11 files changed, 528 insertions, 100 deletions

diff --git a/Android.mk b/Android.mk
index 3b29c7acc..95c190ea8 100644
--- a/Android.mk
+++ b/Android.mk
@@ -196,6 +196,11 @@ LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/sbin
 #else
 #  LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_UI_LIB)
 #endif
+ifeq ($(TARGET_RECOVERY_TWRP_LIB),)
+    LOCAL_SRC_FILES += BasePartition.cpp
+else
+    LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_TWRP_LIB)
+endif
 
 LOCAL_C_INCLUDES += system/extras/ext4_utils
 
@@ -302,6 +307,9 @@ ifeq ($(TW_INCLUDE_CRYPTO), true)
         TW_INCLUDE_CRYPTO_FBE := true
         LOCAL_CFLAGS += -DTW_INCLUDE_FBE
         LOCAL_SHARED_LIBRARIES += libe4crypt
+        ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+            LOCAL_CFLAGS += -DTW_INCLUDE_FBE_METADATA_DECRYPT
+        endif
     endif
     ifneq ($(TW_CRYPTO_USE_SYSTEM_VOLD),)
     ifneq ($(TW_CRYPTO_USE_SYSTEM_VOLD),false)
@@ -482,6 +490,9 @@ ifeq ($(shell test $(CM_PLATFORM_SDK_VERSION) -ge 3; echo $$?),0)
         fsck.f2fs \
         mkfs.f2fs
 endif
+ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+    LOCAL_REQUIRED_MODULES += sload.f2fs
+endif
 endif
 
 ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 25; echo $$?),0)
diff --git a/BasePartition.cpp b/BasePartition.cpp
new file mode 100644
index 000000000..3b34d75c2
--- /dev/null
+++ b/BasePartition.cpp
@@ -0,0 +1,28 @@
+/*
+	Copyright 2018 TeamWin
+	This file is part of TWRP/TeamWin Recovery Project.
+
+	TWRP is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	TWRP is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with TWRP.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+
+#include "partitions.hpp"
+
+// On devices that need it, this is supposed to be overridden using
+// TARGET_RECOVERY_TWRP_LIB to allow device-specific pre and post
+// wipe encryption calls.
+
+BasePartition* make_partition() {
+  return new BasePartition();
+}
diff --git a/crypto/ext4crypt/Android.mk b/crypto/ext4crypt/Android.mk
index e589903d9..8e77cdf30 100644
--- a/crypto/ext4crypt/Android.mk
+++ b/crypto/ext4crypt/Android.mk
@@ -21,7 +21,7 @@ ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 26; echo $$?),0)
     ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
         #9.0 rules
         LOCAL_CFLAGS += -DUSE_KEYSTORAGE_4 -Wno-unused-variable -Wno-sign-compare -Wno-unused-parameter -Wno-comment
-        LOCAL_SRC_FILES += Ext4CryptPie.cpp Keymaster4.cpp KeyStorage4.cpp KeyUtil.cpp
+        LOCAL_SRC_FILES += Ext4CryptPie.cpp Keymaster4.cpp KeyStorage4.cpp KeyUtil.cpp MetadataCrypt.cpp KeyBuffer.cpp
         LOCAL_SHARED_LIBRARIES += android.hardware.keymaster@4.0 libkeymaster4support
         LOCAL_SHARED_LIBRARIES += android.hardware.gatekeeper@1.0 libkeystore_parcelables libkeystore_aidl
         LOCAL_CFLAGS += -DHAVE_SYNTH_PWD_SUPPORT
diff --git a/crypto/ext4crypt/Ext4Crypt.cpp b/crypto/ext4crypt/Ext4Crypt.cpp
index 15d7d8f32..c9e71fd9b 100644
--- a/crypto/ext4crypt/Ext4Crypt.cpp
+++ b/crypto/ext4crypt/Ext4Crypt.cpp
@@ -317,9 +317,8 @@ bool lookup_key_ref(const std::map<userid_t, std::string>& key_map, userid_t use
 }
 
 static bool ensure_policy(const std::string& raw_ref __unused, const std::string& path) {
-    LOG(INFO) << "ensure_policy '" << path << "'\n";
     return true;
-    return access(path.c_str(), F_OK) == 0; // ensure policy will set a policy if one is not set on an empty folder - we don't want to do this in recovery
+    // ensure policy will set a policy if one is not set on an empty folder - we don't want to do this in recovery
     /*if (e4crypt_policy_ensure(path.c_str(), raw_ref.data(), raw_ref.size()) != 0) {
         LOG(ERROR) << "Failed to set policy on: " << path << "\n";
         return false;
diff --git a/crypto/ext4crypt/Ext4CryptPie.cpp b/crypto/ext4crypt/Ext4CryptPie.cpp
index 615229ea9..d6ea53156 100644
--- a/crypto/ext4crypt/Ext4CryptPie.cpp
+++ b/crypto/ext4crypt/Ext4CryptPie.cpp
@@ -295,9 +295,10 @@ static void get_data_file_encryption_modes(PolicyKeyRef* key_ref) {
 }
 
 static bool ensure_policy(const PolicyKeyRef& key_ref, const std::string& path) {
-    return e4crypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
+    return true;
+    /*return e4crypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
                                  key_ref.key_raw_ref.size(), key_ref.contents_mode.c_str(),
-                                 key_ref.filenames_mode.c_str()) == 0;
+                                 key_ref.filenames_mode.c_str()) == 0;*/
 }
 
 static bool is_numeric(const char* name) {
diff --git a/crypto/ext4crypt/MetadataCrypt.cpp b/crypto/ext4crypt/MetadataCrypt.cpp
new file mode 100644
index 000000000..b195fa09e
--- /dev/null
+++ b/crypto/ext4crypt/MetadataCrypt.cpp
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "KeyBuffer.h"
+#include "MetadataCrypt.h"
+
+#include <string>
+#include <thread>
+#include <vector>
+#include <algorithm>
+
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include <linux/dm-ioctl.h>
+
+//#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android-base/unique_fd.h>
+#include <cutils/fs.h>
+//#include <fs_mgr.h>
+
+//#include "EncryptInplace.h"
+#include "KeyStorage4.h"
+#include "KeyUtil.h"
+//#include "secontext.h"
+#include "Utils.h"
+//#include "VoldUtil.h"
+
+#include <iostream>
+#define LOG(x) std::cout
+#define PLOG(x) std::cout
+#include <linux/fs.h>
+
+#define DM_CRYPT_BUF_SIZE 4096
+#define TABLE_LOAD_RETRIES 10
+#define DEFAULT_KEY_TARGET_TYPE "default-key"
+
+using android::vold::KeyBuffer;
+
+static const std::string kDmNameUserdata = "userdata";
+
+void get_blkdev_size(int fd, unsigned long* nr_sec) {
+  if ((ioctl(fd, BLKGETSIZE, nr_sec)) == -1) {
+    *nr_sec = 0;
+  }
+}
+
+static const char* kLookup = "0123456789abcdef";
+
+android::status_t StrToHex(const KeyBuffer& str, KeyBuffer& hex) {
+    hex.clear();
+    for (size_t i = 0; i < str.size(); i++) {
+        hex.push_back(kLookup[(str.data()[i] & 0xF0) >> 4]);
+        hex.push_back(kLookup[str.data()[i] & 0x0F]);
+    }
+    return android::OK;
+}
+
+/*static bool mount_via_fs_mgr(const char* mount_point, const char* blk_device) {
+    // fs_mgr_do_mount runs fsck. Use setexeccon to run trusted
+    // partitions in the fsck domain.
+    if (setexeccon(secontextFsck())) {
+        PLOG(ERROR) << "Failed to setexeccon";
+        return false;
+    }
+    auto mount_rc = fs_mgr_do_mount(fstab_default, const_cast<char*>(mount_point),
+                                    const_cast<char*>(blk_device), nullptr);
+    if (setexeccon(nullptr)) {
+        PLOG(ERROR) << "Failed to clear setexeccon";
+        return false;
+    }
+    if (mount_rc != 0) {
+        LOG(ERROR) << "fs_mgr_do_mount failed with rc " << mount_rc;
+        return false;
+    }
+    LOG(DEBUG) << "Mounted " << mount_point;
+    return true;
+}*/
+
+static bool read_key(const std::string& key_dir, bool create_if_absent, KeyBuffer* key) {
+    /*if (!data_rec->key_dir) {
+        LOG(ERROR) << "Failed to get key_dir";
+        return false;
+    }
+    std::string key_dir = data_rec->key_dir;*/
+    auto dir = key_dir + "/key";
+    LOG(DEBUG) << "key_dir/key: " << dir << "\n";
+    /*if (fs_mkdirs(dir.c_str(), 0700)) {
+        PLOG(ERROR) << "Creating directories: " << dir;
+        return false;
+    }*/
+    auto temp = key_dir + "/tmp";
+    if (!android::vold::retrieveKey(create_if_absent, dir, temp, key)) return false;
+    return true;
+}
+
+static KeyBuffer default_key_params(const std::string& real_blkdev, const KeyBuffer& key) {
+    KeyBuffer hex_key;
+    if (/*android::vold::*/StrToHex(key, hex_key) != android::OK) {
+        LOG(ERROR) << "Failed to turn key to hex\n";
+        return KeyBuffer();
+    }
+    auto res = KeyBuffer() + "AES-256-XTS " + hex_key + " " + real_blkdev.c_str() + " 0";
+    return res;
+}
+
+static bool get_number_of_sectors(const std::string& real_blkdev, uint64_t *nr_sec) {
+    android::base::unique_fd dev_fd(TEMP_FAILURE_RETRY(open(
+        real_blkdev.c_str(), O_RDONLY | O_CLOEXEC, 0)));
+    if (dev_fd == -1) {
+        PLOG(ERROR) << "Unable to open " << real_blkdev << " to measure size\n";
+        return false;
+    }
+    unsigned long res;
+    // TODO: should use BLKGETSIZE64
+    get_blkdev_size(dev_fd.get(), &res);
+    if (res == 0) {
+        PLOG(ERROR) << "Unable to measure size of " << real_blkdev << "\n";
+        return false;
+    }
+    *nr_sec = res;
+    return true;
+}
+
+static struct dm_ioctl* dm_ioctl_init(char *buffer, size_t buffer_size,
+                                      const std::string& dm_name) {
+    if (buffer_size < sizeof(dm_ioctl)) {
+        LOG(ERROR) << "dm_ioctl buffer too small\n";
+        return nullptr;
+    }
+
+    memset(buffer, 0, buffer_size);
+    struct dm_ioctl* io = (struct dm_ioctl*) buffer;
+    io->data_size = buffer_size;
+    io->data_start = sizeof(struct dm_ioctl);
+    io->version[0] = 4;
+    io->version[1] = 0;
+    io->version[2] = 0;
+    io->flags = 0;
+    dm_name.copy(io->name, sizeof(io->name));
+    return io;
+}
+
+static bool create_crypto_blk_dev(const std::string& dm_name, uint64_t nr_sec,
+                                  const std::string& target_type, const KeyBuffer& crypt_params,
+                                  std::string* crypto_blkdev) {
+    PLOG(INFO) << "starting create_crypto_blk_dev\n";
+    android::base::unique_fd dm_fd(TEMP_FAILURE_RETRY(open(
+        "/dev/device-mapper", O_RDWR | O_CLOEXEC, 0)));
+    if (dm_fd == -1) {
+        PLOG(ERROR) << "Cannot open device-mapper\n";
+        return false;
+    }
+    alignas(struct dm_ioctl) char buffer[DM_CRYPT_BUF_SIZE];
+    auto io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+    if (!io || ioctl(dm_fd.get(), DM_DEV_CREATE, io) != 0) {
+        PLOG(ERROR) << "Cannot create dm-crypt device " << dm_name << "\n";
+        return false;
+    }
+
+    // Get the device status, in particular, the name of its device file
+    io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+    if (ioctl(dm_fd.get(), DM_DEV_STATUS, io) != 0) {
+        PLOG(ERROR) << "Cannot retrieve dm-crypt device status " << dm_name << "\n";
+        return false;
+    }
+    *crypto_blkdev = std::string() + "/dev/block/dm-" + std::to_string(
+        (io->dev & 0xff) | ((io->dev >> 12) & 0xfff00));
+
+    io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+    size_t paramix = io->data_start + sizeof(struct dm_target_spec);
+    size_t nullix = paramix + crypt_params.size();
+    size_t endix = (nullix + 1 + 7) & 8; // Add room for \0 and align to 8 byte boundary
+
+    if (endix > sizeof(buffer)) {
+        LOG(ERROR) << "crypt_params too big for DM_CRYPT_BUF_SIZE\n";
+        return false;
+    }
+
+    io->target_count = 1;
+    auto tgt = (struct dm_target_spec *) (buffer + io->data_start);
+    tgt->status = 0;
+    tgt->sector_start = 0;
+    tgt->length = nr_sec;
+    target_type.copy(tgt->target_type, sizeof(tgt->target_type));
+    memcpy(buffer + paramix, crypt_params.data(),
+            std::min(crypt_params.size(), sizeof(buffer) - paramix));
+    buffer[nullix] = '\0';
+    tgt->next = endix;
+
+    for (int i = 0; ; i++) {
+        if (ioctl(dm_fd.get(), DM_TABLE_LOAD, io) == 0) {
+            break;
+        }
+        if (i+1 >= TABLE_LOAD_RETRIES) {
+            PLOG(ERROR) << "DM_TABLE_LOAD ioctl failed\n";
+            return false;
+        }
+        PLOG(INFO) << "DM_TABLE_LOAD ioctl failed, retrying\n";
+        usleep(500000);
+    }
+
+    // Resume this device to activate it
+    io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+    if (ioctl(dm_fd.get(), DM_DEV_SUSPEND, io)) {
+        PLOG(ERROR) << "Cannot resume dm-crypt device " << dm_name << "\n";
+        return false;
+    }
+    return true;
+}
+
+bool e4crypt_mount_metadata_encrypted(const std::string& mount_point, bool needs_encrypt, const std::string& key_dir, const std::string& blk_device, std::string* crypto_blkdev) {
+    LOG(DEBUG) << "e4crypt_mount_metadata_encrypted: " << mount_point << " " << needs_encrypt << "\n";
+    /*auto encrypted_state = android::base::GetProperty("ro.crypto.state", "");
+    if (encrypted_state != "") {
+        LOG(DEBUG) << "e4crypt_enable_crypto got unexpected starting state: " << encrypted_state;
+        return false;
+    }
+    auto data_rec = fs_mgr_get_entry_for_mount_point(fstab_default, mount_point);
+    if (!data_rec) {
+        LOG(ERROR) << "Failed to get data_rec";
+        return false;
+    }*/
+    KeyBuffer key;
+    if (!read_key(key_dir, needs_encrypt, &key)) return false;
+    uint64_t nr_sec;
+    if (!get_number_of_sectors(blk_device, &nr_sec)) return false;
+    //std::string crypto_blkdev;
+    if (!create_crypto_blk_dev(kDmNameUserdata, nr_sec, DEFAULT_KEY_TARGET_TYPE,
+                               default_key_params(blk_device, key), /*&*/crypto_blkdev))
+        return false;
+    // FIXME handle the corrupt case
+    /*if (needs_encrypt) {
+        LOG(INFO) << "Beginning inplace encryption, nr_sec: " << nr_sec;
+        off64_t size_already_done = 0;
+        auto rc =
+            cryptfs_enable_inplace(const_cast<char*>(crypto_blkdev.c_str()), data_rec->blk_device,
+                                   nr_sec, &size_already_done, nr_sec, 0, false);
+        if (rc != 0) {
+            LOG(ERROR) << "Inplace crypto failed with code: " << rc;
+            return false;
+        }
+        if (static_cast<uint64_t>(size_already_done) != nr_sec) {
+            LOG(ERROR) << "Inplace crypto only got up to sector: " << size_already_done;
+            return false;
+        }
+        LOG(INFO) << "Inplace encryption complete";
+    }
+
+    LOG(DEBUG) << "Mounting metadata-encrypted filesystem:" << mount_point;
+    mount_via_fs_mgr(data_rec->mount_point, crypto_blkdev.c_str());*/
+    LOG(DEBUG) << "crypto block device '" << *crypto_blkdev << "\n";
+    return true;
+}
diff --git a/crypto/ext4crypt/MetadataCrypt.h b/crypto/ext4crypt/MetadataCrypt.h
new file mode 100644
index 000000000..69addf318
--- /dev/null
+++ b/crypto/ext4crypt/MetadataCrypt.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _METADATA_CRYPT_H
+#define _METADATA_CRYPT_H
+
+#include <string>
+__BEGIN_DECLS
+bool e4crypt_mount_metadata_encrypted(const std::string& mount_point, bool needs_encrypt, const std::string& key_dir, const std::string& blk_device, std::string* crypto_blkdev);
+__END_DECLS
+
+#endif
diff --git a/partition.cpp b/partition.cpp
index 1bdb91a35..ee346863d 100644
--- a/partition.cpp
+++ b/partition.cpp
@@ -114,6 +114,8 @@ const struct flag_list mount_flags[] = {
 const char *ignored_mount_items[] = {
 	"defaults=",
 	"errors=",
+	"latemount",
+	"sysfs_path=",
 	NULL
 };
 
@@ -154,6 +156,7 @@ enum TW_FSTAB_FLAGS {
 	TWFLAG_VOLDMANAGED,
 	TWFLAG_FORMATTABLE,
 	TWFLAG_RESIZE,
+	TWFLAG_KEYDIRECTORY,
 };
 
 /* Flags without a trailing '=' are considered dual format flags and can be
@@ -197,6 +200,7 @@ const struct flag_list tw_flags[] = {
 	{ "voldmanaged=",           TWFLAG_VOLDMANAGED },
 	{ "formattable",            TWFLAG_FORMATTABLE },
 	{ "resize",                 TWFLAG_RESIZE },
+	{ "keydirectory=",          TWFLAG_KEYDIRECTORY },
 	{ 0,                        0 },
 };
 
@@ -260,6 +264,7 @@ TWPartition::TWPartition() {
 	Is_Adopted_Storage = false;
 	Adopted_GUID = "";
 	SlotSelect = false;
+	Key_Directory = "";
 }
 
 TWPartition::~TWPartition(void) {
@@ -624,80 +629,39 @@ void TWPartition::Setup_Data_Partition(bool Display_Error) {
 		DataManager::SetValue(TW_IS_DECRYPTED, 1);
 		Is_Encrypted = true;
 		Is_Decrypted = true;
-		Is_FBE = false;
+		if (Key_Directory.empty())
+			Is_FBE = false;
+		else
+			Is_FBE = true;
 		DataManager::SetValue(TW_IS_FBE, 0);
 		Decrypted_Block_Device = crypto_blkdev;
 		LOGINFO("Data already decrypted, new block device: '%s'\n", crypto_blkdev);
 	} else if (!Mount(false)) {
 		if (Is_Present) {
-			set_partition_data(Actual_Block_Device.c_str(), Crypto_Key_Location.c_str(), Fstab_File_System.c_str());
-			if (cryptfs_check_footer() == 0) {
+			if (Key_Directory.empty()) {
+				set_partition_data(Actual_Block_Device.c_str(), Crypto_Key_Location.c_str(), Fstab_File_System.c_str());
+				if (cryptfs_check_footer() == 0) {
+					Is_Encrypted = true;
+					Is_Decrypted = false;
+					Can_Be_Mounted = false;
+					Current_File_System = "emmc";
+					Setup_Image();
+					DataManager::SetValue(TW_IS_ENCRYPTED, 1);
+					DataManager::SetValue(TW_CRYPTO_PWTYPE, cryptfs_get_password_type());
+					DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
+					DataManager::SetValue("tw_crypto_display", "");
+				} else {
+					gui_err("mount_data_footer=Could not mount /data and unable to find crypto footer.");
+				}
+			} else {
 				Is_Encrypted = true;
 				Is_Decrypted = false;
-				Can_Be_Mounted = false;
-				Current_File_System = "emmc";
-				Setup_Image();
-				DataManager::SetValue(TW_IS_ENCRYPTED, 1);
-				DataManager::SetValue(TW_CRYPTO_PWTYPE, cryptfs_get_password_type());
-				DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
-				DataManager::SetValue("tw_crypto_display", "");
-			} else {
-				gui_err("mount_data_footer=Could not mount /data and unable to find crypto footer.");
 			}
-		} else {
+		} else if (Key_Directory.empty()) {
 			LOGERR("Primary block device '%s' for mount point '%s' is not present!\n", Primary_Block_Device.c_str(), Mount_Point.c_str());
 		}
 	} else {
-		if (TWFunc::Path_Exists("/data/unencrypted/key/version")) {
-			LOGINFO("File Based Encryption is present\n");
-#ifdef TW_INCLUDE_FBE
-			ExcludeAll(Mount_Point + "/convert_fbe");
-			ExcludeAll(Mount_Point + "/unencrypted");
-			//ExcludeAll(Mount_Point + "/system/users/0"); // we WILL need to retain some of this if multiple users are present or we just need to delete more folders for the extra users somewhere else
-			ExcludeAll(Mount_Point + "/misc/vold/user_keys");
-			//ExcludeAll(Mount_Point + "/system_ce");
-			//ExcludeAll(Mount_Point + "/system_de");
-			//ExcludeAll(Mount_Point + "/misc_ce");
-			//ExcludeAll(Mount_Point + "/misc_de");
-			ExcludeAll(Mount_Point + "/system/gatekeeper.password.key");
-			ExcludeAll(Mount_Point + "/system/gatekeeper.pattern.key");
-			ExcludeAll(Mount_Point + "/system/locksettings.db");
-			//ExcludeAll(Mount_Point + "/system/locksettings.db-shm"); // don't seem to need this one, but the other 2 are needed
-			ExcludeAll(Mount_Point + "/system/locksettings.db-wal");
-			//ExcludeAll(Mount_Point + "/user_de");
-			//ExcludeAll(Mount_Point + "/misc/profiles/cur/0"); // might be important later
-			ExcludeAll(Mount_Point + "/misc/gatekeeper");
-			ExcludeAll(Mount_Point + "/misc/keystore");
-			ExcludeAll(Mount_Point + "/drm/kek.dat");
-			ExcludeAll(Mount_Point + "/system_de/0/spblob"); // contains data needed to decrypt pixel 2
-			int retry_count = 3;
-			while (!Decrypt_DE() && --retry_count)
-				usleep(2000);
-			if (retry_count > 0) {
-				property_set("ro.crypto.state", "encrypted");
-				Is_Encrypted = true;
-				Is_Decrypted = false;
-				Is_FBE = true;
-				DataManager::SetValue(TW_IS_FBE, 1);
-				DataManager::SetValue(TW_IS_ENCRYPTED, 1);
-				string filename;
-				int pwd_type = Get_Password_Type(0, filename);
-				if (pwd_type < 0) {
-					LOGERR("This TWRP does not have synthetic password decrypt support\n");
-					pwd_type = 0; // default password
-				}
-				DataManager::SetValue(TW_CRYPTO_PWTYPE, pwd_type);
-				DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
-				DataManager::SetValue("tw_crypto_display", "");
-			}
-#else
-			LOGERR("FBE found but FBE support not present in TWRP\n");
-#endif
-		} else {
-			// Filesystem is not encrypted and the mount succeeded, so return to
-			// the original unmounted state
-			UnMount(false);
-		}
+		Decrypt_FBE_DE();
 	}
 	if (datamedia && (!Is_Encrypted || (Is_Encrypted && Is_Decrypted))) {
 		Setup_Data_Media();
@@ -711,6 +675,57 @@ void TWPartition::Setup_Data_Partition(bool Display_Error) {
 #endif
 }
 
+bool TWPartition::Decrypt_FBE_DE() {
+if (TWFunc::Path_Exists("/data/unencrypted/key/version")) {
+		LOGINFO("File Based Encryption is present\n");
+#ifdef TW_INCLUDE_FBE
+		ExcludeAll(Mount_Point + "/convert_fbe");
+		ExcludeAll(Mount_Point + "/unencrypted");
+		//ExcludeAll(Mount_Point + "/system/users/0"); // we WILL need to retain some of this if multiple users are present or we just need to delete more folders for the extra users somewhere else
+		ExcludeAll(Mount_Point + "/misc/vold/user_keys");
+		//ExcludeAll(Mount_Point + "/system_ce");
+		//ExcludeAll(Mount_Point + "/system_de");
+		//ExcludeAll(Mount_Point + "/misc_ce");
+		//ExcludeAll(Mount_Point + "/misc_de");
+		ExcludeAll(Mount_Point + "/system/gatekeeper.password.key");
+		ExcludeAll(Mount_Point + "/system/gatekeeper.pattern.key");
+		ExcludeAll(Mount_Point + "/system/locksettings.db");
+		//ExcludeAll(Mount_Point + "/system/locksettings.db-shm"); // don't seem to need this one, but the other 2 are needed
+		ExcludeAll(Mount_Point + "/system/locksettings.db-wal");
+		//ExcludeAll(Mount_Point + "/user_de");
+		//ExcludeAll(Mount_Point + "/misc/profiles/cur/0"); // might be important later
+		ExcludeAll(Mount_Point + "/misc/gatekeeper");
+		ExcludeAll(Mount_Point + "/misc/keystore");
+		ExcludeAll(Mount_Point + "/drm/kek.dat");
+		ExcludeAll(Mount_Point + "/system_de/0/spblob"); // contains data needed to decrypt pixel 2
+		int retry_count = 3;
+		while (!Decrypt_DE() && --retry_count)
+			usleep(2000);
+		if (retry_count > 0) {
+			property_set("ro.crypto.state", "encrypted");
+			Is_Encrypted = true;
+			Is_Decrypted = false;
+			Is_FBE = true;
+			DataManager::SetValue(TW_IS_FBE, 1);
+			DataManager::SetValue(TW_IS_ENCRYPTED, 1);
+			string filename;
+			int pwd_type = Get_Password_Type(0, filename);
+			if (pwd_type < 0) {
+				LOGERR("This TWRP does not have synthetic password decrypt support\n");
+				pwd_type = 0; // default password
+			}
+			DataManager::SetValue(TW_CRYPTO_PWTYPE, pwd_type);
+			DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
+			DataManager::SetValue("tw_crypto_display", "");
+			return true;
+		}
+#else
+		LOGERR("FBE found but FBE support not present in TWRP\n");
+#endif
+	}
+	return false;
+}
+
 void TWPartition::Setup_Cache_Partition(bool Display_Error __unused) {
 	if (Mount_Point != "/cache")
 		return;
@@ -826,12 +841,14 @@ void TWPartition::Apply_TW_Flag(const unsigned flag, const char* str, const bool
 			// fileencryption=ice:aes-256-heh
 			{
 				std::string FBE = str;
-				std::string FBE_contents, FBE_filenames;
 				size_t colon_loc = FBE.find(":");
 				if (colon_loc == std::string::npos) {
-					LOGINFO("Invalid fileencryption fstab flag: '%s'\n", str);
+					property_set("fbe.contents", FBE.c_str());
+					property_set("fbe.filenames", "");
+					LOGINFO("FBE contents '%s', filenames ''\n", FBE.c_str());
 					break;
 				}
+				std::string FBE_contents, FBE_filenames;
 				FBE_contents = FBE.substr(0, colon_loc);
 				FBE_filenames = FBE.substr(colon_loc + 1);
 				property_set("fbe.contents", FBE_contents.c_str());
@@ -905,6 +922,8 @@ void TWPartition::Apply_TW_Flag(const unsigned flag, const char* str, const bool
 		case TWFLAG_ALTDEVICE:
 			Alternate_Block_Device = str;
 			break;
+		case TWFLAG_KEYDIRECTORY:
+			Key_Directory = str;
 		default:
 			// Should not get here
 			LOGINFO("Flag identified for processing, but later unmatched: %i\n", flag);
@@ -1904,21 +1923,26 @@ bool TWPartition::Decrypt(string Password) {
 
 bool TWPartition::Wipe_Encryption() {
 	bool Save_Data_Media = Has_Data_Media;
+	bool ret = false;
+	BasePartition* base_partition = make_partition();
+
+	if (!base_partition->PreWipeEncryption())
+		goto exit;
 
 	if (!UnMount(true))
-		return false;
+		goto exit;
 
 	Has_Data_Media = false;
-	Decrypted_Block_Device = "";
 #ifdef TW_INCLUDE_CRYPTO
 	if (Is_Decrypted && !Decrypted_Block_Device.empty()) {
 		if (!UnMount(true))
-			return false;
+			goto exit;
 		if (delete_crypto_blk_dev((char*)("userdata")) != 0) {
 			LOGERR("Error deleting crypto block device, continuing anyway.\n");
 		}
 	}
 #endif
+	Decrypted_Block_Device = "";
 	Is_Decrypted = false;
 	Is_Encrypted = false;
 	Find_Actual_Block_Device();
@@ -1978,15 +2002,22 @@ bool TWPartition::Wipe_Encryption() {
 #ifndef TW_OEM_BUILD
 		gui_msg("format_data_msg=You may need to reboot recovery to be able to use /data again.");
 #endif
-		return true;
+		ret = true;
+		if (!Key_Directory.empty())
+			ret = PartitionManager.Wipe_By_Path(Key_Directory);
+		if (ret)
+			ret = base_partition->PostWipeEncryption();
+		goto exit;
 	} else {
 		Has_Data_Media = Save_Data_Media;
 		gui_err("format_data_err=Unable to format to remove encryption.");
 		if (Has_Data_Media && Mount(false))
 			PartitionManager.Add_MTP_Storage(MTP_Storage_ID);
-		return false;
+		goto exit;
 	}
-	return false;
+exit:
+	delete base_partition;
+	return ret;
 }
 
 void TWPartition::Check_FS_Type() {
@@ -2233,18 +2264,23 @@ bool TWPartition::Wipe_F2FS() {
 
 		gui_msg(Msg("formatting_using=Formatting {1} using {2}...")(Display_Name)("mkfs.f2fs"));
 		Find_Actual_Block_Device();
-		command = "mkfs.f2fs -t 0";
-		if (!Is_Decrypted && Length != 0) {
-			// Only use length if we're not decrypted
-			char len[32];
-			int mod_length = Length;
-			if (Length < 0)
-				mod_length *= -1;
-			sprintf(len, "%i", mod_length);
-			command += " -r ";
-			command += len;
-		}
-		command += " " + Actual_Block_Device;
+		if (!TWFunc::Path_Exists("/sbin/sload.f2fs")) {
+			command = "mkfs.f2fs -t 0";
+			if (!Is_Decrypted && Length != 0) {
+				// Only use length if we're not decrypted
+				char len[32];
+				int mod_length = Length;
+				if (Length < 0)
+					mod_length *= -1;
+				sprintf(len, "%i", mod_length);
+				command += " -r ";
+				command += len;
+			}
+			command += " " + Actual_Block_Device;
+		} else {
+			unsigned long long size = IOCTL_Get_Block_Size() + Length;
+			command = "mkfs.f2fs -d1 -f -O encrypt -O quota -O verity -w 4096 " + Actual_Block_Device + " " + std::to_string(size / 4096) + " && sload.f2fs -t /data " + Actual_Block_Device;
+		}
 		if (TWFunc::Exec_Cmd(command) == 0) {
 			Recreate_AndSec_Folder();
 			gui_msg("done=Done.");
diff --git a/partitionmanager.cpp b/partitionmanager.cpp
index da407fa69..45460d1dc 100644
--- a/partitionmanager.cpp
+++ b/partitionmanager.cpp
@@ -71,6 +71,9 @@ extern "C" {
 	#include "gui/pages.hpp"
 	#ifdef TW_INCLUDE_FBE
 		#include "crypto/ext4crypt/Decrypt.h"
+		#ifdef TW_INCLUDE_FBE_METADATA_DECRYPT
+			#include "crypto/ext4crypt/MetadataCrypt.h"
+		#endif
 	#endif
 	#ifdef TW_CRYPTO_USE_SYSTEM_VOLD
 		#include "crypto/vold_decrypt/vold_decrypt.h"
@@ -277,6 +280,27 @@ int TWPartitionManager::Process_Fstab(string Fstab_Filename, bool Display_Error)
 #ifdef TW_INCLUDE_CRYPTO
 	TWPartition* Decrypt_Data = Find_Partition_By_Path("/data");
 	if (Decrypt_Data && Decrypt_Data->Is_Encrypted && !Decrypt_Data->Is_Decrypted) {
+		if (!Decrypt_Data->Key_Directory.empty() && Mount_By_Path(Decrypt_Data->Key_Directory, false)) {
+#ifdef TW_INCLUDE_FBE_METADATA_DECRYPT
+			if (e4crypt_mount_metadata_encrypted(Decrypt_Data->Mount_Point, false, Decrypt_Data->Key_Directory, Decrypt_Data->Actual_Block_Device, &Decrypt_Data->Decrypted_Block_Device)) {
+				LOGINFO("Successfully decrypted metadata encrypted data partition with new block device: '%s'\n", Decrypt_Data->Decrypted_Block_Device.c_str());
+				property_set("ro.crypto.state", "encrypted");
+				Decrypt_Data->Is_Decrypted = true; // Needed to make the mount function work correctly
+				int retry_count = 10;
+				while (!Decrypt_Data->Mount(false) && --retry_count)
+					usleep(500);
+				if (Decrypt_Data->Mount(false)) {
+					Decrypt_Data->Decrypt_FBE_DE();
+				} else {
+					LOGINFO("Failed to mount data after metadata decrypt\n");
+				}
+			} else {
+				LOGINFO("Unable to decrypt metadata encryption\n");
+			}
+#else
+			LOGERR("Metadata FBE decrypt support not present in this TWRP\n");
+#endif
+		}
 		if (Decrypt_Data->Is_FBE) {
 			if (DataManager::GetIntValue(TW_CRYPTO_PWTYPE) == 0) {
 				if (Decrypt_Device("!") == 0) {
@@ -467,6 +491,8 @@ void TWPartitionManager::Output_Partition(TWPartition* Part) {
 		printf("   Mount_Flags: %i, Mount_Options: %s\n", Part->Mount_Flags, Part->Mount_Options.c_str());
 	if (Part->MTP_Storage_ID)
 		printf("   MTP_Storage_ID: %i\n", Part->MTP_Storage_ID);
+	if (!Part->Key_Directory.empty())
+		printf("   Metadata Key Directory: %s\n", Part->Key_Directory.c_str());
 	printf("\n");
 }
 
diff --git a/partitions.hpp b/partitions.hpp
index 094c718de..a8fd70b40 100644
--- a/partitions.hpp
+++ b/partitions.hpp
@@ -31,6 +31,23 @@
 
 using namespace std;
 
+// BasePartition is used for overriding so we can run custom, device
+// specific code.
+class BasePartition {
+	public:
+		explicit BasePartition() {}
+		virtual ~BasePartition() {}
+
+		virtual bool PreWipeEncryption() {
+			return true;
+		}
+
+		virtual bool PostWipeEncryption() {
+			return true;
+		}
+};
+BasePartition* make_partition();
+
 struct PartitionList {
 	std::string Display_Name;
 	std::string Mount_Point;
@@ -128,6 +145,7 @@ public:
 	void Partition_Post_Processing(bool Display_Error);                       // Apply partition specific settings after fstab processed
 	void Set_Backup_FileName(string fname);                                   // Set Backup_FileName for partition
 	string Get_Backup_Name();                                                 // Get Backup_Name for partition
+	bool Decrypt_FBE_DE();                                                    // If FBE is present, backup exclusions are set up and DE decrypt is attempted
 
 public:
 	string Current_File_System;                                               // Current file system
@@ -246,6 +264,7 @@ private:
 	bool SlotSelect;                                                          // Partition has A/B slots
 	TWExclude backup_exclusions;                                              // Exclusions for file based backups
 	TWExclude wipe_exclusions;                                                // Exclusions for file based wipes (data/media devices only)
+	string Key_Directory;                                                      // Metadata key directory needed for mounting FBE encrypted data partitions using metadata encryption
 
 	struct partition_fs_flags_struct {                                        // This struct is used to store mount flags and options for different file systems for the same partition
 		string File_System;
diff --git a/prebuilt/Android.mk b/prebuilt/Android.mk
index e7bf8017e..235b77c86 100644
--- a/prebuilt/Android.mk
+++ b/prebuilt/Android.mk
@@ -16,19 +16,22 @@ RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/flash_image
 RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/erase_image
 RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/bu
 ifneq ($(TW_USE_TOOLBOX), true)
-	RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/busybox
+    RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/busybox
 else
-	RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/sh
-	RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libcrypto.so
-	ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 23; echo $$?),0)
-	    RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/toybox
-	    ifneq ($(wildcard external/zip/Android.mk),)
-                RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/zip
-	    endif
-	    ifneq ($(wildcard external/unzip/Android.mk),)
-                RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/unzip
-	    endif
-	endif
+    RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/sh
+    RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libcrypto.so
+    ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 23; echo $$?),0)
+        RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/toybox
+        ifneq ($(wildcard external/zip/Android.mk),)
+            RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/zip
+        endif
+        ifneq ($(wildcard external/unzip/Android.mk),)
+            RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/unzip
+        endif
+        ifneq ($(wildcard system/core/libziparchive/Android.bp),)
+            RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/unzip
+        endif
+    endif
 endif
 RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/pigz
 RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/fsck.fat
@@ -229,6 +232,11 @@ ifeq ($(TW_INCLUDE_CRYPTO), true)
             RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libservices.so
             RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libkeymaster_portable.so
          endif
+         # lshal can be useful for seeing if you have things like the keymaster working properly, but it isn't needed for TWRP to work
+         #RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/lshal
+         #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/liblshal.so
+         #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libssl.so
+         #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libhidl-gen-hash.so
     endif
 endif
 ifeq ($(AB_OTA_UPDATER), true)
@@ -255,6 +263,9 @@ ifeq ($(TARGET_USERIMAGES_USE_F2FS), true)
         RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libf2fs.so
     else ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 26; echo $$?),0)
         RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/mkfs.f2fs
+        ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+            RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/sload.f2fs
+        endif
     else ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 24; echo $$?),0)
         RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/mkfs.f2fs
         RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libf2fs.so
@@ -337,6 +348,7 @@ endif
 ifeq ($(shell test $(PLATFORM_SDK_VERSION) -gt 27; echo $$?),0)
     RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libclang_rt.ubsan_standalone-aarch64-android.so
     RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/liblogwrap.so
+    RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libext2_misc.so
 endif
 
 TW_BB_SYMLINKS :=