDataName = new File(mDataDir, packageName + ".data"); 3206 mNewStateName = new File(mStateDir, packageName + ".new"); 3207 if (MORE_DEBUG) Slog.d(TAG, "data file: " + mBackupDataName); 3208 3209 mSavedState = null; 3210 mBackupData = null; 3211 mNewState = null; 3212 3213 boolean callingAgent = false; 3214 mEphemeralOpToken = generateRandomIntegerToken(); 3215 try { 3216 // Look up the package info & signatures. This is first so that if it 3217 // throws an exception, there's no file setup yet that would need to 3218 // be unraveled. 3219 if (packageName.equals(PACKAGE_MANAGER_SENTINEL)) { 3220 // The metadata 'package' is synthetic; construct one and make 3221 // sure our global state is pointed at it 3222 mCurrentPackage = new PackageInfo(); 3223 mCurrentPackage.packageName = packageName; 3224 } 3225 3226 // In a full backup, we pass a null ParcelFileDescriptor as 3227 // the saved-state "file". For key/value backups we pass the old state if 3228 // an incremental backup is required, and a blank state otherwise. 3229 mSavedState = ParcelFileDescriptor.open( 3230 mNonIncremental ? blankStateName : mSavedStateName, 3231 ParcelFileDescriptor.MODE_READ_ONLY | 3232 ParcelFileDescriptor.MODE_CREATE); // Make an empty file if necessary 3233 3234 mBackupData = ParcelFileDescriptor.open(mBackupDataName, 3235 ParcelFileDescriptor.MODE_READ_WRITE | 3236 ParcelFileDescriptor.MODE_CREATE | 3237 ParcelFileDescriptor.MODE_TRUNCATE); 3238 3239 if (!SELinux.restorecon(mBackupDataName)) { 3240 Slog.e(TAG, "SELinux restorecon failed on " + mBackupDataName); 3241 } 3242 3243 mNewState = ParcelFileDescriptor.open(mNewStateName, 3244 ParcelFileDescriptor.MODE_READ_WRITE | 3245 ParcelFileDescriptor.MODE_CREATE | 3246 ParcelFileDescriptor.MODE_TRUNCATE); 3247 3248 final long quota = mTransport.getBackupQuota(packageName, false /* isFullBackup */); 3249 callingAgent = true; 3250 3251 // Initiate the target's backup pass 3252 addBackupTrace("setting timeout"); 3253 prepareOperationTimeout(mEphemeralOpToken, TIMEOUT_BACKUP_INTERVAL, this, 3254 OP_TYPE_BACKUP_WAIT); 3255 addBackupTrace("calling agent doBackup()"); 3256 3257 agent.doBackup(mSavedState, mBackupData, mNewState, quota, mEphemeralOpToken, 3258 mBackupManagerBinder); 3259 } catch (Exception e) { 3260 Slog.e(TAG, "Error invoking for backup on " + packageName + ". " + e); 3261 addBackupTrace("exception: " + e); 3262 EventLog.writeEvent(EventLogTags.BACKUP_AGENT_FAILURE, packageName, 3263 e.toString()); 3264 errorCleanup(); 3265 return callingAgent ? BackupTransport.AGENT_ERROR 3266 : BackupTransport.TRANSPORT_ERROR; 3267 } finally { 3268 if (mNonIncremental) { 3269 blankStateName.delete(); 3270 } 3271 } 3272 3273 // At this point the agent is off and running. The next thing to happen will 3274 // either be a callback from the agent, at which point we'll process its data 3275 // for transport, or a timeout. Either way the next phase will happen in 3276 // response to the TimeoutHandler interface callbacks. 3277 addBackupTrace("invoke success"); 3278 return BackupTransport.TRANSPORT_OK; 3279 } 3280 3281 public void failAgent(IBackupAgent agent, String message) { 3282 try { 3283 agent.fail(message); 3284 } catch (Exception e) { 3285 Slog.w(TAG, "Error conveying failure to " + mCurrentPackage.packageName); 3286 } 3287 } 3288 3289 // SHA-1 a byte array and return the result in hex 3290 private String SHA1Checksum(byte[] input) { 3291 final byte[] checksum; 3292 try { 3293 MessageDigest md = MessageDigest.getInstance("SHA-1"); 3294 checksum = md.digest(input); 3295 } catch (NoSuchAlgorithmException e) { 3296 Slog.e(TAG, "Unable to use SHA-1!"); 3297 return "00"; 3298 } 3299 3300 StringBuffer sb = new StringBuffer(checksum.length * 2); 3301 for (int i = 0; i < checksum.length; i++) { 3302 sb.append(Integer.toHexString(checksum[i])); 3303 } 3304 return sb.toString(); 3305 } 3306 3307 private void writeWidgetPayloadIfAppropriate(FileDescriptor fd, String pkgName) 3308 throws IOException { 3309 // TODO: http://b/22388012 3310 byte[] widgetState = AppWidgetBackupBridge.getWidgetState(pkgName, 3311 UserHandle.USER_SYSTEM); 3312 // has the widget state changed since last time? 3313 final File widgetFile = new File(mStateDir, pkgName + "_widget"); 3314 final boolean priorStateExists = widgetFile.exists(); 3315 3316 if (MORE_DEBUG) { 3317 if (priorStateExists || widgetState != null) { 3318 Slog.i(TAG, "Checking widget update: state=" + (widgetState != null) 3319 + " prior=" + priorStateExists); 3320 } 3321 } 3322 3323 if (!priorStateExists && widgetState == null) { 3324 // no prior state, no new state => nothing to do 3325 return; 3326 } 3327 3328 // if the new state is not null, we might need to compare checksums to 3329 // determine whether to update the widget blob in the archive. If the 3330 // widget state *is* null, we know a priori at this point that we simply 3331 // need to commit a deletion for it. 3332 String newChecksum = null; 3333 if (widgetState != null) { 3334 newChecksum = SHA1Checksum(widgetState); 3335 if (priorStateExists) { 3336 final String priorChecksum; 3337 try ( 3338 FileInputStream fin = new FileInputStream(widgetFile); 3339 DataInputStream in = new DataInputStream(fin) 3340 ) { 3341 priorChecksum = in.readUTF(); 3342 } 3343 if (Objects.equals(newChecksum, priorChecksum)) { 3344 // Same checksum => no state change => don't rewrite the widget data 3345 return; 3346 } 3347 } 3348 } // else widget state *became* empty, so we need to commit a deletion 3349 3350 BackupDataOutput out = new BackupDataOutput(fd); 3351 if (widgetState != null) { 3352 try ( 3353 FileOutputStream fout = new FileOutputStream(widgetFile); 3354 DataOutputStream stateOut = new DataOutputStream(fout) 3355 ) { 3356 stateOut.writeUTF(newChecksum); 3357 } 3358 3359 out.writeEntityHeader(KEY_WIDGET_STATE, widgetState.length); 3360 out.writeEntityData(widgetState, widgetState.length); 3361 } else { 3362 // Widget state for this app has been removed; commit a deletion 3363 out.writeEntityHeader(KEY_WIDGET_STATE, -1); 3364 widgetFile.delete(); 3365 } 3366 } 3367 3368 @Override 3369 @GuardedBy("mCancelLock") 3370 public void operationComplete(long unusedResult) { 3371 removeOperation(mEphemeralOpToken); 3372 synchronized (mCancelLock) { 3373 // The agent reported back to us! 3374 if (mFinished) { 3375 Slog.d(TAG, "operationComplete received after task finished."); 3376 return; 3377 } 3378 3379 if (mBackupData == null) { 3380 // This callback was racing with our timeout, so we've cleaned up the 3381 // agent state already and are on to the next thing. We have nothing 3382 // further to do here: agent state having been cleared means that we've 3383 // initiated the appropriate next operation. 3384 final String pkg = (mCurrentPackage != null) 3385 ? mCurrentPackage.packageName : "[none]"; 3386 if (MORE_DEBUG) { 3387 Slog.i(TAG, "Callback after agent teardown: " + pkg); 3388 } 3389 addBackupTrace("late opComplete; curPkg = " + pkg); 3390 return; 3391 } 3392 3393 final String pkgName = mCurrentPackage.packageName; 3394 final long filepos = mBackupDataName.length(); 3395 FileDescriptor fd = mBackupData.getFileDescriptor(); 3396 try { 3397 // If it's a 3rd party app, see whether they wrote any protected keys 3398 // and complain mightily if they are attempting shenanigans. 3399 if (mCurrentPackage.applicationInfo != null && 3400 (mCurrentPackage.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) 3401 == 0) { 3402 ParcelFileDescriptor readFd = ParcelFileDescriptor.open(mBackupDataName, 3403 ParcelFileDescriptor.MODE_READ_ONLY); 3404 BackupDataInput in = new BackupDataInput(readFd.getFileDescriptor()); 3405 try { 3406 while (in.readNextHeader()) { 3407 final String key = in.getKey(); 3408 if (key != null && key.charAt(0) >= 0xff00) { 3409 // Not okay: crash them and bail. 3410 failAgent(mAgentBinder, "Illegal backup key: " + key); 3411 addBackupTrace("illegal key " + key + " from " + pkgName); 3412 EventLog.writeEvent(EventLogTags.BACKUP_AGENT_FAILURE, pkgName, 3413 "bad key"); 3414 mMonitor = monitorEvent(mMonitor, 3415 BackupManagerMonitor.LOG_EVENT_ID_ILLEGAL_KEY, 3416 mCurrentPackage, 3417 BackupManagerMonitor 3418 .LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 3419 putMonitoringExtra(null, 3420 BackupManagerMonitor.EXTRA_LOG_ILLEGAL_KEY, 3421 key)); 3422 mBackupHandler.removeMessages(MSG_BACKUP_OPERATION_TIMEOUT); 3423 sendBackupOnPackageResult(mObserver, pkgName, 3424 BackupManager.ERROR_AGENT_FAILURE); 3425 errorCleanup(); 3426 // agentErrorCleanup() implicitly executes next state properly 3427 return; 3428 } 3429 in.skipEntityData(); 3430 } 3431 } finally { 3432 if (readFd != null) { 3433 readFd.close(); 3434 } 3435 } 3436 } 3437 3438 // Piggyback the widget state payload, if any 3439 writeWidgetPayloadIfAppropriate(fd, pkgName); 3440 } catch (IOException e) { 3441 // Hard disk error; recovery/failure policy TBD. For now roll back, 3442 // but we may want to consider this a transport-level failure (i.e. 3443 // we're in such a bad state that we can't contemplate doing backup 3444 // operations any more during this pass). 3445 Slog.w(TAG, "Unable to save widget state for " + pkgName); 3446 try { 3447 Os.ftruncate(fd, filepos); 3448 } catch (ErrnoException ee) { 3449 Slog.w(TAG, "Unable to roll back!"); 3450 } 3451 } 3452 3453 // Spin the data off to the transport and proceed with the next stage. 3454 if (MORE_DEBUG) Slog.v(TAG, "operationComplete(): sending data to transport for " 3455 + pkgName); 3456 mBackupHandler.removeMessages(MSG_BACKUP_OPERATION_TIMEOUT); 3457 clearAgentState(); 3458 addBackupTrace("operation complete"); 3459 3460 ParcelFileDescriptor backupData = null; 3461 mStatus = BackupTransport.TRANSPORT_OK; 3462 long size = 0; 3463 try { 3464 size = mBackupDataName.length(); 3465 if (size > 0) { 3466 if (mStatus == BackupTransport.TRANSPORT_OK) { 3467 backupData = ParcelFileDescriptor.open(mBackupDataName, 3468 ParcelFileDescriptor.MODE_READ_ONLY); 3469 addBackupTrace("sending data to transport"); 3470 int flags = mUserInitiated ? BackupTransport.FLAG_USER_INITIATED : 0; 3471 mStatus = mTransport.performBackup(mCurrentPackage, backupData, flags); 3472 } 3473 3474 // TODO - We call finishBackup() for each application backed up, because 3475 // we need to know now whether it succeeded or failed. Instead, we should 3476 // hold off on finishBackup() until the end, which implies holding off on 3477 // renaming *all* the output state files (see below) until that happens. 3478 3479 addBackupTrace("data delivered: " + mStatus); 3480 if (mStatus == BackupTransport.TRANSPORT_OK) { 3481 addBackupTrace("finishing op on transport"); 3482 mStatus = mTransport.finishBackup(); 3483 addBackupTrace("finished: " + mStatus); 3484 } else if (mStatus == BackupTransport.TRANSPORT_PACKAGE_REJECTED) { 3485 addBackupTrace("transport rejected package"); 3486 } 3487 } else { 3488 if (MORE_DEBUG) Slog.i(TAG, 3489 "no backup data written; not calling transport"); 3490 addBackupTrace("no data to send"); 3491 mMonitor = monitorEvent(mMonitor, 3492 BackupManagerMonitor.LOG_EVENT_ID_NO_DATA_TO_SEND, 3493 mCurrentPackage, 3494 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 3495 null); 3496 } 3497 3498 if (mStatus == BackupTransport.TRANSPORT_OK) { 3499 // After successful transport, delete the now-stale data 3500 // and juggle the files so that next time we supply the agent 3501 // with the new state file it just created. 3502 mBackupDataName.delete(); 3503 mNewStateName.renameTo(mSavedStateName); 3504 sendBackupOnPackageResult(mObserver, pkgName, BackupManager.SUCCESS); 3505 EventLog.writeEvent(EventLogTags.BACKUP_PACKAGE, pkgName, size); 3506 logBackupComplete(pkgName); 3507 } else if (mStatus == BackupTransport.TRANSPORT_PACKAGE_REJECTED) { 3508 // The transport has rejected backup of this specific package. Roll it 3509 // back but proceed with running the rest of the queue. 3510 mBackupDataName.delete(); 3511 mNewStateName.delete(); 3512 sendBackupOnPackageResult(mObserver, pkgName, 3513 BackupManager.ERROR_TRANSPORT_PACKAGE_REJECTED); 3514 EventLogTags.writeBackupAgentFailure(pkgName, "Transport rejected"); 3515 } else if (mStatus == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) { 3516 sendBackupOnPackageResult(mObserver, pkgName, 3517 BackupManager.ERROR_TRANSPORT_QUOTA_EXCEEDED); 3518 EventLog.writeEvent(EventLogTags.BACKUP_QUOTA_EXCEEDED, pkgName); 3519 } else { 3520 // Actual transport-level failure to communicate the data to the backend 3521 sendBackupOnPackageResult(mObserver, pkgName, 3522 BackupManager.ERROR_TRANSPORT_ABORTED); 3523 EventLog.writeEvent(EventLogTags.BACKUP_TRANSPORT_FAILURE, pkgName); 3524 } 3525 } catch (Exception e) { 3526 sendBackupOnPackageResult(mObserver, pkgName, 3527 BackupManager.ERROR_TRANSPORT_ABORTED); 3528 Slog.e(TAG, "Transport error backing up " + pkgName, e); 3529 EventLog.writeEvent(EventLogTags.BACKUP_TRANSPORT_FAILURE, pkgName); 3530 mStatus = BackupTransport.TRANSPORT_ERROR; 3531 } finally { 3532 try { 3533 if (backupData != null) backupData.close(); 3534 } catch (IOException e) { 3535 } 3536 } 3537 3538 final BackupState nextState; 3539 if (mStatus == BackupTransport.TRANSPORT_OK 3540 || mStatus == BackupTransport.TRANSPORT_PACKAGE_REJECTED) { 3541 // Success or single-package rejection. Proceed with the next app if any, 3542 // otherwise we're done. 3543 nextState = (mQueue.isEmpty()) ? BackupState.FINAL : BackupState.RUNNING_QUEUE; 3544 } else if (mStatus == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) { 3545 if (MORE_DEBUG) { 3546 Slog.d(TAG, "Package " + mCurrentPackage.packageName + 3547 " hit quota limit on k/v backup"); 3548 } 3549 if (mAgentBinder != null) { 3550 try { 3551 long quota = mTransport.getBackupQuota(mCurrentPackage.packageName, 3552 false); 3553 mAgentBinder.doQuotaExceeded(size, quota); 3554 } catch (Exception e) { 3555 Slog.e(TAG, "Unable to notify about quota exceeded: " + e.getMessage()); 3556 } 3557 } 3558 nextState = (mQueue.isEmpty()) ? BackupState.FINAL : BackupState.RUNNING_QUEUE; 3559 } else { 3560 // Any other error here indicates a transport-level failure. That means 3561 // we need to halt everything and reschedule everything for next time. 3562 revertAndEndBackup(); 3563 nextState = BackupState.FINAL; 3564 } 3565 3566 executeNextState(nextState); 3567 } 3568 } 3569 3570 3571 @Override 3572 @GuardedBy("mCancelLock") 3573 public void handleCancel(boolean cancelAll) { 3574 removeOperation(mEphemeralOpToken); 3575 synchronized (mCancelLock) { 3576 if (mFinished) { 3577 // We have already cancelled this operation. 3578 if (MORE_DEBUG) { 3579 Slog.d(TAG, "Ignoring stale cancel. cancelAll=" + cancelAll); 3580 } 3581 return; 3582 } 3583 mCancelAll = cancelAll; 3584 final String logPackageName = (mCurrentPackage != null) 3585 ? mCurrentPackage.packageName 3586 : "no_package_yet"; 3587 Slog.i(TAG, "Cancel backing up " + logPackageName); 3588 EventLog.writeEvent(EventLogTags.BACKUP_AGENT_FAILURE, logPackageName); 3589 addBackupTrace("cancel of " + logPackageName + ", cancelAll=" + cancelAll); 3590 mMonitor = monitorEvent(mMonitor, 3591 BackupManagerMonitor.LOG_EVENT_ID_KEY_VALUE_BACKUP_CANCEL, 3592 mCurrentPackage, BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT, 3593 putMonitoringExtra(null, BackupManagerMonitor.EXTRA_LOG_CANCEL_ALL, 3594 mCancelAll)); 3595 errorCleanup(); 3596 if (!cancelAll) { 3597 // The current agent either timed out or was cancelled running doBackup(). 3598 // Restage it for the next time we run a backup pass. 3599 // !!! TODO: keep track of failure counts per agent, and blacklist those which 3600 // fail repeatedly (i.e. have proved themselves to be buggy). 3601 executeNextState( 3602 mQueue.isEmpty() ? BackupState.FINAL : BackupState.RUNNING_QUEUE); 3603 dataChangedImpl(mCurrentPackage.packageName); 3604 } else { 3605 finalizeBackup(); 3606 } 3607 } 3608 } 3609 3610 void revertAndEndBackup() { 3611 if (MORE_DEBUG) Slog.i(TAG, "Reverting backup queue - restaging everything"); 3612 addBackupTrace("transport error; reverting"); 3613 3614 // We want to reset the backup schedule based on whatever the transport suggests 3615 // by way of retry/backoff time. 3616 long delay; 3617 try { 3618 delay = mTransport.requestBackupTime(); 3619 } catch (Exception e) { 3620 Slog.w(TAG, "Unable to contact transport for recommended backoff: " + e.getMessage()); 3621 delay = 0; // use the scheduler's default 3622 } 3623 KeyValueBackupJob.schedule(mContext, delay); 3624 3625 for (BackupRequest request : mOriginalQueue) { 3626 dataChangedImpl(request.packageName); 3627 } 3628 3629 } 3630 3631 void errorCleanup() { 3632 mBackupDataName.delete(); 3633 mNewStateName.delete(); 3634 clearAgentState(); 3635 } 3636 3637 // Cleanup common to both success and failure cases 3638 void clearAgentState() { 3639 try { if (mSavedState != null) mSavedState.close(); } catch (IOException e) {} 3640 try { if (mBackupData != null) mBackupData.close(); } catch (IOException e) {} 3641 try { if (mNewState != null) mNewState.close(); } catch (IOException e) {} 3642 synchronized (mCurrentOpLock) { 3643 // Current-operation callback handling requires the validity of these various 3644 // bits of internal state as an invariant of the operation still being live. 3645 // This means we make sure to clear all of the state in unison inside the lock. 3646 mCurrentOperations.remove(mEphemeralOpToken); 3647 mSavedState = mBackupData = mNewState = null; 3648 } 3649 3650 // If this was a pseudopackage there's no associated Activity Manager state 3651 if (mCurrentPackage.applicationInfo != null) { 3652 addBackupTrace("unbinding " + mCurrentPackage.packageName); 3653 try { // unbind even on timeout, just in case 3654 mActivityManager.unbindBackupAgent(mCurrentPackage.applicationInfo); 3655 } catch (RemoteException e) { /* can't happen; activity manager is local */ } 3656 } 3657 } 3658 3659 void executeNextState(BackupState nextState) { 3660 if (MORE_DEBUG) Slog.i(TAG, " => executing next step on " 3661 + this + " nextState=" + nextState); 3662 addBackupTrace("executeNextState => " + nextState); 3663 mCurrentState = nextState; 3664 Message msg = mBackupHandler.obtainMessage(MSG_BACKUP_RESTORE_STEP, this); 3665 mBackupHandler.sendMessage(msg); 3666 } 3667 } 3668 3669 private boolean isBackupOperationInProgress() { 3670 synchronized (mCurrentOpLock) { 3671 for (int i = 0; i < mCurrentOperations.size(); i++) { 3672 Operation op = mCurrentOperations.valueAt(i); 3673 if (op.type == OP_TYPE_BACKUP && op.state == OP_PENDING) { 3674 return true; 3675 } 3676 } 3677 } 3678 return false; 3679 } 3680 3681 3682 // ----- Full backup/restore to a file/socket ----- 3683 3684 class FullBackupObbConnection implements ServiceConnection { 3685 volatile IObbBackupService mService; 3686 3687 FullBackupObbConnection() { 3688 mService = null; 3689 } 3690 3691 public void establish() { 3692 if (MORE_DEBUG) Slog.i(TAG, "Initiating bind of OBB service on " + this); 3693 Intent obbIntent = new Intent().setComponent(new ComponentName( 3694 "com.android.sharedstoragebackup", 3695 "com.android.sharedstoragebackup.ObbBackupService")); 3696 BackupManagerService.this.mContext.bindServiceAsUser( 3697 obbIntent, this, Context.BIND_AUTO_CREATE, UserHandle.SYSTEM); 3698 } 3699 3700 public void tearDown() { 3701 BackupManagerService.this.mContext.unbindService(this); 3702 } 3703 3704 public boolean backupObbs(PackageInfo pkg, OutputStream out) { 3705 boolean success = false; 3706 waitForConnection(); 3707 3708 ParcelFileDescriptor[] pipes = null; 3709 try { 3710 pipes = ParcelFileDescriptor.createPipe(); 3711 int token = generateRandomIntegerToken(); 3712 prepareOperationTimeout(token, TIMEOUT_FULL_BACKUP_INTERVAL, 3713 null, OP_TYPE_BACKUP_WAIT); 3714 mService.backupObbs(pkg.packageName, pipes[1], token, mBackupManagerBinder); 3715 routeSocketDataToOutput(pipes[0], out); 3716 success = waitUntilOperationComplete(token); 3717 } catch (Exception e) { 3718 Slog.w(TAG, "Unable to back up OBBs for " + pkg, e); 3719 } finally { 3720 try { 3721 out.flush(); 3722 if (pipes != null) { 3723 if (pipes[0] != null) pipes[0].close(); 3724 if (pipes[1] != null) pipes[1].close(); 3725 } 3726 } catch (IOException e) { 3727 Slog.w(TAG, "I/O error closing down OBB backup", e); 3728 } 3729 } 3730 return success; 3731 } 3732 3733 public void restoreObbFile(String pkgName, ParcelFileDescriptor data, 3734 long fileSize, int type, String path, long mode, long mtime, 3735 int token, IBackupManager callbackBinder) { 3736 waitForConnection(); 3737 3738 try { 3739 mService.restoreObbFile(pkgName, data, fileSize, type, path, mode, mtime, 3740 token, callbackBinder); 3741 } catch (Exception e) { 3742 Slog.w(TAG, "Unable to restore OBBs for " + pkgName, e); 3743 } 3744 } 3745 3746 private void waitForConnection() { 3747 synchronized (this) { 3748 while (mService == null) { 3749 if (MORE_DEBUG) Slog.i(TAG, "...waiting for OBB service binding..."); 3750 try { 3751 this.wait(); 3752 } catch (InterruptedException e) { /* never interrupted */ } 3753 } 3754 if (MORE_DEBUG) Slog.i(TAG, "Connected to OBB service; continuing"); 3755 } 3756 } 3757 3758 @Override 3759 public void onServiceConnected(ComponentName name, IBinder service) { 3760 synchronized (this) { 3761 mService = IObbBackupService.Stub.asInterface(service); 3762 if (MORE_DEBUG) Slog.i(TAG, "OBB service connection " + mService 3763 + " connected on " + this); 3764 this.notifyAll(); 3765 } 3766 } 3767 3768 @Override 3769 public void onServiceDisconnected(ComponentName name) { 3770 synchronized (this) { 3771 mService = null; 3772 if (MORE_DEBUG) Slog.i(TAG, "OBB service connection disconnected on " + this); 3773 this.notifyAll(); 3774 } 3775 } 3776 3777 } 3778 3779 static void routeSocketDataToOutput(ParcelFileDescriptor inPipe, OutputStream out) 3780 throws IOException { 3781 // We do not take close() responsibility for the pipe FD 3782 FileInputStream raw = new FileInputStream(inPipe.getFileDescriptor()); 3783 DataInputStream in = new DataInputStream(raw); 3784 3785 byte[] buffer = new byte[32 * 1024]; 3786 int chunkTotal; 3787 while ((chunkTotal = in.readInt()) > 0) { 3788 while (chunkTotal > 0) { 3789 int toRead = (chunkTotal > buffer.length) ? buffer.length : chunkTotal; 3790 int nRead = in.read(buffer, 0, toRead); 3791 out.write(buffer, 0, nRead); 3792 chunkTotal -= nRead; 3793 } 3794 } 3795 } 3796 3797 @Override 3798 public void tearDownAgentAndKill(ApplicationInfo app) { 3799 if (app == null) { 3800 // Null means the system package, so just quietly move on. :) 3801 return; 3802 } 3803 3804 try { 3805 // unbind and tidy up even on timeout or failure, just in case 3806 mActivityManager.unbindBackupAgent(app); 3807 3808 // The agent was running with a stub Application object, so shut it down. 3809 // !!! We hardcode the confirmation UI's package name here rather than use a 3810 // manifest flag! TODO something less direct. 3811 if (app.uid >= Process.FIRST_APPLICATION_UID 3812 && !app.packageName.equals("com.android.backupconfirm")) { 3813 if (MORE_DEBUG) Slog.d(TAG, "Killing agent host process"); 3814 mActivityManager.killApplicationProcess(app.processName, app.uid); 3815 } else { 3816 if (MORE_DEBUG) Slog.d(TAG, "Not killing after operation: " + app.processName); 3817 } 3818 } catch (RemoteException e) { 3819 Slog.d(TAG, "Lost app trying to shut down"); 3820 } 3821 } 3822 3823 // Core logic for performing one package's full backup, gathering the tarball from the 3824 // application and emitting it to the designated OutputStream. 3825 3826 // Callout from the engine to an interested participant that might need to communicate 3827 // with the agent prior to asking it to move data 3828 interface FullBackupPreflight { 3829 /** 3830 * Perform the preflight operation necessary for the given package. 3831 * @param pkg The name of the package being proposed for full-data backup 3832 * @param agent Live BackupAgent binding to the target app's agent 3833 * @return BackupTransport.TRANSPORT_OK to proceed with the backup operation, 3834 * or one of the other BackupTransport.* error codes as appropriate 3835 */ 3836 int preflightFullBackup(PackageInfo pkg, IBackupAgent agent); 3837 3838 long getExpectedSizeOrErrorCode(); 3839 }; 3840 3841 class FullBackupEngine { 3842 OutputStream mOutput; 3843 FullBackupPreflight mPreflightHook; 3844 BackupRestoreTask mTimeoutMonitor; 3845 IBackupAgent mAgent; 3846 File mFilesDir; 3847 File mManifestFile; 3848 File mMetadataFile; 3849 boolean mIncludeApks; 3850 PackageInfo mPkg; 3851 private final long mQuota; 3852 private final int mOpToken; 3853 3854 class FullBackupRunner implements Runnable { 3855 PackageInfo mPackage; 3856 byte[] mWidgetData; 3857 IBackupAgent mAgent; 3858 ParcelFileDescriptor mPipe; 3859 int mToken; 3860 boolean mSendApk; 3861 boolean mWriteManifest; 3862 3863 FullBackupRunner(PackageInfo pack, IBackupAgent agent, ParcelFileDescriptor pipe, 3864 int token, boolean sendApk, boolean writeManifest, byte[] widgetData) 3865 throws IOException { 3866 mPackage = pack; 3867 mWidgetData = widgetData; 3868 mAgent = agent; 3869 mPipe = ParcelFileDescriptor.dup(pipe.getFileDescriptor()); 3870 mToken = token; 3871 mSendApk = sendApk; 3872 mWriteManifest = writeManifest; 3873 } 3874 3875 @Override 3876 public void run() { 3877 try { 3878 FullBackupDataOutput output = new FullBackupDataOutput(mPipe); 3879 3880 if (mWriteManifest) { 3881 final boolean writeWidgetData = mWidgetData != null; 3882 if (MORE_DEBUG) Slog.d(TAG, "Writing manifest for " + mPackage.packageName); 3883 writeAppManifest(mPackage, mPackageManager, mManifestFile, mSendApk, writeWidgetData); 3884 FullBackup.backupToTar(mPackage.packageName, null, null, 3885 mFilesDir.getAbsolutePath(), 3886 mManifestFile.getAbsolutePath(), 3887 output); 3888 mManifestFile.delete(); 3889 3890 // We only need to write a metadata file if we have widget data to stash 3891 if (writeWidgetData) { 3892 writeMetadata(mPackage, mMetadataFile, mWidgetData); 3893 FullBackup.backupToTar(mPackage.packageName, null, null, 3894 mFilesDir.getAbsolutePath(), 3895 mMetadataFile.getAbsolutePath(), 3896 output); 3897 mMetadataFile.delete(); 3898 } 3899 } 3900 3901 if (mSendApk) { 3902 writeApkToBackup(mPackage, output); 3903 } 3904 3905 final boolean isSharedStorage = 3906 mPackage.packageName.equals(SHARED_BACKUP_AGENT_PACKAGE); 3907 final long timeout = isSharedStorage ? 3908 TIMEOUT_SHARED_BACKUP_INTERVAL : TIMEOUT_FULL_BACKUP_INTERVAL; 3909 3910 if (DEBUG) Slog.d(TAG, "Calling doFullBackup() on " + mPackage.packageName); 3911 prepareOperationTimeout(mToken, timeout, mTimeoutMonitor /* in parent class */, 3912 OP_TYPE_BACKUP_WAIT); 3913 mAgent.doFullBackup(mPipe, mQuota, mToken, mBackupManagerBinder); 3914 } catch (IOException e) { 3915 Slog.e(TAG, "Error running full backup for " + mPackage.packageName); 3916 } catch (RemoteException e) { 3917 Slog.e(TAG, "Remote agent vanished during full backup of " 3918 + mPackage.packageName); 3919 } finally { 3920 try { 3921 mPipe.close(); 3922 } catch (IOException e) {} 3923 } 3924 } 3925 } 3926 3927 FullBackupEngine(OutputStream output, FullBackupPreflight preflightHook, PackageInfo pkg, 3928 boolean alsoApks, BackupRestoreTask timeoutMonitor, long quota, int opToken) { 3929 mOutput = output; 3930 mPreflightHook = preflightHook; 3931 mPkg = pkg; 3932 mIncludeApks = alsoApks; 3933 mTimeoutMonitor = timeoutMonitor; 3934 mFilesDir = new File("/data/system"); 3935 mManifestFile = new File(mFilesDir, BACKUP_MANIFEST_FILENAME); 3936 mMetadataFile = new File(mFilesDir, BACKUP_METADATA_FILENAME); 3937 mQuota = quota; 3938 mOpToken = opToken; 3939 } 3940 3941 public int preflightCheck() throws RemoteException { 3942 if (mPreflightHook == null) { 3943 if (MORE_DEBUG) { 3944 Slog.v(TAG, "No preflight check"); 3945 } 3946 return BackupTransport.TRANSPORT_OK; 3947 } 3948 if (initializeAgent()) { 3949 int result = mPreflightHook.preflightFullBackup(mPkg, mAgent); 3950 if (MORE_DEBUG) { 3951 Slog.v(TAG, "preflight returned " + result); 3952 } 3953 return result; 3954 } else { 3955 Slog.w(TAG, "Unable to bind to full agent for " + mPkg.packageName); 3956 return BackupTransport.AGENT_ERROR; 3957 } 3958 } 3959 3960 public int backupOnePackage() throws RemoteException { 3961 int result = BackupTransport.AGENT_ERROR; 3962 3963 if (initializeAgent()) { 3964 ParcelFileDescriptor[] pipes = null; 3965 try { 3966 pipes = ParcelFileDescriptor.createPipe(); 3967 3968 ApplicationInfo app = mPkg.applicationInfo; 3969 final boolean isSharedStorage = 3970 mPkg.packageName.equals(SHARED_BACKUP_AGENT_PACKAGE); 3971 final boolean sendApk = mIncludeApks 3972 && !isSharedStorage 3973 && ((app.privateFlags & ApplicationInfo.PRIVATE_FLAG_FORWARD_LOCK) == 0) 3974 && ((app.flags & ApplicationInfo.FLAG_SYSTEM) == 0 || 3975 (app.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0); 3976 3977 // TODO: http://b/22388012 3978 byte[] widgetBlob = AppWidgetBackupBridge.getWidgetState(mPkg.packageName, 3979 UserHandle.USER_SYSTEM); 3980 3981 FullBackupRunner runner = new FullBackupRunner(mPkg, mAgent, pipes[1], 3982 mOpToken, sendApk, !isSharedStorage, widgetBlob); 3983 pipes[1].close(); // the runner has dup'd it 3984 pipes[1] = null; 3985 Thread t = new Thread(runner, "app-data-runner"); 3986 t.start(); 3987 3988 // Now pull data from the app and stuff it into the output 3989 routeSocketDataToOutput(pipes[0], mOutput); 3990 3991 if (!waitUntilOperationComplete(mOpToken)) { 3992 Slog.e(TAG, "Full backup failed on package " + mPkg.packageName); 3993 } else { 3994 if (MORE_DEBUG) { 3995 Slog.d(TAG, "Full package backup success: " + mPkg.packageName); 3996 } 3997 result = BackupTransport.TRANSPORT_OK; 3998 } 3999 } catch (IOException e) { 4000 Slog.e(TAG, "Error backing up " + mPkg.packageName + ": " + e.getMessage()); 4001 result = BackupTransport.AGENT_ERROR; 4002 } finally { 4003 try { 4004 // flush after every package 4005 mOutput.flush(); 4006 if (pipes != null) { 4007 if (pipes[0] != null) pipes[0].close(); 4008 if (pipes[1] != null) pipes[1].close(); 4009 } 4010 } catch (IOException e) { 4011 Slog.w(TAG, "Error bringing down backup stack"); 4012 result = BackupTransport.TRANSPORT_ERROR; 4013 } 4014 } 4015 } else { 4016 Slog.w(TAG, "Unable to bind to full agent for " + mPkg.packageName); 4017 } 4018 tearDown(); 4019 return result; 4020 } 4021 4022 public void sendQuotaExceeded(final long backupDataBytes, final long quotaBytes) { 4023 if (initializeAgent()) { 4024 try { 4025 mAgent.doQuotaExceeded(backupDataBytes, quotaBytes); 4026 } catch (RemoteException e) { 4027 Slog.e(TAG, "Remote exception while telling agent about quota exceeded"); 4028 } 4029 } 4030 } 4031 4032 private boolean initializeAgent() { 4033 if (mAgent == null) { 4034 if (MORE_DEBUG) { 4035 Slog.d(TAG, "Binding to full backup agent : " + mPkg.packageName); 4036 } 4037 mAgent = bindToAgentSynchronous(mPkg.applicationInfo, 4038 ApplicationThreadConstants.BACKUP_MODE_FULL); 4039 } 4040 return mAgent != null; 4041 } 4042 4043 private void writeApkToBackup(PackageInfo pkg, FullBackupDataOutput output) { 4044 // Forward-locked apps, system-bundled .apks, etc are filtered out before we get here 4045 // TODO: handle backing up split APKs 4046 final String appSourceDir = pkg.applicationInfo.getBaseCodePath(); 4047 final String apkDir = new File(appSourceDir).getParent(); 4048 FullBackup.backupToTar(pkg.packageName, FullBackup.APK_TREE_TOKEN, null, 4049 apkDir, appSourceDir, output); 4050 4051 // TODO: migrate this to SharedStorageBackup, since AID_SYSTEM 4052 // doesn't have access to external storage. 4053 4054 // Save associated .obb content if it exists and we did save the apk 4055 // check for .obb and save those too 4056 // TODO: http://b/22388012 4057 final UserEnvironment userEnv = new UserEnvironment(UserHandle.USER_SYSTEM); 4058 final File obbDir = userEnv.buildExternalStorageAppObbDirs(pkg.packageName)[0]; 4059 if (obbDir != null) { 4060 if (MORE_DEBUG) Log.i(TAG, "obb dir: " + obbDir.getAbsolutePath()); 4061 File[] obbFiles = obbDir.listFiles(); 4062 if (obbFiles != null) { 4063 final String obbDirName = obbDir.getAbsolutePath(); 4064 for (File obb : obbFiles) { 4065 FullBackup.backupToTar(pkg.packageName, FullBackup.OBB_TREE_TOKEN, null, 4066 obbDirName, obb.getAbsolutePath(), output); 4067 } 4068 } 4069 } 4070 } 4071 4072 // Widget metadata format. All header entries are strings ending in LF: 4073 // 4074 // Version 1 header: 4075 // BACKUP_METADATA_VERSION, currently "1" 4076 // package name 4077 // 4078 // File data (all integers are binary in network byte order) 4079 // *N: 4 : integer token identifying which metadata blob 4080 // 4 : integer size of this blob = N 4081 // N : raw bytes of this metadata blob 4082 // 4083 // Currently understood blobs (always in network byte order): 4084 // 4085 // widgets : metadata token = 0x01FFED01 (BACKUP_WIDGET_METADATA_TOKEN) 4086 // 4087 // Unrecognized blobs are *ignored*, not errors. 4088 private void writeMetadata(PackageInfo pkg, File destination, byte[] widgetData) 4089 throws IOException { 4090 StringBuilder b = new StringBuilder(512); 4091 StringBuilderPrinter printer = new StringBuilderPrinter(b); 4092 printer.println(Integer.toString(BACKUP_METADATA_VERSION)); 4093 printer.println(pkg.packageName); 4094 4095 FileOutputStream fout = new FileOutputStream(destination); 4096 BufferedOutputStream bout = new BufferedOutputStream(fout); 4097 DataOutputStream out = new DataOutputStream(bout); 4098 bout.write(b.toString().getBytes()); // bypassing DataOutputStream 4099 4100 if (widgetData != null && widgetData.length > 0) { 4101 out.writeInt(BACKUP_WIDGET_METADATA_TOKEN); 4102 out.writeInt(widgetData.length); 4103 out.write(widgetData); 4104 } 4105 bout.flush(); 4106 out.close(); 4107 4108 // As with the manifest file, guarantee idempotence of the archive metadata 4109 // for the widget block by using a fixed mtime on the transient file. 4110 destination.setLastModified(0); 4111 } 4112 4113 private void tearDown() { 4114 if (mPkg != null) { 4115 tearDownAgentAndKill(mPkg.applicationInfo); 4116 } 4117 } 4118 } 4119 4120 static void writeAppManifest(PackageInfo pkg, PackageManager packageManager, File manifestFile, 4121 boolean withApk, boolean withWidgets) throws IOException { 4122 // Manifest format. All data are strings ending in LF: 4123 // BACKUP_MANIFEST_VERSION, currently 1 4124 // 4125 // Version 1: 4126 // package name 4127 // package's versionCode 4128 // platform versionCode 4129 // getInstallerPackageName() for this package (maybe empty) 4130 // boolean: "1" if archive includes .apk; any other string means not 4131 // number of signatures == N 4132 // N*: signature byte array in ascii format per Signature.toCharsString() 4133 StringBuilder builder = new StringBuilder(4096); 4134 StringBuilderPrinter printer = new StringBuilderPrinter(builder); 4135 4136 printer.println(Integer.toString(BACKUP_MANIFEST_VERSION)); 4137 printer.println(pkg.packageName); 4138 printer.println(Integer.toString(pkg.versionCode)); 4139 printer.println(Integer.toString(Build.VERSION.SDK_INT)); 4140 4141 String installerName = packageManager.getInstallerPackageName(pkg.packageName); 4142 printer.println((installerName != null) ? installerName : ""); 4143 4144 printer.println(withApk ? "1" : "0"); 4145 if (pkg.signatures == null) { 4146 printer.println("0"); 4147 } else { 4148 printer.println(Integer.toString(pkg.signatures.length)); 4149 for (Signature sig : pkg.signatures) { 4150 printer.println(sig.toCharsString()); 4151 } 4152 } 4153 4154 FileOutputStream outstream = new FileOutputStream(manifestFile); 4155 outstream.write(builder.toString().getBytes()); 4156 outstream.close(); 4157 4158 // We want the manifest block in the archive stream to be idempotent: 4159 // each time we generate a backup stream for the app, we want the manifest 4160 // block to be identical. The underlying tar mechanism sees it as a file, 4161 // though, and will propagate its mtime, causing the tar header to vary. 4162 // Avoid this problem by pinning the mtime to zero. 4163 manifestFile.setLastModified(0); 4164 } 4165 4166 // Generic driver skeleton for full backup operations 4167 abstract class FullBackupTask implements Runnable { 4168 IFullBackupRestoreObserver mObserver; 4169 4170 FullBackupTask(IFullBackupRestoreObserver observer) { 4171 mObserver = observer; 4172 } 4173 4174 // wrappers for observer use 4175 final void sendStartBackup() { 4176 if (mObserver != null) { 4177 try { 4178 mObserver.onStartBackup(); 4179 } catch (RemoteException e) { 4180 Slog.w(TAG, "full backup observer went away: startBackup"); 4181 mObserver = null; 4182 } 4183 } 4184 } 4185 4186 final void sendOnBackupPackage(String name) { 4187 if (mObserver != null) { 4188 try { 4189 // TODO: use a more user-friendly name string 4190 mObserver.onBackupPackage(name); 4191 } catch (RemoteException e) { 4192 Slog.w(TAG, "full backup observer went away: backupPackage"); 4193 mObserver = null; 4194 } 4195 } 4196 } 4197 4198 final void sendEndBackup() { 4199 if (mObserver != null) { 4200 try { 4201 mObserver.onEndBackup(); 4202 } catch (RemoteException e) { 4203 Slog.w(TAG, "full backup observer went away: endBackup"); 4204 mObserver = null; 4205 } 4206 } 4207 } 4208 } 4209 4210 boolean deviceIsEncrypted() { 4211 try { 4212 return mStorageManager.getEncryptionState() 4213 != StorageManager.ENCRYPTION_STATE_NONE 4214 && mStorageManager.getPasswordType() 4215 != StorageManager.CRYPT_TYPE_DEFAULT; 4216 } catch (Exception e) { 4217 // If we can't talk to the storagemanager service we have a serious problem; fail 4218 // "secure" i.e. assuming that the device is encrypted. 4219 Slog.e(TAG, "Unable to communicate with storagemanager service: " + e.getMessage()); 4220 return true; 4221 } 4222 } 4223 4224 // Full backup task variant used for adb backup 4225 class PerformAdbBackupTask extends FullBackupTask implements BackupRestoreTask { 4226 FullBackupEngine mBackupEngine; 4227 final AtomicBoolean mLatch; 4228 4229 ParcelFileDescriptor mOutputFile; 4230 DeflaterOutputStream mDeflater; 4231 boolean mIncludeApks; 4232 boolean mIncludeObbs; 4233 boolean mIncludeShared; 4234 boolean mDoWidgets; 4235 boolean mAllApps; 4236 boolean mIncludeSystem; 4237 boolean mCompress; 4238 boolean mKeyValue; 4239 ArrayList<String> mPackages; 4240 PackageInfo mCurrentTarget; 4241 String mCurrentPassword; 4242 String mEncryptPassword; 4243 private final int mCurrentOpToken; 4244 4245 PerformAdbBackupTask(ParcelFileDescriptor fd, IFullBackupRestoreObserver observer, 4246 boolean includeApks, boolean includeObbs, boolean includeShared, boolean doWidgets, 4247 String curPassword, String encryptPassword, boolean doAllApps, boolean doSystem, 4248 boolean doCompress, boolean doKeyValue, String[] packages, AtomicBoolean latch) { 4249 super(observer); 4250 mCurrentOpToken = generateRandomIntegerToken(); 4251 mLatch = latch; 4252 4253 mOutputFile = fd; 4254 mIncludeApks = includeApks; 4255 mIncludeObbs = includeObbs; 4256 mIncludeShared = includeShared; 4257 mDoWidgets = doWidgets; 4258 mAllApps = doAllApps; 4259 mIncludeSystem = doSystem; 4260 mPackages = (packages == null) 4261 ? new ArrayList<String>() 4262 : new ArrayList<String>(Arrays.asList(packages)); 4263 mCurrentPassword = curPassword; 4264 // when backing up, if there is a current backup password, we require that 4265 // the user use a nonempty encryption password as well. if one is supplied 4266 // in the UI we use that, but if the UI was left empty we fall back to the 4267 // current backup password (which was supplied by the user as well). 4268 if (encryptPassword == null || "".equals(encryptPassword)) { 4269 mEncryptPassword = curPassword; 4270 } else { 4271 mEncryptPassword = encryptPassword; 4272 } 4273 if (MORE_DEBUG) { 4274 Slog.w(TAG, "Encrypting backup with passphrase=" + mEncryptPassword); 4275 } 4276 mCompress = doCompress; 4277 mKeyValue = doKeyValue; 4278 } 4279 4280 void addPackagesToSet(TreeMap<String, PackageInfo> set, List<String> pkgNames) { 4281 for (String pkgName : pkgNames) { 4282 if (!set.containsKey(pkgName)) { 4283 try { 4284 PackageInfo info = mPackageManager.getPackageInfo(pkgName, 4285 PackageManager.GET_SIGNATURES); 4286 set.put(pkgName, info); 4287 } catch (NameNotFoundException e) { 4288 Slog.w(TAG, "Unknown package " + pkgName + ", skipping"); 4289 } 4290 } 4291 } 4292 } 4293 4294 private OutputStream emitAesBackupHeader(StringBuilder headerbuf, 4295 OutputStream ofstream) throws Exception { 4296 // User key will be used to encrypt the master key. 4297 byte[] newUserSalt = randomBytes(PBKDF2_SALT_SIZE); 4298 SecretKey userKey = buildPasswordKey(PBKDF_CURRENT, mEncryptPassword, newUserSalt, 4299 PBKDF2_HASH_ROUNDS); 4300 4301 // the master key is random for each backup 4302 byte[] masterPw = new byte[256 / 8]; 4303 mRng.nextBytes(masterPw); 4304 byte[] checksumSalt = randomBytes(PBKDF2_SALT_SIZE); 4305 4306 // primary encryption of the datastream with the random key 4307 Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding"); 4308 SecretKeySpec masterKeySpec = new SecretKeySpec(masterPw, "AES"); 4309 c.init(Cipher.ENCRYPT_MODE, masterKeySpec); 4310 OutputStream finalOutput = new CipherOutputStream(ofstream, c); 4311 4312 // line 4: name of encryption algorithm 4313 headerbuf.append(ENCRYPTION_ALGORITHM_NAME); 4314 headerbuf.append('\n'); 4315 // line 5: user password salt [hex] 4316 headerbuf.append(byteArrayToHex(newUserSalt)); 4317 headerbuf.append('\n'); 4318 // line 6: master key checksum salt [hex] 4319 headerbuf.append(byteArrayToHex(checksumSalt)); 4320 headerbuf.append('\n'); 4321 // line 7: number of PBKDF2 rounds used [decimal] 4322 headerbuf.append(PBKDF2_HASH_ROUNDS); 4323 headerbuf.append('\n'); 4324 4325 // line 8: IV of the user key [hex] 4326 Cipher mkC = Cipher.getInstance("AES/CBC/PKCS5Padding"); 4327 mkC.init(Cipher.ENCRYPT_MODE, userKey); 4328 4329 byte[] IV = mkC.getIV(); 4330 headerbuf.append(byteArrayToHex(IV)); 4331 headerbuf.append('\n'); 4332 4333 // line 9: master IV + key blob, encrypted by the user key [hex]. Blob format: 4334 // [byte] IV length = Niv 4335 // [array of Niv bytes] IV itself 4336 // [byte] master key length = Nmk 4337 // [array of Nmk bytes] master key itself 4338 // [byte] MK checksum hash length = Nck 4339 // [array of Nck bytes] master key checksum hash 4340 // 4341 // The checksum is the (master key + checksum salt), run through the 4342 // stated number of PBKDF2 rounds 4343 IV = c.getIV(); 4344 byte[] mk = masterKeySpec.getEncoded(); 4345 byte[] checksum = makeKeyChecksum(PBKDF_CURRENT, masterKeySpec.getEncoded(), 4346 checksumSalt, PBKDF2_HASH_ROUNDS); 4347 4348 ByteArrayOutputStream blob = new ByteArrayOutputStream(IV.length + mk.length 4349 + checksum.length + 3); 4350 DataOutputStream mkOut = new DataOutputStream(blob); 4351 mkOut.writeByte(IV.length); 4352 mkOut.write(IV); 4353 mkOut.writeByte(mk.length); 4354 mkOut.write(mk); 4355 mkOut.writeByte(checksum.length); 4356 mkOut.write(checksum); 4357 mkOut.flush(); 4358 byte[] encryptedMk = mkC.doFinal(blob.toByteArray()); 4359 headerbuf.append(byteArrayToHex(encryptedMk)); 4360 headerbuf.append('\n'); 4361 4362 return finalOutput; 4363 } 4364 4365 private void finalizeBackup(OutputStream out) { 4366 try { 4367 // A standard 'tar' EOF sequence: two 512-byte blocks of all zeroes. 4368 byte[] eof = new byte[512 * 2]; // newly allocated == zero filled 4369 out.write(eof); 4370 } catch (IOException e) { 4371 Slog.w(TAG, "Error attempting to finalize backup stream"); 4372 } 4373 } 4374 4375 @Override 4376 public void run() { 4377 String includeKeyValue = mKeyValue ? ", including key-value backups" : ""; 4378 Slog.i(TAG, "--- Performing adb backup" + includeKeyValue + " ---"); 4379 4380 TreeMap<String, PackageInfo> packagesToBackup = new TreeMap<String, PackageInfo>(); 4381 FullBackupObbConnection obbConnection = new FullBackupObbConnection(); 4382 obbConnection.establish(); // we'll want this later 4383 4384 sendStartBackup(); 4385 4386 // doAllApps supersedes the package set if any 4387 if (mAllApps) { 4388 List<PackageInfo> allPackages = mPackageManager.getInstalledPackages( 4389 PackageManager.GET_SIGNATURES); 4390 for (int i = 0; i < allPackages.size(); i++) { 4391 PackageInfo pkg = allPackages.get(i); 4392 // Exclude system apps if we've been asked to do so 4393 if (mIncludeSystem == true 4394 || ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) == 0)) { 4395 packagesToBackup.put(pkg.packageName, pkg); 4396 } 4397 } 4398 } 4399 4400 // If we're doing widget state as well, ensure that we have all the involved 4401 // host & provider packages in the set 4402 if (mDoWidgets) { 4403 // TODO: http://b/22388012 4404 List<String> pkgs = 4405 AppWidgetBackupBridge.getWidgetParticipants(UserHandle.USER_SYSTEM); 4406 if (pkgs != null) { 4407 if (MORE_DEBUG) { 4408 Slog.i(TAG, "Adding widget participants to backup set:"); 4409 StringBuilder sb = new StringBuilder(128); 4410 sb.append(" "); 4411 for (String s : pkgs) { 4412 sb.append(' '); 4413 sb.append(s); 4414 } 4415 Slog.i(TAG, sb.toString()); 4416 } 4417 addPackagesToSet(packagesToBackup, pkgs); 4418 } 4419 } 4420 4421 // Now process the command line argument packages, if any. Note that explicitly- 4422 // named system-partition packages will be included even if includeSystem was 4423 // set to false. 4424 if (mPackages != null) { 4425 addPackagesToSet(packagesToBackup, mPackages); 4426 } 4427 4428 // Now we cull any inapplicable / inappropriate packages from the set. This 4429 // includes the special shared-storage agent package; we handle that one 4430 // explicitly at the end of the backup pass. Packages supporting key-value backup are 4431 // added to their own queue, and handled after packages supporting fullbackup. 4432 ArrayList<PackageInfo> keyValueBackupQueue = new ArrayList<>(); 4433 Iterator<Entry<String, PackageInfo>> iter = packagesToBackup.entrySet().iterator(); 4434 while (iter.hasNext()) { 4435 PackageInfo pkg = iter.next().getValue(); 4436 if (!appIsEligibleForBackup(pkg.applicationInfo, mPackageManager) 4437 || appIsStopped(pkg.applicationInfo)) { 4438 iter.remove(); 4439 if (DEBUG) { 4440 Slog.i(TAG, "Package " + pkg.packageName 4441 + " is not eligible for backup, removing."); 4442 } 4443 } else if (appIsKeyValueOnly(pkg)) { 4444 iter.remove(); 4445 if (DEBUG) { 4446 Slog.i(TAG, "Package " + pkg.packageName 4447 + " is key-value."); 4448 } 4449 keyValueBackupQueue.add(pkg); 4450 } 4451 } 4452 4453 // flatten the set of packages now so we can explicitly control the ordering 4454 ArrayList<PackageInfo> backupQueue = 4455 new ArrayList<PackageInfo>(packagesToBackup.values()); 4456 FileOutputStream ofstream = new FileOutputStream(mOutputFile.getFileDescriptor()); 4457 OutputStream out = null; 4458 4459 PackageInfo pkg = null; 4460 try { 4461 boolean encrypting = (mEncryptPassword != null && mEncryptPassword.length() > 0); 4462 4463 // Only allow encrypted backups of encrypted devices 4464 if (deviceIsEncrypted() && !encrypting) { 4465 Slog.e(TAG, "Unencrypted backup of encrypted device; aborting"); 4466 return; 4467 } 4468 4469 OutputStream finalOutput = ofstream; 4470 4471 // Verify that the given password matches the currently-active 4472 // backup password, if any 4473 if (!backupPasswordMatches(mCurrentPassword)) { 4474 if (DEBUG) Slog.w(TAG, "Backup password mismatch; aborting"); 4475 return; 4476 } 4477 4478 // Write the global file header. All strings are UTF-8 encoded; lines end 4479 // with a '\n' byte. Actual backup data begins immediately following the 4480 // final '\n'. 4481 // 4482 // line 1: "ANDROID BACKUP" 4483 // line 2: backup file format version, currently "5" 4484 // line 3: compressed? "0" if not compressed, "1" if compressed. 4485 // line 4: name of encryption algorithm [currently only "none" or "AES-256"] 4486 // 4487 // When line 4 is not "none", then additional header data follows: 4488 // 4489 // line 5: user password salt [hex] 4490 // line 6: master key checksum salt [hex] 4491 // line 7: number of PBKDF2 rounds to use (same for user & master) [decimal] 4492 // line 8: IV of the user key [hex] 4493 // line 9: master key blob [hex] 4494 // IV of the master key, master key itself, master key checksum hash 4495 // 4496 // The master key checksum is the master key plus its checksum salt, run through 4497 // 10k rounds of PBKDF2. This is used to verify that the user has supplied the 4498 // correct password for decrypting the archive: the master key decrypted from 4499 // the archive using the user-supplied password is also run through PBKDF2 in 4500 // this way, and if the result does not match the checksum as stored in the 4501 // archive, then we know that the user-supplied password does not match the 4502 // archive's. 4503 StringBuilder headerbuf = new StringBuilder(1024); 4504 4505 headerbuf.append(BACKUP_FILE_HEADER_MAGIC); 4506 headerbuf.append(BACKUP_FILE_VERSION); // integer, no trailing \n 4507 headerbuf.append(mCompress ? "\n1\n" : "\n0\n"); 4508 4509 try { 4510 // Set up the encryption stage if appropriate, and emit the correct header 4511 if (encrypting) { 4512 finalOutput = emitAesBackupHeader(headerbuf, finalOutput); 4513 } else { 4514 headerbuf.append("none\n"); 4515 } 4516 4517 byte[] header = headerbuf.toString().getBytes("UTF-8"); 4518 ofstream.write(header); 4519 4520 // Set up the compression stage feeding into the encryption stage (if any) 4521 if (mCompress) { 4522 Deflater deflater = new Deflater(Deflater.BEST_COMPRESSION); 4523 finalOutput = new DeflaterOutputStream(finalOutput, deflater, true); 4524 } 4525 4526 out = finalOutput; 4527 } catch (Exception e) { 4528 // Should never happen! 4529 Slog.e(TAG, "Unable to emit archive header", e); 4530 return; 4531 } 4532 4533 // Shared storage if requested 4534 if (mIncludeShared) { 4535 try { 4536 pkg = mPackageManager.getPackageInfo(SHARED_BACKUP_AGENT_PACKAGE, 0); 4537 backupQueue.add(pkg); 4538 } catch (NameNotFoundException e) { 4539 Slog.e(TAG, "Unable to find shared-storage backup handler"); 4540 } 4541 } 4542 4543 // Now actually run the constructed backup sequence for full backup 4544 int N = backupQueue.size(); 4545 for (int i = 0; i < N; i++) { 4546 pkg = backupQueue.get(i); 4547 if (DEBUG) { 4548 Slog.i(TAG,"--- Performing full backup for package " + pkg.packageName 4549 + " ---"); 4550 } 4551 final boolean isSharedStorage = 4552 pkg.packageName.equals(SHARED_BACKUP_AGENT_PACKAGE); 4553 4554 mBackupEngine = new FullBackupEngine(out, null, pkg, mIncludeApks, this, Long.MAX_VALUE, mCurrentOpToken); 4555 sendOnBackupPackage(isSharedStorage ? "Shared storage" : pkg.packageName); 4556 4557 // Don't need to check preflight result as there is no preflight hook. 4558 mCurrentTarget = pkg; 4559 mBackupEngine.backupOnePackage(); 4560 4561 // after the app's agent runs to handle its private filesystem 4562 // contents, back up any OBB content it has on its behalf. 4563 if (mIncludeObbs) { 4564 boolean obbOkay = obbConnection.backupObbs(pkg, out); 4565 if (!obbOkay) { 4566 throw new RuntimeException("Failure writing OBB stack for " + pkg); 4567 } 4568 } 4569 } 4570 // And for key-value backup if enabled 4571 if (mKeyValue) { 4572 for (PackageInfo keyValuePackage : keyValueBackupQueue) { 4573 if (DEBUG) { 4574 Slog.i(TAG, "--- Performing key-value backup for package " 4575 + keyValuePackage.packageName + " ---"); 4576 } 4577 KeyValueAdbBackupEngine kvBackupEngine = 4578 new KeyValueAdbBackupEngine(out, keyValuePackage, 4579 BackupManagerService.this, 4580 mPackageManager, mBaseStateDir, mDataDir); 4581 sendOnBackupPackage(keyValuePackage.packageName); 4582 kvBackupEngine.backupOnePackage(); 4583 } 4584 } 4585 4586 // Done! 4587 finalizeBackup(out); 4588 } catch (RemoteException e) { 4589 Slog.e(TAG, "App died during full backup"); 4590 } catch (Exception e) { 4591 Slog.e(TAG, "Internal exception during full backup", e); 4592 } finally { 4593 try { 4594 if (out != null) { 4595 out.flush(); 4596 out.close(); 4597 } 4598 mOutputFile.close(); 4599 } catch (IOException e) { 4600 /* nothing we can do about this */ 4601 } 4602 synchronized (mLatch) { 4603 mLatch.set(true); 4604 mLatch.notifyAll(); 4605 } 4606 sendEndBackup(); 4607 obbConnection.tearDown(); 4608 if (DEBUG) Slog.d(TAG, "Full backup pass complete."); 4609 mWakelock.release(); 4610 } 4611 } 4612 4613 // BackupRestoreTask methods, used for timeout handling 4614 @Override 4615 public void execute() { 4616 // Unused 4617 } 4618 4619 @Override 4620 public void operationComplete(long result) { 4621 // Unused 4622 } 4623 4624 @Override 4625 public void handleCancel(boolean cancelAll) { 4626 final PackageInfo target = mCurrentTarget; 4627 if (DEBUG) { 4628 Slog.w(TAG, "adb backup cancel of " + target); 4629 } 4630 if (target != null) { 4631 tearDownAgentAndKill(mCurrentTarget.applicationInfo); 4632 } 4633 removeOperation(mCurrentOpToken); 4634 } 4635 } 4636 4637 /** 4638 * Full backup task extension used for transport-oriented operation. 4639 * 4640 * Flow: 4641 * For each requested package: 4642 * - Spin off a new SinglePackageBackupRunner (mBackupRunner) for the current package. 4643 * - Wait until preflight is complete. (mBackupRunner.getPreflightResultBlocking()) 4644 * - If preflight data size is within limit, start reading data from agent pipe and writing 4645 * to transport pipe. While there is data to send, call transport.sendBackupData(int) to 4646 * tell the transport how many bytes to expect on its pipe. 4647 * - After sending all data, call transport.finishBackup() if things went well. And 4648 * transport.cancelFullBackup() otherwise. 4649 * 4650 * Interactions with mCurrentOperations: 4651 * - An entry for this object is added to mCurrentOperations for the entire lifetime of this 4652 * object. Used to cancel the operation. 4653 * - SinglePackageBackupRunner and SinglePackageBackupPreflight will put ephemeral entries 4654 * to get timeouts or operation complete callbacks. 4655 * 4656 * Handling cancels: 4657 * - The contract we provide is that the task won't interact with the transport after 4658 * handleCancel() is done executing. 4659 * - This task blocks at 3 points: 1. Preflight result check 2. Reading on agent side pipe 4660 * and 3. Get backup result from mBackupRunner. 4661 * - Bubbling up handleCancel to mBackupRunner handles all 3: 1. Calls handleCancel on the 4662 * preflight operation which counts down on the preflight latch. 2. Tears down the agent, 4663 * so read() returns -1. 3. Notifies mCurrentOpLock which unblocks 4664 * mBackupRunner.getBackupResultBlocking(). 4665 */ 4666 class PerformFullTransportBackupTask extends FullBackupTask implements BackupRestoreTask { 4667 static final String TAG = "PFTBT"; 4668 4669 private final Object mCancelLock = new Object(); 4670 4671 ArrayList<PackageInfo> mPackages; 4672 PackageInfo mCurrentPackage; 4673 boolean mUpdateSchedule; 4674 CountDownLatch mLatch; 4675 FullBackupJob mJob; // if a scheduled job needs to be finished afterwards 4676 IBackupObserver mBackupObserver; 4677 IBackupManagerMonitor mMonitor; 4678 boolean mUserInitiated; 4679 private volatile IBackupTransport mTransport; 4680 SinglePackageBackupRunner mBackupRunner; 4681 private final int mBackupRunnerOpToken; 4682 4683 // This is true when a backup operation for some package is in progress. 4684 private volatile boolean mIsDoingBackup; 4685 private volatile boolean mCancelAll; 4686 private final int mCurrentOpToken; 4687 4688 PerformFullTransportBackupTask(IFullBackupRestoreObserver observer, 4689 String[] whichPackages, boolean updateSchedule, 4690 FullBackupJob runningJob, CountDownLatch latch, IBackupObserver backupObserver, 4691 IBackupManagerMonitor monitor, boolean userInitiated) { 4692 super(observer); 4693 mUpdateSchedule = updateSchedule; 4694 mLatch = latch; 4695 mJob = runningJob; 4696 mPackages = new ArrayList<PackageInfo>(whichPackages.length); 4697 mBackupObserver = backupObserver; 4698 mMonitor = monitor; 4699 mUserInitiated = userInitiated; 4700 mCurrentOpToken = generateRandomIntegerToken(); 4701 mBackupRunnerOpToken = generateRandomIntegerToken(); 4702 4703 if (isBackupOperationInProgress()) { 4704 if (DEBUG) { 4705 Slog.d(TAG, "Skipping full backup. A backup is already in progress."); 4706 } 4707 mCancelAll = true; 4708 return; 4709 } 4710 4711 registerTask(); 4712 4713 for (String pkg : whichPackages) { 4714 try { 4715 PackageInfo info = mPackageManager.getPackageInfo(pkg, 4716 PackageManager.GET_SIGNATURES); 4717 mCurrentPackage = info; 4718 if (!appIsEligibleForBackup(info.applicationInfo, mPackageManager)) { 4719 // Cull any packages that have indicated that backups are not permitted, 4720 // that run as system-domain uids but do not define their own backup agents, 4721 // as well as any explicit mention of the 'special' shared-storage agent 4722 // package (we handle that one at the end). 4723 if (MORE_DEBUG) { 4724 Slog.d(TAG, "Ignoring ineligible package " + pkg); 4725 } 4726 mMonitor = monitorEvent(mMonitor, 4727 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_INELIGIBLE, 4728 mCurrentPackage, 4729 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 4730 null); 4731 sendBackupOnPackageResult(mBackupObserver, pkg, 4732 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 4733 continue; 4734 } else if (!appGetsFullBackup(info)) { 4735 // Cull any packages that are found in the queue but now aren't supposed 4736 // to get full-data backup operations. 4737 if (MORE_DEBUG) { 4738 Slog.d(TAG, "Ignoring full-data backup of key/value participant " 4739 + pkg); 4740 } 4741 mMonitor = monitorEvent(mMonitor, 4742 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_KEY_VALUE_PARTICIPANT, 4743 mCurrentPackage, 4744 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 4745 null); 4746 sendBackupOnPackageResult(mBackupObserver, pkg, 4747 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 4748 continue; 4749 } else if (appIsStopped(info.applicationInfo)) { 4750 // Cull any packages in the 'stopped' state: they've either just been 4751 // installed or have explicitly been force-stopped by the user. In both 4752 // cases we do not want to launch them for backup. 4753 if (MORE_DEBUG) { 4754 Slog.d(TAG, "Ignoring stopped package " + pkg); 4755 } 4756 mMonitor = monitorEvent(mMonitor, 4757 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_STOPPED, 4758 mCurrentPackage, 4759 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 4760 null); 4761 sendBackupOnPackageResult(mBackupObserver, pkg, 4762 BackupManager.ERROR_BACKUP_NOT_ALLOWED); 4763 continue; 4764 } 4765 mPackages.add(info); 4766 } catch (NameNotFoundException e) { 4767 Slog.i(TAG, "Requested package " + pkg + " not found; ignoring"); 4768 mMonitor = monitorEvent(mMonitor, 4769 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_NOT_FOUND, 4770 mCurrentPackage, 4771 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 4772 null); 4773 } 4774 } 4775 } 4776 4777 private void registerTask() { 4778 synchronized (mCurrentOpLock) { 4779 Slog.d(TAG, "backupmanager pftbt token=" + Integer.toHexString(mCurrentOpToken)); 4780 mCurrentOperations.put(mCurrentOpToken, new Operation(OP_PENDING, this, 4781 OP_TYPE_BACKUP)); 4782 } 4783 } 4784 4785 private void unregisterTask() { 4786 removeOperation(mCurrentOpToken); 4787 } 4788 4789 @Override 4790 public void execute() { 4791 // Nothing to do. 4792 } 4793 4794 @Override 4795 public void handleCancel(boolean cancelAll) { 4796 synchronized (mCancelLock) { 4797 // We only support 'cancelAll = true' case for this task. Cancelling of a single package 4798 4799 // due to timeout is handled by SinglePackageBackupRunner and SinglePackageBackupPreflight. 4800 4801 if (!cancelAll) { 4802 Slog.wtf(TAG, "Expected cancelAll to be true."); 4803 } 4804 4805 if (mCancelAll) { 4806 Slog.d(TAG, "Ignoring duplicate cancel call."); 4807 return; 4808 } 4809 4810 mCancelAll = true; 4811 if (mIsDoingBackup) { 4812 BackupManagerService.this.handleCancel(mBackupRunnerOpToken, cancelAll); 4813 try { 4814 mTransport.cancelFullBackup(); 4815 } catch (RemoteException e) { 4816 Slog.w(TAG, "Error calling cancelFullBackup() on transport: " + e); 4817 // Can't do much. 4818 } 4819 } 4820 } 4821 } 4822 4823 @Override 4824 public void operationComplete(long result) { 4825 // Nothing to do. 4826 } 4827 4828 @Override 4829 public void run() { 4830 4831 // data from the app, passed to us for bridging to the transport 4832 ParcelFileDescriptor[] enginePipes = null; 4833 4834 // Pipe through which we write data to the transport 4835 ParcelFileDescriptor[] transportPipes = null; 4836 4837 long backoff = 0; 4838 int backupRunStatus = BackupManager.SUCCESS; 4839 4840 try { 4841 if (!mEnabled || !mProvisioned) { 4842 // Backups are globally disabled, so don't proceed. 4843 if (DEBUG) { 4844 Slog.i(TAG, "full backup requested but enabled=" + mEnabled 4845 + " provisioned=" + mProvisioned + "; ignoring"); 4846 } 4847 int monitoringEvent; 4848 if (!mEnabled) { 4849 monitoringEvent = BackupManagerMonitor.LOG_EVENT_ID_BACKUP_DISABLED; 4850 } else { 4851 monitoringEvent = BackupManagerMonitor.LOG_EVENT_ID_DEVICE_NOT_PROVISIONED; 4852 } 4853 mMonitor = monitorEvent(mMonitor, monitoringEvent, null, 4854 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 4855 mUpdateSchedule = false; 4856 backupRunStatus = BackupManager.ERROR_BACKUP_NOT_ALLOWED; 4857 return; 4858 } 4859 4860 mTransport = mTransportManager.getCurrentTransportBinder(); 4861 if (mTransport == null) { 4862 Slog.w(TAG, "Transport not present; full data backup not performed"); 4863 backupRunStatus = BackupManager.ERROR_TRANSPORT_ABORTED; 4864 mMonitor = monitorEvent(mMonitor, 4865 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_TRANSPORT_NOT_PRESENT, 4866 mCurrentPackage, BackupManagerMonitor.LOG_EVENT_CATEGORY_TRANSPORT, 4867 null); 4868 return; 4869 } 4870 4871 // Set up to send data to the transport 4872 final int N = mPackages.size(); 4873 final byte[] buffer = new byte[8192]; 4874 for (int i = 0; i < N; i++) { 4875 mBackupRunner = null; 4876 PackageInfo currentPackage = mPackages.get(i); 4877 String packageName = currentPackage.packageName; 4878 if (DEBUG) { 4879 Slog.i(TAG, "Initiating full-data transport backup of " + packageName 4880 + " token: " + mCurrentOpToken); 4881 } 4882 EventLog.writeEvent(EventLogTags.FULL_BACKUP_PACKAGE, packageName); 4883 4884 transportPipes = ParcelFileDescriptor.createPipe(); 4885 4886 // Tell the transport the data's coming 4887 int flags = mUserInitiated ? BackupTransport.FLAG_USER_INITIATED : 0; 4888 int backupPackageStatus; 4889 long quota = Long.MAX_VALUE; 4890 synchronized (mCancelLock) { 4891 if (mCancelAll) { 4892 break; 4893 } 4894 backupPackageStatus = mTransport.performFullBackup(currentPackage, 4895 transportPipes[0], flags); 4896 4897 if (backupPackageStatus == BackupTransport.TRANSPORT_OK) { 4898 quota = mTransport.getBackupQuota(currentPackage.packageName, 4899 true /* isFullBackup */); 4900 // Now set up the backup engine / data source end of things 4901 enginePipes = ParcelFileDescriptor.createPipe(); 4902 mBackupRunner = 4903 new SinglePackageBackupRunner(enginePipes[1], currentPackage, 4904 mTransport, quota, mBackupRunnerOpToken); 4905 // The runner dup'd the pipe half, so we close it here 4906 enginePipes[1].close(); 4907 enginePipes[1] = null; 4908 4909 mIsDoingBackup = true; 4910 } 4911 } 4912 if (backupPackageStatus == BackupTransport.TRANSPORT_OK) { 4913 4914 // The transport has its own copy of the read end of the pipe, 4915 // so close ours now 4916 transportPipes[0].close(); 4917 transportPipes[0] = null; 4918 4919 // Spin off the runner to fetch the app's data and pipe it 4920 // into the engine pipes 4921 (new Thread(mBackupRunner, "package-backup-bridge")).start(); 4922 4923 // Read data off the engine pipe and pass it to the transport 4924 // pipe until we hit EOD on the input stream. We do not take 4925 // close() responsibility for these FDs into these stream wrappers. 4926 FileInputStream in = new FileInputStream( 4927 enginePipes[0].getFileDescriptor()); 4928 FileOutputStream out = new FileOutputStream( 4929 transportPipes[1].getFileDescriptor()); 4930 long totalRead = 0; 4931 final long preflightResult = mBackupRunner.getPreflightResultBlocking(); 4932 // Preflight result is negative if some error happened on preflight. 4933 if (preflightResult < 0) { 4934 if (MORE_DEBUG) { 4935 Slog.d(TAG, "Backup error after preflight of package " 4936 + packageName + ": " + preflightResult 4937 + ", not running backup."); 4938 } 4939 mMonitor = monitorEvent(mMonitor, 4940 BackupManagerMonitor.LOG_EVENT_ID_ERROR_PREFLIGHT, 4941 mCurrentPackage, 4942 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 4943 putMonitoringExtra(null, 4944 BackupManagerMonitor.EXTRA_LOG_PREFLIGHT_ERROR, 4945 preflightResult)); 4946 backupPackageStatus = (int) preflightResult; 4947 } else { 4948 int nRead = 0; 4949 do { 4950 nRead = in.read(buffer); 4951 if (MORE_DEBUG) { 4952 Slog.v(TAG, "in.read(buffer) from app: " + nRead); 4953 } 4954 if (nRead > 0) { 4955 out.write(buffer, 0, nRead); 4956 synchronized (mCancelLock) { 4957 if (!mCancelAll) { 4958 backupPackageStatus = mTransport.sendBackupData(nRead); 4959 } 4960 } 4961 totalRead += nRead; 4962 if (mBackupObserver != null && preflightResult > 0) { 4963 sendBackupOnUpdate(mBackupObserver, packageName, 4964 new BackupProgress(preflightResult, totalRead)); 4965 } 4966 } 4967 } while (nRead > 0 4968 && backupPackageStatus == BackupTransport.TRANSPORT_OK); 4969 // Despite preflight succeeded, package still can hit quota on flight. 4970 if (backupPackageStatus == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) { 4971 Slog.w(TAG, "Package hit quota limit in-flight " + packageName 4972 + ": " + totalRead + " of " + quota); 4973 mMonitor = monitorEvent(mMonitor, 4974 BackupManagerMonitor.LOG_EVENT_ID_QUOTA_HIT_PREFLIGHT, 4975 mCurrentPackage, 4976 BackupManagerMonitor.LOG_EVENT_CATEGORY_TRANSPORT, 4977 null); 4978 mBackupRunner.sendQuotaExceeded(totalRead, quota); 4979 } 4980 } 4981 4982 final int backupRunnerResult = mBackupRunner.getBackupResultBlocking(); 4983 4984 synchronized (mCancelLock) { 4985 mIsDoingBackup = false; 4986 // If mCancelCurrent is true, we have already called cancelFullBackup(). 4987 if (!mCancelAll) { 4988 if (backupRunnerResult == BackupTransport.TRANSPORT_OK) { 4989 // If we were otherwise in a good state, now interpret the final 4990 // result based on what finishBackup() returns. If we're in a 4991 // failure case already, preserve that result and ignore whatever 4992 // finishBackup() reports. 4993 final int finishResult = mTransport.finishBackup(); 4994 if (backupPackageStatus == BackupTransport.TRANSPORT_OK) { 4995 backupPackageStatus = finishResult; 4996 } 4997 } else { 4998 mTransport.cancelFullBackup(); 4999 } 5000 } 5001 } 5002 5003 // A transport-originated error here means that we've hit an error that the 5004 // runner doesn't know about, so it's still moving data but we're pulling the 5005 // rug out from under it. Don't ask for its result: we already know better 5006 // and we'll hang if we block waiting for it, since it relies on us to 5007 // read back the data it's writing into the engine. Just proceed with 5008 // a graceful failure. The runner/engine mechanism will tear itself 5009 // down cleanly when we close the pipes from this end. Transport-level 5010 // errors take precedence over agent/app-specific errors for purposes of 5011 // determining our course of action. 5012 if (backupPackageStatus == BackupTransport.TRANSPORT_OK) { 5013 // We still could fail in backup runner thread. 5014 if (backupRunnerResult != BackupTransport.TRANSPORT_OK) { 5015 // If there was an error in runner thread and 5016 // not TRANSPORT_ERROR here, overwrite it. 5017 backupPackageStatus = backupRunnerResult; 5018 } 5019 } else { 5020 if (MORE_DEBUG) { 5021 Slog.i(TAG, "Transport-level failure; cancelling agent work"); 5022 } 5023 } 5024 5025 if (MORE_DEBUG) { 5026 Slog.i(TAG, "Done delivering backup data: result=" 5027 + backupPackageStatus); 5028 } 5029 5030 if (backupPackageStatus != BackupTransport.TRANSPORT_OK) { 5031 Slog.e(TAG, "Error " + backupPackageStatus + " backing up " 5032 + packageName); 5033 } 5034 5035 // Also ask the transport how long it wants us to wait before 5036 // moving on to the next package, if any. 5037 backoff = mTransport.requestFullBackupTime(); 5038 if (DEBUG_SCHEDULING) { 5039 Slog.i(TAG, "Transport suggested backoff=" + backoff); 5040 } 5041 5042 } 5043 5044 // Roll this package to the end of the backup queue if we're 5045 // in a queue-driven mode (regardless of success/failure) 5046 if (mUpdateSchedule) { 5047 enqueueFullBackup(packageName, System.currentTimeMillis()); 5048 } 5049 5050 if (backupPackageStatus == BackupTransport.TRANSPORT_PACKAGE_REJECTED) { 5051 sendBackupOnPackageResult(mBackupObserver, packageName, 5052 BackupManager.ERROR_TRANSPORT_PACKAGE_REJECTED); 5053 if (DEBUG) { 5054 Slog.i(TAG, "Transport rejected backup of " + packageName 5055 + ", skipping"); 5056 } 5057 EventLog.writeEvent(EventLogTags.FULL_BACKUP_AGENT_FAILURE, packageName, 5058 "transport rejected"); 5059 // This failure state can come either a-priori from the transport, or 5060 // from the preflight pass. If we got as far as preflight, we now need 5061 // to tear down the target process. 5062 if (mBackupRunner != null) { 5063 tearDownAgentAndKill(currentPackage.applicationInfo); 5064 } 5065 // ... and continue looping. 5066 } else if (backupPackageStatus == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) { 5067 sendBackupOnPackageResult(mBackupObserver, packageName, 5068 BackupManager.ERROR_TRANSPORT_QUOTA_EXCEEDED); 5069 if (DEBUG) { 5070 Slog.i(TAG, "Transport quota exceeded for package: " + packageName); 5071 EventLog.writeEvent(EventLogTags.FULL_BACKUP_QUOTA_EXCEEDED, 5072 packageName); 5073 } 5074 tearDownAgentAndKill(currentPackage.applicationInfo); 5075 // Do nothing, clean up, and continue looping. 5076 } else if (backupPackageStatus == BackupTransport.AGENT_ERROR) { 5077 sendBackupOnPackageResult(mBackupObserver, packageName, 5078 BackupManager.ERROR_AGENT_FAILURE); 5079 Slog.w(TAG, "Application failure for package: " + packageName); 5080 EventLog.writeEvent(EventLogTags.BACKUP_AGENT_FAILURE, packageName); 5081 tearDownAgentAndKill(currentPackage.applicationInfo); 5082 // Do nothing, clean up, and continue looping. 5083 } else if (backupPackageStatus == BackupManager.ERROR_BACKUP_CANCELLED) { 5084 sendBackupOnPackageResult(mBackupObserver, packageName, 5085 BackupManager.ERROR_BACKUP_CANCELLED); 5086 Slog.w(TAG, "Backup cancelled. package=" + packageName + 5087 ", cancelAll=" + mCancelAll); 5088 EventLog.writeEvent(EventLogTags.FULL_BACKUP_CANCELLED, packageName); 5089 tearDownAgentAndKill(currentPackage.applicationInfo); 5090 // Do nothing, clean up, and continue looping. 5091 } else if (backupPackageStatus != BackupTransport.TRANSPORT_OK) { 5092 sendBackupOnPackageResult(mBackupObserver, packageName, 5093 BackupManager.ERROR_TRANSPORT_ABORTED); 5094 Slog.w(TAG, "Transport failed; aborting backup: " + backupPackageStatus); 5095 EventLog.writeEvent(EventLogTags.FULL_BACKUP_TRANSPORT_FAILURE); 5096 // Abort entire backup pass. 5097 backupRunStatus = BackupManager.ERROR_TRANSPORT_ABORTED; 5098 tearDownAgentAndKill(currentPackage.applicationInfo); 5099 return; 5100 } else { 5101 // Success! 5102 sendBackupOnPackageResult(mBackupObserver, packageName, 5103 BackupManager.SUCCESS); 5104 EventLog.writeEvent(EventLogTags.FULL_BACKUP_SUCCESS, packageName); 5105 logBackupComplete(packageName); 5106 } 5107 cleanUpPipes(transportPipes); 5108 cleanUpPipes(enginePipes); 5109 if (currentPackage.applicationInfo != null) { 5110 Slog.i(TAG, "Unbinding agent in " + packageName); 5111 addBackupTrace("unbinding " + packageName); 5112 try { 5113 mActivityManager.unbindBackupAgent(currentPackage.applicationInfo); 5114 } catch (RemoteException e) { /* can't happen; activity manager is local */ } 5115 } 5116 } 5117 } catch (Exception e) { 5118 backupRunStatus = BackupManager.ERROR_TRANSPORT_ABORTED; 5119 Slog.w(TAG, "Exception trying full transport backup", e); 5120 mMonitor = monitorEvent(mMonitor, 5121 BackupManagerMonitor.LOG_EVENT_ID_EXCEPTION_FULL_BACKUP, 5122 mCurrentPackage, 5123 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 5124 putMonitoringExtra(null, 5125 BackupManagerMonitor.EXTRA_LOG_EXCEPTION_FULL_BACKUP, 5126 Log.getStackTraceString(e))); 5127 5128 } finally { 5129 5130 if (mCancelAll) { 5131 backupRunStatus = BackupManager.ERROR_BACKUP_CANCELLED; 5132 } 5133 5134 if (DEBUG) { 5135 Slog.i(TAG, "Full backup completed with status: " + backupRunStatus); 5136 } 5137 sendBackupFinished(mBackupObserver, backupRunStatus); 5138 5139 cleanUpPipes(transportPipes); 5140 cleanUpPipes(enginePipes); 5141 5142 unregisterTask(); 5143 5144 if (mJob != null) { 5145 mJob.finishBackupPass(); 5146 } 5147 5148 synchronized (mQueueLock) { 5149 mRunningFullBackupTask = null; 5150 } 5151 5152 mLatch.countDown(); 5153 5154 // Now that we're actually done with schedule-driven work, reschedule 5155 // the next pass based on the new queue state. 5156 if (mUpdateSchedule) { 5157 scheduleNextFullBackupJob(backoff); 5158 } 5159 5160 Slog.i(BackupManagerService.TAG, "Full data backup pass finished."); 5161 mWakelock.release(); 5162 } 5163 } 5164 5165 void cleanUpPipes(ParcelFileDescriptor[] pipes) { 5166 if (pipes != null) { 5167 if (pipes[0] != null) { 5168 ParcelFileDescriptor fd = pipes[0]; 5169 pipes[0] = null; 5170 try { 5171 fd.close(); 5172 } catch (IOException e) { 5173 Slog.w(TAG, "Unable to close pipe!"); 5174 } 5175 } 5176 if (pipes[1] != null) { 5177 ParcelFileDescriptor fd = pipes[1]; 5178 pipes[1] = null; 5179 try { 5180 fd.close(); 5181 } catch (IOException e) { 5182 Slog.w(TAG, "Unable to close pipe!"); 5183 } 5184 } 5185 } 5186 } 5187 5188 // Run the backup and pipe it back to the given socket -- expects to run on 5189 // a standalone thread. The runner owns this half of the pipe, and closes 5190 // it to indicate EOD to the other end. 5191 class SinglePackageBackupPreflight implements BackupRestoreTask, FullBackupPreflight { 5192 final AtomicLong mResult = new AtomicLong(BackupTransport.AGENT_ERROR); 5193 final CountDownLatch mLatch = new CountDownLatch(1); 5194 final IBackupTransport mTransport; 5195 final long mQuota; 5196 private final int mCurrentOpToken; 5197 5198 SinglePackageBackupPreflight(IBackupTransport transport, long quota, int currentOpToken) { 5199 mTransport = transport; 5200 mQuota = quota; 5201 mCurrentOpToken = currentOpToken; 5202 } 5203 5204 @Override 5205 public int preflightFullBackup(PackageInfo pkg, IBackupAgent agent) { 5206 int result; 5207 try { 5208 prepareOperationTimeout(mCurrentOpToken, TIMEOUT_FULL_BACKUP_INTERVAL, 5209 this, OP_TYPE_BACKUP_WAIT); 5210 addBackupTrace("preflighting"); 5211 if (MORE_DEBUG) { 5212 Slog.d(TAG, "Preflighting full payload of " + pkg.packageName); 5213 } 5214 agent.doMeasureFullBackup(mQuota, mCurrentOpToken, mBackupManagerBinder); 5215 5216 // Now wait to get our result back. If this backstop timeout is reached without 5217 // the latch being thrown, flow will continue as though a result or "normal" 5218 // timeout had been produced. In case of a real backstop timeout, mResult 5219 // will still contain the value it was constructed with, AGENT_ERROR, which 5220 // intentionaly falls into the "just report failure" code. 5221 mLatch.await(TIMEOUT_FULL_BACKUP_INTERVAL, TimeUnit.MILLISECONDS); 5222 5223 long totalSize = mResult.get(); 5224 // If preflight timed out, mResult will contain error code as int. 5225 if (totalSize < 0) { 5226 return (int) totalSize; 5227 } 5228 if (MORE_DEBUG) { 5229 Slog.v(TAG, "Got preflight response; size=" + totalSize); 5230 } 5231 5232 result = mTransport.checkFullBackupSize(totalSize); 5233 if (result == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) { 5234 if (MORE_DEBUG) { 5235 Slog.d(TAG, "Package hit quota limit on preflight " + 5236 pkg.packageName + ": " + totalSize + " of " + mQuota); 5237 } 5238 agent.doQuotaExceeded(totalSize, mQuota); 5239 } 5240 } catch (Exception e) { 5241 Slog.w(TAG, "Exception preflighting " + pkg.packageName + ": " + e.getMessage()); 5242 result = BackupTransport.AGENT_ERROR; 5243 } 5244 return result; 5245 } 5246 5247 @Override 5248 public void execute() { 5249 // Unused. 5250 } 5251 5252 @Override 5253 public void operationComplete(long result) { 5254 // got the callback, and our preflightFullBackup() method is waiting for the result 5255 if (MORE_DEBUG) { 5256 Slog.i(TAG, "Preflight op complete, result=" + result); 5257 } 5258 mResult.set(result); 5259 mLatch.countDown(); 5260 removeOperation(mCurrentOpToken); 5261 } 5262 5263 @Override 5264 public void handleCancel(boolean cancelAll) { 5265 if (MORE_DEBUG) { 5266 Slog.i(TAG, "Preflight cancelled; failing"); 5267 } 5268 mResult.set(BackupTransport.AGENT_ERROR); 5269 mLatch.countDown(); 5270 removeOperation(mCurrentOpToken); 5271 } 5272 5273 @Override 5274 public long getExpectedSizeOrErrorCode() { 5275 try { 5276 mLatch.await(TIMEOUT_FULL_BACKUP_INTERVAL, TimeUnit.MILLISECONDS); 5277 return mResult.get(); 5278 } catch (InterruptedException e) { 5279 return BackupTransport.NO_MORE_DATA; 5280 } 5281 } 5282 } 5283 5284 class SinglePackageBackupRunner implements Runnable, BackupRestoreTask { 5285 final ParcelFileDescriptor mOutput; 5286 final PackageInfo mTarget; 5287 final SinglePackageBackupPreflight mPreflight; 5288 final CountDownLatch mPreflightLatch; 5289 final CountDownLatch mBackupLatch; 5290 private final int mCurrentOpToken; 5291 private final int mEphemeralToken; 5292 private FullBackupEngine mEngine; 5293 private volatile int mPreflightResult; 5294 private volatile int mBackupResult; 5295 private final long mQuota; 5296 private volatile boolean mIsCancelled; 5297 5298 SinglePackageBackupRunner(ParcelFileDescriptor output, PackageInfo target, 5299 IBackupTransport transport, long quota, int currentOpToken) throws IOException { 5300 mOutput = ParcelFileDescriptor.dup(output.getFileDescriptor()); 5301 mTarget = target; 5302 mCurrentOpToken = currentOpToken; 5303 mEphemeralToken = generateRandomIntegerToken(); 5304 mPreflight = new SinglePackageBackupPreflight(transport, quota, mEphemeralToken); 5305 mPreflightLatch = new CountDownLatch(1); 5306 mBackupLatch = new CountDownLatch(1); 5307 mPreflightResult = BackupTransport.AGENT_ERROR; 5308 mBackupResult = BackupTransport.AGENT_ERROR; 5309 mQuota = quota; 5310 registerTask(); 5311 } 5312 5313 void registerTask() { 5314 synchronized (mCurrentOpLock) { 5315 mCurrentOperations.put(mCurrentOpToken, new Operation(OP_PENDING, this, 5316 OP_TYPE_BACKUP_WAIT)); 5317 } 5318 } 5319 5320 void unregisterTask() { 5321 synchronized (mCurrentOpLock) { 5322 mCurrentOperations.remove(mCurrentOpToken); 5323 } 5324 } 5325 5326 @Override 5327 public void run() { 5328 FileOutputStream out = new FileOutputStream(mOutput.getFileDescriptor()); 5329 mEngine = new FullBackupEngine(out, mPreflight, mTarget, false, this, mQuota, mCurrentOpToken); 5330 try { 5331 try { 5332 if (!mIsCancelled) { 5333 mPreflightResult = mEngine.preflightCheck(); 5334 } 5335 } finally { 5336 mPreflightLatch.countDown(); 5337 } 5338 // If there is no error on preflight, continue backup. 5339 if (mPreflightResult == BackupTransport.TRANSPORT_OK) { 5340 if (!mIsCancelled) { 5341 mBackupResult = mEngine.backupOnePackage(); 5342 } 5343 } 5344 } catch (Exception e) { 5345 Slog.e(TAG, "Exception during full package backup of " + mTarget.packageName); 5346 } finally { 5347 unregisterTask(); 5348 mBackupLatch.countDown(); 5349 try { 5350 mOutput.close(); 5351 } catch (IOException e) { 5352 Slog.w(TAG, "Error closing transport pipe in runner"); 5353 } 5354 } 5355 } 5356 5357 public void sendQuotaExceeded(final long backupDataBytes, final long quotaBytes) { 5358 mEngine.sendQuotaExceeded(backupDataBytes, quotaBytes); 5359 } 5360 5361 // If preflight succeeded, returns positive number - preflight size, 5362 // otherwise return negative error code. 5363 long getPreflightResultBlocking() { 5364 try { 5365 mPreflightLatch.await(TIMEOUT_FULL_BACKUP_INTERVAL, TimeUnit.MILLISECONDS); 5366 if (mIsCancelled) { 5367 return BackupManager.ERROR_BACKUP_CANCELLED; 5368 } 5369 if (mPreflightResult == BackupTransport.TRANSPORT_OK) { 5370 return mPreflight.getExpectedSizeOrErrorCode(); 5371 } else { 5372 return mPreflightResult; 5373 } 5374 } catch (InterruptedException e) { 5375 return BackupTransport.AGENT_ERROR; 5376 } 5377 } 5378 5379 int getBackupResultBlocking() { 5380 try { 5381 mBackupLatch.await(TIMEOUT_FULL_BACKUP_INTERVAL, TimeUnit.MILLISECONDS); 5382 if (mIsCancelled) { 5383 return BackupManager.ERROR_BACKUP_CANCELLED; 5384 } 5385 return mBackupResult; 5386 } catch (InterruptedException e) { 5387 return BackupTransport.AGENT_ERROR; 5388 } 5389 } 5390 5391 5392 // BackupRestoreTask interface: specifically, timeout detection 5393 5394 @Override 5395 public void execute() { /* intentionally empty */ } 5396 5397 @Override 5398 public void operationComplete(long result) { /* intentionally empty */ } 5399 5400 @Override 5401 public void handleCancel(boolean cancelAll) { 5402 if (DEBUG) { 5403 Slog.w(TAG, "Full backup cancel of " + mTarget.packageName); 5404 } 5405 5406 mMonitor = monitorEvent(mMonitor, 5407 BackupManagerMonitor.LOG_EVENT_ID_FULL_BACKUP_CANCEL, 5408 mCurrentPackage, BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT, null); 5409 mIsCancelled = true; 5410 // Cancel tasks spun off by this task. 5411 BackupManagerService.this.handleCancel(mEphemeralToken, cancelAll); 5412 tearDownAgentAndKill(mTarget.applicationInfo); 5413 // Free up everyone waiting on this task and its children. 5414 mPreflightLatch.countDown(); 5415 mBackupLatch.countDown(); 5416 // We are done with this operation. 5417 removeOperation(mCurrentOpToken); 5418 } 5419 } 5420 } 5421 5422 // ----- Full-data backup scheduling ----- 5423 5424 /** 5425 * Schedule a job to tell us when it's a good time to run a full backup 5426 */ 5427 void scheduleNextFullBackupJob(long transportMinLatency) { 5428 synchronized (mQueueLock) { 5429 if (mFullBackupQueue.size() > 0) { 5430 // schedule the next job at the point in the future when the least-recently 5431 // backed up app comes due for backup again; or immediately if it's already 5432 // due. 5433 final long upcomingLastBackup = mFullBackupQueue.get(0).lastBackup; 5434 final long timeSinceLast = System.currentTimeMillis() - upcomingLastBackup; 5435 final long appLatency = (timeSinceLast < MIN_FULL_BACKUP_INTERVAL) 5436 ? (MIN_FULL_BACKUP_INTERVAL - timeSinceLast) : 0; 5437 final long latency = Math.max(transportMinLatency, appLatency); 5438 Runnable r = new Runnable() { 5439 @Override public void run() { 5440 FullBackupJob.schedule(mContext, latency); 5441 } 5442 }; 5443 mBackupHandler.postDelayed(r, 2500); 5444 } else { 5445 if (DEBUG_SCHEDULING) { 5446 Slog.i(TAG, "Full backup queue empty; not scheduling"); 5447 } 5448 } 5449 } 5450 } 5451 5452 /** 5453 * Remove a package from the full-data queue. 5454 */ 5455 void dequeueFullBackupLocked(String packageName) { 5456 final int N = mFullBackupQueue.size(); 5457 for (int i = N-1; i >= 0; i--) { 5458 final FullBackupEntry e = mFullBackupQueue.get(i); 5459 if (packageName.equals(e.packageName)) { 5460 mFullBackupQueue.remove(i); 5461 } 5462 } 5463 } 5464 5465 /** 5466 * Enqueue full backup for the given app, with a note about when it last ran. 5467 */ 5468 void enqueueFullBackup(String packageName, long lastBackedUp) { 5469 FullBackupEntry newEntry = new FullBackupEntry(packageName, lastBackedUp); 5470 synchronized (mQueueLock) { 5471 // First, sanity check that we aren't adding a duplicate. Slow but 5472 // straightforward; we'll have at most on the order of a few hundred 5473 // items in this list. 5474 dequeueFullBackupLocked(packageName); 5475 5476 // This is also slow but easy for modest numbers of apps: work backwards 5477 // from the end of the queue until we find an item whose last backup 5478 // time was before this one, then insert this new entry after it. If we're 5479 // adding something new we don't bother scanning, and just prepend. 5480 int which = -1; 5481 if (lastBackedUp > 0) { 5482 for (which = mFullBackupQueue.size() - 1; which >= 0; which--) { 5483 final FullBackupEntry entry = mFullBackupQueue.get(which); 5484 if (entry.lastBackup <= lastBackedUp) { 5485 mFullBackupQueue.add(which + 1, newEntry); 5486 break; 5487 } 5488 } 5489 } 5490 if (which < 0) { 5491 // this one is earlier than any existing one, so prepend 5492 mFullBackupQueue.add(0, newEntry); 5493 } 5494 } 5495 writeFullBackupScheduleAsync(); 5496 } 5497 5498 private boolean fullBackupAllowable(IBackupTransport transport) { 5499 if (transport == null) { 5500 Slog.w(TAG, "Transport not present; full data backup not performed"); 5501 return false; 5502 } 5503 5504 // Don't proceed unless we have already established package metadata 5505 // for the current dataset via a key/value backup pass. 5506 try { 5507 File stateDir = new File(mBaseStateDir, transport.transportDirName()); 5508 File pmState = new File(stateDir, PACKAGE_MANAGER_SENTINEL); 5509 if (pmState.length() <= 0) { 5510 if (DEBUG) { 5511 Slog.i(TAG, "Full backup requested but dataset not yet initialized"); 5512 } 5513 return false; 5514 } 5515 } catch (Exception e) { 5516 Slog.w(TAG, "Unable to get transport name: " + e.getMessage()); 5517 return false; 5518 } 5519 5520 return true; 5521 } 5522 5523 /** 5524 * Conditions are right for a full backup operation, so run one. The model we use is 5525 * to perform one app backup per scheduled job execution, and to reschedule the job 5526 * with zero latency as long as conditions remain right and we still have work to do. 5527 * 5528 * <p>This is the "start a full backup operation" entry point called by the scheduled job. 5529 * 5530 * @return Whether ongoing work will continue. The return value here will be passed 5531 * along as the return value to the scheduled job's onStartJob() callback. 5532 */ 5533 @Override 5534 public boolean beginFullBackup(FullBackupJob scheduledJob) { 5535 long now = System.currentTimeMillis(); 5536 FullBackupEntry entry = null; 5537 long latency = MIN_FULL_BACKUP_INTERVAL; 5538 5539 if (!mEnabled || !mProvisioned) { 5540 // Backups are globally disabled, so don't proceed. We also don't reschedule 5541 // the job driving automatic backups; that job will be scheduled again when 5542 // the user enables backup. 5543 if (MORE_DEBUG) { 5544 Slog.i(TAG, "beginFullBackup but e=" + mEnabled 5545 + " p=" + mProvisioned + "; ignoring"); 5546 } 5547 return false; 5548 } 5549 5550 // Don't run the backup if we're in battery saver mode, but reschedule 5551 // to try again in the not-so-distant future. 5552 final PowerSaveState result = 5553 mPowerManager.getPowerSaveState(ServiceType.FULL_BACKUP); 5554 if (result.batterySaverEnabled) { 5555 if (DEBUG) Slog.i(TAG, "Deferring scheduled full backups in battery saver mode"); 5556 FullBackupJob.schedule(mContext, KeyValueBackupJob.BATCH_INTERVAL); 5557 return false; 5558 } 5559 5560 if (DEBUG_SCHEDULING) { 5561 Slog.i(TAG, "Beginning scheduled full backup operation"); 5562 } 5563 5564 // Great; we're able to run full backup jobs now. See if we have any work to do. 5565 synchronized (mQueueLock) { 5566 if (mRunningFullBackupTask != null) { 5567 Slog.e(TAG, "Backup triggered but one already/still running!"); 5568 return false; 5569 } 5570 5571 // At this point we think that we have work to do, but possibly not right now. 5572 // Any exit without actually running backups will also require that we 5573 // reschedule the job. 5574 boolean runBackup = true; 5575 boolean headBusy; 5576 5577 do { 5578 // Recheck each time, because culling due to ineligibility may 5579 // have emptied the queue. 5580 if (mFullBackupQueue.size() == 0) { 5581 // no work to do so just bow out 5582 if (DEBUG) { 5583 Slog.i(TAG, "Backup queue empty; doing nothing"); 5584 } 5585 runBackup = false; 5586 break; 5587 } 5588 5589 headBusy = false; 5590 5591 if (!fullBackupAllowable(mTransportManager.getCurrentTransportBinder())) { 5592 if (MORE_DEBUG) { 5593 Slog.i(TAG, "Preconditions not met; not running full backup"); 5594 } 5595 runBackup = false; 5596 // Typically this means we haven't run a key/value backup yet. Back off 5597 // full-backup operations by the key/value job's run interval so that 5598 // next time we run, we are likely to be able to make progress. 5599 latency = KeyValueBackupJob.BATCH_INTERVAL; 5600 } 5601 5602 if (runBackup) { 5603 entry = mFullBackupQueue.get(0); 5604 long timeSinceRun = now - entry.lastBackup; 5605 runBackup = (timeSinceRun >= MIN_FULL_BACKUP_INTERVAL); 5606 if (!runBackup) { 5607 // It's too early to back up the next thing in the queue, so bow out 5608 if (MORE_DEBUG) { 5609 Slog.i(TAG, "Device ready but too early to back up next app"); 5610 } 5611 // Wait until the next app in the queue falls due for a full data backup 5612 latency = MIN_FULL_BACKUP_INTERVAL - timeSinceRun; 5613 break; // we know we aren't doing work yet, so bail. 5614 } 5615 5616 try { 5617 PackageInfo appInfo = mPackageManager.getPackageInfo(entry.packageName, 0); 5618 if (!appGetsFullBackup(appInfo)) { 5619 // The head app isn't supposed to get full-data backups [any more]; 5620 // so we cull it and force a loop around to consider the new head 5621 // app. 5622 if (MORE_DEBUG) { 5623 Slog.i(TAG, "Culling package " + entry.packageName 5624 + " in full-backup queue but not eligible"); 5625 } 5626 mFullBackupQueue.remove(0); 5627 headBusy = true; // force the while() condition 5628 continue; 5629 } 5630 5631 final int privFlags = appInfo.applicationInfo.privateFlags; 5632 headBusy = (privFlags & PRIVATE_FLAG_BACKUP_IN_FOREGROUND) == 0 5633 && mActivityManager.isAppForeground(appInfo.applicationInfo.uid); 5634 5635 if (headBusy) { 5636 final long nextEligible = System.currentTimeMillis() 5637 + BUSY_BACKOFF_MIN_MILLIS 5638 + mTokenGenerator.nextInt(BUSY_BACKOFF_FUZZ); 5639 if (DEBUG_SCHEDULING) { 5640 SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); 5641 Slog.i(TAG, "Full backup time but " + entry.packageName 5642 + " is busy; deferring to " 5643 + sdf.format(new Date(nextEligible))); 5644 } 5645 // This relocates the app's entry from the head of the queue to 5646 // its order-appropriate position further down, so upon looping 5647 // a new candidate will be considered at the head. 5648 enqueueFullBackup(entry.packageName, 5649 nextEligible - MIN_FULL_BACKUP_INTERVAL); 5650 } 5651 } catch (NameNotFoundException nnf) { 5652 // So, we think we want to back this up, but it turns out the package 5653 // in question is no longer installed. We want to drop it from the 5654 // queue entirely and move on, but if there's nothing else in the queue 5655 // we should bail entirely. headBusy cannot have been set to true yet. 5656 runBackup = (mFullBackupQueue.size() > 1); 5657 } catch (RemoteException e) { 5658 // Cannot happen; the Activity Manager is in the same process 5659 } 5660 } 5661 } while (headBusy); 5662 5663 if (!runBackup) { 5664 if (DEBUG_SCHEDULING) { 5665 Slog.i(TAG, "Nothing pending full backup; rescheduling +" + latency); 5666 } 5667 final long deferTime = latency; // pin for the closure 5668 mBackupHandler.post(new Runnable() { 5669 @Override public void run() { 5670 FullBackupJob.schedule(mContext, deferTime); 5671 } 5672 }); 5673 return false; 5674 } 5675 5676 // Okay, the top thing is ready for backup now. Do it. 5677 mFullBackupQueue.remove(0); 5678 CountDownLatch latch = new CountDownLatch(1); 5679 String[] pkg = new String[] {entry.packageName}; 5680 mRunningFullBackupTask = new PerformFullTransportBackupTask(null, pkg, true, 5681 scheduledJob, latch, null, null, false /* userInitiated */); 5682 // Acquiring wakelock for PerformFullTransportBackupTask before its start. 5683 mWakelock.acquire(); 5684 (new Thread(mRunningFullBackupTask)).start(); 5685 } 5686 5687 return true; 5688 } 5689 5690 // The job scheduler says our constraints don't hold any more, 5691 // so tear down any ongoing backup task right away. 5692 @Override 5693 public void endFullBackup() { 5694 // offload the mRunningFullBackupTask.handleCancel() call to another thread, 5695 // as we might have to wait for mCancelLock 5696 Runnable endFullBackupRunnable = new Runnable() { 5697 @Override 5698 public void run() { 5699 PerformFullTransportBackupTask pftbt = null; 5700 synchronized (mQueueLock) { 5701 if (mRunningFullBackupTask != null) { 5702 pftbt = mRunningFullBackupTask; 5703 } 5704 } 5705 if (pftbt != null) { 5706 if (DEBUG_SCHEDULING) { 5707 Slog.i(TAG, "Telling running backup to stop"); 5708 } 5709 pftbt.handleCancel(true); 5710 } 5711 } 5712 }; 5713 new Thread(endFullBackupRunnable, "end-full-backup").start(); 5714 } 5715 5716 // ----- Restore infrastructure ----- 5717 5718 abstract class RestoreEngine { 5719 static final String TAG = "RestoreEngine"; 5720 5721 public static final int SUCCESS = 0; 5722 public static final int TARGET_FAILURE = -2; 5723 public static final int TRANSPORT_FAILURE = -3; 5724 5725 private AtomicBoolean mRunning = new AtomicBoolean(false); 5726 private AtomicInteger mResult = new AtomicInteger(SUCCESS); 5727 5728 public boolean isRunning() { 5729 return mRunning.get(); 5730 } 5731 5732 public void setRunning(boolean stillRunning) { 5733 synchronized (mRunning) { 5734 mRunning.set(stillRunning); 5735 mRunning.notifyAll(); 5736 } 5737 } 5738 5739 public int waitForResult() { 5740 synchronized (mRunning) { 5741 while (isRunning()) { 5742 try { 5743 mRunning.wait(); 5744 } catch (InterruptedException e) {} 5745 } 5746 } 5747 return getResult(); 5748 } 5749 5750 public int getResult() { 5751 return mResult.get(); 5752 } 5753 5754 public void setResult(int result) { 5755 mResult.set(result); 5756 } 5757 5758 // TODO: abstract restore state and APIs 5759 } 5760 5761 // ----- Full restore from a file/socket ----- 5762 5763 enum RestorePolicy { 5764 IGNORE, 5765 ACCEPT, 5766 ACCEPT_IF_APK 5767 } 5768 5769 // Full restore engine, used by both adb restore and transport-based full restore 5770 class FullRestoreEngine extends RestoreEngine { 5771 // Task in charge of monitoring timeouts 5772 BackupRestoreTask mMonitorTask; 5773 5774 // Dedicated observer, if any 5775 IFullBackupRestoreObserver mObserver; 5776 5777 IBackupManagerMonitor mMonitor; 5778 5779 // Where we're delivering the file data as we go 5780 IBackupAgent mAgent; 5781 5782 // Are we permitted to only deliver a specific package's metadata? 5783 PackageInfo mOnlyPackage; 5784 5785 boolean mAllowApks; 5786 boolean mAllowObbs; 5787 5788 // Which package are we currently handling data for? 5789 String mAgentPackage; 5790 5791 // Info for working with the target app process 5792 ApplicationInfo mTargetApp; 5793 5794 // Machinery for restoring OBBs 5795 FullBackupObbConnection mObbConnection = null; 5796 5797 // possible handling states for a given package in the restore dataset 5798 final HashMap<String, RestorePolicy> mPackagePolicies 5799 = new HashMap<String, RestorePolicy>(); 5800 5801 // installer package names for each encountered app, derived from the manifests 5802 final HashMap<String, String> mPackageInstallers = new HashMap<String, String>(); 5803 5804 // Signatures for a given package found in its manifest file 5805 final HashMap<String, Signature[]> mManifestSignatures 5806 = new HashMap<String, Signature[]>(); 5807 5808 // Packages we've already wiped data on when restoring their first file 5809 final HashSet<String> mClearedPackages = new HashSet<String>(); 5810 5811 // How much data have we moved? 5812 long mBytes; 5813 5814 // Working buffer 5815 byte[] mBuffer; 5816 5817 // Pipes for moving data 5818 ParcelFileDescriptor[] mPipes = null; 5819 5820 // Widget blob to be restored out-of-band 5821 byte[] mWidgetData = null; 5822 5823 private final int mEphemeralOpToken; 5824 5825 // Runner that can be placed in a separate thread to do in-process 5826 // invocations of the full restore API asynchronously. Used by adb restore. 5827 class RestoreFileRunnable implements Runnable { 5828 IBackupAgent mAgent; 5829 FileMetadata mInfo; 5830 ParcelFileDescriptor mSocket; 5831 int mToken; 5832 5833 RestoreFileRunnable(IBackupAgent agent, FileMetadata info, 5834 ParcelFileDescriptor socket, int token) throws IOException { 5835 mAgent = agent; 5836 mInfo = info; 5837 mToken = token; 5838 5839 // This class is used strictly for process-local binder invocations. The 5840 // semantics of ParcelFileDescriptor differ in this case; in particular, we 5841 // do not automatically get a 'dup'ed descriptor that we can can continue 5842 // to use asynchronously from the caller. So, we make sure to dup it ourselves 5843 // before proceeding to do the restore. 5844 mSocket = ParcelFileDescriptor.dup(socket.getFileDescriptor()); 5845 } 5846 5847 @Override 5848 public void run() { 5849 try { 5850 mAgent.doRestoreFile(mSocket, mInfo.size, mInfo.type, 5851 mInfo.domain, mInfo.path, mInfo.mode, mInfo.mtime, 5852 mToken, mBackupManagerBinder); 5853 } catch (RemoteException e) { 5854 // never happens; this is used strictly for local binder calls 5855 } 5856 } 5857 } 5858 5859 public FullRestoreEngine(BackupRestoreTask monitorTask, IFullBackupRestoreObserver observer, 5860 IBackupManagerMonitor monitor, PackageInfo onlyPackage, boolean allowApks, 5861 boolean allowObbs, int ephemeralOpToken) { 5862 mEphemeralOpToken = ephemeralOpToken; 5863 mMonitorTask = monitorTask; 5864 mObserver = observer; 5865 mMonitor = monitor; 5866 mOnlyPackage = onlyPackage; 5867 mAllowApks = allowApks; 5868 mAllowObbs = allowObbs; 5869 mBuffer = new byte[32 * 1024]; 5870 mBytes = 0; 5871 } 5872 5873 public IBackupAgent getAgent() { 5874 return mAgent; 5875 } 5876 5877 public byte[] getWidgetData() { 5878 return mWidgetData; 5879 } 5880 5881 public boolean restoreOneFile(InputStream instream, boolean mustKillAgent) { 5882 if (!isRunning()) { 5883 Slog.w(TAG, "Restore engine used after halting"); 5884 return false; 5885 } 5886 5887 FileMetadata info; 5888 try { 5889 if (MORE_DEBUG) { 5890 Slog.v(TAG, "Reading tar header for restoring file"); 5891 } 5892 info = readTarHeaders(instream); 5893 if (info != null) { 5894 if (MORE_DEBUG) { 5895 dumpFileMetadata(info); 5896 } 5897 5898 final String pkg = info.packageName; 5899 if (!pkg.equals(mAgentPackage)) { 5900 // In the single-package case, it's a semantic error to expect 5901 // one app's data but see a different app's on the wire 5902 if (mOnlyPackage != null) { 5903 if (!pkg.equals(mOnlyPackage.packageName)) { 5904 Slog.w(TAG, "Expected data for " + mOnlyPackage 5905 + " but saw " + pkg); 5906 setResult(RestoreEngine.TRANSPORT_FAILURE); 5907 setRunning(false); 5908 return false; 5909 } 5910 } 5911 5912 // okay, change in package; set up our various 5913 // bookkeeping if we haven't seen it yet 5914 if (!mPackagePolicies.containsKey(pkg)) { 5915 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 5916 } 5917 5918 // Clean up the previous agent relationship if necessary, 5919 // and let the observer know we're considering a new app. 5920 if (mAgent != null) { 5921 if (DEBUG) Slog.d(TAG, "Saw new package; finalizing old one"); 5922 // Now we're really done 5923 tearDownPipes(); 5924 tearDownAgent(mTargetApp); 5925 mTargetApp = null; 5926 mAgentPackage = null; 5927 } 5928 } 5929 5930 if (info.path.equals(BACKUP_MANIFEST_FILENAME)) { 5931 mPackagePolicies.put(pkg, readAppManifest(info, instream)); 5932 mPackageInstallers.put(pkg, info.installerPackageName); 5933 // We've read only the manifest content itself at this point, 5934 // so consume the footer before looping around to the next 5935 // input file 5936 skipTarPadding(info.size, instream); 5937 sendOnRestorePackage(pkg); 5938 } else if (info.path.equals(BACKUP_METADATA_FILENAME)) { 5939 // Metadata blobs! 5940 readMetadata(info, instream); 5941 skipTarPadding(info.size, instream); 5942 } else { 5943 // Non-manifest, so it's actual file data. Is this a package 5944 // we're ignoring? 5945 boolean okay = true; 5946 RestorePolicy policy = mPackagePolicies.get(pkg); 5947 switch (policy) { 5948 case IGNORE: 5949 okay = false; 5950 break; 5951 5952 case ACCEPT_IF_APK: 5953 // If we're in accept-if-apk state, then the first file we 5954 // see MUST be the apk. 5955 if (info.domain.equals(FullBackup.APK_TREE_TOKEN)) { 5956 if (DEBUG) Slog.d(TAG, "APK file; installing"); 5957 // Try to install the app. 5958 String installerName = mPackageInstallers.get(pkg); 5959 okay = installApk(info, installerName, instream); 5960 // good to go; promote to ACCEPT 5961 mPackagePolicies.put(pkg, (okay) 5962 ? RestorePolicy.ACCEPT 5963 : RestorePolicy.IGNORE); 5964 // At this point we've consumed this file entry 5965 // ourselves, so just strip the tar footer and 5966 // go on to the next file in the input stream 5967 skipTarPadding(info.size, instream); 5968 return true; 5969 } else { 5970 // File data before (or without) the apk. We can't 5971 // handle it coherently in this case so ignore it. 5972 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 5973 okay = false; 5974 } 5975 break; 5976 5977 case ACCEPT: 5978 if (info.domain.equals(FullBackup.APK_TREE_TOKEN)) { 5979 if (DEBUG) Slog.d(TAG, "apk present but ACCEPT"); 5980 // we can take the data without the apk, so we 5981 // *want* to do so. skip the apk by declaring this 5982 // one file not-okay without changing the restore 5983 // policy for the package. 5984 okay = false; 5985 } 5986 break; 5987 5988 default: 5989 // Something has gone dreadfully wrong when determining 5990 // the restore policy from the manifest. Ignore the 5991 // rest of this package's data. 5992 Slog.e(TAG, "Invalid policy from manifest"); 5993 okay = false; 5994 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 5995 break; 5996 } 5997 5998 // Is it a *file* we need to drop? 5999 if (!isRestorableFile(info)) { 6000 okay = false; 6001 } 6002 6003 // If the policy is satisfied, go ahead and set up to pipe the 6004 // data to the agent. 6005 if (MORE_DEBUG && okay && mAgent != null) { 6006 Slog.i(TAG, "Reusing existing agent instance"); 6007 } 6008 if (okay && mAgent == null) { 6009 if (MORE_DEBUG) Slog.d(TAG, "Need to launch agent for " + pkg); 6010 6011 try { 6012 mTargetApp = mPackageManager.getApplicationInfo(pkg, 0); 6013 6014 // If we haven't sent any data to this app yet, we probably 6015 // need to clear it first. Check that. 6016 if (!mClearedPackages.contains(pkg)) { 6017 // apps with their own backup agents are 6018 // responsible for coherently managing a full 6019 // restore. 6020 if (mTargetApp.backupAgentName == null) { 6021 if (DEBUG) Slog.d(TAG, "Clearing app data preparatory to full restore"); 6022 clearApplicationDataSynchronous(pkg); 6023 } else { 6024 if (MORE_DEBUG) Slog.d(TAG, "backup agent (" 6025 + mTargetApp.backupAgentName + ") => no clear"); 6026 } 6027 mClearedPackages.add(pkg); 6028 } else { 6029 if (MORE_DEBUG) { 6030 Slog.d(TAG, "We've initialized this app already; no clear required"); 6031 } 6032 } 6033 6034 // All set; now set up the IPC and launch the agent 6035 setUpPipes(); 6036 mAgent = bindToAgentSynchronous(mTargetApp, 6037 ApplicationThreadConstants.BACKUP_MODE_RESTORE_FULL); 6038 mAgentPackage = pkg; 6039 } catch (IOException e) { 6040 // fall through to error handling 6041 } catch (NameNotFoundException e) { 6042 // fall through to error handling 6043 } 6044 6045 if (mAgent == null) { 6046 Slog.e(TAG, "Unable to create agent for " + pkg); 6047 okay = false; 6048 tearDownPipes(); 6049 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 6050 } 6051 } 6052 6053 // Sanity check: make sure we never give data to the wrong app. This 6054 // should never happen but a little paranoia here won't go amiss. 6055 if (okay && !pkg.equals(mAgentPackage)) { 6056 Slog.e(TAG, "Restoring data for " + pkg 6057 + " but agent is for " + mAgentPackage); 6058 okay = false; 6059 } 6060 6061 // At this point we have an agent ready to handle the full 6062 // restore data as well as a pipe for sending data to 6063 // that agent. Tell the agent to start reading from the 6064 // pipe. 6065 if (okay) { 6066 boolean agentSuccess = true; 6067 long toCopy = info.size; 6068 try { 6069 prepareOperationTimeout(mEphemeralOpToken, 6070 TIMEOUT_FULL_BACKUP_INTERVAL, mMonitorTask, 6071 OP_TYPE_RESTORE_WAIT); 6072 6073 if (info.domain.equals(FullBackup.OBB_TREE_TOKEN)) { 6074 if (DEBUG) Slog.d(TAG, "Restoring OBB file for " + pkg 6075 + " : " + info.path); 6076 mObbConnection.restoreObbFile(pkg, mPipes[0], 6077 info.size, info.type, info.path, info.mode, 6078 info.mtime, mEphemeralOpToken, mBackupManagerBinder); 6079 } else { 6080 if (MORE_DEBUG) Slog.d(TAG, "Invoking agent to restore file " 6081 + info.path); 6082 // fire up the app's agent listening on the socket. If 6083 // the agent is running in the system process we can't 6084 // just invoke it asynchronously, so we provide a thread 6085 // for it here. 6086 if (mTargetApp.processName.equals("system")) { 6087 Slog.d(TAG, "system process agent - spinning a thread"); 6088 RestoreFileRunnable runner = new RestoreFileRunnable( 6089 mAgent, info, mPipes[0], mEphemeralOpToken); 6090 new Thread(runner, "restore-sys-runner").start(); 6091 } else { 6092 mAgent.doRestoreFile(mPipes[0], info.size, info.type, 6093 info.domain, info.path, info.mode, info.mtime, 6094 mEphemeralOpToken, mBackupManagerBinder); 6095 } 6096 } 6097 } catch (IOException e) { 6098 // couldn't dup the socket for a process-local restore 6099 Slog.d(TAG, "Couldn't establish restore"); 6100 agentSuccess = false; 6101 okay = false; 6102 } catch (RemoteException e) { 6103 // whoops, remote entity went away. We'll eat the content 6104 // ourselves, then, and not copy it over. 6105 Slog.e(TAG, "Agent crashed during full restore"); 6106 agentSuccess = false; 6107 okay = false; 6108 } 6109 6110 // Copy over the data if the agent is still good 6111 if (okay) { 6112 if (MORE_DEBUG) { 6113 Slog.v(TAG, " copying to restore agent: " 6114 + toCopy + " bytes"); 6115 } 6116 boolean pipeOkay = true; 6117 FileOutputStream pipe = new FileOutputStream( 6118 mPipes[1].getFileDescriptor()); 6119 while (toCopy > 0) { 6120 int toRead = (toCopy > mBuffer.length) 6121 ? mBuffer.length : (int)toCopy; 6122 int nRead = instream.read(mBuffer, 0, toRead); 6123 if (nRead >= 0) mBytes += nRead; 6124 if (nRead <= 0) break; 6125 toCopy -= nRead; 6126 6127 // send it to the output pipe as long as things 6128 // are still good 6129 if (pipeOkay) { 6130 try { 6131 pipe.write(mBuffer, 0, nRead); 6132 } catch (IOException e) { 6133 Slog.e(TAG, "Failed to write to restore pipe: " 6134 + e.getMessage()); 6135 pipeOkay = false; 6136 } 6137 } 6138 } 6139 6140 // done sending that file! Now we just need to consume 6141 // the delta from info.size to the end of block. 6142 skipTarPadding(info.size, instream); 6143 6144 // and now that we've sent it all, wait for the remote 6145 // side to acknowledge receipt 6146 agentSuccess = waitUntilOperationComplete(mEphemeralOpToken); 6147 } 6148 6149 // okay, if the remote end failed at any point, deal with 6150 // it by ignoring the rest of the restore on it 6151 if (!agentSuccess) { 6152 Slog.w(TAG, "Agent failure; ending restore"); 6153 mBackupHandler.removeMessages(MSG_RESTORE_OPERATION_TIMEOUT); 6154 tearDownPipes(); 6155 tearDownAgent(mTargetApp); 6156 mAgent = null; 6157 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 6158 6159 // If this was a single-package restore, we halt immediately 6160 // with an agent error under these circumstances 6161 if (mOnlyPackage != null) { 6162 setResult(RestoreEngine.TARGET_FAILURE); 6163 setRunning(false); 6164 return false; 6165 } 6166 } 6167 } 6168 6169 // Problems setting up the agent communication, an explicitly 6170 // dropped file, or an already-ignored package: skip to the 6171 // next stream entry by reading and discarding this file. 6172 if (!okay) { 6173 if (MORE_DEBUG) Slog.d(TAG, "[discarding file content]"); 6174 long bytesToConsume = (info.size + 511) & ~511; 6175 while (bytesToConsume > 0) { 6176 int toRead = (bytesToConsume > mBuffer.length) 6177 ? mBuffer.length : (int)bytesToConsume; 6178 long nRead = instream.read(mBuffer, 0, toRead); 6179 if (nRead >= 0) mBytes += nRead; 6180 if (nRead <= 0) break; 6181 bytesToConsume -= nRead; 6182 } 6183 } 6184 } 6185 } 6186 } catch (IOException e) { 6187 if (DEBUG) Slog.w(TAG, "io exception on restore socket read: " + e.getMessage()); 6188 setResult(RestoreEngine.TRANSPORT_FAILURE); 6189 info = null; 6190 } 6191 6192 // If we got here we're either running smoothly or we've finished 6193 if (info == null) { 6194 if (MORE_DEBUG) { 6195 Slog.i(TAG, "No [more] data for this package; tearing down"); 6196 } 6197 tearDownPipes(); 6198 setRunning(false); 6199 if (mustKillAgent) { 6200 tearDownAgent(mTargetApp); 6201 } 6202 } 6203 return (info != null); 6204 } 6205 6206 void setUpPipes() throws IOException { 6207 mPipes = ParcelFileDescriptor.createPipe(); 6208 } 6209 6210 void tearDownPipes() { 6211 // Teardown might arise from the inline restore processing or from the asynchronous 6212 // timeout mechanism, and these might race. Make sure we don't try to close and 6213 // null out the pipes twice. 6214 synchronized (this) { 6215 if (mPipes != null) { 6216 try { 6217 mPipes[0].close(); 6218 mPipes[0] = null; 6219 mPipes[1].close(); 6220 mPipes[1] = null; 6221 } catch (IOException e) { 6222 Slog.w(TAG, "Couldn't close agent pipes", e); 6223 } 6224 mPipes = null; 6225 } 6226 } 6227 } 6228 6229 void tearDownAgent(ApplicationInfo app) { 6230 if (mAgent != null) { 6231 tearDownAgentAndKill(app); 6232 mAgent = null; 6233 } 6234 } 6235 6236 void handleTimeout() { 6237 tearDownPipes(); 6238 setResult(RestoreEngine.TARGET_FAILURE); 6239 setRunning(false); 6240 } 6241 6242 class RestoreInstallObserver extends PackageInstallObserver { 6243 final AtomicBoolean mDone = new AtomicBoolean(); 6244 String mPackageName; 6245 int mResult; 6246 6247 public void reset() { 6248 synchronized (mDone) { 6249 mDone.set(false); 6250 } 6251 } 6252 6253 public void waitForCompletion() { 6254 synchronized (mDone) { 6255 while (mDone.get() == false) { 6256 try { 6257 mDone.wait(); 6258 } catch (InterruptedException e) { } 6259 } 6260 } 6261 } 6262 6263 int getResult() { 6264 return mResult; 6265 } 6266 6267 @Override 6268 public void onPackageInstalled(String packageName, int returnCode, 6269 String msg, Bundle extras) { 6270 synchronized (mDone) { 6271 mResult = returnCode; 6272 mPackageName = packageName; 6273 mDone.set(true); 6274 mDone.notifyAll(); 6275 } 6276 } 6277 } 6278 6279 class RestoreDeleteObserver extends IPackageDeleteObserver.Stub { 6280 final AtomicBoolean mDone = new AtomicBoolean(); 6281 int mResult; 6282 6283 public void reset() { 6284 synchronized (mDone) { 6285 mDone.set(false); 6286 } 6287 } 6288 6289 public void waitForCompletion() { 6290 synchronized (mDone) { 6291 while (mDone.get() == false) { 6292 try { 6293 mDone.wait(); 6294 } catch (InterruptedException e) { } 6295 } 6296 } 6297 } 6298 6299 @Override 6300 public void packageDeleted(String packageName, int returnCode) throws RemoteException { 6301 synchronized (mDone) { 6302 mResult = returnCode; 6303 mDone.set(true); 6304 mDone.notifyAll(); 6305 } 6306 } 6307 } 6308 6309 final RestoreInstallObserver mInstallObserver = new RestoreInstallObserver(); 6310 final RestoreDeleteObserver mDeleteObserver = new RestoreDeleteObserver(); 6311 6312 boolean installApk(FileMetadata info, String installerPackage, InputStream instream) { 6313 boolean okay = true; 6314 6315 if (DEBUG) Slog.d(TAG, "Installing from backup: " + info.packageName); 6316 6317 // The file content is an .apk file. Copy it out to a staging location and 6318 // attempt to install it. 6319 File apkFile = new File(mDataDir, info.packageName); 6320 try { 6321 FileOutputStream apkStream = new FileOutputStream(apkFile); 6322 byte[] buffer = new byte[32 * 1024]; 6323 long size = info.size; 6324 while (size > 0) { 6325 long toRead = (buffer.length < size) ? buffer.length : size; 6326 int didRead = instream.read(buffer, 0, (int)toRead); 6327 if (didRead >= 0) mBytes += didRead; 6328 apkStream.write(buffer, 0, didRead); 6329 size -= didRead; 6330 } 6331 apkStream.close(); 6332 6333 // make sure the installer can read it 6334 apkFile.setReadable(true, false); 6335 6336 // Now install it 6337 Uri packageUri = Uri.fromFile(apkFile); 6338 mInstallObserver.reset(); 6339 mPackageManager.installPackage(packageUri, mInstallObserver, 6340 PackageManager.INSTALL_REPLACE_EXISTING | PackageManager.INSTALL_FROM_ADB, 6341 installerPackage); 6342 mInstallObserver.waitForCompletion(); 6343 6344 if (mInstallObserver.getResult() != PackageManager.INSTALL_SUCCEEDED) { 6345 // The only time we continue to accept install of data even if the 6346 // apk install failed is if we had already determined that we could 6347 // accept the data regardless. 6348 if (mPackagePolicies.get(info.packageName) != RestorePolicy.ACCEPT) { 6349 okay = false; 6350 } 6351 } else { 6352 // Okay, the install succeeded. Make sure it was the right app. 6353 boolean uninstall = false; 6354 if (!mInstallObserver.mPackageName.equals(info.packageName)) { 6355 Slog.w(TAG, "Restore stream claimed to include apk for " 6356 + info.packageName + " but apk was really " 6357 + mInstallObserver.mPackageName); 6358 // delete the package we just put in place; it might be fraudulent 6359 okay = false; 6360 uninstall = true; 6361 } else { 6362 try { 6363 PackageInfo pkg = mPackageManager.getPackageInfo(info.packageName, 6364 PackageManager.GET_SIGNATURES); 6365 if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_ALLOW_BACKUP) == 0) { 6366 Slog.w(TAG, "Restore stream contains apk of package " 6367 + info.packageName + " but it disallows backup/restore"); 6368 okay = false; 6369 } else { 6370 // So far so good -- do the signatures match the manifest? 6371 Signature[] sigs = mManifestSignatures.get(info.packageName); 6372 if (signaturesMatch(sigs, pkg)) { 6373 // If this is a system-uid app without a declared backup agent, 6374 // don't restore any of the file data. 6375 if ((pkg.applicationInfo.uid < Process.FIRST_APPLICATION_UID) 6376 && (pkg.applicationInfo.backupAgentName == null)) { 6377 Slog.w(TAG, "Installed app " + info.packageName 6378 + " has restricted uid and no agent"); 6379 okay = false; 6380 } 6381 } else { 6382 Slog.w(TAG, "Installed app " + info.packageName 6383 + " signatures do not match restore manifest"); 6384 okay = false; 6385 uninstall = true; 6386 } 6387 } 6388 } catch (NameNotFoundException e) { 6389 Slog.w(TAG, "Install of package " + info.packageName 6390 + " succeeded but now not found"); 6391 okay = false; 6392 } 6393 } 6394 6395 // If we're not okay at this point, we need to delete the package 6396 // that we just installed. 6397 if (uninstall) { 6398 mDeleteObserver.reset(); 6399 mPackageManager.deletePackage(mInstallObserver.mPackageName, 6400 mDeleteObserver, 0); 6401 mDeleteObserver.waitForCompletion(); 6402 } 6403 } 6404 } catch (IOException e) { 6405 Slog.e(TAG, "Unable to transcribe restored apk for install"); 6406 okay = false; 6407 } finally { 6408 apkFile.delete(); 6409 } 6410 6411 return okay; 6412 } 6413 6414 // Given an actual file content size, consume the post-content padding mandated 6415 // by the tar format. 6416 void skipTarPadding(long size, InputStream instream) throws IOException { 6417 long partial = (size + 512) % 512; 6418 if (partial > 0) { 6419 final int needed = 512 - (int)partial; 6420 if (MORE_DEBUG) { 6421 Slog.i(TAG, "Skipping tar padding: " + needed + " bytes"); 6422 } 6423 byte[] buffer = new byte[needed]; 6424 if (readExactly(instream, buffer, 0, needed) == needed) { 6425 mBytes += needed; 6426 } else throw new IOException("Unexpected EOF in padding"); 6427 } 6428 } 6429 6430 // Read a widget metadata file, returning the restored blob 6431 void readMetadata(FileMetadata info, InputStream instream) throws IOException { 6432 // Fail on suspiciously large widget dump files 6433 if (info.size > 64 * 1024) { 6434 throw new IOException("Metadata too big; corrupt? size=" + info.size); 6435 } 6436 6437 byte[] buffer = new byte[(int) info.size]; 6438 if (readExactly(instream, buffer, 0, (int)info.size) == info.size) { 6439 mBytes += info.size; 6440 } else throw new IOException("Unexpected EOF in widget data"); 6441 6442 String[] str = new String[1]; 6443 int offset = extractLine(buffer, 0, str); 6444 int version = Integer.parseInt(str[0]); 6445 if (version == BACKUP_MANIFEST_VERSION) { 6446 offset = extractLine(buffer, offset, str); 6447 final String pkg = str[0]; 6448 if (info.packageName.equals(pkg)) { 6449 // Data checks out -- the rest of the buffer is a concatenation of 6450 // binary blobs as described in the comment at writeAppWidgetData() 6451 ByteArrayInputStream bin = new ByteArrayInputStream(buffer, 6452 offset, buffer.length - offset); 6453 DataInputStream in = new DataInputStream(bin); 6454 while (bin.available() > 0) { 6455 int token = in.readInt(); 6456 int size = in.readInt(); 6457 if (size > 64 * 1024) { 6458 throw new IOException("Datum " 6459 + Integer.toHexString(token) 6460 + " too big; corrupt? size=" + info.size); 6461 } 6462 switch (token) { 6463 case BACKUP_WIDGET_METADATA_TOKEN: 6464 { 6465 if (MORE_DEBUG) { 6466 Slog.i(TAG, "Got widget metadata for " + info.packageName); 6467 } 6468 mWidgetData = new byte[size]; 6469 in.read(mWidgetData); 6470 break; 6471 } 6472 default: 6473 { 6474 if (DEBUG) { 6475 Slog.i(TAG, "Ignoring metadata blob " 6476 + Integer.toHexString(token) 6477 + " for " + info.packageName); 6478 } 6479 in.skipBytes(size); 6480 break; 6481 } 6482 } 6483 } 6484 } else { 6485 Slog.w(TAG, "Metadata mismatch: package " + info.packageName 6486 + " but widget data for " + pkg); 6487 6488 Bundle monitoringExtras = putMonitoringExtra(null, 6489 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName); 6490 monitoringExtras = putMonitoringExtra(monitoringExtras, 6491 BackupManagerMonitor.EXTRA_LOG_WIDGET_PACKAGE_NAME, pkg); 6492 mMonitor = monitorEvent(mMonitor, 6493 BackupManagerMonitor.LOG_EVENT_ID_WIDGET_METADATA_MISMATCH, 6494 null, 6495 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6496 monitoringExtras); 6497 } 6498 } else { 6499 Slog.w(TAG, "Unsupported metadata version " + version); 6500 6501 Bundle monitoringExtras = putMonitoringExtra(null, EXTRA_LOG_EVENT_PACKAGE_NAME, 6502 info.packageName); 6503 monitoringExtras = putMonitoringExtra(monitoringExtras, 6504 EXTRA_LOG_EVENT_PACKAGE_VERSION, version); 6505 mMonitor = monitorEvent(mMonitor, 6506 BackupManagerMonitor.LOG_EVENT_ID_WIDGET_UNKNOWN_VERSION, 6507 null, 6508 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6509 monitoringExtras); 6510 } 6511 } 6512 6513 // Returns a policy constant 6514 RestorePolicy readAppManifest(FileMetadata info, InputStream instream) 6515 throws IOException { 6516 // Fail on suspiciously large manifest files 6517 if (info.size > 64 * 1024) { 6518 throw new IOException("Restore manifest too big; corrupt? size=" + info.size); 6519 } 6520 6521 byte[] buffer = new byte[(int) info.size]; 6522 if (MORE_DEBUG) { 6523 Slog.i(TAG, " readAppManifest() looking for " + info.size + " bytes, " 6524 + mBytes + " already consumed"); 6525 } 6526 if (readExactly(instream, buffer, 0, (int)info.size) == info.size) { 6527 mBytes += info.size; 6528 } else throw new IOException("Unexpected EOF in manifest"); 6529 6530 RestorePolicy policy = RestorePolicy.IGNORE; 6531 String[] str = new String[1]; 6532 int offset = 0; 6533 6534 try { 6535 offset = extractLine(buffer, offset, str); 6536 int version = Integer.parseInt(str[0]); 6537 if (version == BACKUP_MANIFEST_VERSION) { 6538 offset = extractLine(buffer, offset, str); 6539 String manifestPackage = str[0]; 6540 // TODO: handle <original-package> 6541 if (manifestPackage.equals(info.packageName)) { 6542 offset = extractLine(buffer, offset, str); 6543 version = Integer.parseInt(str[0]); // app version 6544 offset = extractLine(buffer, offset, str); 6545 // This is the platform version, which we don't use, but we parse it 6546 // as a safety against corruption in the manifest. 6547 Integer.parseInt(str[0]); 6548 offset = extractLine(buffer, offset, str); 6549 info.installerPackageName = (str[0].length() > 0) ? str[0] : null; 6550 offset = extractLine(buffer, offset, str); 6551 boolean hasApk = str[0].equals("1"); 6552 offset = extractLine(buffer, offset, str); 6553 int numSigs = Integer.parseInt(str[0]); 6554 if (numSigs > 0) { 6555 Signature[] sigs = new Signature[numSigs]; 6556 for (int i = 0; i < numSigs; i++) { 6557 offset = extractLine(buffer, offset, str); 6558 sigs[i] = new Signature(str[0]); 6559 } 6560 mManifestSignatures.put(info.packageName, sigs); 6561 6562 // Okay, got the manifest info we need... 6563 try { 6564 PackageInfo pkgInfo = mPackageManager.getPackageInfo( 6565 info.packageName, PackageManager.GET_SIGNATURES); 6566 // Fall through to IGNORE if the app explicitly disallows backup 6567 final int flags = pkgInfo.applicationInfo.flags; 6568 if ((flags & ApplicationInfo.FLAG_ALLOW_BACKUP) != 0) { 6569 // Restore system-uid-space packages only if they have 6570 // defined a custom backup agent 6571 if ((pkgInfo.applicationInfo.uid >= Process.FIRST_APPLICATION_UID) 6572 || (pkgInfo.applicationInfo.backupAgentName != null)) { 6573 // Verify signatures against any installed version; if they 6574 // don't match, then we fall though and ignore the data. The 6575 // signatureMatch() method explicitly ignores the signature 6576 // check for packages installed on the system partition, because 6577 // such packages are signed with the platform cert instead of 6578 // the app developer's cert, so they're different on every 6579 // device. 6580 if (signaturesMatch(sigs, pkgInfo)) { 6581 if ((pkgInfo.applicationInfo.flags 6582 & ApplicationInfo.FLAG_RESTORE_ANY_VERSION) != 0) { 6583 Slog.i(TAG, "Package has restoreAnyVersion; taking data"); 6584 mMonitor = monitorEvent(mMonitor, 6585 LOG_EVENT_ID_RESTORE_ANY_VERSION, 6586 pkgInfo, 6587 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6588 null); 6589 policy = RestorePolicy.ACCEPT; 6590 } else if (pkgInfo.versionCode >= version) { 6591 Slog.i(TAG, "Sig + version match; taking data"); 6592 policy = RestorePolicy.ACCEPT; 6593 mMonitor = monitorEvent(mMonitor, 6594 LOG_EVENT_ID_VERSIONS_MATCH, 6595 pkgInfo, 6596 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6597 null); 6598 } else { 6599 // The data is from a newer version of the app than 6600 // is presently installed. That means we can only 6601 // use it if the matching apk is also supplied. 6602 if (mAllowApks) { 6603 Slog.i(TAG, "Data version " + version 6604 + " is newer than installed version " 6605 + pkgInfo.versionCode 6606 + " - requiring apk"); 6607 policy = RestorePolicy.ACCEPT_IF_APK; 6608 } else { 6609 Slog.i(TAG, "Data requires newer version " 6610 + version + "; ignoring"); 6611 mMonitor = monitorEvent(mMonitor, 6612 LOG_EVENT_ID_VERSION_OF_BACKUP_OLDER, 6613 pkgInfo, 6614 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6615 putMonitoringExtra(null, 6616 EXTRA_LOG_OLD_VERSION, 6617 version)); 6618 6619 policy = RestorePolicy.IGNORE; 6620 } 6621 } 6622 } else { 6623 Slog.w(TAG, "Restore manifest signatures do not match " 6624 + "installed application for " + info.packageName); 6625 mMonitor = monitorEvent(mMonitor, 6626 LOG_EVENT_ID_FULL_RESTORE_SIGNATURE_MISMATCH, 6627 pkgInfo, 6628 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6629 null); 6630 } 6631 } else { 6632 Slog.w(TAG, "Package " + info.packageName 6633 + " is system level with no agent"); 6634 mMonitor = monitorEvent(mMonitor, 6635 LOG_EVENT_ID_SYSTEM_APP_NO_AGENT, 6636 pkgInfo, 6637 LOG_EVENT_CATEGORY_AGENT, 6638 null); 6639 } 6640 } else { 6641 if (DEBUG) Slog.i(TAG, "Restore manifest from " 6642 + info.packageName + " but allowBackup=false"); 6643 mMonitor = monitorEvent(mMonitor, 6644 LOG_EVENT_ID_FULL_RESTORE_ALLOW_BACKUP_FALSE, 6645 pkgInfo, 6646 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6647 null); 6648 } 6649 } catch (NameNotFoundException e) { 6650 // Okay, the target app isn't installed. We can process 6651 // the restore properly only if the dataset provides the 6652 // apk file and we can successfully install it. 6653 if (mAllowApks) { 6654 if (DEBUG) Slog.i(TAG, "Package " + info.packageName 6655 + " not installed; requiring apk in dataset"); 6656 policy = RestorePolicy.ACCEPT_IF_APK; 6657 } else { 6658 policy = RestorePolicy.IGNORE; 6659 } 6660 Bundle monitoringExtras = putMonitoringExtra(null, 6661 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName); 6662 monitoringExtras = putMonitoringExtra(monitoringExtras, 6663 EXTRA_LOG_POLICY_ALLOW_APKS, mAllowApks); 6664 mMonitor = monitorEvent(mMonitor, 6665 LOG_EVENT_ID_APK_NOT_INSTALLED, 6666 null, 6667 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6668 monitoringExtras); 6669 } 6670 6671 if (policy == RestorePolicy.ACCEPT_IF_APK && !hasApk) { 6672 Slog.i(TAG, "Cannot restore package " + info.packageName 6673 + " without the matching .apk"); 6674 mMonitor = monitorEvent(mMonitor, 6675 LOG_EVENT_ID_CANNOT_RESTORE_WITHOUT_APK, 6676 null, 6677 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6678 putMonitoringExtra(null, 6679 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName)); 6680 } 6681 } else { 6682 Slog.i(TAG, "Missing signature on backed-up package " 6683 + info.packageName); 6684 mMonitor = monitorEvent(mMonitor, 6685 LOG_EVENT_ID_MISSING_SIGNATURE, 6686 null, 6687 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6688 putMonitoringExtra(null, 6689 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName)); 6690 } 6691 } else { 6692 Slog.i(TAG, "Expected package " + info.packageName 6693 + " but restore manifest claims " + manifestPackage); 6694 Bundle monitoringExtras = putMonitoringExtra(null, 6695 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName); 6696 monitoringExtras = putMonitoringExtra(monitoringExtras, 6697 EXTRA_LOG_MANIFEST_PACKAGE_NAME, manifestPackage); 6698 mMonitor = monitorEvent(mMonitor, 6699 LOG_EVENT_ID_EXPECTED_DIFFERENT_PACKAGE, 6700 null, 6701 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6702 monitoringExtras); 6703 } 6704 } else { 6705 Slog.i(TAG, "Unknown restore manifest version " + version 6706 + " for package " + info.packageName); 6707 Bundle monitoringExtras = putMonitoringExtra(null, 6708 EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName); 6709 monitoringExtras = putMonitoringExtra(monitoringExtras, 6710 EXTRA_LOG_EVENT_PACKAGE_VERSION, version); 6711 mMonitor = monitorEvent(mMonitor, 6712 BackupManagerMonitor.LOG_EVENT_ID_UNKNOWN_VERSION, 6713 null, 6714 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6715 monitoringExtras); 6716 6717 } 6718 } catch (NumberFormatException e) { 6719 Slog.w(TAG, "Corrupt restore manifest for package " + info.packageName); 6720 mMonitor = monitorEvent(mMonitor, 6721 BackupManagerMonitor.LOG_EVENT_ID_CORRUPT_MANIFEST, 6722 null, 6723 LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 6724 putMonitoringExtra(null, EXTRA_LOG_EVENT_PACKAGE_NAME, info.packageName)); 6725 } catch (IllegalArgumentException e) { 6726 Slog.w(TAG, e.getMessage()); 6727 } 6728 6729 return policy; 6730 } 6731 6732 // Builds a line from a byte buffer starting at 'offset', and returns 6733 // the index of the next unconsumed data in the buffer. 6734 int extractLine(byte[] buffer, int offset, String[] outStr) throws IOException { 6735 final int end = buffer.length; 6736 if (offset >= end) throw new IOException("Incomplete data"); 6737 6738 int pos; 6739 for (pos = offset; pos < end; pos++) { 6740 byte c = buffer[pos]; 6741 // at LF we declare end of line, and return the next char as the 6742 // starting point for the next time through 6743 if (c == '\n') { 6744 break; 6745 } 6746 } 6747 outStr[0] = new String(buffer, offset, pos - offset); 6748 pos++; // may be pointing an extra byte past the end but that's okay 6749 return pos; 6750 } 6751 6752 void dumpFileMetadata(FileMetadata info) { 6753 if (MORE_DEBUG) { 6754 StringBuilder b = new StringBuilder(128); 6755 6756 // mode string 6757 b.append((info.type == BackupAgent.TYPE_DIRECTORY) ? 'd' : '-'); 6758 b.append(((info.mode & 0400) != 0) ? 'r' : '-'); 6759 b.append(((info.mode & 0200) != 0) ? 'w' : '-'); 6760 b.append(((info.mode & 0100) != 0) ? 'x' : '-'); 6761 b.append(((info.mode & 0040) != 0) ? 'r' : '-'); 6762 b.append(((info.mode & 0020) != 0) ? 'w' : '-'); 6763 b.append(((info.mode & 0010) != 0) ? 'x' : '-'); 6764 b.append(((info.mode & 0004) != 0) ? 'r' : '-'); 6765 b.append(((info.mode & 0002) != 0) ? 'w' : '-'); 6766 b.append(((info.mode & 0001) != 0) ? 'x' : '-'); 6767 b.append(String.format(" %9d ", info.size)); 6768 6769 Date stamp = new Date(info.mtime); 6770 b.append(new SimpleDateFormat("MMM dd HH:mm:ss ").format(stamp)); 6771 6772 b.append(info.packageName); 6773 b.append(" :: "); 6774 b.append(info.domain); 6775 b.append(" :: "); 6776 b.append(info.path); 6777 6778 Slog.i(TAG, b.toString()); 6779 } 6780 } 6781 6782 // Consume a tar file header block [sequence] and accumulate the relevant metadata 6783 FileMetadata readTarHeaders(InputStream instream) throws IOException { 6784 byte[] block = new byte[512]; 6785 FileMetadata info = null; 6786 6787 boolean gotHeader = readTarHeader(instream, block); 6788 if (gotHeader) { 6789 try { 6790 // okay, presume we're okay, and extract the various metadata 6791 info = new FileMetadata(); 6792 info.size = extractRadix(block, TAR_HEADER_OFFSET_FILESIZE, 6793 TAR_HEADER_LENGTH_FILESIZE, TAR_HEADER_LONG_RADIX); 6794 info.mtime = extractRadix(block, TAR_HEADER_OFFSET_MODTIME, 6795 TAR_HEADER_LENGTH_MODTIME, TAR_HEADER_LONG_RADIX); 6796 info.mode = extractRadix(block, TAR_HEADER_OFFSET_MODE, 6797 TAR_HEADER_LENGTH_MODE, TAR_HEADER_LONG_RADIX); 6798 6799 info.path = extractString(block, TAR_HEADER_OFFSET_PATH_PREFIX, 6800 TAR_HEADER_LENGTH_PATH_PREFIX); 6801 String path = extractString(block, TAR_HEADER_OFFSET_PATH, 6802 TAR_HEADER_LENGTH_PATH); 6803 if (path.length() > 0) { 6804 if (info.path.length() > 0) info.path += '/'; 6805 info.path += path; 6806 } 6807 6808 // tar link indicator field: 1 byte at offset 156 in the header. 6809 int typeChar = block[TAR_HEADER_OFFSET_TYPE_CHAR]; 6810 if (typeChar == 'x') { 6811 // pax extended header, so we need to read that 6812 gotHeader = readPaxExtendedHeader(instream, info); 6813 if (gotHeader) { 6814 // and after a pax extended header comes another real header -- read 6815 // that to find the real file type 6816 gotHeader = readTarHeader(instream, block); 6817 } 6818 if (!gotHeader) throw new IOException("Bad or missing pax header"); 6819 6820 typeChar = block[TAR_HEADER_OFFSET_TYPE_CHAR]; 6821 } 6822 6823 switch (typeChar) { 6824 case '0': info.type = BackupAgent.TYPE_FILE; break; 6825 case '5': { 6826 info.type = BackupAgent.TYPE_DIRECTORY; 6827 if (info.size != 0) { 6828 Slog.w(TAG, "Directory entry with nonzero size in header"); 6829 info.size = 0; 6830 } 6831 break; 6832 } 6833 case 0: { 6834 // presume EOF 6835 if (MORE_DEBUG) Slog.w(TAG, "Saw type=0 in tar header block, info=" + info); 6836 return null; 6837 } 6838 default: { 6839 Slog.e(TAG, "Unknown tar entity type: " + typeChar); 6840 throw new IOException("Unknown entity type " + typeChar); 6841 } 6842 } 6843 6844 // Parse out the path 6845 // 6846 // first: apps/shared/unrecognized 6847 if (FullBackup.SHARED_PREFIX.regionMatches(0, 6848 info.path, 0, FullBackup.SHARED_PREFIX.length())) { 6849 // File in shared storage. !!! TODO: implement this. 6850 info.path = info.path.substring(FullBackup.SHARED_PREFIX.length()); 6851 info.packageName = SHARED_BACKUP_AGENT_PACKAGE; 6852 info.domain = FullBackup.SHARED_STORAGE_TOKEN; 6853 if (DEBUG) Slog.i(TAG, "File in shared storage: " + info.path); 6854 } else if (FullBackup.APPS_PREFIX.regionMatches(0, 6855 info.path, 0, FullBackup.APPS_PREFIX.length())) { 6856 // App content! Parse out the package name and domain 6857 6858 // strip the apps/ prefix 6859 info.path = info.path.substring(FullBackup.APPS_PREFIX.length()); 6860 6861 // extract the package name 6862 int slash = info.path.indexOf('/'); 6863 if (slash < 0) throw new IOException("Illegal semantic path in " + info.path); 6864 info.packageName = info.path.substring(0, slash); 6865 info.path = info.path.substring(slash+1); 6866 6867 // if it's a manifest or metadata payload we're done, otherwise parse 6868 // out the domain into which the file will be restored 6869 if (!info.path.equals(BACKUP_MANIFEST_FILENAME) 6870 && !info.path.equals(BACKUP_METADATA_FILENAME)) { 6871 slash = info.path.indexOf('/'); 6872 if (slash < 0) { 6873 throw new IOException("Illegal semantic path in non-manifest " 6874 + info.path); 6875 } 6876 info.domain = info.path.substring(0, slash); 6877 info.path = info.path.substring(slash + 1); 6878 } 6879 } 6880 } catch (IOException e) { 6881 if (DEBUG) { 6882 Slog.e(TAG, "Parse error in header: " + e.getMessage()); 6883 if (MORE_DEBUG) { 6884 HEXLOG(block); 6885 } 6886 } 6887 throw e; 6888 } 6889 } 6890 return info; 6891 } 6892 6893 private boolean isRestorableFile(FileMetadata info) { 6894 if (FullBackup.CACHE_TREE_TOKEN.equals(info.domain)) { 6895 if (MORE_DEBUG) { 6896 Slog.i(TAG, "Dropping cache file path " + info.path); 6897 } 6898 return false; 6899 } 6900 6901 if (FullBackup.ROOT_TREE_TOKEN.equals(info.domain)) { 6902 // It's possible this is "no-backup" dir contents in an archive stream 6903 // produced on a device running a version of the OS that predates that 6904 // API. Respect the no-backup intention and don't let the data get to 6905 // the app. 6906 if (info.path.startsWith("no_backup/")) { 6907 if (MORE_DEBUG) { 6908 Slog.i(TAG, "Dropping no_backup file path " + info.path); 6909 } 6910 return false; 6911 } 6912 } 6913 6914 // The path needs to be canonical 6915 if (info.path.contains("..") || info.path.contains("//")) { 6916 if (MORE_DEBUG) { 6917 Slog.w(TAG, "Dropping invalid path " + info.path); 6918 } 6919 return false; 6920 } 6921 6922 // Otherwise we think this file is good to go 6923 return true; 6924 } 6925 6926 private void HEXLOG(byte[] block) { 6927 int offset = 0; 6928 int todo = block.length; 6929 StringBuilder buf = new StringBuilder(64); 6930 while (todo > 0) { 6931 buf.append(String.format("%04x ", offset)); 6932 int numThisLine = (todo > 16) ? 16 : todo; 6933 for (int i = 0; i < numThisLine; i++) { 6934 buf.append(String.format("%02x ", block[offset+i])); 6935 } 6936 Slog.i("hexdump", buf.toString()); 6937 buf.setLength(0); 6938 todo -= numThisLine; 6939 offset += numThisLine; 6940 } 6941 } 6942 6943 // Read exactly the given number of bytes into a buffer at the stated offset. 6944 // Returns false if EOF is encountered before the requested number of bytes 6945 // could be read. 6946 int readExactly(InputStream in, byte[] buffer, int offset, int size) 6947 throws IOException { 6948 if (size <= 0) throw new IllegalArgumentException("size must be > 0"); 6949if (MORE_DEBUG) Slog.i(TAG, " ... readExactly(" + size + ") called"); 6950 int soFar = 0; 6951 while (soFar < size) { 6952 int nRead = in.read(buffer, offset + soFar, size - soFar); 6953 if (nRead <= 0) { 6954 if (MORE_DEBUG) Slog.w(TAG, "- wanted exactly " + size + " but got only " + soFar); 6955 break; 6956 } 6957 soFar += nRead; 6958if (MORE_DEBUG) Slog.v(TAG, " + got " + nRead + "; now wanting " + (size - soFar)); 6959 } 6960 return soFar; 6961 } 6962 6963 boolean readTarHeader(InputStream instream, byte[] block) throws IOException { 6964 final int got = readExactly(instream, block, 0, 512); 6965 if (got == 0) return false; // Clean EOF 6966 if (got < 512) throw new IOException("Unable to read full block header"); 6967 mBytes += 512; 6968 return true; 6969 } 6970 6971 // overwrites 'info' fields based on the pax extended header 6972 boolean readPaxExtendedHeader(InputStream instream, FileMetadata info) 6973 throws IOException { 6974 // We should never see a pax extended header larger than this 6975 if (info.size > 32*1024) { 6976 Slog.w(TAG, "Suspiciously large pax header size " + info.size 6977 + " - aborting"); 6978 throw new IOException("Sanity failure: pax header size " + info.size); 6979 } 6980 6981 // read whole blocks, not just the content size 6982 int numBlocks = (int)((info.size + 511) >> 9); 6983 byte[] data = new byte[numBlocks * 512]; 6984 if (readExactly(instream, data, 0, data.length) < data.length) { 6985 throw new IOException("Unable to read full pax header"); 6986 } 6987 mBytes += data.length; 6988 6989 final int contentSize = (int) info.size; 6990 int offset = 0; 6991 do { 6992 // extract the line at 'offset' 6993 int eol = offset+1; 6994 while (eol < contentSize && data[eol] != ' ') eol++; 6995 if (eol >= contentSize) { 6996 // error: we just hit EOD looking for the end of the size field 6997 throw new IOException("Invalid pax data"); 6998 } 6999 // eol points to the space between the count and the key 7000 int linelen = (int) extractRadix(data, offset, eol - offset, 10); 7001 int key = eol + 1; // start of key=value 7002 eol = offset + linelen - 1; // trailing LF 7003 int value; 7004 for (value = key+1; data[value] != '=' && value <= eol; value++); 7005 if (value > eol) { 7006 throw new IOException("Invalid pax declaration"); 7007 } 7008 7009 // pax requires that key/value strings be in UTF-8 7010 String keyStr = new String(data, key, value-key, "UTF-8"); 7011 // -1 to strip the trailing LF 7012 String valStr = new String(data, value+1, eol-value-1, "UTF-8"); 7013 7014 if ("path".equals(keyStr)) { 7015 info.path = valStr; 7016 } else if ("size".equals(keyStr)) { 7017 info.size = Long.parseLong(valStr); 7018 } else { 7019 if (DEBUG) Slog.i(TAG, "Unhandled pax key: " + key); 7020 } 7021 7022 offset += linelen; 7023 } while (offset < contentSize); 7024 7025 return true; 7026 } 7027 7028 long extractRadix(byte[] data, int offset, int maxChars, int radix) 7029 throws IOException { 7030 long value = 0; 7031 final int end = offset + maxChars; 7032 for (int i = offset; i < end; i++) { 7033 final byte b = data[i]; 7034 // Numeric fields in tar can terminate with either NUL or SPC 7035 if (b == 0 || b == ' ') break; 7036 if (b < '0' || b > ('0' + radix - 1)) { 7037 throw new IOException("Invalid number in header: '" + (char)b 7038 + "' for radix " + radix); 7039 } 7040 value = radix * value + (b - '0'); 7041 } 7042 return value; 7043 } 7044 7045 String extractString(byte[] data, int offset, int maxChars) throws IOException { 7046 final int end = offset + maxChars; 7047 int eos = offset; 7048 // tar string fields terminate early with a NUL 7049 while (eos < end && data[eos] != 0) eos++; 7050 return new String(data, offset, eos-offset, "US-ASCII"); 7051 } 7052 7053 void sendStartRestore() { 7054 if (mObserver != null) { 7055 try { 7056 mObserver.onStartRestore(); 7057 } catch (RemoteException e) { 7058 Slog.w(TAG, "full restore observer went away: startRestore"); 7059 mObserver = null; 7060 } 7061 } 7062 } 7063 7064 void sendOnRestorePackage(String name) { 7065 if (mObserver != null) { 7066 try { 7067 // TODO: use a more user-friendly name string 7068 mObserver.onRestorePackage(name); 7069 } catch (RemoteException e) { 7070 Slog.w(TAG, "full restore observer went away: restorePackage"); 7071 mObserver = null; 7072 } 7073 } 7074 } 7075 7076 void sendEndRestore() { 7077 if (mObserver != null) { 7078 try { 7079 mObserver.onEndRestore(); 7080 } catch (RemoteException e) { 7081 Slog.w(TAG, "full restore observer went away: endRestore"); 7082 mObserver = null; 7083 } 7084 } 7085 } 7086 } 7087 7088 // ***** end new engine class *** 7089 7090 // Used for synchronizing doRestoreFinished during adb restore 7091 class AdbRestoreFinishedLatch implements BackupRestoreTask { 7092 static final String TAG = "AdbRestoreFinishedLatch"; 7093 final CountDownLatch mLatch; 7094 private final int mCurrentOpToken; 7095 7096 AdbRestoreFinishedLatch(int currentOpToken) { 7097 mLatch = new CountDownLatch(1); 7098 mCurrentOpToken = currentOpToken; 7099 } 7100 7101 void await() { 7102 boolean latched = false; 7103 try { 7104 latched = mLatch.await(TIMEOUT_FULL_BACKUP_INTERVAL, TimeUnit.MILLISECONDS); 7105 } catch (InterruptedException e) { 7106 Slog.w(TAG, "Interrupted!"); 7107 } 7108 } 7109 7110 @Override 7111 public void execute() { 7112 // Unused 7113 } 7114 7115 @Override 7116 public void operationComplete(long result) { 7117 if (MORE_DEBUG) { 7118 Slog.w(TAG, "adb onRestoreFinished() complete"); 7119 } 7120 mLatch.countDown(); 7121 removeOperation(mCurrentOpToken); 7122 } 7123 7124 @Override 7125 public void handleCancel(boolean cancelAll) { 7126 if (DEBUG) { 7127 Slog.w(TAG, "adb onRestoreFinished() timed out"); 7128 } 7129 mLatch.countDown(); 7130 removeOperation(mCurrentOpToken); 7131 } 7132 } 7133 7134 class PerformAdbRestoreTask implements Runnable { 7135 ParcelFileDescriptor mInputFile; 7136 String mCurrentPassword; 7137 String mDecryptPassword; 7138 IFullBackupRestoreObserver mObserver; 7139 AtomicBoolean mLatchObject; 7140 IBackupAgent mAgent; 7141 PackageManagerBackupAgent mPackageManagerBackupAgent; 7142 String mAgentPackage; 7143 ApplicationInfo mTargetApp; 7144 FullBackupObbConnection mObbConnection = null; 7145 ParcelFileDescriptor[] mPipes = null; 7146 byte[] mWidgetData = null; 7147 7148 long mBytes; 7149 7150 // Runner that can be placed on a separate thread to do in-process invocation 7151 // of the "restore finished" API asynchronously. Used by adb restore. 7152 class RestoreFinishedRunnable implements Runnable { 7153 final IBackupAgent mAgent; 7154 final int mToken; 7155 7156 RestoreFinishedRunnable(IBackupAgent agent, int token) { 7157 mAgent = agent; 7158 mToken = token; 7159 } 7160 7161 @Override 7162 public void run() { 7163 try { 7164 mAgent.doRestoreFinished(mToken, mBackupManagerBinder); 7165 } catch (RemoteException e) { 7166 // never happens; this is used only for local binder calls 7167 } 7168 } 7169 } 7170 7171 // possible handling states for a given package in the restore dataset 7172 final HashMap<String, RestorePolicy> mPackagePolicies 7173 = new HashMap<String, RestorePolicy>(); 7174 7175 // installer package names for each encountered app, derived from the manifests 7176 final HashMap<String, String> mPackageInstallers = new HashMap<String, String>(); 7177 7178 // Signatures for a given package found in its manifest file 7179 final HashMap<String, Signature[]> mManifestSignatures 7180 = new HashMap<String, Signature[]>(); 7181 7182 // Packages we've already wiped data on when restoring their first file 7183 final HashSet<String> mClearedPackages = new HashSet<String>(); 7184 7185 PerformAdbRestoreTask(ParcelFileDescriptor fd, String curPassword, String decryptPassword, 7186 IFullBackupRestoreObserver observer, AtomicBoolean latch) { 7187 mInputFile = fd; 7188 mCurrentPassword = curPassword; 7189 mDecryptPassword = decryptPassword; 7190 mObserver = observer; 7191 mLatchObject = latch; 7192 mAgent = null; 7193 mPackageManagerBackupAgent = makeMetadataAgent(); 7194 mAgentPackage = null; 7195 mTargetApp = null; 7196 mObbConnection = new FullBackupObbConnection(); 7197 7198 // Which packages we've already wiped data on. We prepopulate this 7199 // with a whitelist of packages known to be unclearable. 7200 mClearedPackages.add("android"); 7201 mClearedPackages.add(SETTINGS_PACKAGE); 7202 } 7203 7204 class RestoreFileRunnable implements Runnable { 7205 IBackupAgent mAgent; 7206 FileMetadata mInfo; 7207 ParcelFileDescriptor mSocket; 7208 int mToken; 7209 7210 RestoreFileRunnable(IBackupAgent agent, FileMetadata info, 7211 ParcelFileDescriptor socket, int token) throws IOException { 7212 mAgent = agent; 7213 mInfo = info; 7214 mToken = token; 7215 7216 // This class is used strictly for process-local binder invocations. The 7217 // semantics of ParcelFileDescriptor differ in this case; in particular, we 7218 // do not automatically get a 'dup'ed descriptor that we can can continue 7219 // to use asynchronously from the caller. So, we make sure to dup it ourselves 7220 // before proceeding to do the restore. 7221 mSocket = ParcelFileDescriptor.dup(socket.getFileDescriptor()); 7222 } 7223 7224 @Override 7225 public void run() { 7226 try { 7227 mAgent.doRestoreFile(mSocket, mInfo.size, mInfo.type, 7228 mInfo.domain, mInfo.path, mInfo.mode, mInfo.mtime, 7229 mToken, mBackupManagerBinder); 7230 } catch (RemoteException e) { 7231 // never happens; this is used strictly for local binder calls 7232 } 7233 } 7234 } 7235 7236 @Override 7237 public void run() { 7238 Slog.i(TAG, "--- Performing full-dataset restore ---"); 7239 mObbConnection.establish(); 7240 sendStartRestore(); 7241 7242 // Are we able to restore shared-storage data? 7243 if (Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED)) { 7244 mPackagePolicies.put(SHARED_BACKUP_AGENT_PACKAGE, RestorePolicy.ACCEPT); 7245 } 7246 7247 FileInputStream rawInStream = null; 7248 DataInputStream rawDataIn = null; 7249 try { 7250 if (!backupPasswordMatches(mCurrentPassword)) { 7251 if (DEBUG) Slog.w(TAG, "Backup password mismatch; aborting"); 7252 return; 7253 } 7254 7255 mBytes = 0; 7256 byte[] buffer = new byte[32 * 1024]; 7257 rawInStream = new FileInputStream(mInputFile.getFileDescriptor()); 7258 rawDataIn = new DataInputStream(rawInStream); 7259 7260 // First, parse out the unencrypted/uncompressed header 7261 boolean compressed = false; 7262 InputStream preCompressStream = rawInStream; 7263 final InputStream in; 7264 7265 boolean okay = false; 7266 final int headerLen = BACKUP_FILE_HEADER_MAGIC.length(); 7267 byte[] streamHeader = new byte[headerLen]; 7268 rawDataIn.readFully(streamHeader); 7269 byte[] magicBytes = BACKUP_FILE_HEADER_MAGIC.getBytes("UTF-8"); 7270 if (Arrays.equals(magicBytes, streamHeader)) { 7271 // okay, header looks good. now parse out the rest of the fields. 7272 String s = readHeaderLine(rawInStream); 7273 final int archiveVersion = Integer.parseInt(s); 7274 if (archiveVersion <= BACKUP_FILE_VERSION) { 7275 // okay, it's a version we recognize. if it's version 1, we may need 7276 // to try two different PBKDF2 regimes to compare checksums. 7277 final boolean pbkdf2Fallback = (archiveVersion == 1); 7278 7279 s = readHeaderLine(rawInStream); 7280 compressed = (Integer.parseInt(s) != 0); 7281 s = readHeaderLine(rawInStream); 7282 if (s.equals("none")) { 7283 // no more header to parse; we're good to go 7284 okay = true; 7285 } else if (mDecryptPassword != null && mDecryptPassword.length() > 0) { 7286 preCompressStream = decodeAesHeaderAndInitialize(s, pbkdf2Fallback, 7287 rawInStream); 7288 if (preCompressStream != null) { 7289 okay = true; 7290 } 7291 } else Slog.w(TAG, "Archive is encrypted but no password given"); 7292 } else Slog.w(TAG, "Wrong header version: " + s); 7293 } else Slog.w(TAG, "Didn't read the right header magic"); 7294 7295 if (!okay) { 7296 Slog.w(TAG, "Invalid restore data; aborting."); 7297 return; 7298 } 7299 7300 // okay, use the right stream layer based on compression 7301 in = (compressed) ? new InflaterInputStream(preCompressStream) : preCompressStream; 7302 7303 boolean didRestore; 7304 do { 7305 didRestore = restoreOneFile(in, buffer); 7306 } while (didRestore); 7307 7308 if (MORE_DEBUG) Slog.v(TAG, "Done consuming input tarfile, total bytes=" + mBytes); 7309 } catch (IOException e) { 7310 Slog.e(TAG, "Unable to read restore input"); 7311 } finally { 7312 tearDownPipes(); 7313 tearDownAgent(mTargetApp, true); 7314 7315 try { 7316 if (rawDataIn != null) rawDataIn.close(); 7317 if (rawInStream != null) rawInStream.close(); 7318 mInputFile.close(); 7319 } catch (IOException e) { 7320 Slog.w(TAG, "Close of restore data pipe threw", e); 7321 /* nothing we can do about this */ 7322 } 7323 synchronized (mLatchObject) { 7324 mLatchObject.set(true); 7325 mLatchObject.notifyAll(); 7326 } 7327 mObbConnection.tearDown(); 7328 sendEndRestore(); 7329 Slog.d(TAG, "Full restore pass complete."); 7330 mWakelock.release(); 7331 } 7332 } 7333 7334 String readHeaderLine(InputStream in) throws IOException { 7335 int c; 7336 StringBuilder buffer = new StringBuilder(80); 7337 while ((c = in.read()) >= 0) { 7338 if (c == '\n') break; // consume and discard the newlines 7339 buffer.append((char)c); 7340 } 7341 return buffer.toString(); 7342 } 7343 7344 InputStream attemptMasterKeyDecryption(String algorithm, byte[] userSalt, byte[] ckSalt, 7345 int rounds, String userIvHex, String masterKeyBlobHex, InputStream rawInStream, 7346 boolean doLog) { 7347 InputStream result = null; 7348 7349 try { 7350 Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding"); 7351 SecretKey userKey = buildPasswordKey(algorithm, mDecryptPassword, userSalt, 7352 rounds); 7353 byte[] IV = hexToByteArray(userIvHex); 7354 IvParameterSpec ivSpec = new IvParameterSpec(IV); 7355 c.init(Cipher.DECRYPT_MODE, 7356 new SecretKeySpec(userKey.getEncoded(), "AES"), 7357 ivSpec); 7358 byte[] mkCipher = hexToByteArray(masterKeyBlobHex); 7359 byte[] mkBlob = c.doFinal(mkCipher); 7360 7361 // first, the master key IV 7362 int offset = 0; 7363 int len = mkBlob[offset++]; 7364 IV = Arrays.copyOfRange(mkBlob, offset, offset + len); 7365 offset += len; 7366 // then the master key itself 7367 len = mkBlob[offset++]; 7368 byte[] mk = Arrays.copyOfRange(mkBlob, 7369 offset, offset + len); 7370 offset += len; 7371 // and finally the master key checksum hash 7372 len = mkBlob[offset++]; 7373 byte[] mkChecksum = Arrays.copyOfRange(mkBlob, 7374 offset, offset + len); 7375 7376 // now validate the decrypted master key against the checksum 7377 byte[] calculatedCk = makeKeyChecksum(algorithm, mk, ckSalt, rounds); 7378 if (Arrays.equals(calculatedCk, mkChecksum)) { 7379 ivSpec = new IvParameterSpec(IV); 7380 c.init(Cipher.DECRYPT_MODE, 7381 new SecretKeySpec(mk, "AES"), 7382 ivSpec); 7383 // Only if all of the above worked properly will 'result' be assigned 7384 result = new CipherInputStream(rawInStream, c); 7385 } else if (doLog) Slog.w(TAG, "Incorrect password"); 7386 } catch (InvalidAlgorithmParameterException e) { 7387 if (doLog) Slog.e(TAG, "Needed parameter spec unavailable!", e); 7388 } catch (BadPaddingException e) { 7389 // This case frequently occurs when the wrong password is used to decrypt 7390 // the master key. Use the identical "incorrect password" log text as is 7391 // used in the checksum failure log in order to avoid providing additional 7392 // information to an attacker. 7393 if (doLog) Slog.w(TAG, "Incorrect password"); 7394 } catch (IllegalBlockSizeException e) { 7395 if (doLog) Slog.w(TAG, "Invalid block size in master key"); 7396 } catch (NoSuchAlgorithmException e) { 7397 if (doLog) Slog.e(TAG, "Needed decryption algorithm unavailable!"); 7398 } catch (NoSuchPaddingException e) { 7399 if (doLog) Slog.e(TAG, "Needed padding mechanism unavailable!"); 7400 } catch (InvalidKeyException e) { 7401 if (doLog) Slog.w(TAG, "Illegal password; aborting"); 7402 } 7403 7404 return result; 7405 } 7406 7407 InputStream decodeAesHeaderAndInitialize(String encryptionName, boolean pbkdf2Fallback, 7408 InputStream rawInStream) { 7409 InputStream result = null; 7410 try { 7411 if (encryptionName.equals(ENCRYPTION_ALGORITHM_NAME)) { 7412 7413 String userSaltHex = readHeaderLine(rawInStream); // 5 7414 byte[] userSalt = hexToByteArray(userSaltHex); 7415 7416 String ckSaltHex = readHeaderLine(rawInStream); // 6 7417 byte[] ckSalt = hexToByteArray(ckSaltHex); 7418 7419 int rounds = Integer.parseInt(readHeaderLine(rawInStream)); // 7 7420 String userIvHex = readHeaderLine(rawInStream); // 8 7421 7422 String masterKeyBlobHex = readHeaderLine(rawInStream); // 9 7423 7424 // decrypt the master key blob 7425 result = attemptMasterKeyDecryption(PBKDF_CURRENT, userSalt, ckSalt, 7426 rounds, userIvHex, masterKeyBlobHex, rawInStream, false); 7427 if (result == null && pbkdf2Fallback) { 7428 result = attemptMasterKeyDecryption(PBKDF_FALLBACK, userSalt, ckSalt, 7429 rounds, userIvHex, masterKeyBlobHex, rawInStream, true); 7430 } 7431 } else Slog.w(TAG, "Unsupported encryption method: " + encryptionName); 7432 } catch (NumberFormatException e) { 7433 Slog.w(TAG, "Can't parse restore data header"); 7434 } catch (IOException e) { 7435 Slog.w(TAG, "Can't read input header"); 7436 } 7437 7438 return result; 7439 } 7440 7441 boolean restoreOneFile(InputStream instream, byte[] buffer) { 7442 FileMetadata info; 7443 try { 7444 info = readTarHeaders(instream); 7445 if (info != null) { 7446 if (MORE_DEBUG) { 7447 dumpFileMetadata(info); 7448 } 7449 7450 final String pkg = info.packageName; 7451 if (!pkg.equals(mAgentPackage)) { 7452 // okay, change in package; set up our various 7453 // bookkeeping if we haven't seen it yet 7454 if (!mPackagePolicies.containsKey(pkg)) { 7455 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 7456 } 7457 7458 // Clean up the previous agent relationship if necessary, 7459 // and let the observer know we're considering a new app. 7460 if (mAgent != null) { 7461 if (DEBUG) Slog.d(TAG, "Saw new package; finalizing old one"); 7462 // Now we're really done 7463 tearDownPipes(); 7464 tearDownAgent(mTargetApp, true); 7465 mTargetApp = null; 7466 mAgentPackage = null; 7467 } 7468 } 7469 7470 if (info.path.equals(BACKUP_MANIFEST_FILENAME)) { 7471 mPackagePolicies.put(pkg, readAppManifest(info, instream)); 7472 mPackageInstallers.put(pkg, info.installerPackageName); 7473 // We've read only the manifest content itself at this point, 7474 // so consume the footer before looping around to the next 7475 // input file 7476 skipTarPadding(info.size, instream); 7477 sendOnRestorePackage(pkg); 7478 } else if (info.path.equals(BACKUP_METADATA_FILENAME)) { 7479 // Metadata blobs! 7480 readMetadata(info, instream); 7481 skipTarPadding(info.size, instream); 7482 } else { 7483 // Non-manifest, so it's actual file data. Is this a package 7484 // we're ignoring? 7485 boolean okay = true; 7486 RestorePolicy policy = mPackagePolicies.get(pkg); 7487 switch (policy) { 7488 case IGNORE: 7489 okay = false; 7490 break; 7491 7492 case ACCEPT_IF_APK: 7493 // If we're in accept-if-apk state, then the first file we 7494 // see MUST be the apk. 7495 if (info.domain.equals(FullBackup.APK_TREE_TOKEN)) { 7496 if (DEBUG) Slog.d(TAG, "APK file; installing"); 7497 // Try to install the app. 7498 String installerName = mPackageInstallers.get(pkg); 7499 okay = installApk(info, installerName, instream); 7500 // good to go; promote to ACCEPT 7501 mPackagePolicies.put(pkg, (okay) 7502 ? RestorePolicy.ACCEPT 7503 : RestorePolicy.IGNORE); 7504 // At this point we've consumed this file entry 7505 // ourselves, so just strip the tar footer and 7506 // go on to the next file in the input stream 7507 skipTarPadding(info.size, instream); 7508 return true; 7509 } else { 7510 // File data before (or without) the apk. We can't 7511 // handle it coherently in this case so ignore it. 7512 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 7513 okay = false; 7514 } 7515 break; 7516 7517 case ACCEPT: 7518 if (info.domain.equals(FullBackup.APK_TREE_TOKEN)) { 7519 if (DEBUG) Slog.d(TAG, "apk present but ACCEPT"); 7520 // we can take the data without the apk, so we 7521 // *want* to do so. skip the apk by declaring this 7522 // one file not-okay without changing the restore 7523 // policy for the package. 7524 okay = false; 7525 } 7526 break; 7527 7528 default: 7529 // Something has gone dreadfully wrong when determining 7530 // the restore policy from the manifest. Ignore the 7531 // rest of this package's data. 7532 Slog.e(TAG, "Invalid policy from manifest"); 7533 okay = false; 7534 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 7535 break; 7536 } 7537 7538 // The path needs to be canonical 7539 if (info.path.contains("..") || info.path.contains("//")) { 7540 if (MORE_DEBUG) { 7541 Slog.w(TAG, "Dropping invalid path " + info.path); 7542 } 7543 okay = false; 7544 } 7545 7546 // If the policy is satisfied, go ahead and set up to pipe the 7547 // data to the agent. 7548 if (DEBUG && okay && mAgent != null) { 7549 Slog.i(TAG, "Reusing existing agent instance"); 7550 } 7551 if (okay && mAgent == null) { 7552 if (DEBUG) Slog.d(TAG, "Need to launch agent for " + pkg); 7553 7554 try { 7555 mTargetApp = mPackageManager.getApplicationInfo(pkg, 0); 7556 7557 // If we haven't sent any data to this app yet, we probably 7558 // need to clear it first. Check that. 7559 if (!mClearedPackages.contains(pkg)) { 7560 // apps with their own backup agents are 7561 // responsible for coherently managing a full 7562 // restore. 7563 if (mTargetApp.backupAgentName == null) { 7564 if (DEBUG) Slog.d(TAG, "Clearing app data preparatory to full restore"); 7565 clearApplicationDataSynchronous(pkg); 7566 } else { 7567 if (DEBUG) Slog.d(TAG, "backup agent (" 7568 + mTargetApp.backupAgentName + ") => no clear"); 7569 } 7570 mClearedPackages.add(pkg); 7571 } else { 7572 if (DEBUG) Slog.d(TAG, "We've initialized this app already; no clear required"); 7573 } 7574 7575 // All set; now set up the IPC and launch the agent 7576 setUpPipes(); 7577 mAgent = bindToAgentSynchronous(mTargetApp, 7578 ApplicationThreadConstants.BACKUP_MODE_RESTORE_FULL); 7579 mAgentPackage = pkg; 7580 } catch (IOException e) { 7581 // fall through to error handling 7582 } catch (NameNotFoundException e) { 7583 // fall through to error handling 7584 } 7585 7586 if (mAgent == null) { 7587 if (DEBUG) Slog.d(TAG, "Unable to create agent for " + pkg); 7588 okay = false; 7589 tearDownPipes(); 7590 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 7591 } 7592 } 7593 7594 // Sanity check: make sure we never give data to the wrong app. This 7595 // should never happen but a little paranoia here won't go amiss. 7596 if (okay && !pkg.equals(mAgentPackage)) { 7597 Slog.e(TAG, "Restoring data for " + pkg 7598 + " but agent is for " + mAgentPackage); 7599 okay = false; 7600 } 7601 7602 // At this point we have an agent ready to handle the full 7603 // restore data as well as a pipe for sending data to 7604 // that agent. Tell the agent to start reading from the 7605 // pipe. 7606 if (okay) { 7607 boolean agentSuccess = true; 7608 long toCopy = info.size; 7609 final boolean isSharedStorage = pkg.equals(SHARED_BACKUP_AGENT_PACKAGE); 7610 final long timeout = isSharedStorage ? 7611 TIMEOUT_SHARED_BACKUP_INTERVAL : TIMEOUT_RESTORE_INTERVAL; 7612 final int token = generateRandomIntegerToken(); 7613 try { 7614 prepareOperationTimeout(token, timeout, null, 7615 OP_TYPE_RESTORE_WAIT); 7616 if (FullBackup.OBB_TREE_TOKEN.equals(info.domain)) { 7617 if (DEBUG) Slog.d(TAG, "Restoring OBB file for " + pkg 7618 + " : " + info.path); 7619 mObbConnection.restoreObbFile(pkg, mPipes[0], 7620 info.size, info.type, info.path, info.mode, 7621 info.mtime, token, mBackupManagerBinder); 7622 } else if (FullBackup.KEY_VALUE_DATA_TOKEN.equals(info.domain)) { 7623 if (DEBUG) Slog.d(TAG, "Restoring key-value file for " + pkg 7624 + " : " + info.path); 7625 KeyValueAdbRestoreEngine restoreEngine = 7626 new KeyValueAdbRestoreEngine(BackupManagerService.this, 7627 mDataDir, info, mPipes[0], mAgent, token); 7628 new Thread(restoreEngine, "restore-key-value-runner").start(); 7629 } else { 7630 if (DEBUG) Slog.d(TAG, "Invoking agent to restore file " 7631 + info.path); 7632 // fire up the app's agent listening on the socket. If 7633 // the agent is running in the system process we can't 7634 // just invoke it asynchronously, so we provide a thread 7635 // for it here. 7636 if (mTargetApp.processName.equals("system")) { 7637 Slog.d(TAG, "system process agent - spinning a thread"); 7638 RestoreFileRunnable runner = new RestoreFileRunnable( 7639 mAgent, info, mPipes[0], token); 7640 new Thread(runner, "restore-sys-runner").start(); 7641 } else { 7642 mAgent.doRestoreFile(mPipes[0], info.size, info.type, 7643 info.domain, info.path, info.mode, info.mtime, 7644 token, mBackupManagerBinder); 7645 } 7646 } 7647 } catch (IOException e) { 7648 // couldn't dup the socket for a process-local restore 7649 Slog.d(TAG, "Couldn't establish restore"); 7650 agentSuccess = false; 7651 okay = false; 7652 } catch (RemoteException e) { 7653 // whoops, remote entity went away. We'll eat the content 7654 // ourselves, then, and not copy it over. 7655 Slog.e(TAG, "Agent crashed during full restore"); 7656 agentSuccess = false; 7657 okay = false; 7658 } 7659 7660 // Copy over the data if the agent is still good 7661 if (okay) { 7662 boolean pipeOkay = true; 7663 FileOutputStream pipe = new FileOutputStream( 7664 mPipes[1].getFileDescriptor()); 7665 while (toCopy > 0) { 7666 int toRead = (toCopy > buffer.length) 7667 ? buffer.length : (int)toCopy; 7668 int nRead = instream.read(buffer, 0, toRead); 7669 if (nRead >= 0) mBytes += nRead; 7670 if (nRead <= 0) break; 7671 toCopy -= nRead; 7672 7673 // send it to the output pipe as long as things 7674 // are still good 7675 if (pipeOkay) { 7676 try { 7677 pipe.write(buffer, 0, nRead); 7678 } catch (IOException e) { 7679 Slog.e(TAG, "Failed to write to restore pipe", e); 7680 pipeOkay = false; 7681 } 7682 } 7683 } 7684 7685 // done sending that file! Now we just need to consume 7686 // the delta from info.size to the end of block. 7687 skipTarPadding(info.size, instream); 7688 7689 // and now that we've sent it all, wait for the remote 7690 // side to acknowledge receipt 7691 agentSuccess = waitUntilOperationComplete(token); 7692 } 7693 7694 // okay, if the remote end failed at any point, deal with 7695 // it by ignoring the rest of the restore on it 7696 if (!agentSuccess) { 7697 if (DEBUG) { 7698 Slog.d(TAG, "Agent failure restoring " + pkg + "; now ignoring"); 7699 } 7700 mBackupHandler.removeMessages(MSG_RESTORE_OPERATION_TIMEOUT); 7701 tearDownPipes(); 7702 tearDownAgent(mTargetApp, false); 7703 mPackagePolicies.put(pkg, RestorePolicy.IGNORE); 7704 } 7705 } 7706 7707 // Problems setting up the agent communication, or an already- 7708 // ignored package: skip to the next tar stream entry by 7709 // reading and discarding this file. 7710 if (!okay) { 7711 if (DEBUG) Slog.d(TAG, "[discarding file content]"); 7712 long bytesToConsume = (info.size + 511) & ~511; 7713 while (bytesToConsume > 0) { 7714 int toRead = (bytesToConsume > buffer.length) 7715 ? buffer.length : (int)bytesToConsume; 7716 long nRead = instream.read(buffer, 0, toRead); 7717 if (nRead >= 0) mBytes += nRead; 7718 if (nRead <= 0) break; 7719 bytesToConsume -= nRead; 7720 } 7721 } 7722 } 7723 } 7724 } catch (IOException e) { 7725 if (DEBUG) Slog.w(TAG, "io exception on restore socket read", e); 7726 // treat as EOF 7727 info = null; 7728 } 7729 7730 return (info != null); 7731 } 7732 7733 void setUpPipes() throws IOException { 7734 mPipes = ParcelFileDescriptor.createPipe(); 7735 } 7736 7737 void tearDownPipes() { 7738 if (mPipes != null) { 7739 try { 7740 mPipes[0].close(); 7741 mPipes[0] = null; 7742 mPipes[1].close(); 7743 mPipes[1] = null; 7744 } catch (IOException e) { 7745 Slog.w(TAG, "Couldn't close agent pipes", e); 7746 } 7747 mPipes = null; 7748 } 7749 } 7750 7751 void tearDownAgent(ApplicationInfo app, boolean doRestoreFinished) { 7752 if (mAgent != null) { 7753 try { 7754 // In the adb restore case, we do restore-finished here 7755 if (doRestoreFinished) { 7756 final int token = generateRandomIntegerToken(); 7757 final AdbRestoreFinishedLatch latch = new AdbRestoreFinishedLatch(token); 7758 prepareOperationTimeout(token, TIMEOUT_FULL_BACKUP_INTERVAL, latch, 7759 OP_TYPE_RESTORE_WAIT); 7760 if (mTargetApp.processName.equals("system")) { 7761 if (MORE_DEBUG) { 7762 Slog.d(TAG, "system agent - restoreFinished on thread"); 7763 } 7764 Runnable runner = new RestoreFinishedRunnable(mAgent, token); 7765 new Thread(runner, "restore-sys-finished-runner").start(); 7766 } else { 7767 mAgent.doRestoreFinished(token, mBackupManagerBinder); 7768 } 7769 7770 latch.await(); 7771 } 7772 7773 // unbind and tidy up even on timeout or failure, just in case 7774 mActivityManager.unbindBackupAgent(app); 7775 7776 // The agent was running with a stub Application object, so shut it down. 7777 // !!! We hardcode the confirmation UI's package name here rather than use a 7778 // manifest flag! TODO something less direct. 7779 if (app.uid >= Process.FIRST_APPLICATION_UID 7780 && !app.packageName.equals("com.android.backupconfirm")) { 7781 if (DEBUG) Slog.d(TAG, "Killing host process"); 7782 mActivityManager.killApplicationProcess(app.processName, app.uid); 7783 } else { 7784 if (DEBUG) Slog.d(TAG, "Not killing after full restore"); 7785 } 7786 } catch (RemoteException e) { 7787 Slog.d(TAG, "Lost app trying to shut down"); 7788 } 7789 mAgent = null; 7790 } 7791 } 7792 7793 class RestoreInstallObserver extends PackageInstallObserver { 7794 final AtomicBoolean mDone = new AtomicBoolean(); 7795 String mPackageName; 7796 int mResult; 7797 7798 public void reset() { 7799 synchronized (mDone) { 7800 mDone.set(false); 7801 } 7802 } 7803 7804 public void waitForCompletion() { 7805 synchronized (mDone) { 7806 while (mDone.get() == false) { 7807 try { 7808 mDone.wait(); 7809 } catch (InterruptedException e) { } 7810 } 7811 } 7812 } 7813 7814 int getResult() { 7815 return mResult; 7816 } 7817 7818 @Override 7819 public void onPackageInstalled(String packageName, int returnCode, 7820 String msg, Bundle extras) { 7821 synchronized (mDone) { 7822 mResult = returnCode; 7823 mPackageName = packageName; 7824 mDone.set(true); 7825 mDone.notifyAll(); 7826 } 7827 } 7828 } 7829 7830 class RestoreDeleteObserver extends IPackageDeleteObserver.Stub { 7831 final AtomicBoolean mDone = new AtomicBoolean(); 7832 int mResult; 7833 7834 public void reset() { 7835 synchronized (mDone) { 7836 mDone.set(false); 7837 } 7838 } 7839 7840 public void waitForCompletion() { 7841 synchronized (mDone) { 7842 while (mDone.get() == false) { 7843 try { 7844 mDone.wait(); 7845 } catch (InterruptedException e) { } 7846 } 7847 } 7848 } 7849 7850 @Override 7851 public void packageDeleted(String packageName, int returnCode) throws RemoteException { 7852 synchronized (mDone) { 7853 mResult = returnCode; 7854 mDone.set(true); 7855 mDone.notifyAll(); 7856 } 7857 } 7858 } 7859 7860 final RestoreInstallObserver mInstallObserver = new RestoreInstallObserver(); 7861 final RestoreDeleteObserver mDeleteObserver = new RestoreDeleteObserver(); 7862 7863 boolean installApk(FileMetadata info, String installerPackage, InputStream instream) { 7864 boolean okay = true; 7865 7866 if (DEBUG) Slog.d(TAG, "Installing from backup: " + info.packageName); 7867 7868 // The file content is an .apk file. Copy it out to a staging location and 7869 // attempt to install it. 7870 File apkFile = new File(mDataDir, info.packageName); 7871 try { 7872 FileOutputStream apkStream = new FileOutputStream(apkFile); 7873 byte[] buffer = new byte[32 * 1024]; 7874 long size = info.size; 7875 while (size > 0) { 7876 long toRead = (buffer.length < size) ? buffer.length : size; 7877 int didRead = instream.read(buffer, 0, (int)toRead); 7878 if (didRead >= 0) mBytes += didRead; 7879 apkStream.write(buffer, 0, didRead); 7880 size -= didRead; 7881 } 7882 apkStream.close(); 7883 7884 // make sure the installer can read it 7885 apkFile.setReadable(true, false); 7886 7887 // Now install it 7888 Uri packageUri = Uri.fromFile(apkFile); 7889 mInstallObserver.reset(); 7890 mPackageManager.installPackage(packageUri, mInstallObserver, 7891 PackageManager.INSTALL_REPLACE_EXISTING | PackageManager.INSTALL_FROM_ADB, 7892 installerPackage); 7893 mInstallObserver.waitForCompletion(); 7894 7895 if (mInstallObserver.getResult() != PackageManager.INSTALL_SUCCEEDED) { 7896 // The only time we continue to accept install of data even if the 7897 // apk install failed is if we had already determined that we could 7898 // accept the data regardless. 7899 if (mPackagePolicies.get(info.packageName) != RestorePolicy.ACCEPT) { 7900 okay = false; 7901 } 7902 } else { 7903 // Okay, the install succeeded. Make sure it was the right app. 7904 boolean uninstall = false; 7905 if (!mInstallObserver.mPackageName.equals(info.packageName)) { 7906 Slog.w(TAG, "Restore stream claimed to include apk for " 7907 + info.packageName + " but apk was really " 7908 + mInstallObserver.mPackageName); 7909 // delete the package we just put in place; it might be fraudulent 7910 okay = false; 7911 uninstall = true; 7912 } else { 7913 try { 7914 PackageInfo pkg = mPackageManager.getPackageInfo(info.packageName, 7915 PackageManager.GET_SIGNATURES); 7916 if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_ALLOW_BACKUP) == 0) { 7917 Slog.w(TAG, "Restore stream contains apk of package " 7918 + info.packageName + " but it disallows backup/restore"); 7919 okay = false; 7920 } else { 7921 // So far so good -- do the signatures match the manifest? 7922 Signature[] sigs = mManifestSignatures.get(info.packageName); 7923 if (signaturesMatch(sigs, pkg)) { 7924 // If this is a system-uid app without a declared backup agent, 7925 // don't restore any of the file data. 7926 if ((pkg.applicationInfo.uid < Process.FIRST_APPLICATION_UID) 7927 && (pkg.applicationInfo.backupAgentName == null)) { 7928 Slog.w(TAG, "Installed app " + info.packageName 7929 + " has restricted uid and no agent"); 7930 okay = false; 7931 } 7932 } else { 7933 Slog.w(TAG, "Installed app " + info.packageName 7934 + " signatures do not match restore manifest"); 7935 okay = false; 7936 uninstall = true; 7937 } 7938 } 7939 } catch (NameNotFoundException e) { 7940 Slog.w(TAG, "Install of package " + info.packageName 7941 + " succeeded but now not found"); 7942 okay = false; 7943 } 7944 } 7945 7946 // If we're not okay at this point, we need to delete the package 7947 // that we just installed. 7948 if (uninstall) { 7949 mDeleteObserver.reset(); 7950 mPackageManager.deletePackage(mInstallObserver.mPackageName, 7951 mDeleteObserver, 0); 7952 mDeleteObserver.waitForCompletion(); 7953 } 7954 } 7955 } catch (IOException e) { 7956 Slog.e(TAG, "Unable to transcribe restored apk for install"); 7957 okay = false; 7958 } finally { 7959 apkFile.delete(); 7960 } 7961 7962 return okay; 7963 } 7964 7965 // Given an actual file content size, consume the post-content padding mandated 7966 // by the tar format. 7967 void skipTarPadding(long size, InputStream instream) throws IOException { 7968 long partial = (size + 512) % 512; 7969 if (partial > 0) { 7970 final int needed = 512 - (int)partial; 7971 byte[] buffer = new byte[needed]; 7972 if (readExactly(instream, buffer, 0, needed) == needed) { 7973 mBytes += needed; 7974 } else throw new IOException("Unexpected EOF in padding"); 7975 } 7976 } 7977 7978 // Read a widget metadata file, returning the restored blob 7979 void readMetadata(FileMetadata info, InputStream instream) throws IOException { 7980 // Fail on suspiciously large widget dump files 7981 if (info.size > 64 * 1024) { 7982 throw new IOException("Metadata too big; corrupt? size=" + info.size); 7983 } 7984 7985 byte[] buffer = new byte[(int) info.size]; 7986 if (readExactly(instream, buffer, 0, (int)info.size) == info.size) { 7987 mBytes += info.size; 7988 } else throw new IOException("Unexpected EOF in widget data"); 7989 7990 String[] str = new String[1]; 7991 int offset = extractLine(buffer, 0, str); 7992 int version = Integer.parseInt(str[0]); 7993 if (version == BACKUP_MANIFEST_VERSION) { 7994 offset = extractLine(buffer, offset, str); 7995 final String pkg = str[0]; 7996 if (info.packageName.equals(pkg)) { 7997 // Data checks out -- the rest of the buffer is a concatenation of 7998 // binary blobs as described in the comment at writeAppWidgetData() 7999 ByteArrayInputStream bin = new ByteArrayInputStream(buffer, 8000 offset, buffer.length - offset); 8001 DataInputStream in = new DataInputStream(bin); 8002 while (bin.available() > 0) { 8003 int token = in.readInt(); 8004 int size = in.readInt(); 8005 if (size > 64 * 1024) { 8006 throw new IOException("Datum " 8007 + Integer.toHexString(token) 8008 + " too big; corrupt? size=" + info.size); 8009 } 8010 switch (token) { 8011 case BACKUP_WIDGET_METADATA_TOKEN: 8012 { 8013 if (MORE_DEBUG) { 8014 Slog.i(TAG, "Got widget metadata for " + info.packageName); 8015 } 8016 mWidgetData = new byte[size]; 8017 in.read(mWidgetData); 8018 break; 8019 } 8020 default: 8021 { 8022 if (DEBUG) { 8023 Slog.i(TAG, "Ignoring metadata blob " 8024 + Integer.toHexString(token) 8025 + " for " + info.packageName); 8026 } 8027 in.skipBytes(size); 8028 break; 8029 } 8030 } 8031 } 8032 } else { 8033 Slog.w(TAG, "Metadata mismatch: package " + info.packageName 8034 + " but widget data for " + pkg); 8035 } 8036 } else { 8037 Slog.w(TAG, "Unsupported metadata version " + version); 8038 } 8039 } 8040 8041 // Returns a policy constant; takes a buffer arg to reduce memory churn 8042 RestorePolicy readAppManifest(FileMetadata info, InputStream instream) 8043 throws IOException { 8044 // Fail on suspiciously large manifest files 8045 if (info.size > 64 * 1024) { 8046 throw new IOException("Restore manifest too big; corrupt? size=" + info.size); 8047 } 8048 8049 byte[] buffer = new byte[(int) info.size]; 8050 if (readExactly(instream, buffer, 0, (int)info.size) == info.size) { 8051 mBytes += info.size; 8052 } else throw new IOException("Unexpected EOF in manifest"); 8053 8054 RestorePolicy policy = RestorePolicy.IGNORE; 8055 String[] str = new String[1]; 8056 int offset = 0; 8057 8058 try { 8059 offset = extractLine(buffer, offset, str); 8060 int version = Integer.parseInt(str[0]); 8061 if (version == BACKUP_MANIFEST_VERSION) { 8062 offset = extractLine(buffer, offset, str); 8063 String manifestPackage = str[0]; 8064 // TODO: handle <original-package> 8065 if (manifestPackage.equals(info.packageName)) { 8066 offset = extractLine(buffer, offset, str); 8067 version = Integer.parseInt(str[0]); // app version 8068 offset = extractLine(buffer, offset, str); 8069 // This is the platform version, which we don't use, but we parse it 8070 // as a safety against corruption in the manifest. 8071 Integer.parseInt(str[0]); 8072 offset = extractLine(buffer, offset, str); 8073 info.installerPackageName = (str[0].length() > 0) ? str[0] : null; 8074 offset = extractLine(buffer, offset, str); 8075 boolean hasApk = str[0].equals("1"); 8076 offset = extractLine(buffer, offset, str); 8077 int numSigs = Integer.parseInt(str[0]); 8078 if (numSigs > 0) { 8079 Signature[] sigs = new Signature[numSigs]; 8080 for (int i = 0; i < numSigs; i++) { 8081 offset = extractLine(buffer, offset, str); 8082 sigs[i] = new Signature(str[0]); 8083 } 8084 mManifestSignatures.put(info.packageName, sigs); 8085 8086 // Okay, got the manifest info we need... 8087 try { 8088 PackageInfo pkgInfo = mPackageManager.getPackageInfo( 8089 info.packageName, PackageManager.GET_SIGNATURES); 8090 // Fall through to IGNORE if the app explicitly disallows backup 8091 final int flags = pkgInfo.applicationInfo.flags; 8092 if ((flags & ApplicationInfo.FLAG_ALLOW_BACKUP) != 0) { 8093 // Restore system-uid-space packages only if they have 8094 // defined a custom backup agent 8095 if ((pkgInfo.applicationInfo.uid >= Process.FIRST_APPLICATION_UID) 8096 || (pkgInfo.applicationInfo.backupAgentName != null)) { 8097 // Verify signatures against any installed version; if they 8098 // don't match, then we fall though and ignore the data. The 8099 // signatureMatch() method explicitly ignores the signature 8100 // check for packages installed on the system partition, because 8101 // such packages are signed with the platform cert instead of 8102 // the app developer's cert, so they're different on every 8103 // device. 8104 if (signaturesMatch(sigs, pkgInfo)) { 8105 if ((pkgInfo.applicationInfo.flags 8106 & ApplicationInfo.FLAG_RESTORE_ANY_VERSION) != 0) { 8107 Slog.i(TAG, "Package has restoreAnyVersion; taking data"); 8108 policy = RestorePolicy.ACCEPT; 8109 } else if (pkgInfo.versionCode >= version) { 8110 Slog.i(TAG, "Sig + version match; taking data"); 8111 policy = RestorePolicy.ACCEPT; 8112 } else { 8113 // The data is from a newer version of the app than 8114 // is presently installed. That means we can only 8115 // use it if the matching apk is also supplied. 8116 Slog.d(TAG, "Data version " + version 8117 + " is newer than installed version " 8118 + pkgInfo.versionCode + " - requiring apk"); 8119 policy = RestorePolicy.ACCEPT_IF_APK; 8120 } 8121 } else { 8122 Slog.w(TAG, "Restore manifest signatures do not match " 8123 + "installed application for " + info.packageName); 8124 } 8125 } else { 8126 Slog.w(TAG, "Package " + info.packageName 8127 + " is system level with no agent"); 8128 } 8129 } else { 8130 if (DEBUG) Slog.i(TAG, "Restore manifest from " 8131 + info.packageName + " but allowBackup=false"); 8132 } 8133 } catch (NameNotFoundException e) { 8134 // Okay, the target app isn't installed. We can process 8135 // the restore properly only if the dataset provides the 8136 // apk file and we can successfully install it. 8137 if (DEBUG) Slog.i(TAG, "Package " + info.packageName 8138 + " not installed; requiring apk in dataset"); 8139 policy = RestorePolicy.ACCEPT_IF_APK; 8140 } 8141 8142 if (policy == RestorePolicy.ACCEPT_IF_APK && !hasApk) { 8143 Slog.i(TAG, "Cannot restore package " + info.packageName 8144 + " without the matching .apk"); 8145 } 8146 } else { 8147 Slog.i(TAG, "Missing signature on backed-up package " 8148 + info.packageName); 8149 } 8150 } else { 8151 Slog.i(TAG, "Expected package " + info.packageName 8152 + " but restore manifest claims " + manifestPackage); 8153 } 8154 } else { 8155 Slog.i(TAG, "Unknown restore manifest version " + version 8156 + " for package " + info.packageName); 8157 } 8158 } catch (NumberFormatException e) { 8159 Slog.w(TAG, "Corrupt restore manifest for package " + info.packageName); 8160 } catch (IllegalArgumentException e) { 8161 Slog.w(TAG, e.getMessage()); 8162 } 8163 8164 return policy; 8165 } 8166 8167 // Builds a line from a byte buffer starting at 'offset', and returns 8168 // the index of the next unconsumed data in the buffer. 8169 int extractLine(byte[] buffer, int offset, String[] outStr) throws IOException { 8170 final int end = buffer.length; 8171 if (offset >= end) throw new IOException("Incomplete data"); 8172 8173 int pos; 8174 for (pos = offset; pos < end; pos++) { 8175 byte c = buffer[pos]; 8176 // at LF we declare end of line, and return the next char as the 8177 // starting point for the next time through 8178 if (c == '\n') { 8179 break; 8180 } 8181 } 8182 outStr[0] = new String(buffer, offset, pos - offset); 8183 pos++; // may be pointing an extra byte past the end but that's okay 8184 return pos; 8185 } 8186 8187 void dumpFileMetadata(FileMetadata info) { 8188 if (DEBUG) { 8189 StringBuilder b = new StringBuilder(128); 8190 8191 // mode string 8192 b.append((info.type == BackupAgent.TYPE_DIRECTORY) ? 'd' : '-'); 8193 b.append(((info.mode & 0400) != 0) ? 'r' : '-'); 8194 b.append(((info.mode & 0200) != 0) ? 'w' : '-'); 8195 b.append(((info.mode & 0100) != 0) ? 'x' : '-'); 8196 b.append(((info.mode & 0040) != 0) ? 'r' : '-'); 8197 b.append(((info.mode & 0020) != 0) ? 'w' : '-'); 8198 b.append(((info.mode & 0010) != 0) ? 'x' : '-'); 8199 b.append(((info.mode & 0004) != 0) ? 'r' : '-'); 8200 b.append(((info.mode & 0002) != 0) ? 'w' : '-'); 8201 b.append(((info.mode & 0001) != 0) ? 'x' : '-'); 8202 b.append(String.format(" %9d ", info.size)); 8203 8204 Date stamp = new Date(info.mtime); 8205 b.append(new SimpleDateFormat("MMM dd HH:mm:ss ").format(stamp)); 8206 8207 b.append(info.packageName); 8208 b.append(" :: "); 8209 b.append(info.domain); 8210 b.append(" :: "); 8211 b.append(info.path); 8212 8213 Slog.i(TAG, b.toString()); 8214 } 8215 } 8216 8217 // Consume a tar file header block [sequence] and accumulate the relevant metadata 8218 FileMetadata readTarHeaders(InputStream instream) throws IOException { 8219 byte[] block = new byte[512]; 8220 FileMetadata info = null; 8221 8222 boolean gotHeader = readTarHeader(instream, block); 8223 if (gotHeader) { 8224 try { 8225 // okay, presume we're okay, and extract the various metadata 8226 info = new FileMetadata(); 8227 info.size = extractRadix(block, 124, 12, 8); 8228 info.mtime = extractRadix(block, 136, 12, 8); 8229 info.mode = extractRadix(block, 100, 8, 8); 8230 8231 info.path = extractString(block, 345, 155); // prefix 8232 String path = extractString(block, 0, 100); 8233 if (path.length() > 0) { 8234 if (info.path.length() > 0) info.path += '/'; 8235 info.path += path; 8236 } 8237 8238 // tar link indicator field: 1 byte at offset 156 in the header. 8239 int typeChar = block[156]; 8240 if (typeChar == 'x') { 8241 // pax extended header, so we need to read that 8242 gotHeader = readPaxExtendedHeader(instream, info); 8243 if (gotHeader) { 8244 // and after a pax extended header comes another real header -- read 8245 // that to find the real file type 8246 gotHeader = readTarHeader(instream, block); 8247 } 8248 if (!gotHeader) throw new IOException("Bad or missing pax header"); 8249 8250 typeChar = block[156]; 8251 } 8252 8253 switch (typeChar) { 8254 case '0': info.type = BackupAgent.TYPE_FILE; break; 8255 case '5': { 8256 info.type = BackupAgent.TYPE_DIRECTORY; 8257 if (info.size != 0) { 8258 Slog.w(TAG, "Directory entry with nonzero size in header"); 8259 info.size = 0; 8260 } 8261 break; 8262 } 8263 case 0: { 8264 // presume EOF 8265 if (DEBUG) Slog.w(TAG, "Saw type=0 in tar header block, info=" + info); 8266 return null; 8267 } 8268 default: { 8269 Slog.e(TAG, "Unknown tar entity type: " + typeChar); 8270 throw new IOException("Unknown entity type " + typeChar); 8271 } 8272 } 8273 8274 // Parse out the path 8275 // 8276 // first: apps/shared/unrecognized 8277 if (FullBackup.SHARED_PREFIX.regionMatches(0, 8278 info.path, 0, FullBackup.SHARED_PREFIX.length())) { 8279 // File in shared storage. !!! TODO: implement this. 8280 info.path = info.path.substring(FullBackup.SHARED_PREFIX.length()); 8281 info.packageName = SHARED_BACKUP_AGENT_PACKAGE; 8282 info.domain = FullBackup.SHARED_STORAGE_TOKEN; 8283 if (DEBUG) Slog.i(TAG, "File in shared storage: " + info.path); 8284 } else if (FullBackup.APPS_PREFIX.regionMatches(0, 8285 info.path, 0, FullBackup.APPS_PREFIX.length())) { 8286 // App content! Parse out the package name and domain 8287 8288 // strip the apps/ prefix 8289 info.path = info.path.substring(FullBackup.APPS_PREFIX.length()); 8290 8291 // extract the package name 8292 int slash = info.path.indexOf('/'); 8293 if (slash < 0) throw new IOException("Illegal semantic path in " + info.path); 8294 info.packageName = info.path.substring(0, slash); 8295 info.path = info.path.substring(slash+1); 8296 8297 // if it's a manifest or metadata payload we're done, otherwise parse 8298 // out the domain into which the file will be restored 8299 if (!info.path.equals(BACKUP_MANIFEST_FILENAME) 8300 && !info.path.equals(BACKUP_METADATA_FILENAME)) { 8301 slash = info.path.indexOf('/'); 8302 if (slash < 0) throw new IOException("Illegal semantic path in non-manifest " + info.path); 8303 info.domain = info.path.substring(0, slash); 8304 info.path = info.path.substring(slash + 1); 8305 } 8306 } 8307 } catch (IOException e) { 8308 if (DEBUG) { 8309 Slog.e(TAG, "Parse error in header: " + e.getMessage()); 8310 HEXLOG(block); 8311 } 8312 throw e; 8313 } 8314 } 8315 return info; 8316 } 8317 8318 private void HEXLOG(byte[] block) { 8319 int offset = 0; 8320 int todo = block.length; 8321 StringBuilder buf = new StringBuilder(64); 8322 while (todo > 0) { 8323 buf.append(String.format("%04x ", offset)); 8324 int numThisLine = (todo > 16) ? 16 : todo; 8325 for (int i = 0; i < numThisLine; i++) { 8326 buf.append(String.format("%02x ", block[offset+i])); 8327 } 8328 Slog.i("hexdump", buf.toString()); 8329 buf.setLength(0); 8330 todo -= numThisLine; 8331 offset += numThisLine; 8332 } 8333 } 8334 8335 // Read exactly the given number of bytes into a buffer at the stated offset. 8336 // Returns false if EOF is encountered before the requested number of bytes 8337 // could be read. 8338 int readExactly(InputStream in, byte[] buffer, int offset, int size) 8339 throws IOException { 8340 if (size <= 0) throw new IllegalArgumentException("size must be > 0"); 8341 8342 int soFar = 0; 8343 while (soFar < size) { 8344 int nRead = in.read(buffer, offset + soFar, size - soFar); 8345 if (nRead <= 0) { 8346 if (MORE_DEBUG) Slog.w(TAG, "- wanted exactly " + size + " but got only " + soFar); 8347 break; 8348 } 8349 soFar += nRead; 8350 } 8351 return soFar; 8352 } 8353 8354 boolean readTarHeader(InputStream instream, byte[] block) throws IOException { 8355 final int got = readExactly(instream, block, 0, 512); 8356 if (got == 0) return false; // Clean EOF 8357 if (got < 512) throw new IOException("Unable to read full block header"); 8358 mBytes += 512; 8359 return true; 8360 } 8361 8362 // overwrites 'info' fields based on the pax extended header 8363 boolean readPaxExtendedHeader(InputStream instream, FileMetadata info) 8364 throws IOException { 8365 // We should never see a pax extended header larger than this 8366 if (info.size > 32*1024) { 8367 Slog.w(TAG, "Suspiciously large pax header size " + info.size 8368 + " - aborting"); 8369 throw new IOException("Sanity failure: pax header size " + info.size); 8370 } 8371 8372 // read whole blocks, not just the content size 8373 int numBlocks = (int)((info.size + 511) >> 9); 8374 byte[] data = new byte[numBlocks * 512]; 8375 if (readExactly(instream, data, 0, data.length) < data.length) { 8376 throw new IOException("Unable to read full pax header"); 8377 } 8378 mBytes += data.length; 8379 8380 final int contentSize = (int) info.size; 8381 int offset = 0; 8382 do { 8383 // extract the line at 'offset' 8384 int eol = offset+1; 8385 while (eol < contentSize && data[eol] != ' ') eol++; 8386 if (eol >= contentSize) { 8387 // error: we just hit EOD looking for the end of the size field 8388 throw new IOException("Invalid pax data"); 8389 } 8390 // eol points to the space between the count and the key 8391 int linelen = (int) extractRadix(data, offset, eol - offset, 10); 8392 int key = eol + 1; // start of key=value 8393 eol = offset + linelen - 1; // trailing LF 8394 int value; 8395 for (value = key+1; data[value] != '=' && value <= eol; value++); 8396 if (value > eol) { 8397 throw new IOException("Invalid pax declaration"); 8398 } 8399 8400 // pax requires that key/value strings be in UTF-8 8401 String keyStr = new String(data, key, value-key, "UTF-8"); 8402 // -1 to strip the trailing LF 8403 String valStr = new String(data, value+1, eol-value-1, "UTF-8"); 8404 8405 if ("path".equals(keyStr)) { 8406 info.path = valStr; 8407 } else if ("size".equals(keyStr)) { 8408 info.size = Long.parseLong(valStr); 8409 } else { 8410 if (DEBUG) Slog.i(TAG, "Unhandled pax key: " + key); 8411 } 8412 8413 offset += linelen; 8414 } while (offset < contentSize); 8415 8416 return true; 8417 } 8418 8419 long extractRadix(byte[] data, int offset, int maxChars, int radix) 8420 throws IOException { 8421 long value = 0; 8422 final int end = offset + maxChars; 8423 for (int i = offset; i < end; i++) { 8424 final byte b = data[i]; 8425 // Numeric fields in tar can terminate with either NUL or SPC 8426 if (b == 0 || b == ' ') break; 8427 if (b < '0' || b > ('0' + radix - 1)) { 8428 throw new IOException("Invalid number in header: '" + (char)b + "' for radix " + radix); 8429 } 8430 value = radix * value + (b - '0'); 8431 } 8432 return value; 8433 } 8434 8435 String extractString(byte[] data, int offset, int maxChars) throws IOException { 8436 final int end = offset + maxChars; 8437 int eos = offset; 8438 // tar string fields terminate early with a NUL 8439 while (eos < end && data[eos] != 0) eos++; 8440 return new String(data, offset, eos-offset, "US-ASCII"); 8441 } 8442 8443 void sendStartRestore() { 8444 if (mObserver != null) { 8445 try { 8446 mObserver.onStartRestore(); 8447 } catch (RemoteException e) { 8448 Slog.w(TAG, "full restore observer went away: startRestore"); 8449 mObserver = null; 8450 } 8451 } 8452 } 8453 8454 void sendOnRestorePackage(String name) { 8455 if (mObserver != null) { 8456 try { 8457 // TODO: use a more user-friendly name string 8458 mObserver.onRestorePackage(name); 8459 } catch (RemoteException e) { 8460 Slog.w(TAG, "full restore observer went away: restorePackage"); 8461 mObserver = null; 8462 } 8463 } 8464 } 8465 8466 void sendEndRestore() { 8467 if (mObserver != null) { 8468 try { 8469 mObserver.onEndRestore(); 8470 } catch (RemoteException e) { 8471 Slog.w(TAG, "full restore observer went away: endRestore"); 8472 mObserver = null; 8473 } 8474 } 8475 } 8476 } 8477 8478 // ----- Restore handling ----- 8479 8480 // Old style: directly match the stored vs on device signature blocks 8481 static boolean signaturesMatch(Signature[] storedSigs, PackageInfo target) { 8482 if (target == null) { 8483 return false; 8484 } 8485 8486 // If the target resides on the system partition, we allow it to restore 8487 // data from the like-named package in a restore set even if the signatures 8488 // do not match. (Unlike general applications, those flashed to the system 8489 // partition will be signed with the device's platform certificate, so on 8490 // different phones the same system app will have different signatures.) 8491 if ((target.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) { 8492 if (MORE_DEBUG) Slog.v(TAG, "System app " + target.packageName + " - skipping sig check"); 8493 return true; 8494 } 8495 8496 // Allow unsigned apps, but not signed on one device and unsigned on the other 8497 // !!! TODO: is this the right policy? 8498 Signature[] deviceSigs = target.signatures; 8499 if (MORE_DEBUG) Slog.v(TAG, "signaturesMatch(): stored=" + storedSigs 8500 + " device=" + deviceSigs); 8501 if ((storedSigs == null || storedSigs.length == 0) 8502 && (deviceSigs == null || deviceSigs.length == 0)) { 8503 return true; 8504 } 8505 if (storedSigs == null || deviceSigs == null) { 8506 return false; 8507 } 8508 8509 // !!! TODO: this demands that every stored signature match one 8510 // that is present on device, and does not demand the converse. 8511 // Is this this right policy? 8512 int nStored = storedSigs.length; 8513 int nDevice = deviceSigs.length; 8514 8515 for (int i=0; i < nStored; i++) { 8516 boolean match = false; 8517 for (int j=0; j < nDevice; j++) { 8518 if (storedSigs[i].equals(deviceSigs[j])) { 8519 match = true; 8520 break; 8521 } 8522 } 8523 if (!match) { 8524 return false; 8525 } 8526 } 8527 return true; 8528 } 8529 8530 // Used by both incremental and full restore 8531 void restoreWidgetData(String packageName, byte[] widgetData) { 8532 // Apply the restored widget state and generate the ID update for the app 8533 // TODO: http://b/22388012 8534 if (MORE_DEBUG) { 8535 Slog.i(TAG, "Incorporating restored widget data"); 8536 } 8537 AppWidgetBackupBridge.restoreWidgetState(packageName, widgetData, UserHandle.USER_SYSTEM); 8538 } 8539 8540 // ***************************** 8541 // NEW UNIFIED RESTORE IMPLEMENTATION 8542 // ***************************** 8543 8544 // states of the unified-restore state machine 8545 enum UnifiedRestoreState { 8546 INITIAL, 8547 RUNNING_QUEUE, 8548 RESTORE_KEYVALUE, 8549 RESTORE_FULL, 8550 RESTORE_FINISHED, 8551 FINAL 8552 } 8553 8554 class PerformUnifiedRestoreTask implements BackupRestoreTask { 8555 // Transport we're working with to do the restore 8556 private IBackupTransport mTransport; 8557 8558 // Where per-transport saved state goes 8559 File mStateDir; 8560 8561 // Restore observer; may be null 8562 private IRestoreObserver mObserver; 8563 8564 // BackuoManagerMonitor; may be null 8565 private IBackupManagerMonitor mMonitor; 8566 8567 // Token identifying the dataset to the transport 8568 private long mToken; 8569 8570 // When this is a restore-during-install, this is the token identifying the 8571 // operation to the Package Manager, and we must ensure that we let it know 8572 // when we're finished. 8573 private int mPmToken; 8574 8575 // When this is restore-during-install, we need to tell the package manager 8576 // whether we actually launched the app, because this affects notifications 8577 // around externally-visible state transitions. 8578 private boolean mDidLaunch; 8579 8580 // Is this a whole-system restore, i.e. are we establishing a new ancestral 8581 // dataset to base future restore-at-install operations from? 8582 private boolean mIsSystemRestore; 8583 8584 // If this is a single-package restore, what package are we interested in? 8585 private PackageInfo mTargetPackage; 8586 8587 // In all cases, the calculated list of packages that we are trying to restore 8588 private List<PackageInfo> mAcceptSet; 8589 8590 // Our bookkeeping about the ancestral dataset 8591 private PackageManagerBackupAgent mPmAgent; 8592 8593 // Currently-bound backup agent for restore + restoreFinished purposes 8594 private IBackupAgent mAgent; 8595 8596 // What sort of restore we're doing now 8597 private RestoreDescription mRestoreDescription; 8598 8599 // The package we're currently restoring 8600 private PackageInfo mCurrentPackage; 8601 8602 // Widget-related data handled as part of this restore operation 8603 private byte[] mWidgetData; 8604 8605 // Number of apps restored in this pass 8606 private int mCount; 8607 8608 // When did we start? 8609 private long mStartRealtime; 8610 8611 // State machine progress 8612 private UnifiedRestoreState mState; 8613 8614 // How are things going? 8615 private int mStatus; 8616 8617 // Done? 8618 private boolean mFinished; 8619 8620 // Key/value: bookkeeping about staged data and files for agent access 8621 private File mBackupDataName; 8622 private File mStageName; 8623 private File mSavedStateName; 8624 private File mNewStateName; 8625 ParcelFileDescriptor mBackupData; 8626 ParcelFileDescriptor mNewState; 8627 8628 private final int mEphemeralOpToken; 8629 8630 // Invariant: mWakelock is already held, and this task is responsible for 8631 // releasing it at the end of the restore operation. 8632 PerformUnifiedRestoreTask(IBackupTransport transport, IRestoreObserver observer, 8633 IBackupManagerMonitor monitor, long restoreSetToken, PackageInfo targetPackage, 8634 int pmToken, boolean isFullSystemRestore, String[] filterSet) { 8635 mEphemeralOpToken = generateRandomIntegerToken(); 8636 mState = UnifiedRestoreState.INITIAL; 8637 mStartRealtime = SystemClock.elapsedRealtime(); 8638 8639 mTransport = transport; 8640 mObserver = observer; 8641 mMonitor = monitor; 8642 mToken = restoreSetToken; 8643 mPmToken = pmToken; 8644 mTargetPackage = targetPackage; 8645 mIsSystemRestore = isFullSystemRestore; 8646 mFinished = false; 8647 mDidLaunch = false; 8648 8649 if (targetPackage != null) { 8650 // Single package restore 8651 mAcceptSet = new ArrayList<PackageInfo>(); 8652 mAcceptSet.add(targetPackage); 8653 } else { 8654 // Everything possible, or a target set 8655 if (filterSet == null) { 8656 // We want everything and a pony 8657 List<PackageInfo> apps = 8658 PackageManagerBackupAgent.getStorableApplications(mPackageManager); 8659 filterSet = packagesToNames(apps); 8660 if (DEBUG) { 8661 Slog.i(TAG, "Full restore; asking about " + filterSet.length + " apps"); 8662 } 8663 } 8664 8665 mAcceptSet = new ArrayList<PackageInfo>(filterSet.length); 8666 8667 // Pro tem, we insist on moving the settings provider package to last place. 8668 // Keep track of whether it's in the list, and bump it down if so. We also 8669 // want to do the system package itself first if it's called for. 8670 boolean hasSystem = false; 8671 boolean hasSettings = false; 8672 for (int i = 0; i < filterSet.length; i++) { 8673 try { 8674 PackageInfo info = mPackageManager.getPackageInfo(filterSet[i], 0); 8675 if ("android".equals(info.packageName)) { 8676 hasSystem = true; 8677 continue; 8678 } 8679 if (SETTINGS_PACKAGE.equals(info.packageName)) { 8680 hasSettings = true; 8681 continue; 8682 } 8683 8684 if (appIsEligibleForBackup(info.applicationInfo, mPackageManager)) { 8685 mAcceptSet.add(info); 8686 } 8687 } catch (NameNotFoundException e) { 8688 // requested package name doesn't exist; ignore it 8689 } 8690 } 8691 if (hasSystem) { 8692 try { 8693 mAcceptSet.add(0, mPackageManager.getPackageInfo("android", 0)); 8694 } catch (NameNotFoundException e) { 8695 // won't happen; we know a priori that it's valid 8696 } 8697 } 8698 if (hasSettings) { 8699 try { 8700 mAcceptSet.add(mPackageManager.getPackageInfo(SETTINGS_PACKAGE, 0)); 8701 } catch (NameNotFoundException e) { 8702 // this one is always valid too 8703 } 8704 } 8705 } 8706 8707 if (MORE_DEBUG) { 8708 Slog.v(TAG, "Restore; accept set size is " + mAcceptSet.size()); 8709 for (PackageInfo info : mAcceptSet) { 8710 Slog.v(TAG, " " + info.packageName); 8711 } 8712 } 8713 } 8714 8715 private String[] packagesToNames(List<PackageInfo> apps) { 8716 final int N = apps.size(); 8717 String[] names = new String[N]; 8718 for (int i = 0; i < N; i++) { 8719 names[i] = apps.get(i).packageName; 8720 } 8721 return names; 8722 } 8723 8724 // Execute one tick of whatever state machine the task implements 8725 @Override 8726 public void execute() { 8727 if (MORE_DEBUG) Slog.v(TAG, "*** Executing restore step " + mState); 8728 switch (mState) { 8729 case INITIAL: 8730 startRestore(); 8731 break; 8732 8733 case RUNNING_QUEUE: 8734 dispatchNextRestore(); 8735 break; 8736 8737 case RESTORE_KEYVALUE: 8738 restoreKeyValue(); 8739 break; 8740 8741 case RESTORE_FULL: 8742 restoreFull(); 8743 break; 8744 8745 case RESTORE_FINISHED: 8746 restoreFinished(); 8747 break; 8748 8749 case FINAL: 8750 if (!mFinished) finalizeRestore(); 8751 else { 8752 Slog.e(TAG, "Duplicate finish"); 8753 } 8754 mFinished = true; 8755 break; 8756 } 8757 } 8758 8759 /* 8760 * SKETCH OF OPERATION 8761 * 8762 * create one of these PerformUnifiedRestoreTask objects, telling it which 8763 * dataset & transport to address, and then parameters within the restore 8764 * operation: single target package vs many, etc. 8765 * 8766 * 1. transport.startRestore(token, list-of-packages). If we need @pm@ it is 8767 * always placed first and the settings provider always placed last [for now]. 8768 * 8769 * 1a [if we needed @pm@ then nextRestorePackage() and restore the PMBA inline] 8770 * 8771 * [ state change => RUNNING_QUEUE ] 8772 * 8773 * NOW ITERATE: 8774 * 8775 * { 3. t.nextRestorePackage() 8776 * 4. does the metadata for this package allow us to restore it? 8777 * does the on-disk app permit us to restore it? [re-check allowBackup etc] 8778 * 5. is this a key/value dataset? => key/value agent restore 8779 * [ state change => RESTORE_KEYVALUE ] 8780 * 5a. spin up agent 8781 * 5b. t.getRestoreData() to stage it properly 8782 * 5c. call into agent to perform restore 8783 * 5d. tear down agent 8784 * [ state change => RUNNING_QUEUE ] 8785 * 8786 * 6. else it's a stream dataset: 8787 * [ state change => RESTORE_FULL ] 8788 * 6a. instantiate the engine for a stream restore: engine handles agent lifecycles 8789 * 6b. spin off engine runner on separate thread 8790 * 6c. ITERATE getNextFullRestoreDataChunk() and copy data to engine runner socket 8791 * [ state change => RUNNING_QUEUE ] 8792 * } 8793 * 8794 * [ state change => FINAL ] 8795 * 8796 * 7. t.finishRestore(), release wakelock, etc. 8797 * 8798 * 8799 */ 8800 8801 // state INITIAL : set up for the restore and read the metadata if necessary 8802 private void startRestore() { 8803 sendStartRestore(mAcceptSet.size()); 8804 8805 // If we're starting a full-system restore, set up to begin widget ID remapping 8806 if (mIsSystemRestore) { 8807 // TODO: http://b/22388012 8808 AppWidgetBackupBridge.restoreStarting(UserHandle.USER_SYSTEM); 8809 } 8810 8811 try { 8812 String transportDir = mTransport.transportDirName(); 8813 mStateDir = new File(mBaseStateDir, transportDir); 8814 8815 // Fetch the current metadata from the dataset first 8816 PackageInfo pmPackage = new PackageInfo(); 8817 pmPackage.packageName = PACKAGE_MANAGER_SENTINEL; 8818 mAcceptSet.add(0, pmPackage); 8819 8820 PackageInfo[] packages = mAcceptSet.toArray(new PackageInfo[0]); 8821 mStatus = mTransport.startRestore(mToken, packages); 8822 if (mStatus != BackupTransport.TRANSPORT_OK) { 8823 Slog.e(TAG, "Transport error " + mStatus + "; no restore possible"); 8824 mStatus = BackupTransport.TRANSPORT_ERROR; 8825 executeNextState(UnifiedRestoreState.FINAL); 8826 return; 8827 } 8828 8829 RestoreDescription desc = mTransport.nextRestorePackage(); 8830 if (desc == null) { 8831 Slog.e(TAG, "No restore metadata available; halting"); 8832 mMonitor = monitorEvent(mMonitor, 8833 BackupManagerMonitor.LOG_EVENT_ID_NO_RESTORE_METADATA_AVAILABLE, 8834 mCurrentPackage, 8835 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 8836 mStatus = BackupTransport.TRANSPORT_ERROR; 8837 executeNextState(UnifiedRestoreState.FINAL); 8838 return; 8839 } 8840 if (!PACKAGE_MANAGER_SENTINEL.equals(desc.getPackageName())) { 8841 Slog.e(TAG, "Required package metadata but got " 8842 + desc.getPackageName()); 8843 mMonitor = monitorEvent(mMonitor, 8844 BackupManagerMonitor.LOG_EVENT_ID_NO_PM_METADATA_RECEIVED, 8845 mCurrentPackage, 8846 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 8847 mStatus = BackupTransport.TRANSPORT_ERROR; 8848 executeNextState(UnifiedRestoreState.FINAL); 8849 return; 8850 } 8851 8852 // Pull the Package Manager metadata from the restore set first 8853 mCurrentPackage = new PackageInfo(); 8854 mCurrentPackage.packageName = PACKAGE_MANAGER_SENTINEL; 8855 mPmAgent = makeMetadataAgent(null); 8856 mAgent = IBackupAgent.Stub.asInterface(mPmAgent.onBind()); 8857 if (MORE_DEBUG) { 8858 Slog.v(TAG, "initiating restore for PMBA"); 8859 } 8860 initiateOneRestore(mCurrentPackage, 0); 8861 // The PM agent called operationComplete() already, because our invocation 8862 // of it is process-local and therefore synchronous. That means that the 8863 // next-state message (RUNNING_QUEUE) is already enqueued. Only if we're 8864 // unable to proceed with running the queue do we remove that pending 8865 // message and jump straight to the FINAL state. Because this was 8866 // synchronous we also know that we should cancel the pending timeout 8867 // message. 8868 mBackupHandler.removeMessages(MSG_RESTORE_OPERATION_TIMEOUT); 8869 8870 // Verify that the backup set includes metadata. If not, we can't do 8871 // signature/version verification etc, so we simply do not proceed with 8872 // the restore operation. 8873 if (!mPmAgent.hasMetadata()) { 8874 Slog.e(TAG, "PM agent has no metadata, so not restoring"); 8875 mMonitor = monitorEvent(mMonitor, 8876 BackupManagerMonitor.LOG_EVENT_ID_PM_AGENT_HAS_NO_METADATA, 8877 mCurrentPackage, 8878 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 8879 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 8880 PACKAGE_MANAGER_SENTINEL, 8881 "Package manager restore metadata missing"); 8882 mStatus = BackupTransport.TRANSPORT_ERROR; 8883 mBackupHandler.removeMessages(MSG_BACKUP_RESTORE_STEP, this); 8884 executeNextState(UnifiedRestoreState.FINAL); 8885 return; 8886 } 8887 8888 // Success; cache the metadata and continue as expected with the 8889 // next state already enqueued 8890 8891 } catch (Exception e) { 8892 // If we lost the transport at any time, halt 8893 Slog.e(TAG, "Unable to contact transport for restore: " + e.getMessage()); 8894 mMonitor = monitorEvent(mMonitor, 8895 BackupManagerMonitor.LOG_EVENT_ID_LOST_TRANSPORT, 8896 null, 8897 BackupManagerMonitor.LOG_EVENT_CATEGORY_TRANSPORT, null); 8898 mStatus = BackupTransport.TRANSPORT_ERROR; 8899 mBackupHandler.removeMessages(MSG_BACKUP_RESTORE_STEP, this); 8900 executeNextState(UnifiedRestoreState.FINAL); 8901 return; 8902 } 8903 } 8904 8905 // state RUNNING_QUEUE : figure out what the next thing to be restored is, 8906 // and fire the appropriate next step 8907 private void dispatchNextRestore() { 8908 UnifiedRestoreState nextState = UnifiedRestoreState.FINAL; 8909 try { 8910 mRestoreDescription = mTransport.nextRestorePackage(); 8911 final String pkgName = (mRestoreDescription != null) 8912 ? mRestoreDescription.getPackageName() : null; 8913 if (pkgName == null) { 8914 Slog.e(TAG, "Failure getting next package name"); 8915 EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 8916 nextState = UnifiedRestoreState.FINAL; 8917 return; 8918 } else if (mRestoreDescription == RestoreDescription.NO_MORE_PACKAGES) { 8919 // Yay we've reached the end cleanly 8920 if (DEBUG) { 8921 Slog.v(TAG, "No more packages; finishing restore"); 8922 } 8923 int millis = (int) (SystemClock.elapsedRealtime() - mStartRealtime); 8924 EventLog.writeEvent(EventLogTags.RESTORE_SUCCESS, mCount, millis); 8925 nextState = UnifiedRestoreState.FINAL; 8926 return; 8927 } 8928 8929 if (DEBUG) { 8930 Slog.i(TAG, "Next restore package: " + mRestoreDescription); 8931 } 8932 sendOnRestorePackage(pkgName); 8933 8934 Metadata metaInfo = mPmAgent.getRestoredMetadata(pkgName); 8935 if (metaInfo == null) { 8936 Slog.e(TAG, "No metadata for " + pkgName); 8937 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, pkgName, 8938 "Package metadata missing"); 8939 nextState = UnifiedRestoreState.RUNNING_QUEUE; 8940 return; 8941 } 8942 8943 try { 8944 mCurrentPackage = mPackageManager.getPackageInfo( 8945 pkgName, PackageManager.GET_SIGNATURES); 8946 } catch (NameNotFoundException e) { 8947 // Whoops, we thought we could restore this package but it 8948 // turns out not to be present. Skip it. 8949 Slog.e(TAG, "Package not present: " + pkgName); 8950 mMonitor = monitorEvent(mMonitor, 8951 BackupManagerMonitor.LOG_EVENT_ID_PACKAGE_NOT_PRESENT, 8952 mCurrentPackage, 8953 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 8954 null); 8955 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, pkgName, 8956 "Package missing on device"); 8957 nextState = UnifiedRestoreState.RUNNING_QUEUE; 8958 return; 8959 } 8960 8961 if (metaInfo.versionCode > mCurrentPackage.versionCode) { 8962 // Data is from a "newer" version of the app than we have currently 8963 // installed. If the app has not declared that it is prepared to 8964 // handle this case, we do not attempt the restore. 8965 if ((mCurrentPackage.applicationInfo.flags 8966 & ApplicationInfo.FLAG_RESTORE_ANY_VERSION) == 0) { 8967 String message = "Source version " + metaInfo.versionCode 8968 + " > installed version " + mCurrentPackage.versionCode; 8969 Slog.w(TAG, "Package " + pkgName + ": " + message); 8970 Bundle monitoringExtras = putMonitoringExtra(null, 8971 BackupManagerMonitor.EXTRA_LOG_RESTORE_VERSION, 8972 metaInfo.versionCode); 8973 monitoringExtras = putMonitoringExtra(monitoringExtras, 8974 BackupManagerMonitor.EXTRA_LOG_RESTORE_ANYWAY, false); 8975 mMonitor = monitorEvent(mMonitor, 8976 BackupManagerMonitor.LOG_EVENT_ID_RESTORE_VERSION_HIGHER, 8977 mCurrentPackage, 8978 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 8979 monitoringExtras); 8980 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 8981 pkgName, message); 8982 nextState = UnifiedRestoreState.RUNNING_QUEUE; 8983 return; 8984 } else { 8985 if (DEBUG) Slog.v(TAG, "Source version " + metaInfo.versionCode 8986 + " > installed version " + mCurrentPackage.versionCode 8987 + " but restoreAnyVersion"); 8988 Bundle monitoringExtras = putMonitoringExtra(null, 8989 BackupManagerMonitor.EXTRA_LOG_RESTORE_VERSION, 8990 metaInfo.versionCode); 8991 monitoringExtras = putMonitoringExtra(monitoringExtras, 8992 BackupManagerMonitor.EXTRA_LOG_RESTORE_ANYWAY, true); 8993 mMonitor = monitorEvent(mMonitor, 8994 BackupManagerMonitor.LOG_EVENT_ID_RESTORE_VERSION_HIGHER, 8995 mCurrentPackage, 8996 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, 8997 monitoringExtras); 8998 } 8999 } 9000 9001 if (MORE_DEBUG) Slog.v(TAG, "Package " + pkgName 9002 + " restore version [" + metaInfo.versionCode 9003 + "] is compatible with installed version [" 9004 + mCurrentPackage.versionCode + "]"); 9005 9006 // Reset per-package preconditions and fire the appropriate next state 9007 mWidgetData = null; 9008 final int type = mRestoreDescription.getDataType(); 9009 if (type == RestoreDescription.TYPE_KEY_VALUE) { 9010 nextState = UnifiedRestoreState.RESTORE_KEYVALUE; 9011 } else if (type == RestoreDescription.TYPE_FULL_STREAM) { 9012 nextState = UnifiedRestoreState.RESTORE_FULL; 9013 } else { 9014 // Unknown restore type; ignore this package and move on 9015 Slog.e(TAG, "Unrecognized restore type " + type); 9016 nextState = UnifiedRestoreState.RUNNING_QUEUE; 9017 return; 9018 } 9019 } catch (Exception e) { 9020 Slog.e(TAG, "Can't get next restore target from transport; halting: " 9021 + e.getMessage()); 9022 EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 9023 nextState = UnifiedRestoreState.FINAL; 9024 return; 9025 } finally { 9026 executeNextState(nextState); 9027 } 9028 } 9029 9030 // state RESTORE_KEYVALUE : restore one package via key/value API set 9031 private void restoreKeyValue() { 9032 // Initiating the restore will pass responsibility for the state machine's 9033 // progress to the agent callback, so we do not always execute the 9034 // next state here. 9035 final String packageName = mCurrentPackage.packageName; 9036 // Validate some semantic requirements that apply in this way 9037 // only to the key/value restore API flow 9038 if (mCurrentPackage.applicationInfo.backupAgentName == null 9039 || "".equals(mCurrentPackage.applicationInfo.backupAgentName)) { 9040 if (MORE_DEBUG) { 9041 Slog.i(TAG, "Data exists for package " + packageName 9042 + " but app has no agent; skipping"); 9043 } 9044 mMonitor = monitorEvent(mMonitor, 9045 BackupManagerMonitor.LOG_EVENT_ID_APP_HAS_NO_AGENT, mCurrentPackage, 9046 BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT, null); 9047 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, packageName, 9048 "Package has no agent"); 9049 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9050 return; 9051 } 9052 9053 Metadata metaInfo = mPmAgent.getRestoredMetadata(packageName); 9054 if (!BackupUtils.signaturesMatch(metaInfo.sigHashes, mCurrentPackage)) { 9055 Slog.w(TAG, "Signature mismatch restoring " + packageName); 9056 mMonitor = monitorEvent(mMonitor, 9057 BackupManagerMonitor.LOG_EVENT_ID_SIGNATURE_MISMATCH, mCurrentPackage, 9058 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 9059 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, packageName, 9060 "Signature mismatch"); 9061 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9062 return; 9063 } 9064 9065 // Good to go! Set up and bind the agent... 9066 mAgent = bindToAgentSynchronous( 9067 mCurrentPackage.applicationInfo, 9068 ApplicationThreadConstants.BACKUP_MODE_INCREMENTAL); 9069 if (mAgent == null) { 9070 Slog.w(TAG, "Can't find backup agent for " + packageName); 9071 mMonitor = monitorEvent(mMonitor, 9072 BackupManagerMonitor.LOG_EVENT_ID_CANT_FIND_AGENT, mCurrentPackage, 9073 BackupManagerMonitor.LOG_EVENT_CATEGORY_BACKUP_MANAGER_POLICY, null); 9074 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, packageName, 9075 "Restore agent missing"); 9076 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9077 return; 9078 } 9079 9080 // Whatever happens next, we've launched the target app now; remember that. 9081 mDidLaunch = true; 9082 9083 // And then finally start the restore on this agent 9084 try { 9085 initiateOneRestore(mCurrentPackage, metaInfo.versionCode); 9086 ++mCount; 9087 } catch (Exception e) { 9088 Slog.e(TAG, "Error when attempting restore: " + e.toString()); 9089 keyValueAgentErrorCleanup(); 9090 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9091 } 9092 } 9093 9094 // Guts of a key/value restore operation 9095 void initiateOneRestore(PackageInfo app, int appVersionCode) { 9096 final String packageName = app.packageName; 9097 9098 if (DEBUG) Slog.d(TAG, "initiateOneRestore packageName=" + packageName); 9099 9100 // !!! TODO: get the dirs from the transport 9101 mBackupDataName = new File(mDataDir, packageName + ".restore"); 9102 mStageName = new File(mDataDir, packageName + ".stage"); 9103 mNewStateName = new File(mStateDir, packageName + ".new"); 9104 mSavedStateName = new File(mStateDir, packageName); 9105 9106 // don't stage the 'android' package where the wallpaper data lives. this is 9107 // an optimization: we know there's no widget data hosted/published by that 9108 // package, and this way we avoid doing a spurious copy of MB-sized wallpaper 9109 // data following the download. 9110 boolean staging = !packageName.equals("android"); 9111 ParcelFileDescriptor stage; 9112 File downloadFile = (staging) ? mStageName : mBackupDataName; 9113 9114 try { 9115 // Run the transport's restore pass 9116 stage = ParcelFileDescriptor.open(downloadFile, 9117 ParcelFileDescriptor.MODE_READ_WRITE | 9118 ParcelFileDescriptor.MODE_CREATE | 9119 ParcelFileDescriptor.MODE_TRUNCATE); 9120 9121 if (mTransport.getRestoreData(stage) != BackupTransport.TRANSPORT_OK) { 9122 // Transport-level failure, so we wind everything up and 9123 // terminate the restore operation. 9124 Slog.e(TAG, "Error getting restore data for " + packageName); 9125 EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 9126 stage.close(); 9127 downloadFile.delete(); 9128 executeNextState(UnifiedRestoreState.FINAL); 9129 return; 9130 } 9131 9132 // We have the data from the transport. Now we extract and strip 9133 // any per-package metadata (typically widget-related information) 9134 // if appropriate 9135 if (staging) { 9136 stage.close(); 9137 stage = ParcelFileDescriptor.open(downloadFile, 9138 ParcelFileDescriptor.MODE_READ_ONLY); 9139 9140 mBackupData = ParcelFileDescriptor.open(mBackupDataName, 9141 ParcelFileDescriptor.MODE_READ_WRITE | 9142 ParcelFileDescriptor.MODE_CREATE | 9143 ParcelFileDescriptor.MODE_TRUNCATE); 9144 9145 BackupDataInput in = new BackupDataInput(stage.getFileDescriptor()); 9146 BackupDataOutput out = new BackupDataOutput(mBackupData.getFileDescriptor()); 9147 byte[] buffer = new byte[8192]; // will grow when needed 9148 while (in.readNextHeader()) { 9149 final String key = in.getKey(); 9150 final int size = in.getDataSize(); 9151 9152 // is this a special key? 9153 if (key.equals(KEY_WIDGET_STATE)) { 9154 if (DEBUG) { 9155 Slog.i(TAG, "Restoring widget state for " + packageName); 9156 } 9157 mWidgetData = new byte[size]; 9158 in.readEntityData(mWidgetData, 0, size); 9159 } else { 9160 if (size > buffer.length) { 9161 buffer = new byte[size]; 9162 } 9163 in.readEntityData(buffer, 0, size); 9164 out.writeEntityHeader(key, size); 9165 out.writeEntityData(buffer, size); 9166 } 9167 } 9168 9169 mBackupData.close(); 9170 } 9171 9172 // Okay, we have the data. Now have the agent do the restore. 9173 stage.close(); 9174 9175 mBackupData = ParcelFileDescriptor.open(mBackupDataName, 9176 ParcelFileDescriptor.MODE_READ_ONLY); 9177 9178 mNewState = ParcelFileDescriptor.open(mNewStateName, 9179 ParcelFileDescriptor.MODE_READ_WRITE | 9180 ParcelFileDescriptor.MODE_CREATE | 9181 ParcelFileDescriptor.MODE_TRUNCATE); 9182 9183 // Kick off the restore, checking for hung agents. The timeout or 9184 // the operationComplete() callback will schedule the next step, 9185 // so we do not do that here. 9186 prepareOperationTimeout(mEphemeralOpToken, TIMEOUT_RESTORE_INTERVAL, 9187 this, OP_TYPE_RESTORE_WAIT); 9188 mAgent.doRestore(mBackupData, appVersionCode, mNewState, 9189 mEphemeralOpToken, mBackupManagerBinder); 9190 } catch (Exception e) { 9191 Slog.e(TAG, "Unable to call app for restore: " + packageName, e); 9192 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 9193 packageName, e.toString()); 9194 keyValueAgentErrorCleanup(); // clears any pending timeout messages as well 9195 9196 // After a restore failure we go back to running the queue. If there 9197 // are no more packages to be restored that will be handled by the 9198 // next step. 9199 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9200 } 9201 } 9202 9203 // state RESTORE_FULL : restore one package via streaming engine 9204 private void restoreFull() { 9205 // None of this can run on the work looper here, so we spin asynchronous 9206 // work like this: 9207 // 9208 // StreamFeederThread: read data from mTransport.getNextFullRestoreDataChunk() 9209 // write it into the pipe to the engine 9210 // EngineThread: FullRestoreEngine thread communicating with the target app 9211 // 9212 // When finished, StreamFeederThread executes next state as appropriate on the 9213 // backup looper, and the overall unified restore task resumes 9214 try { 9215 StreamFeederThread feeder = new StreamFeederThread(); 9216 if (MORE_DEBUG) { 9217 Slog.i(TAG, "Spinning threads for stream restore of " 9218 + mCurrentPackage.packageName); 9219 } 9220 new Thread(feeder, "unified-stream-feeder").start(); 9221 9222 // At this point the feeder is responsible for advancing the restore 9223 // state, so we're done here. 9224 } catch (IOException e) { 9225 // Unable to instantiate the feeder thread -- we need to bail on the 9226 // current target. We haven't asked the transport for data yet, though, 9227 // so we can do that simply by going back to running the restore queue. 9228 Slog.e(TAG, "Unable to construct pipes for stream restore!"); 9229 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9230 } 9231 } 9232 9233 // state RESTORE_FINISHED : provide the "no more data" signpost callback at the end 9234 private void restoreFinished() { 9235 if (DEBUG) { 9236 Slog.d(TAG, "restoreFinished packageName=" + mCurrentPackage.packageName); 9237 } 9238 try { 9239 prepareOperationTimeout(mEphemeralOpToken, TIMEOUT_RESTORE_FINISHED_INTERVAL, this, 9240 OP_TYPE_RESTORE_WAIT); 9241 mAgent.doRestoreFinished(mEphemeralOpToken, mBackupManagerBinder); 9242 // If we get this far, the callback or timeout will schedule the 9243 // next restore state, so we're done 9244 } catch (Exception e) { 9245 final String packageName = mCurrentPackage.packageName; 9246 Slog.e(TAG, "Unable to finalize restore of " + packageName); 9247 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 9248 packageName, e.toString()); 9249 keyValueAgentErrorCleanup(); 9250 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9251 } 9252 } 9253 9254 class StreamFeederThread extends RestoreEngine implements Runnable, BackupRestoreTask { 9255 final String TAG = "StreamFeederThread"; 9256 FullRestoreEngine mEngine; 9257 EngineThread mEngineThread; 9258 9259 // pipe through which we read data from the transport. [0] read, [1] write 9260 ParcelFileDescriptor[] mTransportPipes; 9261 9262 // pipe through which the engine will read data. [0] read, [1] write 9263 ParcelFileDescriptor[] mEnginePipes; 9264 9265 private final int mEphemeralOpToken; 9266 9267 public StreamFeederThread() throws IOException { 9268 mEphemeralOpToken = generateRandomIntegerToken(); 9269 mTransportPipes = ParcelFileDescriptor.createPipe(); 9270 mEnginePipes = ParcelFileDescriptor.createPipe(); 9271 setRunning(true); 9272 } 9273 9274 @Override 9275 public void run() { 9276 UnifiedRestoreState nextState = UnifiedRestoreState.RUNNING_QUEUE; 9277 int status = BackupTransport.TRANSPORT_OK; 9278 9279 EventLog.writeEvent(EventLogTags.FULL_RESTORE_PACKAGE, 9280 mCurrentPackage.packageName); 9281 9282 mEngine = new FullRestoreEngine(this, null, mMonitor, mCurrentPackage, false, false, mEphemeralOpToken); 9283 mEngineThread = new EngineThread(mEngine, mEnginePipes[0]); 9284 9285 ParcelFileDescriptor eWriteEnd = mEnginePipes[1]; 9286 ParcelFileDescriptor tReadEnd = mTransportPipes[0]; 9287 ParcelFileDescriptor tWriteEnd = mTransportPipes[1]; 9288 9289 int bufferSize = 32 * 1024; 9290 byte[] buffer = new byte[bufferSize]; 9291 FileOutputStream engineOut = new FileOutputStream(eWriteEnd.getFileDescriptor()); 9292 FileInputStream transportIn = new FileInputStream(tReadEnd.getFileDescriptor()); 9293 9294 // spin up the engine and start moving data to it 9295 new Thread(mEngineThread, "unified-restore-engine").start(); 9296 9297 try { 9298 while (status == BackupTransport.TRANSPORT_OK) { 9299 // have the transport write some of the restoring data to us 9300 int result = mTransport.getNextFullRestoreDataChunk(tWriteEnd); 9301 if (result > 0) { 9302 // The transport wrote this many bytes of restore data to the 9303 // pipe, so pass it along to the engine. 9304 if (MORE_DEBUG) { 9305 Slog.v(TAG, " <- transport provided chunk size " + result); 9306 } 9307 if (result > bufferSize) { 9308 bufferSize = result; 9309 buffer = new byte[bufferSize]; 9310 } 9311 int toCopy = result; 9312 while (toCopy > 0) { 9313 int n = transportIn.read(buffer, 0, toCopy); 9314 engineOut.write(buffer, 0, n); 9315 toCopy -= n; 9316 if (MORE_DEBUG) { 9317 Slog.v(TAG, " -> wrote " + n + " to engine, left=" + toCopy); 9318 } 9319 } 9320 } else if (result == BackupTransport.NO_MORE_DATA) { 9321 // Clean finish. Wind up and we're done! 9322 if (MORE_DEBUG) { 9323 Slog.i(TAG, "Got clean full-restore EOF for " 9324 + mCurrentPackage.packageName); 9325 } 9326 status = BackupTransport.TRANSPORT_OK; 9327 break; 9328 } else { 9329 // Transport reported some sort of failure; the fall-through 9330 // handling will deal properly with that. 9331 Slog.e(TAG, "Error " + result + " streaming restore for " 9332 + mCurrentPackage.packageName); 9333 EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 9334 status = result; 9335 } 9336 } 9337 if (MORE_DEBUG) Slog.v(TAG, "Done copying to engine, falling through"); 9338 } catch (IOException e) { 9339 // We lost our ability to communicate via the pipes. That's worrying 9340 // but potentially recoverable; abandon this package's restore but 9341 // carry on with the next restore target. 9342 Slog.e(TAG, "Unable to route data for restore"); 9343 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 9344 mCurrentPackage.packageName, "I/O error on pipes"); 9345 status = BackupTransport.AGENT_ERROR; 9346 } catch (Exception e) { 9347 // The transport threw; terminate the whole operation. Closing 9348 // the sockets will wake up the engine and it will then tidy up the 9349 // remote end. 9350 Slog.e(TAG, "Transport failed during restore: " + e.getMessage()); 9351 EventLog.writeEvent(EventLogTags.RESTORE_TRANSPORT_FAILURE); 9352 status = BackupTransport.TRANSPORT_ERROR; 9353 } finally { 9354 // Close the transport pipes and *our* end of the engine pipe, 9355 // but leave the engine thread's end open so that it properly 9356 // hits EOF and winds up its operations. 9357 IoUtils.closeQuietly(mEnginePipes[1]); 9358 IoUtils.closeQuietly(mTransportPipes[0]); 9359 IoUtils.closeQuietly(mTransportPipes[1]); 9360 9361 // Don't proceed until the engine has wound up operations 9362 mEngineThread.waitForResult(); 9363 9364 // Now we're really done with this one too 9365 IoUtils.closeQuietly(mEnginePipes[0]); 9366 9367 // In all cases we want to remember whether we launched 9368 // the target app as part of our work so far. 9369 mDidLaunch = (mEngine.getAgent() != null); 9370 9371 // If we hit a transport-level error, we are done with everything; 9372 // if we hit an agent error we just go back to running the queue. 9373 if (status == BackupTransport.TRANSPORT_OK) { 9374 // Clean finish means we issue the restore-finished callback 9375 nextState = UnifiedRestoreState.RESTORE_FINISHED; 9376 9377 // the engine bound the target's agent, so recover that binding 9378 // to use for the callback. 9379 mAgent = mEngine.getAgent(); 9380 9381 // and the restored widget data, if any 9382 mWidgetData = mEngine.getWidgetData(); 9383 } else { 9384 // Something went wrong somewhere. Whether it was at the transport 9385 // level is immaterial; we need to tell the transport to bail 9386 try { 9387 mTransport.abortFullRestore(); 9388 } catch (Exception e) { 9389 // transport itself is dead; make sure we handle this as a 9390 // fatal error 9391 Slog.e(TAG, "Transport threw from abortFullRestore: " + e.getMessage()); 9392 status = BackupTransport.TRANSPORT_ERROR; 9393 } 9394 9395 // We also need to wipe the current target's data, as it's probably 9396 // in an incoherent state. 9397 clearApplicationDataSynchronous(mCurrentPackage.packageName); 9398 9399 // Schedule the next state based on the nature of our failure 9400 if (status == BackupTransport.TRANSPORT_ERROR) { 9401 nextState = UnifiedRestoreState.FINAL; 9402 } else { 9403 nextState = UnifiedRestoreState.RUNNING_QUEUE; 9404 } 9405 } 9406 executeNextState(nextState); 9407 setRunning(false); 9408 } 9409 } 9410 9411 // BackupRestoreTask interface, specifically for timeout handling 9412 9413 @Override 9414 public void execute() { /* intentionally empty */ } 9415 9416 @Override 9417 public void operationComplete(long result) { /* intentionally empty */ } 9418 9419 // The app has timed out handling a restoring file 9420 @Override 9421 public void handleCancel(boolean cancelAll) { 9422 removeOperation(mEphemeralOpToken); 9423 if (DEBUG) { 9424 Slog.w(TAG, "Full-data restore target timed out; shutting down"); 9425 } 9426 9427 mMonitor = monitorEvent(mMonitor, 9428 BackupManagerMonitor.LOG_EVENT_ID_FULL_RESTORE_TIMEOUT, 9429 mCurrentPackage, BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT, null); 9430 mEngineThread.handleTimeout(); 9431 9432 IoUtils.closeQuietly(mEnginePipes[1]); 9433 mEnginePipes[1] = null; 9434 IoUtils.closeQuietly(mEnginePipes[0]); 9435 mEnginePipes[0] = null; 9436 } 9437 } 9438 9439 class EngineThread implements Runnable { 9440 FullRestoreEngine mEngine; 9441 FileInputStream mEngineStream; 9442 9443 EngineThread(FullRestoreEngine engine, ParcelFileDescriptor engineSocket) { 9444 mEngine = engine; 9445 engine.setRunning(true); 9446 // We *do* want this FileInputStream to own the underlying fd, so that 9447 // when we are finished with it, it closes this end of the pipe in a way 9448 // that signals its other end. 9449 mEngineStream = new FileInputStream(engineSocket.getFileDescriptor(), true); 9450 } 9451 9452 public boolean isRunning() { 9453 return mEngine.isRunning(); 9454 } 9455 9456 public int waitForResult() { 9457 return mEngine.waitForResult(); 9458 } 9459 9460 @Override 9461 public void run() { 9462 try { 9463 while (mEngine.isRunning()) { 9464 // Tell it to be sure to leave the agent instance up after finishing 9465 mEngine.restoreOneFile(mEngineStream, false); 9466 } 9467 } finally { 9468 // Because mEngineStream adopted its underlying FD, this also 9469 // closes this end of the pipe. 9470 IoUtils.closeQuietly(mEngineStream); 9471 } 9472 } 9473 9474 public void handleTimeout() { 9475 IoUtils.closeQuietly(mEngineStream); 9476 mEngine.handleTimeout(); 9477 } 9478 } 9479 9480 // state FINAL : tear everything down and we're done. 9481 private void finalizeRestore() { 9482 if (MORE_DEBUG) Slog.d(TAG, "finishing restore mObserver=" + mObserver); 9483 9484 try { 9485 mTransport.finishRestore(); 9486 } catch (Exception e) { 9487 Slog.e(TAG, "Error finishing restore", e); 9488 } 9489 9490 // Tell the observer we're done 9491 if (mObserver != null) { 9492 try { 9493 mObserver.restoreFinished(mStatus); 9494 } catch (RemoteException e) { 9495 Slog.d(TAG, "Restore observer died at restoreFinished"); 9496 } 9497 } 9498 9499 // Clear any ongoing session timeout. 9500 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 9501 9502 // If we have a PM token, we must under all circumstances be sure to 9503 // handshake when we've finished. 9504 if (mPmToken > 0) { 9505 if (MORE_DEBUG) Slog.v(TAG, "finishing PM token " + mPmToken); 9506 try { 9507 mPackageManagerBinder.finishPackageInstall(mPmToken, mDidLaunch); 9508 } catch (RemoteException e) { /* can't happen */ } 9509 } else { 9510 // We were invoked via an active restore session, not by the Package 9511 // Manager, so start up the session timeout again. 9512 mBackupHandler.sendEmptyMessageDelayed(MSG_RESTORE_SESSION_TIMEOUT, 9513 TIMEOUT_RESTORE_INTERVAL); 9514 } 9515 9516 // Kick off any work that may be needed regarding app widget restores 9517 // TODO: http://b/22388012 9518 AppWidgetBackupBridge.restoreFinished(UserHandle.USER_SYSTEM); 9519 9520 // If this was a full-system restore, record the ancestral 9521 // dataset information 9522 if (mIsSystemRestore && mPmAgent != null) { 9523 mAncestralPackages = mPmAgent.getRestoredPackages(); 9524 mAncestralToken = mToken; 9525 writeRestoreTokens(); 9526 } 9527 9528 // done; we can finally release the wakelock and be legitimately done. 9529 Slog.i(TAG, "Restore complete."); 9530 9531 synchronized (mPendingRestores) { 9532 if (mPendingRestores.size() > 0) { 9533 if (DEBUG) { 9534 Slog.d(TAG, "Starting next pending restore."); 9535 } 9536 PerformUnifiedRestoreTask task = mPendingRestores.remove(); 9537 mBackupHandler.sendMessage( 9538 mBackupHandler.obtainMessage(MSG_BACKUP_RESTORE_STEP, task)); 9539 9540 } else { 9541 mIsRestoreInProgress = false; 9542 if (MORE_DEBUG) { 9543 Slog.d(TAG, "No pending restores."); 9544 } 9545 } 9546 } 9547 9548 mWakelock.release(); 9549 } 9550 9551 void keyValueAgentErrorCleanup() { 9552 // If the agent fails restore, it might have put the app's data 9553 // into an incoherent state. For consistency we wipe its data 9554 // again in this case before continuing with normal teardown 9555 clearApplicationDataSynchronous(mCurrentPackage.packageName); 9556 keyValueAgentCleanup(); 9557 } 9558 9559 // TODO: clean up naming; this is now used at finish by both k/v and stream restores 9560 void keyValueAgentCleanup() { 9561 mBackupDataName.delete(); 9562 mStageName.delete(); 9563 try { if (mBackupData != null) mBackupData.close(); } catch (IOException e) {} 9564 try { if (mNewState != null) mNewState.close(); } catch (IOException e) {} 9565 mBackupData = mNewState = null; 9566 9567 // if everything went okay, remember the recorded state now 9568 // 9569 // !!! TODO: the restored data could be migrated on the server 9570 // side into the current dataset. In that case the new state file 9571 // we just created would reflect the data already extant in the 9572 // backend, so there'd be nothing more to do. Until that happens, 9573 // however, we need to make sure that we record the data to the 9574 // current backend dataset. (Yes, this means shipping the data over 9575 // the wire in both directions. That's bad, but consistency comes 9576 // first, then efficiency.) Once we introduce server-side data 9577 // migration to the newly-restored device's dataset, we will change 9578 // the following from a discard of the newly-written state to the 9579 // "correct" operation of renaming into the canonical state blob. 9580 mNewStateName.delete(); // TODO: remove; see above comment 9581 //mNewStateName.renameTo(mSavedStateName); // TODO: replace with this 9582 9583 // If this wasn't the PM pseudopackage, tear down the agent side 9584 if (mCurrentPackage.applicationInfo != null) { 9585 // unbind and tidy up even on timeout or failure 9586 try { 9587 mActivityManager.unbindBackupAgent(mCurrentPackage.applicationInfo); 9588 9589 // The agent was probably running with a stub Application object, 9590 // which isn't a valid run mode for the main app logic. Shut 9591 // down the app so that next time it's launched, it gets the 9592 // usual full initialization. Note that this is only done for 9593 // full-system restores: when a single app has requested a restore, 9594 // it is explicitly not killed following that operation. 9595 // 9596 // We execute this kill when these conditions hold: 9597 // 1. it's not a system-uid process, 9598 // 2. the app did not request its own restore (mTargetPackage == null), and either 9599 // 3a. the app is a full-data target (TYPE_FULL_STREAM) or 9600 // b. the app does not state android:killAfterRestore="false" in its manifest 9601 final int appFlags = mCurrentPackage.applicationInfo.flags; 9602 final boolean killAfterRestore = 9603 (mCurrentPackage.applicationInfo.uid >= Process.FIRST_APPLICATION_UID) 9604 && ((mRestoreDescription.getDataType() == RestoreDescription.TYPE_FULL_STREAM) 9605 || ((appFlags & ApplicationInfo.FLAG_KILL_AFTER_RESTORE) != 0)); 9606 9607 if (mTargetPackage == null && killAfterRestore) { 9608 if (DEBUG) Slog.d(TAG, "Restore complete, killing host process of " 9609 + mCurrentPackage.applicationInfo.processName); 9610 mActivityManager.killApplicationProcess( 9611 mCurrentPackage.applicationInfo.processName, 9612 mCurrentPackage.applicationInfo.uid); 9613 } 9614 } catch (RemoteException e) { 9615 // can't happen; we run in the same process as the activity manager 9616 } 9617 } 9618 9619 // The caller is responsible for reestablishing the state machine; our 9620 // responsibility here is to clear the decks for whatever comes next. 9621 mBackupHandler.removeMessages(MSG_RESTORE_OPERATION_TIMEOUT, this); 9622 } 9623 9624 @Override 9625 public void operationComplete(long unusedResult) { 9626 removeOperation(mEphemeralOpToken); 9627 if (MORE_DEBUG) { 9628 Slog.i(TAG, "operationComplete() during restore: target=" 9629 + mCurrentPackage.packageName 9630 + " state=" + mState); 9631 } 9632 9633 final UnifiedRestoreState nextState; 9634 switch (mState) { 9635 case INITIAL: 9636 // We've just (manually) restored the PMBA. It doesn't need the 9637 // additional restore-finished callback so we bypass that and go 9638 // directly to running the queue. 9639 nextState = UnifiedRestoreState.RUNNING_QUEUE; 9640 break; 9641 9642 case RESTORE_KEYVALUE: 9643 case RESTORE_FULL: { 9644 // Okay, we've just heard back from the agent that it's done with 9645 // the restore itself. We now have to send the same agent its 9646 // doRestoreFinished() callback, so roll into that state. 9647 nextState = UnifiedRestoreState.RESTORE_FINISHED; 9648 break; 9649 } 9650 9651 case RESTORE_FINISHED: { 9652 // Okay, we're done with this package. Tidy up and go on to the next 9653 // app in the queue. 9654 int size = (int) mBackupDataName.length(); 9655 EventLog.writeEvent(EventLogTags.RESTORE_PACKAGE, 9656 mCurrentPackage.packageName, size); 9657 9658 // Just go back to running the restore queue 9659 keyValueAgentCleanup(); 9660 9661 // If there was widget state associated with this app, get the OS to 9662 // incorporate it into current bookeeping and then pass that along to 9663 // the app as part of the restore-time work. 9664 if (mWidgetData != null) { 9665 restoreWidgetData(mCurrentPackage.packageName, mWidgetData); 9666 } 9667 9668 nextState = UnifiedRestoreState.RUNNING_QUEUE; 9669 break; 9670 } 9671 9672 default: { 9673 // Some kind of horrible semantic error; we're in an unexpected state. 9674 // Back off hard and wind up. 9675 Slog.e(TAG, "Unexpected restore callback into state " + mState); 9676 keyValueAgentErrorCleanup(); 9677 nextState = UnifiedRestoreState.FINAL; 9678 break; 9679 } 9680 } 9681 9682 executeNextState(nextState); 9683 } 9684 9685 // A call to agent.doRestore() or agent.doRestoreFinished() has timed out 9686 @Override 9687 public void handleCancel(boolean cancelAll) { 9688 removeOperation(mEphemeralOpToken); 9689 Slog.e(TAG, "Timeout restoring application " + mCurrentPackage.packageName); 9690 mMonitor = monitorEvent(mMonitor, 9691 BackupManagerMonitor.LOG_EVENT_ID_KEY_VALUE_RESTORE_TIMEOUT, 9692 mCurrentPackage, BackupManagerMonitor.LOG_EVENT_CATEGORY_AGENT, null); 9693 EventLog.writeEvent(EventLogTags.RESTORE_AGENT_FAILURE, 9694 mCurrentPackage.packageName, "restore timeout"); 9695 // Handle like an agent that threw on invocation: wipe it and go on to the next 9696 keyValueAgentErrorCleanup(); 9697 executeNextState(UnifiedRestoreState.RUNNING_QUEUE); 9698 } 9699 9700 void executeNextState(UnifiedRestoreState nextState) { 9701 if (MORE_DEBUG) Slog.i(TAG, " => executing next step on " 9702 + this + " nextState=" + nextState); 9703 mState = nextState; 9704 Message msg = mBackupHandler.obtainMessage(MSG_BACKUP_RESTORE_STEP, this); 9705 mBackupHandler.sendMessage(msg); 9706 } 9707 9708 // restore observer support 9709 void sendStartRestore(int numPackages) { 9710 if (mObserver != null) { 9711 try { 9712 mObserver.restoreStarting(numPackages); 9713 } catch (RemoteException e) { 9714 Slog.w(TAG, "Restore observer went away: startRestore"); 9715 mObserver = null; 9716 } 9717 } 9718 } 9719 9720 void sendOnRestorePackage(String name) { 9721 if (mObserver != null) { 9722 if (mObserver != null) { 9723 try { 9724 mObserver.onUpdate(mCount, name); 9725 } catch (RemoteException e) { 9726 Slog.d(TAG, "Restore observer died in onUpdate"); 9727 mObserver = null; 9728 } 9729 } 9730 } 9731 } 9732 9733 void sendEndRestore() { 9734 if (mObserver != null) { 9735 try { 9736 mObserver.restoreFinished(mStatus); 9737 } catch (RemoteException e) { 9738 Slog.w(TAG, "Restore observer went away: endRestore"); 9739 mObserver = null; 9740 } 9741 } 9742 } 9743 } 9744 9745 class PerformClearTask implements Runnable { 9746 IBackupTransport mTransport; 9747 PackageInfo mPackage; 9748 9749 PerformClearTask(IBackupTransport transport, PackageInfo packageInfo) { 9750 mTransport = transport; 9751 mPackage = packageInfo; 9752 } 9753 9754 public void run() { 9755 try { 9756 // Clear the on-device backup state to ensure a full backup next time 9757 File stateDir = new File(mBaseStateDir, mTransport.transportDirName()); 9758 File stateFile = new File(stateDir, mPackage.packageName); 9759 stateFile.delete(); 9760 9761 // Tell the transport to remove all the persistent storage for the app 9762 // TODO - need to handle failures 9763 mTransport.clearBackupData(mPackage); 9764 } catch (Exception e) { 9765 Slog.e(TAG, "Transport threw clearing data for " + mPackage + ": " + e.getMessage()); 9766 } finally { 9767 try { 9768 // TODO - need to handle failures 9769 mTransport.finishBackup(); 9770 } catch (Exception e) { 9771 // Nothing we can do here, alas 9772 Slog.e(TAG, "Unable to mark clear operation finished: " + e.getMessage()); 9773 } 9774 9775 // Last but not least, release the cpu 9776 mWakelock.release(); 9777 } 9778 } 9779 } 9780 9781 class PerformInitializeTask implements Runnable { 9782 HashSet<String> mQueue; 9783 9784 PerformInitializeTask(HashSet<String> transportNames) { 9785 mQueue = transportNames; 9786 } 9787 9788 public void run() { 9789 try { 9790 for (String transportName : mQueue) { 9791 IBackupTransport transport = 9792 mTransportManager.getTransportBinder(transportName); 9793 if (transport == null) { 9794 Slog.e(TAG, "Requested init for " + transportName + " but not found"); 9795 continue; 9796 } 9797 9798 Slog.i(TAG, "Initializing (wiping) backup transport storage: " + transportName); 9799 EventLog.writeEvent(EventLogTags.BACKUP_START, transport.transportDirName()); 9800 long startRealtime = SystemClock.elapsedRealtime(); 9801 int status = transport.initializeDevice(); 9802 9803 if (status == BackupTransport.TRANSPORT_OK) { 9804 status = transport.finishBackup(); 9805 } 9806 9807 // Okay, the wipe really happened. Clean up our local bookkeeping. 9808 if (status == BackupTransport.TRANSPORT_OK) { 9809 Slog.i(TAG, "Device init successful"); 9810 int millis = (int) (SystemClock.elapsedRealtime() - startRealtime); 9811 EventLog.writeEvent(EventLogTags.BACKUP_INITIALIZE); 9812 resetBackupState(new File(mBaseStateDir, transport.transportDirName())); 9813 EventLog.writeEvent(EventLogTags.BACKUP_SUCCESS, 0, millis); 9814 synchronized (mQueueLock) { 9815 recordInitPendingLocked(false, transportName); 9816 } 9817 } else { 9818 // If this didn't work, requeue this one and try again 9819 // after a suitable interval 9820 Slog.e(TAG, "Transport error in initializeDevice()"); 9821 EventLog.writeEvent(EventLogTags.BACKUP_TRANSPORT_FAILURE, "(initialize)"); 9822 synchronized (mQueueLock) { 9823 recordInitPendingLocked(true, transportName); 9824 } 9825 // do this via another alarm to make sure of the wakelock states 9826 long delay = transport.requestBackupTime(); 9827 Slog.w(TAG, "Init failed on " + transportName + " resched in " + delay); 9828 mAlarmManager.set(AlarmManager.RTC_WAKEUP, 9829 System.currentTimeMillis() + delay, mRunInitIntent); 9830 } 9831 } 9832 } catch (Exception e) { 9833 Slog.e(TAG, "Unexpected error performing init", e); 9834 } finally { 9835 // Done; release the wakelock 9836 mWakelock.release(); 9837 } 9838 } 9839 } 9840 9841 private void dataChangedImpl(String packageName) { 9842 HashSet<String> targets = dataChangedTargets(packageName); 9843 dataChangedImpl(packageName, targets); 9844 } 9845 9846 private void dataChangedImpl(String packageName, HashSet<String> targets) { 9847 // Record that we need a backup pass for the caller. Since multiple callers 9848 // may share a uid, we need to note all candidates within that uid and schedule 9849 // a backup pass for each of them. 9850 if (targets == null) { 9851 Slog.w(TAG, "dataChanged but no participant pkg='" + packageName + "'" 9852 + " uid=" + Binder.getCallingUid()); 9853 return; 9854 } 9855 9856 synchronized (mQueueLock) { 9857 // Note that this client has made data changes that need to be backed up 9858 if (targets.contains(packageName)) { 9859 // Add the caller to the set of pending backups. If there is 9860 // one already there, then overwrite it, but no harm done. 9861 BackupRequest req = new BackupRequest(packageName); 9862 if (mPendingBackups.put(packageName, req) == null) { 9863 if (MORE_DEBUG) Slog.d(TAG, "Now staging backup of " + packageName); 9864 9865 // Journal this request in case of crash. The put() 9866 // operation returned null when this package was not already 9867 // in the set; we want to avoid touching the disk redundantly. 9868 writeToJournalLocked(packageName); 9869 } 9870 } 9871 } 9872 9873 // ...and schedule a backup pass if necessary 9874 KeyValueBackupJob.schedule(mContext); 9875 } 9876 9877 // Note: packageName is currently unused, but may be in the future 9878 private HashSet<String> dataChangedTargets(String packageName) { 9879 // If the caller does not hold the BACKUP permission, it can only request a 9880 // backup of its own data. 9881 if ((mContext.checkPermission(android.Manifest.permission.BACKUP, Binder.getCallingPid(), 9882 Binder.getCallingUid())) == PackageManager.PERMISSION_DENIED) { 9883 synchronized (mBackupParticipants) { 9884 return mBackupParticipants.get(Binder.getCallingUid()); 9885 } 9886 } 9887 9888 // a caller with full permission can ask to back up any participating app 9889 HashSet<String> targets = new HashSet<String>(); 9890 if (PACKAGE_MANAGER_SENTINEL.equals(packageName)) { 9891 targets.add(PACKAGE_MANAGER_SENTINEL); 9892 } else { 9893 synchronized (mBackupParticipants) { 9894 int N = mBackupParticipants.size(); 9895 for (int i = 0; i < N; i++) { 9896 HashSet<String> s = mBackupParticipants.valueAt(i); 9897 if (s != null) { 9898 targets.addAll(s); 9899 } 9900 } 9901 } 9902 } 9903 return targets; 9904 } 9905 9906 private void writeToJournalLocked(String str) { 9907 RandomAccessFile out = null; 9908 try { 9909 if (mJournal == null) mJournal = File.createTempFile("journal", null, mJournalDir); 9910 out = new RandomAccessFile(mJournal, "rws"); 9911 out.seek(out.length()); 9912 out.writeUTF(str); 9913 } catch (IOException e) { 9914 Slog.e(TAG, "Can't write " + str + " to backup journal", e); 9915 mJournal = null; 9916 } finally { 9917 try { if (out != null) out.close(); } catch (IOException e) {} 9918 } 9919 } 9920 9921 // ----- IBackupManager binder interface ----- 9922 9923 @Override 9924 public void dataChanged(final String packageName) { 9925 final int callingUserHandle = UserHandle.getCallingUserId(); 9926 if (callingUserHandle != UserHandle.USER_SYSTEM) { 9927 // TODO: http://b/22388012 9928 // App is running under a non-owner user profile. For now, we do not back 9929 // up data from secondary user profiles. 9930 // TODO: backups for all user profiles although don't add backup for profiles 9931 // without adding admin control in DevicePolicyManager. 9932 if (MORE_DEBUG) { 9933 Slog.v(TAG, "dataChanged(" + packageName + ") ignored because it's user " 9934 + callingUserHandle); 9935 } 9936 return; 9937 } 9938 9939 final HashSet<String> targets = dataChangedTargets(packageName); 9940 if (targets == null) { 9941 Slog.w(TAG, "dataChanged but no participant pkg='" + packageName + "'" 9942 + " uid=" + Binder.getCallingUid()); 9943 return; 9944 } 9945 9946 mBackupHandler.post(new Runnable() { 9947 public void run() { 9948 dataChangedImpl(packageName, targets); 9949 } 9950 }); 9951 } 9952 9953 // Clear the given package's backup data from the current transport 9954 @Override 9955 public void clearBackupData(String transportName, String packageName) { 9956 if (DEBUG) Slog.v(TAG, "clearBackupData() of " + packageName + " on " + transportName); 9957 PackageInfo info; 9958 try { 9959 info = mPackageManager.getPackageInfo(packageName, PackageManager.GET_SIGNATURES); 9960 } catch (NameNotFoundException e) { 9961 Slog.d(TAG, "No such package '" + packageName + "' - not clearing backup data"); 9962 return; 9963 } 9964 9965 // If the caller does not hold the BACKUP permission, it can only request a 9966 // wipe of its own backed-up data. 9967 HashSet<String> apps; 9968 if ((mContext.checkPermission(android.Manifest.permission.BACKUP, Binder.getCallingPid(), 9969 Binder.getCallingUid())) == PackageManager.PERMISSION_DENIED) { 9970 apps = mBackupParticipants.get(Binder.getCallingUid()); 9971 } else { 9972 // a caller with full permission can ask to back up any participating app 9973 // !!! TODO: allow data-clear of ANY app? 9974 if (MORE_DEBUG) Slog.v(TAG, "Privileged caller, allowing clear of other apps"); 9975 apps = new HashSet<String>(); 9976 int N = mBackupParticipants.size(); 9977 for (int i = 0; i < N; i++) { 9978 HashSet<String> s = mBackupParticipants.valueAt(i); 9979 if (s != null) { 9980 apps.addAll(s); 9981 } 9982 } 9983 } 9984 9985 // Is the given app an available participant? 9986 if (apps.contains(packageName)) { 9987 // found it; fire off the clear request 9988 if (MORE_DEBUG) Slog.v(TAG, "Found the app - running clear process"); 9989 mBackupHandler.removeMessages(MSG_RETRY_CLEAR); 9990 synchronized (mQueueLock) { 9991 final IBackupTransport transport = 9992 mTransportManager.getTransportBinder(transportName); 9993 if (transport == null) { 9994 // transport is currently unavailable -- make sure to retry 9995 Message msg = mBackupHandler.obtainMessage(MSG_RETRY_CLEAR, 9996 new ClearRetryParams(transportName, packageName)); 9997 mBackupHandler.sendMessageDelayed(msg, TRANSPORT_RETRY_INTERVAL); 9998 return; 9999 } 10000 long oldId = Binder.clearCallingIdentity(); 10001 mWakelock.acquire(); 10002 Message msg = mBackupHandler.obtainMessage(MSG_RUN_CLEAR, 10003 new ClearParams(transport, info)); 10004 mBackupHandler.sendMessage(msg); 10005 Binder.restoreCallingIdentity(oldId); 10006 } 10007 } 10008 } 10009 10010 // Run a backup pass immediately for any applications that have declared 10011 // that they have pending updates. 10012 @Override 10013 public void backupNow() { 10014 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, "backupNow"); 10015 10016 final PowerSaveState result = 10017 mPowerManager.getPowerSaveState(ServiceType.KEYVALUE_BACKUP); 10018 if (result.batterySaverEnabled) { 10019 if (DEBUG) Slog.v(TAG, "Not running backup while in battery save mode"); 10020 KeyValueBackupJob.schedule(mContext); // try again in several hours 10021 } else { 10022 if (DEBUG) Slog.v(TAG, "Scheduling immediate backup pass"); 10023 synchronized (mQueueLock) { 10024 // Fire the intent that kicks off the whole shebang... 10025 try { 10026 mRunBackupIntent.send(); 10027 } catch (PendingIntent.CanceledException e) { 10028 // should never happen 10029 Slog.e(TAG, "run-backup intent cancelled!"); 10030 } 10031 10032 // ...and cancel any pending scheduled job, because we've just superseded it 10033 KeyValueBackupJob.cancel(mContext); 10034 } 10035 } 10036 } 10037 10038 boolean deviceIsProvisioned() { 10039 final ContentResolver resolver = mContext.getContentResolver(); 10040 return (Settings.Global.getInt(resolver, Settings.Global.DEVICE_PROVISIONED, 0) != 0); 10041 } 10042 10043 // Run a backup pass for the given packages, writing the resulting data stream 10044 // to the supplied file descriptor. This method is synchronous and does not return 10045 // to the caller until the backup has been completed. 10046 // 10047 // This is the variant used by 'adb backup'; it requires on-screen confirmation 10048 // by the user because it can be used to offload data over untrusted USB. 10049 @Override 10050 public void adbBackup(ParcelFileDescriptor fd, boolean includeApks, boolean includeObbs, 10051 boolean includeShared, boolean doWidgets, boolean doAllApps, boolean includeSystem, 10052 boolean compress, boolean doKeyValue, String[] pkgList) { 10053 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, "adbBackup"); 10054 10055 final int callingUserHandle = UserHandle.getCallingUserId(); 10056 // TODO: http://b/22388012 10057 if (callingUserHandle != UserHandle.USER_SYSTEM) { 10058 throw new IllegalStateException("Backup supported only for the device owner"); 10059 } 10060 10061 // Validate 10062 if (!doAllApps) { 10063 if (!includeShared) { 10064 // If we're backing up shared data (sdcard or equivalent), then we can run 10065 // without any supplied app names. Otherwise, we'd be doing no work, so 10066 // report the error. 10067 if (pkgList == null || pkgList.length == 0) { 10068 throw new IllegalArgumentException( 10069 "Backup requested but neither shared nor any apps named"); 10070 } 10071 } 10072 } 10073 10074 long oldId = Binder.clearCallingIdentity(); 10075 try { 10076 // Doesn't make sense to do a full backup prior to setup 10077 if (!deviceIsProvisioned()) { 10078 Slog.i(TAG, "Backup not supported before setup"); 10079 return; 10080 } 10081 10082 if (DEBUG) Slog.v(TAG, "Requesting backup: apks=" + includeApks + " obb=" + includeObbs 10083 + " shared=" + includeShared + " all=" + doAllApps + " system=" 10084 + includeSystem + " includekeyvalue=" + doKeyValue + " pkgs=" + pkgList); 10085 Slog.i(TAG, "Beginning adb backup..."); 10086 10087 AdbBackupParams params = new AdbBackupParams(fd, includeApks, includeObbs, 10088 includeShared, doWidgets, doAllApps, includeSystem, compress, doKeyValue, 10089 pkgList); 10090 final int token = generateRandomIntegerToken(); 10091 synchronized (mAdbBackupRestoreConfirmations) { 10092 mAdbBackupRestoreConfirmations.put(token, params); 10093 } 10094 10095 // start up the confirmation UI 10096 if (DEBUG) Slog.d(TAG, "Starting backup confirmation UI, token=" + token); 10097 if (!startConfirmationUi(token, FullBackup.FULL_BACKUP_INTENT_ACTION)) { 10098 Slog.e(TAG, "Unable to launch backup confirmation UI"); 10099 mAdbBackupRestoreConfirmations.delete(token); 10100 return; 10101 } 10102 10103 // make sure the screen is lit for the user interaction 10104 mPowerManager.userActivity(SystemClock.uptimeMillis(), 10105 PowerManager.USER_ACTIVITY_EVENT_OTHER, 10106 0); 10107 10108 // start the confirmation countdown 10109 startConfirmationTimeout(token, params); 10110 10111 // wait for the backup to be performed 10112 if (DEBUG) Slog.d(TAG, "Waiting for backup completion..."); 10113 waitForCompletion(params); 10114 } finally { 10115 try { 10116 fd.close(); 10117 } catch (IOException e) { 10118 // just eat it 10119 } 10120 Binder.restoreCallingIdentity(oldId); 10121 Slog.d(TAG, "Adb backup processing complete."); 10122 } 10123 } 10124 10125 @Override 10126 public void fullTransportBackup(String[] pkgNames) { 10127 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, 10128 "fullTransportBackup"); 10129 10130 final int callingUserHandle = UserHandle.getCallingUserId(); 10131 // TODO: http://b/22388012 10132 if (callingUserHandle != UserHandle.USER_SYSTEM) { 10133 throw new IllegalStateException("Restore supported only for the device owner"); 10134 } 10135 10136 if (!fullBackupAllowable(mTransportManager.getCurrentTransportBinder())) { 10137 Slog.i(TAG, "Full backup not currently possible -- key/value backup not yet run?"); 10138 } else { 10139 if (DEBUG) { 10140 Slog.d(TAG, "fullTransportBackup()"); 10141 } 10142 10143 final long oldId = Binder.clearCallingIdentity(); 10144 try { 10145 CountDownLatch latch = new CountDownLatch(1); 10146 PerformFullTransportBackupTask task = new PerformFullTransportBackupTask(null, 10147 pkgNames, false, null, latch, null, null, false /* userInitiated */); 10148 // Acquiring wakelock for PerformFullTransportBackupTask before its start. 10149 mWakelock.acquire(); 10150 (new Thread(task, "full-transport-master")).start(); 10151 do { 10152 try { 10153 latch.await(); 10154 break; 10155 } catch (InterruptedException e) { 10156 // Just go back to waiting for the latch to indicate completion 10157 } 10158 } while (true); 10159 10160 // We just ran a backup on these packages, so kick them to the end of the queue 10161 final long now = System.currentTimeMillis(); 10162 for (String pkg : pkgNames) { 10163 enqueueFullBackup(pkg, now); 10164 } 10165 } finally { 10166 Binder.restoreCallingIdentity(oldId); 10167 } 10168 } 10169 10170 if (DEBUG) { 10171 Slog.d(TAG, "Done with full transport backup."); 10172 } 10173 } 10174 10175 @Override 10176 public void adbRestore(ParcelFileDescriptor fd) { 10177 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, "adbRestore"); 10178 10179 final int callingUserHandle = UserHandle.getCallingUserId(); 10180 // TODO: http://b/22388012 10181 if (callingUserHandle != UserHandle.USER_SYSTEM) { 10182 throw new IllegalStateException("Restore supported only for the device owner"); 10183 } 10184 10185 long oldId = Binder.clearCallingIdentity(); 10186 10187 try { 10188 // Check whether the device has been provisioned -- we don't handle 10189 // full restores prior to completing the setup process. 10190 if (!deviceIsProvisioned()) { 10191 Slog.i(TAG, "Full restore not permitted before setup"); 10192 return; 10193 } 10194 10195 Slog.i(TAG, "Beginning restore..."); 10196 10197 AdbRestoreParams params = new AdbRestoreParams(fd); 10198 final int token = generateRandomIntegerToken(); 10199 synchronized (mAdbBackupRestoreConfirmations) { 10200 mAdbBackupRestoreConfirmations.put(token, params); 10201 } 10202 10203 // start up the confirmation UI 10204 if (DEBUG) Slog.d(TAG, "Starting restore confirmation UI, token=" + token); 10205 if (!startConfirmationUi(token, FullBackup.FULL_RESTORE_INTENT_ACTION)) { 10206 Slog.e(TAG, "Unable to launch restore confirmation"); 10207 mAdbBackupRestoreConfirmations.delete(token); 10208 return; 10209 } 10210 10211 // make sure the screen is lit for the user interaction 10212 mPowerManager.userActivity(SystemClock.uptimeMillis(), 10213 PowerManager.USER_ACTIVITY_EVENT_OTHER, 10214 0); 10215 10216 // start the confirmation countdown 10217 startConfirmationTimeout(token, params); 10218 10219 // wait for the restore to be performed 10220 if (DEBUG) Slog.d(TAG, "Waiting for restore completion..."); 10221 waitForCompletion(params); 10222 } finally { 10223 try { 10224 fd.close(); 10225 } catch (IOException e) { 10226 Slog.w(TAG, "Error trying to close fd after adb restore: " + e); 10227 } 10228 Binder.restoreCallingIdentity(oldId); 10229 Slog.i(TAG, "adb restore processing complete."); 10230 } 10231 } 10232 10233 boolean startConfirmationUi(int token, String action) { 10234 try { 10235 Intent confIntent = new Intent(action); 10236 confIntent.setClassName("com.android.backupconfirm", 10237 "com.android.backupconfirm.BackupRestoreConfirmation"); 10238 confIntent.putExtra(FullBackup.CONF_TOKEN_INTENT_EXTRA, token); 10239 confIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK); 10240 mContext.startActivityAsUser(confIntent, UserHandle.SYSTEM); 10241 } catch (ActivityNotFoundException e) { 10242 return false; 10243 } 10244 return true; 10245 } 10246 10247 void startConfirmationTimeout(int token, AdbParams params) { 10248 if (MORE_DEBUG) Slog.d(TAG, "Posting conf timeout msg after " 10249 + TIMEOUT_FULL_CONFIRMATION + " millis"); 10250 Message msg = mBackupHandler.obtainMessage(MSG_FULL_CONFIRMATION_TIMEOUT, 10251 token, 0, params); 10252 mBackupHandler.sendMessageDelayed(msg, TIMEOUT_FULL_CONFIRMATION); 10253 } 10254 10255 void waitForCompletion(AdbParams params) { 10256 synchronized (params.latch) { 10257 while (params.latch.get() == false) { 10258 try { 10259 params.latch.wait(); 10260 } catch (InterruptedException e) { /* never interrupted */ } 10261 } 10262 } 10263 } 10264 10265 void signalAdbBackupRestoreCompletion(AdbParams params) { 10266 synchronized (params.latch) { 10267 params.latch.set(true); 10268 params.latch.notifyAll(); 10269 } 10270 } 10271 10272 // Confirm that the previously-requested full backup/restore operation can proceed. This 10273 // is used to require a user-facing disclosure about the operation. 10274 @Override 10275 public void acknowledgeAdbBackupOrRestore(int token, boolean allow, 10276 String curPassword, String encPpassword, IFullBackupRestoreObserver observer) { 10277 if (DEBUG) Slog.d(TAG, "acknowledgeAdbBackupOrRestore : token=" + token 10278 + " allow=" + allow); 10279 10280 // TODO: possibly require not just this signature-only permission, but even 10281 // require that the specific designated confirmation-UI app uid is the caller? 10282 mContext.enforceCallingPermission(android.Manifest.permission.BACKUP, "acknowledgeAdbBackupOrRestore"); 10283 10284 long oldId = Binder.clearCallingIdentity(); 10285 try { 10286 10287 AdbParams params; 10288 synchronized (mAdbBackupRestoreConfirmations) { 10289 params = mAdbBackupRestoreConfirmations.get(token); 10290 if (params != null) { 10291 mBackupHandler.removeMessages(MSG_FULL_CONFIRMATION_TIMEOUT, params); 10292 mAdbBackupRestoreConfirmations.delete(token); 10293 10294 if (allow) { 10295 final int verb = params instanceof AdbBackupParams 10296 ? MSG_RUN_ADB_BACKUP 10297 : MSG_RUN_ADB_RESTORE; 10298 10299 params.observer = observer; 10300 params.curPassword = curPassword; 10301 10302 params.encryptPassword = encPpassword; 10303 10304 if (MORE_DEBUG) Slog.d(TAG, "Sending conf message with verb " + verb); 10305 mWakelock.acquire(); 10306 Message msg = mBackupHandler.obtainMessage(verb, params); 10307 mBackupHandler.sendMessage(msg); 10308 } else { 10309 Slog.w(TAG, "User rejected full backup/restore operation"); 10310 // indicate completion without having actually transferred any data 10311 signalAdbBackupRestoreCompletion(params); 10312 } 10313 } else { 10314 Slog.w(TAG, "Attempted to ack full backup/restore with invalid token"); 10315 } 10316 } 10317 } finally { 10318 Binder.restoreCallingIdentity(oldId); 10319 } 10320 } 10321 10322 private static boolean backupSettingMigrated(int userId) { 10323 File base = new File(Environment.getDataDirectory(), "backup"); 10324 File enableFile = new File(base, BACKUP_ENABLE_FILE); 10325 return enableFile.exists(); 10326 } 10327 10328 private static boolean readBackupEnableState(int userId) { 10329 File base = new File(Environment.getDataDirectory(), "backup"); 10330 File enableFile = new File(base, BACKUP_ENABLE_FILE); 10331 if (enableFile.exists()) { 10332 try (FileInputStream fin = new FileInputStream(enableFile)) { 10333 int state = fin.read(); 10334 return state != 0; 10335 } catch (IOException e) { 10336 // can't read the file; fall through to assume disabled 10337 Slog.e(TAG, "Cannot read enable state; assuming disabled"); 10338 } 10339 } else { 10340 if (DEBUG) { 10341 Slog.i(TAG, "isBackupEnabled() => false due to absent settings file"); 10342 } 10343 } 10344 return false; 10345 } 10346 10347 private static void writeBackupEnableState(boolean enable, int userId) { 10348 File base = new File(Environment.getDataDirectory(), "backup"); 10349 File enableFile = new File(base, BACKUP_ENABLE_FILE); 10350 File stage = new File(base, BACKUP_ENABLE_FILE + "-stage"); 10351 FileOutputStream fout = null; 10352 try { 10353 fout = new FileOutputStream(stage); 10354 fout.write(enable ? 1 : 0); 10355 fout.close(); 10356 stage.renameTo(enableFile); 10357 // will be synced immediately by the try-with-resources call to close() 10358 } catch (IOException|RuntimeException e) { 10359 // Whoops; looks like we're doomed. Roll everything out, disabled, 10360 // including the legacy state. 10361 Slog.e(TAG, "Unable to record backup enable state; reverting to disabled: " 10362 + e.getMessage()); 10363 10364 final ContentResolver r = sInstance.mContext.getContentResolver(); 10365 Settings.Secure.putStringForUser(r, 10366 Settings.Secure.BACKUP_ENABLED, null, userId); 10367 enableFile.delete(); 10368 stage.delete(); 10369 } finally { 10370 IoUtils.closeQuietly(fout); 10371 } 10372 } 10373 10374 // Enable/disable backups 10375 @Override 10376 public void setBackupEnabled(boolean enable) { 10377 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10378 "setBackupEnabled"); 10379 10380 Slog.i(TAG, "Backup enabled => " + enable); 10381 10382 long oldId = Binder.clearCallingIdentity(); 10383 try { 10384 boolean wasEnabled = mEnabled; 10385 synchronized (this) { 10386 writeBackupEnableState(enable, UserHandle.USER_SYSTEM); 10387 mEnabled = enable; 10388 } 10389 10390 synchronized (mQueueLock) { 10391 if (enable && !wasEnabled && mProvisioned) { 10392 // if we've just been enabled, start scheduling backup passes 10393 KeyValueBackupJob.schedule(mContext); 10394 scheduleNextFullBackupJob(0); 10395 } else if (!enable) { 10396 // No longer enabled, so stop running backups 10397 if (MORE_DEBUG) Slog.i(TAG, "Opting out of backup"); 10398 10399 KeyValueBackupJob.cancel(mContext); 10400 10401 // This also constitutes an opt-out, so we wipe any data for 10402 // this device from the backend. We start that process with 10403 // an alarm in order to guarantee wakelock states. 10404 if (wasEnabled && mProvisioned) { 10405 // NOTE: we currently flush every registered transport, not just 10406 // the currently-active one. 10407 String[] allTransports = mTransportManager.getBoundTransportNames(); 10408 // build the set of transports for which we are posting an init 10409 for (String transport : allTransports) { 10410 recordInitPendingLocked(true, transport); 10411 } 10412 mAlarmManager.set(AlarmManager.RTC_WAKEUP, System.currentTimeMillis(), 10413 mRunInitIntent); 10414 } 10415 } 10416 } 10417 } finally { 10418 Binder.restoreCallingIdentity(oldId); 10419 } 10420 } 10421 10422 // Enable/disable automatic restore of app data at install time 10423 @Override 10424 public void setAutoRestore(boolean doAutoRestore) { 10425 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10426 "setAutoRestore"); 10427 10428 Slog.i(TAG, "Auto restore => " + doAutoRestore); 10429 10430 final long oldId = Binder.clearCallingIdentity(); 10431 try { 10432 synchronized (this) { 10433 Settings.Secure.putInt(mContext.getContentResolver(), 10434 Settings.Secure.BACKUP_AUTO_RESTORE, doAutoRestore ? 1 : 0); 10435 mAutoRestore = doAutoRestore; 10436 } 10437 } finally { 10438 Binder.restoreCallingIdentity(oldId); 10439 } 10440 } 10441 10442 // Mark the backup service as having been provisioned 10443 @Override 10444 public void setBackupProvisioned(boolean available) { 10445 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10446 "setBackupProvisioned"); 10447 /* 10448 * This is now a no-op; provisioning is simply the device's own setup state. 10449 */ 10450 } 10451 10452 // Report whether the backup mechanism is currently enabled 10453 @Override 10454 public boolean isBackupEnabled() { 10455 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, "isBackupEnabled"); 10456 return mEnabled; // no need to synchronize just to read it 10457 } 10458 10459 // Report the name of the currently active transport 10460 @Override 10461 public String getCurrentTransport() { 10462 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10463 "getCurrentTransport"); 10464 String currentTransport = mTransportManager.getCurrentTransportName(); 10465 if (MORE_DEBUG) Slog.v(TAG, "... getCurrentTransport() returning " + currentTransport); 10466 return currentTransport; 10467 } 10468 10469 // Report all known, available backup transports 10470 @Override 10471 public String[] listAllTransports() { 10472 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, "listAllTransports"); 10473 10474 return mTransportManager.getBoundTransportNames(); 10475 } 10476 10477 @Override 10478 public ComponentName[] listAllTransportComponents() { 10479 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10480 "listAllTransportComponents"); 10481 return mTransportManager.getAllTransportCompenents(); 10482 } 10483 10484 @Override 10485 public String[] getTransportWhitelist() { 10486 // No permission check, intentionally. 10487 Set<ComponentName> whitelistedComponents = mTransportManager.getTransportWhitelist(); 10488 String[] whitelistedTransports = new String[whitelistedComponents.size()]; 10489 int i = 0; 10490 for (ComponentName component : whitelistedComponents) { 10491 whitelistedTransports[i] = component.flattenToShortString(); 10492 i++; 10493 } 10494 return whitelistedTransports; 10495 } 10496 10497 // Select which transport to use for the next backup operation. 10498 @Override 10499 public String selectBackupTransport(String transport) { 10500 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10501 "selectBackupTransport"); 10502 10503 final long oldId = Binder.clearCallingIdentity(); 10504 try { 10505 String prevTransport = mTransportManager.selectTransport(transport); 10506 updateStateForTransport(transport); 10507 Slog.v(TAG, "selectBackupTransport() set " + mTransportManager.getCurrentTransportName() 10508 + " returning " + prevTransport); 10509 return prevTransport; 10510 } finally { 10511 Binder.restoreCallingIdentity(oldId); 10512 } 10513 } 10514 10515 @Override 10516 public void selectBackupTransportAsync(final ComponentName transport, 10517 final ISelectBackupTransportCallback listener) { 10518 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10519 "selectBackupTransportAsync"); 10520 10521 final long oldId = Binder.clearCallingIdentity(); 10522 10523 Slog.v(TAG, "selectBackupTransportAsync() called with transport " + 10524 transport.flattenToShortString()); 10525 10526 mTransportManager.ensureTransportReady(transport, new SelectBackupTransportCallback() { 10527 @Override 10528 public void onSuccess(String transportName) { 10529 mTransportManager.selectTransport(transportName); 10530 updateStateForTransport(mTransportManager.getCurrentTransportName()); 10531 Slog.v(TAG, "Transport successfully selected: " + transport.flattenToShortString()); 10532 try { 10533 listener.onSuccess(transportName); 10534 } catch (RemoteException e) { 10535 // Nothing to do here. 10536 } 10537 } 10538 10539 @Override 10540 public void onFailure(int reason) { 10541 Slog.v(TAG, "Failed to select transport: " + transport.flattenToShortString()); 10542 try { 10543 listener.onFailure(reason); 10544 } catch (RemoteException e) { 10545 // Nothing to do here. 10546 } 10547 } 10548 }); 10549 10550 Binder.restoreCallingIdentity(oldId); 10551 } 10552 10553 private void updateStateForTransport(String newTransportName) { 10554 // Publish the name change 10555 Settings.Secure.putString(mContext.getContentResolver(), 10556 Settings.Secure.BACKUP_TRANSPORT, newTransportName); 10557 10558 // And update our current-dataset bookkeeping 10559 IBackupTransport transport = mTransportManager.getTransportBinder(newTransportName); 10560 if (transport != null) { 10561 try { 10562 mCurrentToken = transport.getCurrentRestoreSet(); 10563 } catch (Exception e) { 10564 // Oops. We can't know the current dataset token, so reset and figure it out 10565 // when we do the next k/v backup operation on this transport. 10566 mCurrentToken = 0; 10567 } 10568 } else { 10569 // The named transport isn't bound at this particular moment, so we can't 10570 // know yet what its current dataset token is. Reset as above. 10571 mCurrentToken = 0; 10572 } 10573 } 10574 10575 // Supply the configuration Intent for the given transport. If the name is not one 10576 // of the available transports, or if the transport does not supply any configuration 10577 // UI, the method returns null. 10578 @Override 10579 public Intent getConfigurationIntent(String transportName) { 10580 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10581 "getConfigurationIntent"); 10582 10583 final IBackupTransport transport = mTransportManager.getTransportBinder(transportName); 10584 if (transport != null) { 10585 try { 10586 final Intent intent = transport.configurationIntent(); 10587 if (MORE_DEBUG) Slog.d(TAG, "getConfigurationIntent() returning config intent " 10588 + intent); 10589 return intent; 10590 } catch (Exception e) { 10591 /* fall through to return null */ 10592 Slog.e(TAG, "Unable to get configuration intent from transport: " + e.getMessage()); 10593 } 10594 } 10595 10596 return null; 10597 } 10598 10599 // Supply the configuration summary string for the given transport. If the name is 10600 // not one of the available transports, or if the transport does not supply any 10601 // summary / destination string, the method can return null. 10602 // 10603 // This string is used VERBATIM as the summary text of the relevant Settings item! 10604 @Override 10605 public String getDestinationString(String transportName) { 10606 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10607 "getDestinationString"); 10608 10609 final IBackupTransport transport = mTransportManager.getTransportBinder(transportName); 10610 if (transport != null) { 10611 try { 10612 final String text = transport.currentDestinationString(); 10613 if (MORE_DEBUG) Slog.d(TAG, "getDestinationString() returning " + text); 10614 return text; 10615 } catch (Exception e) { 10616 /* fall through to return null */ 10617 Slog.e(TAG, "Unable to get string from transport: " + e.getMessage()); 10618 } 10619 } 10620 10621 return null; 10622 } 10623 10624 // Supply the manage-data intent for the given transport. 10625 @Override 10626 public Intent getDataManagementIntent(String transportName) { 10627 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10628 "getDataManagementIntent"); 10629 10630 final IBackupTransport transport = mTransportManager.getTransportBinder(transportName); 10631 if (transport != null) { 10632 try { 10633 final Intent intent = transport.dataManagementIntent(); 10634 if (MORE_DEBUG) Slog.d(TAG, "getDataManagementIntent() returning intent " 10635 + intent); 10636 return intent; 10637 } catch (Exception e) { 10638 /* fall through to return null */ 10639 Slog.e(TAG, "Unable to get management intent from transport: " + e.getMessage()); 10640 } 10641 } 10642 10643 return null; 10644 } 10645 10646 // Supply the menu label for affordances that fire the manage-data intent 10647 // for the given transport. 10648 @Override 10649 public String getDataManagementLabel(String transportName) { 10650 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10651 "getDataManagementLabel"); 10652 10653 final IBackupTransport transport = mTransportManager.getTransportBinder(transportName); 10654 if (transport != null) { 10655 try { 10656 final String text = transport.dataManagementLabel(); 10657 if (MORE_DEBUG) Slog.d(TAG, "getDataManagementLabel() returning " + text); 10658 return text; 10659 } catch (Exception e) { 10660 /* fall through to return null */ 10661 Slog.e(TAG, "Unable to get management label from transport: " + e.getMessage()); 10662 } 10663 } 10664 10665 return null; 10666 } 10667 10668 // Callback: a requested backup agent has been instantiated. This should only 10669 // be called from the Activity Manager. 10670 @Override 10671 public void agentConnected(String packageName, IBinder agentBinder) { 10672 synchronized(mAgentConnectLock) { 10673 if (Binder.getCallingUid() == Process.SYSTEM_UID) { 10674 Slog.d(TAG, "agentConnected pkg=" + packageName + " agent=" + agentBinder); 10675 IBackupAgent agent = IBackupAgent.Stub.asInterface(agentBinder); 10676 mConnectedAgent = agent; 10677 mConnecting = false; 10678 } else { 10679 Slog.w(TAG, "Non-system process uid=" + Binder.getCallingUid() 10680 + " claiming agent connected"); 10681 } 10682 mAgentConnectLock.notifyAll(); 10683 } 10684 } 10685 10686 // Callback: a backup agent has failed to come up, or has unexpectedly quit. 10687 // If the agent failed to come up in the first place, the agentBinder argument 10688 // will be null. This should only be called from the Activity Manager. 10689 @Override 10690 public void agentDisconnected(String packageName) { 10691 // TODO: handle backup being interrupted 10692 synchronized(mAgentConnectLock) { 10693 if (Binder.getCallingUid() == Process.SYSTEM_UID) { 10694 mConnectedAgent = null; 10695 mConnecting = false; 10696 } else { 10697 Slog.w(TAG, "Non-system process uid=" + Binder.getCallingUid() 10698 + " claiming agent disconnected"); 10699 } 10700 mAgentConnectLock.notifyAll(); 10701 } 10702 } 10703 10704 // An application being installed will need a restore pass, then the Package Manager 10705 // will need to be told when the restore is finished. 10706 @Override 10707 public void restoreAtInstall(String packageName, int token) { 10708 if (Binder.getCallingUid() != Process.SYSTEM_UID) { 10709 Slog.w(TAG, "Non-system process uid=" + Binder.getCallingUid() 10710 + " attemping install-time restore"); 10711 return; 10712 } 10713 10714 boolean skip = false; 10715 10716 long restoreSet = getAvailableRestoreToken(packageName); 10717 if (DEBUG) Slog.v(TAG, "restoreAtInstall pkg=" + packageName 10718 + " token=" + Integer.toHexString(token) 10719 + " restoreSet=" + Long.toHexString(restoreSet)); 10720 if (restoreSet == 0) { 10721 if (MORE_DEBUG) Slog.i(TAG, "No restore set"); 10722 skip = true; 10723 } 10724 10725 // Do we have a transport to fetch data for us? 10726 IBackupTransport transport = mTransportManager.getCurrentTransportBinder(); 10727 if (transport == null) { 10728 if (DEBUG) Slog.w(TAG, "No transport"); 10729 skip = true; 10730 } 10731 10732 if (!mAutoRestore) { 10733 if (DEBUG) { 10734 Slog.w(TAG, "Non-restorable state: auto=" + mAutoRestore); 10735 } 10736 skip = true; 10737 } 10738 10739 if (!skip) { 10740 try { 10741 // okay, we're going to attempt a restore of this package from this restore set. 10742 // The eventual message back into the Package Manager to run the post-install 10743 // steps for 'token' will be issued from the restore handling code. 10744 10745 // This can throw and so *must* happen before the wakelock is acquired 10746 String dirName = transport.transportDirName(); 10747 10748 mWakelock.acquire(); 10749 if (MORE_DEBUG) { 10750 Slog.d(TAG, "Restore at install of " + packageName); 10751 } 10752 Message msg = mBackupHandler.obtainMessage(MSG_RUN_RESTORE); 10753 msg.obj = new RestoreParams(transport, dirName, null, null, 10754 restoreSet, packageName, token); 10755 mBackupHandler.sendMessage(msg); 10756 } catch (Exception e) { 10757 // Calling into the transport broke; back off and proceed with the installation. 10758 Slog.e(TAG, "Unable to contact transport: " + e.getMessage()); 10759 skip = true; 10760 } 10761 } 10762 10763 if (skip) { 10764 // Auto-restore disabled or no way to attempt a restore; just tell the Package 10765 // Manager to proceed with the post-install handling for this package. 10766 if (DEBUG) Slog.v(TAG, "Finishing install immediately"); 10767 try { 10768 mPackageManagerBinder.finishPackageInstall(token, false); 10769 } catch (RemoteException e) { /* can't happen */ } 10770 } 10771 } 10772 10773 // Hand off a restore session 10774 @Override 10775 public IRestoreSession beginRestoreSession(String packageName, String transport) { 10776 if (DEBUG) Slog.v(TAG, "beginRestoreSession: pkg=" + packageName 10777 + " transport=" + transport); 10778 10779 boolean needPermission = true; 10780 if (transport == null) { 10781 transport = mTransportManager.getCurrentTransportName(); 10782 10783 if (packageName != null) { 10784 PackageInfo app = null; 10785 try { 10786 app = mPackageManager.getPackageInfo(packageName, 0); 10787 } catch (NameNotFoundException nnf) { 10788 Slog.w(TAG, "Asked to restore nonexistent pkg " + packageName); 10789 throw new IllegalArgumentException("Package " + packageName + " not found"); 10790 } 10791 10792 if (app.applicationInfo.uid == Binder.getCallingUid()) { 10793 // So: using the current active transport, and the caller has asked 10794 // that its own package will be restored. In this narrow use case 10795 // we do not require the caller to hold the permission. 10796 needPermission = false; 10797 } 10798 } 10799 } 10800 10801 if (needPermission) { 10802 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10803 "beginRestoreSession"); 10804 } else { 10805 if (DEBUG) Slog.d(TAG, "restoring self on current transport; no permission needed"); 10806 } 10807 10808 synchronized(this) { 10809 if (mActiveRestoreSession != null) { 10810 Slog.i(TAG, "Restore session requested but one already active"); 10811 return null; 10812 } 10813 if (mBackupRunning) { 10814 Slog.i(TAG, "Restore session requested but currently running backups"); 10815 return null; 10816 } 10817 mActiveRestoreSession = new ActiveRestoreSession(packageName, transport); 10818 mBackupHandler.sendEmptyMessageDelayed(MSG_RESTORE_SESSION_TIMEOUT, 10819 TIMEOUT_RESTORE_INTERVAL); 10820 } 10821 return mActiveRestoreSession; 10822 } 10823 10824 void clearRestoreSession(ActiveRestoreSession currentSession) { 10825 synchronized(this) { 10826 if (currentSession != mActiveRestoreSession) { 10827 Slog.e(TAG, "ending non-current restore session"); 10828 } else { 10829 if (DEBUG) Slog.v(TAG, "Clearing restore session and halting timeout"); 10830 mActiveRestoreSession = null; 10831 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 10832 } 10833 } 10834 } 10835 10836 // Note that a currently-active backup agent has notified us that it has 10837 // completed the given outstanding asynchronous backup/restore operation. 10838 @Override 10839 public void opComplete(int token, long result) { 10840 if (MORE_DEBUG) { 10841 Slog.v(TAG, "opComplete: " + Integer.toHexString(token) + " result=" + result); 10842 } 10843 Operation op = null; 10844 synchronized (mCurrentOpLock) { 10845 op = mCurrentOperations.get(token); 10846 if (op != null) { 10847 if (op.state == OP_TIMEOUT) { 10848 // The operation already timed out, and this is a late response. Tidy up 10849 // and ignore it; we've already dealt with the timeout. 10850 op = null; 10851 mCurrentOperations.delete(token); 10852 } else if (op.state == OP_ACKNOWLEDGED) { 10853 if (DEBUG) { 10854 Slog.w(TAG, "Received duplicate ack for token=" + 10855 Integer.toHexString(token)); 10856 } 10857 op = null; 10858 mCurrentOperations.remove(token); 10859 } else if (op.state == OP_PENDING) { 10860 // Can't delete op from mCurrentOperations. waitUntilOperationComplete can be 10861 // called after we we receive this call. 10862 op.state = OP_ACKNOWLEDGED; 10863 } 10864 } 10865 mCurrentOpLock.notifyAll(); 10866 } 10867 10868 // The completion callback, if any, is invoked on the handler 10869 if (op != null && op.callback != null) { 10870 Pair<BackupRestoreTask, Long> callbackAndResult = Pair.create(op.callback, result); 10871 Message msg = mBackupHandler.obtainMessage(MSG_OP_COMPLETE, callbackAndResult); 10872 mBackupHandler.sendMessage(msg); 10873 } 10874 } 10875 10876 @Override 10877 public boolean isAppEligibleForBackup(String packageName) { 10878 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10879 "isAppEligibleForBackup"); 10880 try { 10881 PackageInfo packageInfo = mPackageManager.getPackageInfo(packageName, 10882 PackageManager.GET_SIGNATURES); 10883 if (!appIsEligibleForBackup(packageInfo.applicationInfo, mPackageManager) || 10884 appIsStopped(packageInfo.applicationInfo)) { 10885 return false; 10886 } 10887 IBackupTransport transport = mTransportManager.getCurrentTransportBinder(); 10888 if (transport != null) { 10889 try { 10890 return transport.isAppEligibleForBackup(packageInfo, 10891 appGetsFullBackup(packageInfo)); 10892 } catch (Exception e) { 10893 Slog.e(TAG, "Unable to ask about eligibility: " + e.getMessage()); 10894 } 10895 } 10896 // If transport is not present we couldn't tell that the package is not eligible. 10897 return true; 10898 } catch (NameNotFoundException e) { 10899 return false; 10900 } 10901 } 10902 10903 // ----- Restore session ----- 10904 10905 class ActiveRestoreSession extends IRestoreSession.Stub { 10906 private static final String TAG = "RestoreSession"; 10907 10908 private String mPackageName; 10909 private IBackupTransport mRestoreTransport = null; 10910 RestoreSet[] mRestoreSets = null; 10911 boolean mEnded = false; 10912 boolean mTimedOut = false; 10913 10914 ActiveRestoreSession(String packageName, String transport) { 10915 mPackageName = packageName; 10916 mRestoreTransport = mTransportManager.getTransportBinder(transport); 10917 } 10918 10919 public void markTimedOut() { 10920 mTimedOut = true; 10921 } 10922 10923 // --- Binder interface --- 10924 public synchronized int getAvailableRestoreSets(IRestoreObserver observer, 10925 IBackupManagerMonitor monitor) { 10926 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10927 "getAvailableRestoreSets"); 10928 if (observer == null) { 10929 throw new IllegalArgumentException("Observer must not be null"); 10930 } 10931 10932 if (mEnded) { 10933 throw new IllegalStateException("Restore session already ended"); 10934 } 10935 10936 if (mTimedOut) { 10937 Slog.i(TAG, "Session already timed out"); 10938 return -1; 10939 } 10940 10941 long oldId = Binder.clearCallingIdentity(); 10942 try { 10943 if (mRestoreTransport == null) { 10944 Slog.w(TAG, "Null transport getting restore sets"); 10945 return -1; 10946 } 10947 10948 // We know we're doing legit work now, so halt the timeout 10949 // until we're done. It gets started again when the result 10950 // comes in. 10951 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 10952 10953 // spin off the transport request to our service thread 10954 mWakelock.acquire(); 10955 Message msg = mBackupHandler.obtainMessage(MSG_RUN_GET_RESTORE_SETS, 10956 new RestoreGetSetsParams(mRestoreTransport, this, observer, 10957 monitor)); 10958 mBackupHandler.sendMessage(msg); 10959 return 0; 10960 } catch (Exception e) { 10961 Slog.e(TAG, "Error in getAvailableRestoreSets", e); 10962 return -1; 10963 } finally { 10964 Binder.restoreCallingIdentity(oldId); 10965 } 10966 } 10967 10968 public synchronized int restoreAll(long token, IRestoreObserver observer, 10969 IBackupManagerMonitor monitor) { 10970 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 10971 "performRestore"); 10972 10973 if (DEBUG) Slog.d(TAG, "restoreAll token=" + Long.toHexString(token) 10974 + " observer=" + observer); 10975 10976 if (mEnded) { 10977 throw new IllegalStateException("Restore session already ended"); 10978 } 10979 10980 if (mTimedOut) { 10981 Slog.i(TAG, "Session already timed out"); 10982 return -1; 10983 } 10984 10985 if (mRestoreTransport == null || mRestoreSets == null) { 10986 Slog.e(TAG, "Ignoring restoreAll() with no restore set"); 10987 return -1; 10988 } 10989 10990 if (mPackageName != null) { 10991 Slog.e(TAG, "Ignoring restoreAll() on single-package session"); 10992 return -1; 10993 } 10994 10995 String dirName; 10996 try { 10997 dirName = mRestoreTransport.transportDirName(); 10998 } catch (Exception e) { 10999 // Transport went AWOL; fail. 11000 Slog.e(TAG, "Unable to get transport dir for restore: " + e.getMessage()); 11001 return -1; 11002 } 11003 11004 synchronized (mQueueLock) { 11005 for (int i = 0; i < mRestoreSets.length; i++) { 11006 if (token == mRestoreSets[i].token) { 11007 // Real work, so stop the session timeout until we finalize the restore 11008 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 11009 11010 long oldId = Binder.clearCallingIdentity(); 11011 mWakelock.acquire(); 11012 if (MORE_DEBUG) { 11013 Slog.d(TAG, "restoreAll() kicking off"); 11014 } 11015 Message msg = mBackupHandler.obtainMessage(MSG_RUN_RESTORE); 11016 msg.obj = new RestoreParams(mRestoreTransport, dirName, 11017 observer, monitor, token); 11018 mBackupHandler.sendMessage(msg); 11019 Binder.restoreCallingIdentity(oldId); 11020 return 0; 11021 } 11022 } 11023 } 11024 11025 Slog.w(TAG, "Restore token " + Long.toHexString(token) + " not found"); 11026 return -1; 11027 } 11028 11029 // Restores of more than a single package are treated as 'system' restores 11030 public synchronized int restoreSome(long token, IRestoreObserver observer, 11031 IBackupManagerMonitor monitor, String[] packages) { 11032 mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP, 11033 "performRestore"); 11034 11035 if (DEBUG) { 11036 StringBuilder b = new StringBuilder(128); 11037 b.append("restoreSome token="); 11038 b.append(Long.toHexString(token)); 11039 b.append(" observer="); 11040 b.append(observer.toString()); 11041 b.append(" monitor="); 11042 if (monitor == null) { 11043 b.append("null"); 11044 } else { 11045 b.append(monitor.toString()); 11046 } 11047 b.append(" packages="); 11048 if (packages == null) { 11049 b.append("null"); 11050 } else { 11051 b.append('{'); 11052 boolean first = true; 11053 for (String s : packages) { 11054 if (!first) { 11055 b.append(", "); 11056 } else first = false; 11057 b.append(s); 11058 } 11059 b.append('}'); 11060 } 11061 Slog.d(TAG, b.toString()); 11062 } 11063 11064 if (mEnded) { 11065 throw new IllegalStateException("Restore session already ended"); 11066 } 11067 11068 if (mTimedOut) { 11069 Slog.i(TAG, "Session already timed out"); 11070 return -1; 11071 } 11072 11073 if (mRestoreTransport == null || mRestoreSets == null) { 11074 Slog.e(TAG, "Ignoring restoreAll() with no restore set"); 11075 return -1; 11076 } 11077 11078 if (mPackageName != null) { 11079 Slog.e(TAG, "Ignoring restoreAll() on single-package session"); 11080 return -1; 11081 } 11082 11083 String dirName; 11084 try { 11085 dirName = mRestoreTransport.transportDirName(); 11086 } catch (Exception e) { 11087 // Transport went AWOL; fail. 11088 Slog.e(TAG, "Unable to get transport name for restoreSome: " + e.getMessage()); 11089 return -1; 11090 } 11091 11092 synchronized (mQueueLock) { 11093 for (int i = 0; i < mRestoreSets.length; i++) { 11094 if (token == mRestoreSets[i].token) { 11095 // Stop the session timeout until we finalize the restore 11096 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 11097 11098 long oldId = Binder.clearCallingIdentity(); 11099 mWakelock.acquire(); 11100 if (MORE_DEBUG) { 11101 Slog.d(TAG, "restoreSome() of " + packages.length + " packages"); 11102 } 11103 Message msg = mBackupHandler.obtainMessage(MSG_RUN_RESTORE); 11104 msg.obj = new RestoreParams(mRestoreTransport, dirName, observer, monitor, 11105 token, packages, packages.length > 1); 11106 mBackupHandler.sendMessage(msg); 11107 Binder.restoreCallingIdentity(oldId); 11108 return 0; 11109 } 11110 } 11111 } 11112 11113 Slog.w(TAG, "Restore token " + Long.toHexString(token) + " not found"); 11114 return -1; 11115 } 11116 11117 public synchronized int restorePackage(String packageName, IRestoreObserver observer, 11118 IBackupManagerMonitor monitor) { 11119 if (DEBUG) Slog.v(TAG, "restorePackage pkg=" + packageName + " obs=" + observer 11120 + "monitor=" + monitor); 11121 11122 if (mEnded) { 11123 throw new IllegalStateException("Restore session already ended"); 11124 } 11125 11126 if (mTimedOut) { 11127 Slog.i(TAG, "Session already timed out"); 11128 return -1; 11129 } 11130 11131 if (mPackageName != null) { 11132 if (! mPackageName.equals(packageName)) { 11133 Slog.e(TAG, "Ignoring attempt to restore pkg=" + packageName 11134 + " on session for package " + mPackageName); 11135 return -1; 11136 } 11137 } 11138 11139 PackageInfo app = null; 11140 try { 11141 app = mPackageManager.getPackageInfo(packageName, 0); 11142 } catch (NameNotFoundException nnf) { 11143 Slog.w(TAG, "Asked to restore nonexistent pkg " + packageName); 11144 return -1; 11145 } 11146 11147 // If the caller is not privileged and is not coming from the target 11148 // app's uid, throw a permission exception back to the caller. 11149 int perm = mContext.checkPermission(android.Manifest.permission.BACKUP, 11150 Binder.getCallingPid(), Binder.getCallingUid()); 11151 if ((perm == PackageManager.PERMISSION_DENIED) && 11152 (app.applicationInfo.uid != Binder.getCallingUid())) { 11153 Slog.w(TAG, "restorePackage: bad packageName=" + packageName 11154 + " or calling uid=" + Binder.getCallingUid()); 11155 throw new SecurityException("No permission to restore other packages"); 11156 } 11157 11158 // So far so good; we're allowed to try to restore this package. 11159 long oldId = Binder.clearCallingIdentity(); 11160 try { 11161 // Check whether there is data for it in the current dataset, falling back 11162 // to the ancestral dataset if not. 11163 long token = getAvailableRestoreToken(packageName); 11164 if (DEBUG) Slog.v(TAG, "restorePackage pkg=" + packageName 11165 + " token=" + Long.toHexString(token)); 11166 11167 // If we didn't come up with a place to look -- no ancestral dataset and 11168 // the app has never been backed up from this device -- there's nothing 11169 // to do but return failure. 11170 if (token == 0) { 11171 if (DEBUG) Slog.w(TAG, "No data available for this package; not restoring"); 11172 return -1; 11173 } 11174 11175 String dirName; 11176 try { 11177 dirName = mRestoreTransport.transportDirName(); 11178 } catch (Exception e) { 11179 // Transport went AWOL; fail. 11180 Slog.e(TAG, "Unable to get transport dir for restorePackage: " + e.getMessage()); 11181 return -1; 11182 } 11183 11184 // Stop the session timeout until we finalize the restore 11185 mBackupHandler.removeMessages(MSG_RESTORE_SESSION_TIMEOUT); 11186 11187 // Ready to go: enqueue the restore request and claim success 11188 mWakelock.acquire(); 11189 if (MORE_DEBUG) { 11190 Slog.d(TAG, "restorePackage() : " + packageName); 11191 } 11192 Message msg = mBackupHandler.obtainMessage(MSG_RUN_RESTORE); 11193 msg.obj = new RestoreParams(mRestoreTransport, dirName, observer, monitor, 11194 token, app); 11195 mBackupHandler.sendMessage(msg); 11196 } finally { 11197 Binder.restoreCallingIdentity(oldId); 11198 } 11199 return 0; 11200 } 11201 11202 // Posted to the handler to tear down a restore session in a cleanly synchronized way 11203 class EndRestoreRunnable implements Runnable { 11204 BackupManagerService mBackupManager; 11205 ActiveRestoreSession mSession; 11206 11207 EndRestoreRunnable(BackupManagerService manager, ActiveRestoreSession session) { 11208 mBackupManager = manager; 11209 mSession = session; 11210 } 11211 11212 public void run() { 11213 // clean up the session's bookkeeping 11214 synchronized (mSession) { 11215 mSession.mRestoreTransport = null; 11216 mSession.mEnded = true; 11217 } 11218 11219 // clean up the BackupManagerImpl side of the bookkeeping 11220 // and cancel any pending timeout message 11221 mBackupManager.clearRestoreSession(mSession); 11222 } 11223 } 11224 11225 public synchronized void endRestoreSession() { 11226 if (DEBUG) Slog.d(TAG, "endRestoreSession"); 11227 11228 if (mTimedOut) { 11229 Slog.i(TAG, "Session already timed out"); 11230 return; 11231 } 11232 11233 if (mEnded) { 11234 throw new IllegalStateException("Restore session already ended"); 11235 } 11236 11237 mBackupHandler.post(new EndRestoreRunnable(BackupManagerService.this, this)); 11238 } 11239 } 11240 11241 @Override 11242 public void dump(FileDescriptor fd, PrintWriter pw, String[] args) { 11243 if (!DumpUtils.checkDumpAndUsageStatsPermission(mContext, TAG, pw)) return; 11244 11245 long identityToken = Binder.clearCallingIdentity(); 11246 try { 11247 if (args != null) { 11248 for (String arg : args) { 11249 if ("-h".equals(arg)) { 11250 pw.println("'dumpsys backup' optional arguments:"); 11251 pw.println(" -h : this help text"); 11252 pw.println(" a[gents] : dump information about defined backup agents"); 11253 return; 11254 } else if ("agents".startsWith(arg)) { 11255 dumpAgents(pw); 11256 return; 11257 } 11258 } 11259 } 11260 dumpInternal(pw); 11261 } finally { 11262 Binder.restoreCallingIdentity(identityToken); 11263 } 11264 } 11265 11266 private void dumpAgents(PrintWriter pw) { 11267 List<PackageInfo> agentPackages = allAgentPackages(); 11268 pw.println("Defined backup agents:"); 11269 for (PackageInfo pkg : agentPackages) { 11270 pw.print(" "); 11271 pw.print(pkg.packageName); pw.println(':'); 11272 pw.print(" "); pw.println(pkg.applicationInfo.backupAgentName); 11273 } 11274 } 11275 11276 private void dumpInternal(PrintWriter pw) { 11277 synchronized (mQueueLock) { 11278 pw.println("Backup Manager is " + (mEnabled ? "enabled" : "disabled") 11279 + " / " + (!mProvisioned ? "not " : "") + "provisioned / " 11280 + (this.mPendingInits.size() == 0 ? "not " : "") + "pending init"); 11281 pw.println("Auto-restore is " + (mAutoRestore ? "enabled" : "disabled")); 11282 if (mBackupRunning) pw.println("Backup currently running"); 11283 pw.println("Last backup pass started: " + mLastBackupPass 11284 + " (now = " + System.currentTimeMillis() + ')'); 11285 pw.println(" next scheduled: " + KeyValueBackupJob.nextScheduled()); 11286 11287 pw.println("Transport whitelist:"); 11288 for (ComponentName transport : mTransportManager.getTransportWhitelist()) { 11289 pw.print(" "); 11290 pw.println(transport.flattenToShortString()); 11291 } 11292 11293 pw.println("Available transports:"); 11294 final String[] transports = listAllTransports(); 11295 if (transports != null) { 11296 for (String t : listAllTransports()) { 11297 pw.println((t.equals(mTransportManager.getCurrentTransportName()) ? " * " : " ") + t); 11298 try { 11299 IBackupTransport transport = mTransportManager.getTransportBinder(t); 11300 File dir = new File(mBaseStateDir, transport.transportDirName()); 11301 pw.println(" destination: " + transport.currentDestinationString()); 11302 pw.println(" intent: " + transport.configurationIntent()); 11303 for (File f : dir.listFiles()) { 11304 pw.println(" " + f.getName() + " - " + f.length() + " state bytes"); 11305 } 11306 } catch (Exception e) { 11307 Slog.e(TAG, "Error in transport", e); 11308 pw.println(" Error: " + e); 11309 } 11310 } 11311 } 11312 11313 pw.println("Pending init: " + mPendingInits.size()); 11314 for (String s : mPendingInits) { 11315 pw.println(" " + s); 11316 } 11317 11318 if (DEBUG_BACKUP_TRACE) { 11319 synchronized (mBackupTrace) { 11320 if (!mBackupTrace.isEmpty()) { 11321 pw.println("Most recent backup trace:"); 11322 for (String s : mBackupTrace) { 11323 pw.println(" " + s); 11324 } 11325 } 11326 } 11327 } 11328 11329 pw.print("Ancestral: "); pw.println(Long.toHexString(mAncestralToken)); 11330 pw.print("Current: "); pw.println(Long.toHexString(mCurrentToken)); 11331 11332 int N = mBackupParticipants.size(); 11333 pw.println("Participants:"); 11334 for (int i=0; i<N; i++) { 11335 int uid = mBackupParticipants.keyAt(i); 11336 pw.print(" uid: "); 11337 pw.println(uid); 11338 HashSet<String> participants = mBackupParticipants.valueAt(i); 11339 for (String app: participants) { 11340 pw.println(" " + app); 11341 } 11342 } 11343 11344 pw.println("Ancestral packages: " 11345 + (mAncestralPackages == null ? "none" : mAncestralPackages.size())); 11346 if (mAncestralPackages != null) { 11347 for (String pkg : mAncestralPackages) { 11348 pw.println(" " + pkg); 11349 } 11350 } 11351 11352 pw.println("Ever backed up: " + mEverStoredApps.size()); 11353 for (String pkg : mEverStoredApps) { 11354 pw.println(" " + pkg); 11355 } 11356 11357 pw.println("Pending key/value backup: " + mPendingBackups.size()); 11358 for (BackupRequest req : mPendingBackups.values()) { 11359 pw.println(" " + req); 11360 } 11361 11362 pw.println("Full backup queue:" + mFullBackupQueue.size()); 11363 for (FullBackupEntry entry : mFullBackupQueue) { 11364 pw.print(" "); pw.print(entry.lastBackup); 11365 pw.print(" : "); pw.println(entry.packageName); 11366 } 11367 } 11368 } 11369 11370 private static void sendBackupOnUpdate(IBackupObserver observer, String packageName, 11371 BackupProgress progress) { 11372 if (observer != null) { 11373 try { 11374 observer.onUpdate(packageName, progress); 11375 } catch (RemoteException e) { 11376 if (DEBUG) { 11377 Slog.w(TAG, "Backup observer went away: onUpdate"); 11378 } 11379 } 11380 } 11381 } 11382 11383 private static void sendBackupOnPackageResult(IBackupObserver observer, String packageName, 11384 int status) { 11385 if (observer != null) { 11386 try { 11387 observer.onResult(packageName, status); 11388 } catch (RemoteException e) { 11389 if (DEBUG) { 11390 Slog.w(TAG, "Backup observer went away: onResult"); 11391 } 11392 } 11393 } 11394 } 11395 11396 private static void sendBackupFinished(IBackupObserver observer, int status) { 11397 if (observer != null) { 11398 try { 11399 observer.backupFinished(status); 11400 } catch (RemoteException e) { 11401 if (DEBUG) { 11402 Slog.w(TAG, "Backup observer went away: backupFinished"); 11403 } 11404 } 11405 } 11406 } 11407 11408 private Bundle putMonitoringExtra(Bundle extras, String key, String value) { 11409 if (extras == null) { 11410 extras = new Bundle(); 11411 } 11412 extras.putString(key, value); 11413 return extras; 11414 } 11415 11416 private Bundle putMonitoringExtra(Bundle extras, String key, int value) { 11417 if (extras == null) { 11418 extras = new Bundle(); 11419 } 11420 extras.putInt(key, value); 11421 return extras; 11422 } 11423 11424 private Bundle putMonitoringExtra(Bundle extras, String key, long value) { 11425 if (extras == null) { 11426 extras = new Bundle(); 11427 } 11428 extras.putLong(key, value); 11429 return extras; 11430 } 11431 11432 11433 private Bundle putMonitoringExtra(Bundle extras, String key, boolean value) { 11434 if (extras == null) { 11435 extras = new Bundle(); 11436 } 11437 extras.putBoolean(key, value); 11438 return extras; 11439 } 11440 11441 private static IBackupManagerMonitor monitorEvent(IBackupManagerMonitor monitor, int id, 11442 PackageInfo pkg, int category, Bundle extras) { 11443 if (monitor != null) { 11444 try { 11445 Bundle bundle = new Bundle(); 11446 bundle.putInt(BackupManagerMonitor.EXTRA_LOG_EVENT_ID, id); 11447 bundle.putInt(BackupManagerMonitor.EXTRA_LOG_EVENT_CATEGORY, category); 11448 if (pkg != null) { 11449 bundle.putString(EXTRA_LOG_EVENT_PACKAGE_NAME, 11450 pkg.packageName); 11451 bundle.putInt(BackupManagerMonitor.EXTRA_LOG_EVENT_PACKAGE_VERSION, 11452 pkg.versionCode); 11453 } 11454 if (extras != null) { 11455 bundle.putAll(extras); 11456 } 11457 monitor.onEvent(bundle); 11458 return monitor; 11459 } catch(RemoteException e) { 11460 if (DEBUG) { 11461 Slog.w(TAG, "backup manager monitor went away"); 11462 } 11463 } 11464 } 11465 return null; 11466 } 11467 11468 @Override 11469 public IBackupManager getBackupManagerBinder() { 11470 return mBackupManagerBinder; 11471 } 11472 11473} 11474