minelf/Retouch.c - platform/bootable/recovery - Git at Google

 /*
  * Copyright (C) 2009 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <errno.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <string.h>
 #include <strings.h>
 #include "Retouch.h"
 #include "applypatch/applypatch.h"

 typedef struct {
     int32_t mmap_addr;
     char tag[4]; /* 'P', 'R', 'E', ' ' */
 } prelink_info_t __attribute__((packed));

 #define false 0
 #define true 1

 static int32_t offs_prev;
 static uint32_t cont_prev;

 static void init_compression_state(void) {
     offs_prev = 0;
     cont_prev = 0;
 }

 // For details on the encoding used for relocation lists, please
 // refer to build/tools/retouch/retouch-prepare.c. The intent is to
 // save space by removing most of the inherent redundancy.

 static void decode_bytes(uint8_t *encoded_bytes, int encoded_size,
                          int32_t *dst_offset, uint32_t *dst_contents) {
     if (encoded_size == 2) {
         *dst_offset = offs_prev + (((encoded_bytes[0]&0x60)>>5)+1)*4;

         // if the original was negative, we need to 1-pad before applying delta
         int32_t tmp = (((encoded_bytes[0] & 0x0000001f) << 8) |
                        encoded_bytes[1]);
         if (tmp & 0x1000) tmp = 0xffffe000 | tmp;
         *dst_contents = cont_prev + tmp;
     } else if (encoded_size == 3) {
         *dst_offset = offs_prev + (((encoded_bytes[0]&0x30)>>4)+1)*4;

         // if the original was negative, we need to 1-pad before applying delta
         int32_t tmp = (((encoded_bytes[0] & 0x0000000f) << 16) |
                        (encoded_bytes[1] << 8) |
                        encoded_bytes[2]);
         if (tmp & 0x80000) tmp = 0xfff00000 | tmp;
         *dst_contents = cont_prev + tmp;
     } else {
         *dst_offset =
           (encoded_bytes[0]<<24) |
           (encoded_bytes[1]<<16) |
           (encoded_bytes[2]<<8) |
           encoded_bytes[3];
         if (*dst_offset == 0x3fffffff) *dst_offset = -1;
         *dst_contents =
           (encoded_bytes[4]<<24) |
           (encoded_bytes[5]<<16) |
           (encoded_bytes[6]<<8) |
           encoded_bytes[7];
     }
 }

 static uint8_t *decode_in_memory(uint8_t *encoded_bytes,
                                  int32_t *offset, uint32_t *contents) {
     int input_size, charIx;
     uint8_t input[8];

     input[0] = *(encoded_bytes++);
     if (input[0] & 0x80)
         input_size = 2;
     else if (input[0] & 0x40)
         input_size = 3;
     else
         input_size = 8;

     // we already read one byte..
     charIx = 1;
     while (charIx < input_size) {
         input[charIx++] = *(encoded_bytes++);
     }

     // depends on the decoder state!
     decode_bytes(input, input_size, offset, contents);

     offs_prev = *offset;
     cont_prev = *contents;

     return encoded_bytes;
 }

 int retouch_mask_data(uint8_t *binary_object,
                       int32_t binary_size,
                       int32_t *desired_offset,
                       int32_t *retouch_offset) {
     retouch_info_t *r_info;
     prelink_info_t *p_info;

     int32_t target_offset = 0;
     if (desired_offset) target_offset = *desired_offset;

     int32_t p_offs = binary_size-sizeof(prelink_info_t); // prelink_info_t
     int32_t r_offs = p_offs-sizeof(retouch_info_t); // retouch_info_t
     int32_t b_offs; // retouch data blob

     // If not retouched, we say it was a match. This might get invoked on
     // non-retouched binaries, so that's why we need to do this.
     if (retouch_offset != NULL) *retouch_offset = target_offset;
     if (r_offs < 0) return (desired_offset == NULL) ?
                       RETOUCH_DATA_NOTAPPLICABLE : RETOUCH_DATA_MATCHED;
     p_info = (prelink_info_t *)(binary_object+p_offs);
     r_info = (retouch_info_t *)(binary_object+r_offs);
     if (strncmp(p_info->tag, "PRE ", 4) ||
         strncmp(r_info->tag, "RETOUCH ", 8))
         return (desired_offset == NULL) ?
           RETOUCH_DATA_NOTAPPLICABLE : RETOUCH_DATA_MATCHED;

     b_offs = r_offs-r_info->blob_size;
     if (b_offs < 0) {
         printf("negative binary offset: %d = %d - %d\n",
                b_offs, r_offs, r_info->blob_size);
         return RETOUCH_DATA_ERROR;
     }
     uint8_t *b_ptr = binary_object+b_offs;

     // Retouched: let's go through the work then.
     int32_t offset_candidate = target_offset;
     bool offset_set = false, offset_mismatch = false;
     init_compression_state();
     while (b_ptr < (uint8_t *)r_info) {
         int32_t retouch_entry_offset;
         uint32_t *retouch_entry;
         uint32_t retouch_original_value;

         b_ptr = decode_in_memory(b_ptr,
                                  &retouch_entry_offset,
                                  &retouch_original_value);
         if (retouch_entry_offset < (-1) ||
             retouch_entry_offset >= b_offs) {
             printf("bad retouch_entry_offset: %d", retouch_entry_offset);
             return RETOUCH_DATA_ERROR;
         }

         // "-1" means this is the value in prelink_info_t, which also gets
         // randomized.
         if (retouch_entry_offset == -1)
             retouch_entry = (uint32_t *)&(p_info->mmap_addr);
         else
             retouch_entry = (uint32_t *)(binary_object+retouch_entry_offset);

         if (desired_offset)
             *retouch_entry = retouch_original_value + target_offset;

         // Infer the randomization shift, compare to previously inferred.
         int32_t offset_of_this_entry = (int32_t)(*retouch_entry-
                                                  retouch_original_value);
         if (!offset_set) {
             offset_candidate = offset_of_this_entry;
             offset_set = true;
         } else {
             if (offset_candidate != offset_of_this_entry) {
                 offset_mismatch = true;
                 printf("offset is mismatched: %d, this entry is %d,"
                        " original 0x%x @ 0x%x",
                        offset_candidate, offset_of_this_entry,
                        retouch_original_value, retouch_entry_offset);
             }
         }
     }
     if (b_ptr > (uint8_t *)r_info) {
         printf("b_ptr went too far: %p, while r_info is %p",
                b_ptr, r_info);
         return RETOUCH_DATA_ERROR;
     }

     if (offset_mismatch) return RETOUCH_DATA_MISMATCHED;
     if (retouch_offset != NULL) *retouch_offset = offset_candidate;
     return RETOUCH_DATA_MATCHED;
 }

 // On success, _override is set to the offset that was actually applied.
 // This implies that once we randomize to an offset we stick with it.
 // This in turn is necessary in order to guarantee recovery after crash.
 bool retouch_one_library(const char *binary_name,
                          const char *binary_sha1,
                          int32_t retouch_offset,
                          int32_t *retouch_offset_override) {
     bool success = true;
     int result;

     FileContents file;
     file.data = NULL;

     char binary_name_atomic[strlen(binary_name)+10];
     strcpy(binary_name_atomic, binary_name);
     strcat(binary_name_atomic, ".atomic");

     // We need a path that exists for calling statfs() later.
     //
     // Assume that binary_name (eg "/system/app/Foo.apk") is located
     // on the same filesystem as its top-level directory ("/system").
     char target_fs[strlen(binary_name)+1];
     char* slash = strchr(binary_name+1, '/');
     if (slash != NULL) {
         int count = slash - binary_name;
         strncpy(target_fs, binary_name, count);
         target_fs[count] = '\0';
     } else {
         strcpy(target_fs, binary_name);
     }

     result = LoadFileContents(binary_name, &file, RETOUCH_DONT_MASK);

     if (result == 0) {
         // Figure out the *apparent* offset to which this file has been
         // retouched. If it looks good, we will skip processing (we might
         // have crashed and during this recovery pass we don't want to
         // overwrite a valuable saved file in /cache---which would happen
         // if we blindly retouch everything again). NOTE: This implies
         // that we might have to override the supplied retouch offset. We
         // can do the override only once though: everything should match
         // afterward.

         int32_t inferred_offset;
         int retouch_probe_result = retouch_mask_data(file.data,
                                                      file.size,
                                                      NULL,
                                                      &inferred_offset);

         if (retouch_probe_result == RETOUCH_DATA_MATCHED) {
             if ((retouch_offset == inferred_offset) ||
                 ((retouch_offset != 0 && inferred_offset != 0) &&
                  (retouch_offset_override != NULL))) {
                 // This file is OK already and we are allowed to override.
                 // Let's just return the offset override value. It is critical
                 // to skip regardless of override: a broken file might need
                 // recovery down the list and we should not mess up the saved
                 // copy by doing unnecessary retouching.
                 //
                 // NOTE: If retouching was already started with a different
                 // value, we will not be allowed to override. This happens
                 // if on the retouch list there is a patched binary (which is
                 // masked in apply_patch()) before there is a non-patched
                 // binary.
                 if (retouch_offset_override != NULL)
                     *retouch_offset_override = inferred_offset;
                 success = true;
                 goto out;
             } else {
                 // Retouch to zero (mask the retouching), to make sure that
                 // the SHA-1 check will pass below.
                 int32_t zero = 0;
                 retouch_mask_data(file.data, file.size, &zero, NULL);
                 SHA(file.data, file.size, file.sha1);
             }
         }

         if (retouch_probe_result == RETOUCH_DATA_NOTAPPLICABLE) {
             // In the case of not retouchable, fake it. We do not want
             // to do the normal processing and overwrite the backup file:
             // we might be recovering!
             //
             // We return a zero override, which tells the caller that we
             // simply skipped the file.
             if (retouch_offset_override != NULL)
                 *retouch_offset_override = 0;
             success = true;
             goto out;
         }

         // If we get here, either there was a mismatch in the offset, or
         // the file has not been processed yet. Continue with normal
         // processing.
     }

     if (result != 0 || FindMatchingPatch(file.sha1, &binary_sha1, 1) < 0) {
         free(file.data);
         printf("Attempting to recover source from '%s' ...\n",
                CACHE_TEMP_SOURCE);
         result = LoadFileContents(CACHE_TEMP_SOURCE, &file, RETOUCH_DO_MASK);
         if (result != 0 || FindMatchingPatch(file.sha1, &binary_sha1, 1) < 0) {
             printf(" failed.\n");
             success = false;
             goto out;
         }
         printf(" succeeded.\n");
     }

     // Retouch in-memory before worrying about backing up the original.
     //
     // Recovery steps will be oblivious to the actual retouch offset used,
     // so might as well write out the already-retouched copy. Then, in the
     // usual case, we will just swap the file locally, with no more writes
     // needed. In the no-free-space case, we will then write the same to the
     // original location.

     result = retouch_mask_data(file.data, file.size, &retouch_offset, NULL);
     if (result != RETOUCH_DATA_MATCHED) {
         success = false;
         goto out;
     }
     if (retouch_offset_override != NULL)
         *retouch_offset_override = retouch_offset;

     // How much free space do we need?
     bool enough_space = false;
     size_t free_space = FreeSpaceForFile(target_fs);
     // 50% margin when estimating the space needed.
     enough_space = (free_space > (file.size * 3 / 2));

     // The experts say we have to allow for a retry of the
     // whole process to avoid filesystem weirdness.
     int retry = 1;
     bool made_copy = false;
     do {
         // First figure out where to store a copy of the original.
         // Ideally leave the original itself intact until the
         // atomic swap. If no room on the same partition, fall back
         // to the cache partition and remove the original.

         if (!enough_space) {
             printf("Target is %ldB; free space is %ldB: not enough.\n",
                    (long)file.size, (long)free_space);

             retry = 0;
             if (MakeFreeSpaceOnCache(file.size) < 0) {
                 printf("Not enough free space on '/cache'.\n");
                 success = false;
                 goto out;
             }
             if (SaveFileContents(CACHE_TEMP_SOURCE, file) < 0) {
                 printf("Failed to back up source file.\n");
                 success = false;
                 goto out;
             }
             made_copy = true;
             unlink(binary_name);

             size_t free_space = FreeSpaceForFile(target_fs);
             printf("(now %ld bytes free for target)\n", (long)free_space);
         }

         result = SaveFileContents(binary_name_atomic, file);
         if (result != 0) {
             // Maybe the filesystem was optimistic: retry.
             enough_space = false;
             unlink(binary_name_atomic);
             printf("Saving the retouched contents failed; retrying.\n");
             continue;
         }

         // Succeeded; no need to retry.
         break;
     } while (retry-- > 0);

     // Give the .atomic file the same owner, group, and mode of the
     // original source file.
     if (chmod(binary_name_atomic, file.st.st_mode) != 0) {
         printf("chmod of \"%s\" failed: %s\n",
                binary_name_atomic, strerror(errno));
         success = false;
         goto out;
     }
     if (chown(binary_name_atomic, file.st.st_uid, file.st.st_gid) != 0) {
         printf("chown of \"%s\" failed: %s\n",
                binary_name_atomic,
                strerror(errno));
         success = false;
         goto out;
     }

     // Finally, rename the .atomic file to replace the target file.
     if (rename(binary_name_atomic, binary_name) != 0) {
         printf("rename of .atomic to \"%s\" failed: %s\n",
                binary_name, strerror(errno));
         success = false;
         goto out;
     }

     // If this run created a copy, and we're here, we can delete it.
     if (made_copy) unlink(CACHE_TEMP_SOURCE);

   out:
     // clean up
     free(file.data);
     unlink(binary_name_atomic);

     return success;
 }
	/*
	* Copyright (C) 2009 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <errno.h>
	#include <sys/stat.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <unistd.h>
	#include <string.h>
	#include <strings.h>
	#include "Retouch.h"
	#include "applypatch/applypatch.h"

	typedef struct {
	int32_t mmap_addr;
	char tag[4]; /* 'P', 'R', 'E', ' ' */
	} prelink_info_t __attribute__((packed));

	#define false 0
	#define true 1

	static int32_t offs_prev;
	static uint32_t cont_prev;

	static void init_compression_state(void) {
	offs_prev = 0;
	cont_prev = 0;
	}

	// For details on the encoding used for relocation lists, please
	// refer to build/tools/retouch/retouch-prepare.c. The intent is to
	// save space by removing most of the inherent redundancy.

	static void decode_bytes(uint8_t *encoded_bytes, int encoded_size,
	int32_t dst_offset, uint32_t dst_contents) {
	if (encoded_size == 2) {
	dst_offset = offs_prev + (((encoded_bytes[0]&0x60)>>5)+1)4;

	// if the original was negative, we need to 1-pad before applying delta
	int32_t tmp = (((encoded_bytes[0] & 0x0000001f) << 8) \|
	encoded_bytes[1]);
	if (tmp & 0x1000) tmp = 0xffffe000 \| tmp;
	*dst_contents = cont_prev + tmp;
	} else if (encoded_size == 3) {
	dst_offset = offs_prev + (((encoded_bytes[0]&0x30)>>4)+1)4;

	// if the original was negative, we need to 1-pad before applying delta
	int32_t tmp = (((encoded_bytes[0] & 0x0000000f) << 16) \|
	(encoded_bytes[1] << 8) \|
	encoded_bytes[2]);
	if (tmp & 0x80000) tmp = 0xfff00000 \| tmp;
	*dst_contents = cont_prev + tmp;
	} else {
	*dst_offset =
	(encoded_bytes[0]<<24) \|
	(encoded_bytes[1]<<16) \|
	(encoded_bytes[2]<<8) \|
	encoded_bytes[3];
	if (dst_offset == 0x3fffffff) dst_offset = -1;
	*dst_contents =
	(encoded_bytes[4]<<24) \|
	(encoded_bytes[5]<<16) \|
	(encoded_bytes[6]<<8) \|
	encoded_bytes[7];
	}
	}

	static uint8_t decode_in_memory(uint8_t encoded_bytes,
	int32_t offset, uint32_t contents) {
	int input_size, charIx;
	uint8_t input[8];

	input[0] = *(encoded_bytes++);
	if (input[0] & 0x80)
	input_size = 2;
	else if (input[0] & 0x40)
	input_size = 3;
	else
	input_size = 8;

	// we already read one byte..
	charIx = 1;
	while (charIx < input_size) {
	input[charIx++] = *(encoded_bytes++);
	}

	// depends on the decoder state!
	decode_bytes(input, input_size, offset, contents);

	offs_prev = *offset;
	cont_prev = *contents;

	return encoded_bytes;
	}

	int retouch_mask_data(uint8_t *binary_object,
	int32_t binary_size,
	int32_t *desired_offset,
	int32_t *retouch_offset) {
	retouch_info_t *r_info;
	prelink_info_t *p_info;

	int32_t target_offset = 0;
	if (desired_offset) target_offset = *desired_offset;

	int32_t p_offs = binary_size-sizeof(prelink_info_t); // prelink_info_t
	int32_t r_offs = p_offs-sizeof(retouch_info_t); // retouch_info_t
	int32_t b_offs; // retouch data blob

	// If not retouched, we say it was a match. This might get invoked on
	// non-retouched binaries, so that's why we need to do this.
	if (retouch_offset != NULL) *retouch_offset = target_offset;
	if (r_offs < 0) return (desired_offset == NULL) ?
	RETOUCH_DATA_NOTAPPLICABLE : RETOUCH_DATA_MATCHED;
	p_info = (prelink_info_t *)(binary_object+p_offs);
	r_info = (retouch_info_t *)(binary_object+r_offs);
	if (strncmp(p_info->tag, "PRE ", 4) \|\|
	strncmp(r_info->tag, "RETOUCH ", 8))
	return (desired_offset == NULL) ?
	RETOUCH_DATA_NOTAPPLICABLE : RETOUCH_DATA_MATCHED;

	b_offs = r_offs-r_info->blob_size;
	if (b_offs < 0) {
	printf("negative binary offset: %d = %d - %d\n",
	b_offs, r_offs, r_info->blob_size);
	return RETOUCH_DATA_ERROR;
	}
	uint8_t *b_ptr = binary_object+b_offs;

	// Retouched: let's go through the work then.
	int32_t offset_candidate = target_offset;
	bool offset_set = false, offset_mismatch = false;
	init_compression_state();
	while (b_ptr < (uint8_t *)r_info) {
	int32_t retouch_entry_offset;
	uint32_t *retouch_entry;
	uint32_t retouch_original_value;

	b_ptr = decode_in_memory(b_ptr,
	&retouch_entry_offset,
	&retouch_original_value);
	if (retouch_entry_offset < (-1) \|\|
	retouch_entry_offset >= b_offs) {
	printf("bad retouch_entry_offset: %d", retouch_entry_offset);
	return RETOUCH_DATA_ERROR;
	}

	// "-1" means this is the value in prelink_info_t, which also gets
	// randomized.
	if (retouch_entry_offset == -1)
	retouch_entry = (uint32_t *)&(p_info->mmap_addr);
	else
	retouch_entry = (uint32_t *)(binary_object+retouch_entry_offset);

	if (desired_offset)
	*retouch_entry = retouch_original_value + target_offset;

	// Infer the randomization shift, compare to previously inferred.
	int32_t offset_of_this_entry = (int32_t)(*retouch_entry-
	retouch_original_value);
	if (!offset_set) {
	offset_candidate = offset_of_this_entry;
	offset_set = true;
	} else {
	if (offset_candidate != offset_of_this_entry) {
	offset_mismatch = true;
	printf("offset is mismatched: %d, this entry is %d,"
	" original 0x%x @ 0x%x",
	offset_candidate, offset_of_this_entry,
	retouch_original_value, retouch_entry_offset);
	}
	}
	}
	if (b_ptr > (uint8_t *)r_info) {
	printf("b_ptr went too far: %p, while r_info is %p",
	b_ptr, r_info);
	return RETOUCH_DATA_ERROR;
	}

	if (offset_mismatch) return RETOUCH_DATA_MISMATCHED;
	if (retouch_offset != NULL) *retouch_offset = offset_candidate;
	return RETOUCH_DATA_MATCHED;
	}

	// On success, _override is set to the offset that was actually applied.
	// This implies that once we randomize to an offset we stick with it.
	// This in turn is necessary in order to guarantee recovery after crash.
	bool retouch_one_library(const char *binary_name,
	const char *binary_sha1,
	int32_t retouch_offset,
	int32_t *retouch_offset_override) {
	bool success = true;
	int result;

	FileContents file;
	file.data = NULL;

	char binary_name_atomic[strlen(binary_name)+10];
	strcpy(binary_name_atomic, binary_name);
	strcat(binary_name_atomic, ".atomic");

	// We need a path that exists for calling statfs() later.
	//
	// Assume that binary_name (eg "/system/app/Foo.apk") is located
	// on the same filesystem as its top-level directory ("/system").
	char target_fs[strlen(binary_name)+1];
	char* slash = strchr(binary_name+1, '/');
	if (slash != NULL) {
	int count = slash - binary_name;
	strncpy(target_fs, binary_name, count);
	target_fs[count] = '\0';
	} else {
	strcpy(target_fs, binary_name);
	}

	result = LoadFileContents(binary_name, &file, RETOUCH_DONT_MASK);

	if (result == 0) {
	// Figure out the apparent offset to which this file has been
	// retouched. If it looks good, we will skip processing (we might
	// have crashed and during this recovery pass we don't want to
	// overwrite a valuable saved file in /cache---which would happen
	// if we blindly retouch everything again). NOTE: This implies
	// that we might have to override the supplied retouch offset. We
	// can do the override only once though: everything should match
	// afterward.

	int32_t inferred_offset;
	int retouch_probe_result = retouch_mask_data(file.data,
	file.size,
	NULL,
	&inferred_offset);

	if (retouch_probe_result == RETOUCH_DATA_MATCHED) {
	if ((retouch_offset == inferred_offset) \|\|
	((retouch_offset != 0 && inferred_offset != 0) &&
	(retouch_offset_override != NULL))) {
	// This file is OK already and we are allowed to override.
	// Let's just return the offset override value. It is critical
	// to skip regardless of override: a broken file might need
	// recovery down the list and we should not mess up the saved
	// copy by doing unnecessary retouching.
	//
	// NOTE: If retouching was already started with a different
	// value, we will not be allowed to override. This happens
	// if on the retouch list there is a patched binary (which is
	// masked in apply_patch()) before there is a non-patched
	// binary.
	if (retouch_offset_override != NULL)
	*retouch_offset_override = inferred_offset;
	success = true;
	goto out;
	} else {
	// Retouch to zero (mask the retouching), to make sure that
	// the SHA-1 check will pass below.
	int32_t zero = 0;
	retouch_mask_data(file.data, file.size, &zero, NULL);
	SHA(file.data, file.size, file.sha1);
	}
	}

	if (retouch_probe_result == RETOUCH_DATA_NOTAPPLICABLE) {
	// In the case of not retouchable, fake it. We do not want
	// to do the normal processing and overwrite the backup file:
	// we might be recovering!
	//
	// We return a zero override, which tells the caller that we
	// simply skipped the file.
	if (retouch_offset_override != NULL)
	*retouch_offset_override = 0;
	success = true;
	goto out;
	}

	// If we get here, either there was a mismatch in the offset, or
	// the file has not been processed yet. Continue with normal
	// processing.
	}

	if (result != 0 \|\| FindMatchingPatch(file.sha1, &binary_sha1, 1) < 0) {
	free(file.data);
	printf("Attempting to recover source from '%s' ...\n",
	CACHE_TEMP_SOURCE);
	result = LoadFileContents(CACHE_TEMP_SOURCE, &file, RETOUCH_DO_MASK);
	if (result != 0 \|\| FindMatchingPatch(file.sha1, &binary_sha1, 1) < 0) {
	printf(" failed.\n");
	success = false;
	goto out;
	}
	printf(" succeeded.\n");
	}

	// Retouch in-memory before worrying about backing up the original.
	//
	// Recovery steps will be oblivious to the actual retouch offset used,
	// so might as well write out the already-retouched copy. Then, in the
	// usual case, we will just swap the file locally, with no more writes
	// needed. In the no-free-space case, we will then write the same to the
	// original location.

	result = retouch_mask_data(file.data, file.size, &retouch_offset, NULL);
	if (result != RETOUCH_DATA_MATCHED) {
	success = false;
	goto out;
	}
	if (retouch_offset_override != NULL)
	*retouch_offset_override = retouch_offset;

	// How much free space do we need?
	bool enough_space = false;
	size_t free_space = FreeSpaceForFile(target_fs);
	// 50% margin when estimating the space needed.
	enough_space = (free_space > (file.size * 3 / 2));

	// The experts say we have to allow for a retry of the
	// whole process to avoid filesystem weirdness.
	int retry = 1;
	bool made_copy = false;
	do {
	// First figure out where to store a copy of the original.
	// Ideally leave the original itself intact until the
	// atomic swap. If no room on the same partition, fall back
	// to the cache partition and remove the original.

	if (!enough_space) {
	printf("Target is %ldB; free space is %ldB: not enough.\n",
	(long)file.size, (long)free_space);

	retry = 0;
	if (MakeFreeSpaceOnCache(file.size) < 0) {
	printf("Not enough free space on '/cache'.\n");
	success = false;
	goto out;
	}
	if (SaveFileContents(CACHE_TEMP_SOURCE, file) < 0) {
	printf("Failed to back up source file.\n");
	success = false;
	goto out;
	}
	made_copy = true;
	unlink(binary_name);

	size_t free_space = FreeSpaceForFile(target_fs);
	printf("(now %ld bytes free for target)\n", (long)free_space);
	}

	result = SaveFileContents(binary_name_atomic, file);
	if (result != 0) {
	// Maybe the filesystem was optimistic: retry.
	enough_space = false;
	unlink(binary_name_atomic);
	printf("Saving the retouched contents failed; retrying.\n");
	continue;
	}

	// Succeeded; no need to retry.
	break;
	} while (retry-- > 0);

	// Give the .atomic file the same owner, group, and mode of the
	// original source file.
	if (chmod(binary_name_atomic, file.st.st_mode) != 0) {
	printf("chmod of \"%s\" failed: %s\n",
	binary_name_atomic, strerror(errno));
	success = false;
	goto out;
	}
	if (chown(binary_name_atomic, file.st.st_uid, file.st.st_gid) != 0) {
	printf("chown of \"%s\" failed: %s\n",
	binary_name_atomic,
	strerror(errno));
	success = false;
	goto out;
	}

	// Finally, rename the .atomic file to replace the target file.
	if (rename(binary_name_atomic, binary_name) != 0) {
	printf("rename of .atomic to \"%s\" failed: %s\n",
	binary_name, strerror(errno));
	success = false;
	goto out;
	}

	// If this run created a copy, and we're here, we can delete it.
	if (made_copy) unlink(CACHE_TEMP_SOURCE);

	out:
	// clean up
	free(file.data);
	unlink(binary_name_atomic);

	return success;
	}