From 09dfe6739ae4cac8728f9f769a35c8d0d259630e Mon Sep 17 00:00:00 2001
From: Nicolas Geoffray <ngeoffray@google.com>
Date: Thu, 7 Sep 2017 14:45:02 +0100
Subject: [PATCH] Make privileged apps always keep uncompressed dex files.

To ensure the verified boot work does not make ART run
dex code uncompressed in memory, make the build system
generate uncompressed dex files in APKs.

The alignment of STORE files in an APK is already handled.

bug: 30972906
bug: 63920015

Test: doing zipinfo on the produced apks after build.
Change-Id: I0ccdeae5d674b2a409a1343c4a14699c7bf0defb
---
 core/base_rules.mk        |  9 +++++++++
 core/definitions.mk       | 12 ++++++++++++
 core/package_internal.mk  |  4 ++++
 core/prebuilt_internal.mk |  3 +++
 4 files changed, 28 insertions(+)

diff --git a/core/base_rules.mk b/core/base_rules.mk
index 57ac23c980..e7da560c90 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -659,6 +659,15 @@ $(LOCAL_MODULE)-$(h_or_hc_or_t)$(my_32_64_bit_suffix) : $(my_all_targets)
 endif
 endif
 
+###########################################################
+# Ensure privileged applications always have LOCAL_PRIVILEGED_MODULE
+###########################################################
+ifndef LOCAL_PRIVILEGED_MODULE
+  ifneq (,$(filter $(TARGET_OUT_APPS_PRIVILEGED)/% $(TARGET_OUT_VENDOR_APPS_PRIVILEGED)/%,$(my_module_path)))
+    LOCAL_PRIVILEGED_MODULE := true
+  endif
+endif
+
 ###########################################################
 ## NOTICE files
 ###########################################################
diff --git a/core/definitions.mk b/core/definitions.mk
index ffeb66381a..13c0e48b71 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2717,6 +2717,18 @@ define remove-timestamps-from-package
 $(hide) $(ZIPTIME) $@
 endef
 
+# Uncompress dex files embedded in an apk.
+#
+define uncompress-dexs
+$(hide) if (zipinfo $@ '*.dex' 2>/dev/null | grep -v ' stor ' >/dev/null) ; then \
+  rm -rf $(dir $@)uncompresseddexs && mkdir $(dir $@)uncompresseddexs; \
+  unzip $@ '*.dex' -d $(dir $@)uncompresseddexs && \
+  zip -d $@ '*.dex' && \
+  ( cd $(dir $@)uncompresseddexs && find -type f | sort | zip -D -X -0 ../$(notdir $@) -@ ) && \
+  rm -rf $(dir $@)uncompresseddexs; \
+  fi
+endef
+
 # Uncompress shared libraries embedded in an apk.
 #
 define uncompress-shared-libs
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 11138db190..9f9f041b8e 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -606,6 +606,10 @@ ifneq ($(BUILD_PLATFORM_ZIP),)
 	@# Keep a copy of apk with classes.dex unstripped
 	$(hide) cp -f $@ $(dir $@)package.dex.apk
 endif  # BUILD_PLATFORM_ZIP
+ifeq (true,$(LOCAL_PRIVILEGED_MODULE))
+	@# No need to align, sign-package below will do it.
+	$(uncompress-dexs)
+endif  # LOCAL_PRIVILEGED_MODULE
 ifneq (nostripping,$(LOCAL_DEX_PREOPT))
 	$(call dexpreopt-remove-classes.dex,$@)
 endif
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index 5a0ac37517..a5695584cf 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -341,6 +341,9 @@ $(built_module): PRIVATE_EMBEDDED_JNI_LIBS := $(embedded_prebuilt_jni_libs)
 $(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) $(SIGNAPK_JAR)
 	$(transform-prebuilt-to-target)
 	$(uncompress-shared-libs)
+ifeq (true,$(LOCAL_PRIVILEGED_MODULE))
+	$(uncompress-dexs)
+endif  # LOCAL_PRIVILEGED_MODULE
 ifdef LOCAL_DEX_PREOPT
 ifneq ($(BUILD_PLATFORM_ZIP),)
 	@# Keep a copy of apk with classes.dex unstripped