• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "TrustyKeymaster"
18 
19 #include <assert.h>
20 #include <errno.h>
21 #include <openssl/evp.h>
22 #include <openssl/x509.h>
23 #include <stddef.h>
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <time.h>
28 
29 #include <algorithm>
30 #include <type_traits>
31 
32 #include <hardware/keymaster2.h>
33 #include <keymaster/authorization_set.h>
34 #include <log/log.h>
35 
36 #include <trusty_keymaster/ipc/keymaster_ipc.h>
37 #include <trusty_keymaster/ipc/trusty_keymaster_ipc.h>
38 #include <trusty_keymaster/legacy/trusty_keymaster_device.h>
39 
40 const size_t kMaximumAttestationChallengeLength = 128;
41 const size_t kMaximumFinishInputLength = 2048;
42 
43 namespace keymaster {
44 
TrustyKeymasterDevice(const hw_module_t * module)45 TrustyKeymasterDevice::TrustyKeymasterDevice(const hw_module_t* module) {
46     static_assert(std::is_standard_layout<TrustyKeymasterDevice>::value,
47                   "TrustyKeymasterDevice must be standard layout");
48     static_assert(offsetof(TrustyKeymasterDevice, device_) == 0,
49                   "device_ must be the first member of TrustyKeymasterDevice");
50     static_assert(offsetof(TrustyKeymasterDevice, device_.common) == 0,
51                   "common must be the first member of keymaster2_device");
52 
53     ALOGI("Creating device");
54     ALOGD("Device address: %p", this);
55 
56     device_ = {};
57 
58     device_.common.tag = HARDWARE_DEVICE_TAG;
59     device_.common.version = 1;
60     device_.common.module = const_cast<hw_module_t*>(module);
61     device_.common.close = close_device;
62 
63     device_.flags = KEYMASTER_SUPPORTS_EC;
64 
65     device_.configure = configure;
66     device_.add_rng_entropy = add_rng_entropy;
67     device_.generate_key = generate_key;
68     device_.get_key_characteristics = get_key_characteristics;
69     device_.import_key = import_key;
70     device_.export_key = export_key;
71     device_.attest_key = attest_key;
72     device_.upgrade_key = upgrade_key;
73     device_.delete_key = delete_key;
74     device_.delete_all_keys = delete_all_keys;
75     device_.begin = begin;
76     device_.update = update;
77     device_.finish = finish;
78     device_.abort = abort;
79 
80     int rc = trusty_keymaster_connect();
81     error_ = translate_error(rc);
82     if (rc < 0) {
83         ALOGE("failed to connect to keymaster (%d)", rc);
84         return;
85     }
86 
87     GetVersionRequest version_request;
88     GetVersionResponse version_response;
89     error_ = trusty_keymaster_send(KM_GET_VERSION, version_request, &version_response);
90     if (error_ == KM_ERROR_INVALID_ARGUMENT || error_ == KM_ERROR_UNIMPLEMENTED) {
91         ALOGE("\"Bad parameters\" error on GetVersion call.  Version 0 is not supported.");
92         error_ = KM_ERROR_VERSION_MISMATCH;
93         return;
94     }
95     message_version_ = MessageVersion(version_response.major_ver, version_response.minor_ver,
96                                       version_response.subminor_ver);
97     if (message_version_ < 0) {
98         // Can't translate version?  Keymaster implementation must be newer.
99         ALOGE("Keymaster version %d.%d.%d not supported.", version_response.major_ver,
100               version_response.minor_ver, version_response.subminor_ver);
101         error_ = KM_ERROR_VERSION_MISMATCH;
102     }
103 }
104 
~TrustyKeymasterDevice()105 TrustyKeymasterDevice::~TrustyKeymasterDevice() {
106     trusty_keymaster_disconnect();
107 }
108 
109 namespace {
110 
111 // Allocates a new buffer with malloc and copies the contents of |buffer| to it. Caller takes
112 // ownership of the returned buffer.
DuplicateBuffer(const uint8_t * buffer,size_t size)113 uint8_t* DuplicateBuffer(const uint8_t* buffer, size_t size) {
114     uint8_t* tmp = reinterpret_cast<uint8_t*>(malloc(size));
115     if (tmp) {
116         memcpy(tmp, buffer, size);
117     }
118     return tmp;
119 }
120 
121 template <typename RequestType>
AddClientAndAppData(const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,RequestType * request)122 void AddClientAndAppData(const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
123                          RequestType* request) {
124     request->additional_params.Clear();
125     if (client_id && client_id->data_length > 0) {
126         request->additional_params.push_back(TAG_APPLICATION_ID, *client_id);
127     }
128     if (app_data && app_data->data_length > 0) {
129         request->additional_params.push_back(TAG_APPLICATION_DATA, *app_data);
130     }
131 }
132 
133 }  //  unnamed namespace
134 
configure(const keymaster_key_param_set_t * params)135 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster_key_param_set_t* params) {
136     ALOGD("Device received configure\n");
137 
138     if (error_ != KM_ERROR_OK) {
139         return error_;
140     }
141     if (!params) {
142         return KM_ERROR_UNEXPECTED_NULL_POINTER;
143     }
144 
145     AuthorizationSet params_copy(*params);
146     ConfigureRequest request(message_version_);
147     if (!params_copy.GetTagValue(TAG_OS_VERSION, &request.os_version) ||
148         !params_copy.GetTagValue(TAG_OS_PATCHLEVEL, &request.os_patchlevel)) {
149         ALOGD("Configuration parameters must contain OS version and patch level");
150         return KM_ERROR_INVALID_ARGUMENT;
151     }
152 
153     ConfigureResponse response(message_version_);
154     keymaster_error_t err = trusty_keymaster_send(KM_CONFIGURE, request, &response);
155     if (err != KM_ERROR_OK) {
156         return err;
157     }
158 
159     return KM_ERROR_OK;
160 }
161 
add_rng_entropy(const uint8_t * data,size_t data_length)162 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const uint8_t* data, size_t data_length) {
163     ALOGD("Device received add_rng_entropy");
164 
165     if (error_ != KM_ERROR_OK) {
166         return error_;
167     }
168 
169     AddEntropyRequest request(message_version_);
170     request.random_data.Reinitialize(data, data_length);
171     AddEntropyResponse response(message_version_);
172     return trusty_keymaster_send(KM_ADD_RNG_ENTROPY, request, &response);
173 }
174 
generate_key(const keymaster_key_param_set_t * params,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)175 keymaster_error_t TrustyKeymasterDevice::generate_key(
176         const keymaster_key_param_set_t* params, keymaster_key_blob_t* key_blob,
177         keymaster_key_characteristics_t* characteristics) {
178     ALOGD("Device received generate_key");
179 
180     if (error_ != KM_ERROR_OK) {
181         return error_;
182     }
183     if (!params) {
184         return KM_ERROR_UNEXPECTED_NULL_POINTER;
185     }
186     if (!key_blob) {
187         return KM_ERROR_OUTPUT_PARAMETER_NULL;
188     }
189 
190     GenerateKeyRequest request(message_version_);
191     request.key_description.Reinitialize(*params);
192     request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
193 
194     GenerateKeyResponse response(message_version_);
195     keymaster_error_t err = trusty_keymaster_send(KM_GENERATE_KEY, request, &response);
196     if (err != KM_ERROR_OK) {
197         return err;
198     }
199 
200     key_blob->key_material_size = response.key_blob.key_material_size;
201     key_blob->key_material =
202             DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
203     if (!key_blob->key_material) {
204         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
205     }
206 
207     if (characteristics) {
208         response.enforced.CopyToParamSet(&characteristics->hw_enforced);
209         response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
210     }
211 
212     return KM_ERROR_OK;
213 }
214 
get_key_characteristics(const keymaster_key_blob_t * key_blob,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_key_characteristics_t * characteristics)215 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
216         const keymaster_key_blob_t* key_blob, const keymaster_blob_t* client_id,
217         const keymaster_blob_t* app_data, keymaster_key_characteristics_t* characteristics) {
218     ALOGD("Device received get_key_characteristics");
219 
220     if (error_ != KM_ERROR_OK) {
221         return error_;
222     }
223     if (!key_blob || !key_blob->key_material) {
224         return KM_ERROR_UNEXPECTED_NULL_POINTER;
225     }
226     if (!characteristics) {
227         return KM_ERROR_OUTPUT_PARAMETER_NULL;
228     }
229 
230     GetKeyCharacteristicsRequest request(message_version_);
231     request.SetKeyMaterial(*key_blob);
232     AddClientAndAppData(client_id, app_data, &request);
233 
234     GetKeyCharacteristicsResponse response(message_version_);
235     keymaster_error_t err = trusty_keymaster_send(KM_GET_KEY_CHARACTERISTICS, request, &response);
236     if (err != KM_ERROR_OK) {
237         return err;
238     }
239 
240     response.enforced.CopyToParamSet(&characteristics->hw_enforced);
241     response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
242 
243     return KM_ERROR_OK;
244 }
245 
import_key(const keymaster_key_param_set_t * params,keymaster_key_format_t key_format,const keymaster_blob_t * key_data,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)246 keymaster_error_t TrustyKeymasterDevice::import_key(
247         const keymaster_key_param_set_t* params, keymaster_key_format_t key_format,
248         const keymaster_blob_t* key_data, keymaster_key_blob_t* key_blob,
249         keymaster_key_characteristics_t* characteristics) {
250     ALOGD("Device received import_key");
251 
252     if (error_ != KM_ERROR_OK) {
253         return error_;
254     }
255     if (!params || !key_data) {
256         return KM_ERROR_UNEXPECTED_NULL_POINTER;
257     }
258     if (!key_blob) {
259         return KM_ERROR_OUTPUT_PARAMETER_NULL;
260     }
261 
262     ImportKeyRequest request(message_version_);
263     request.key_description.Reinitialize(*params);
264     request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
265 
266     request.key_format = key_format;
267     request.SetKeyMaterial(key_data->data, key_data->data_length);
268 
269     ImportKeyResponse response(message_version_);
270     keymaster_error_t err = trusty_keymaster_send(KM_IMPORT_KEY, request, &response);
271     if (err != KM_ERROR_OK) {
272         return err;
273     }
274 
275     key_blob->key_material_size = response.key_blob.key_material_size;
276     key_blob->key_material =
277             DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
278     if (!key_blob->key_material) {
279         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
280     }
281 
282     if (characteristics) {
283         response.enforced.CopyToParamSet(&characteristics->hw_enforced);
284         response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
285     }
286 
287     return KM_ERROR_OK;
288 }
289 
export_key(keymaster_key_format_t export_format,const keymaster_key_blob_t * key_to_export,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_blob_t * export_data)290 keymaster_error_t TrustyKeymasterDevice::export_key(keymaster_key_format_t export_format,
291                                                     const keymaster_key_blob_t* key_to_export,
292                                                     const keymaster_blob_t* client_id,
293                                                     const keymaster_blob_t* app_data,
294                                                     keymaster_blob_t* export_data) {
295     ALOGD("Device received export_key");
296 
297     if (error_ != KM_ERROR_OK) {
298         return error_;
299     }
300     if (!key_to_export || !key_to_export->key_material) {
301         return KM_ERROR_UNEXPECTED_NULL_POINTER;
302     }
303     if (!export_data) {
304         return KM_ERROR_OUTPUT_PARAMETER_NULL;
305     }
306 
307     export_data->data = nullptr;
308     export_data->data_length = 0;
309 
310     ExportKeyRequest request(message_version_);
311     request.key_format = export_format;
312     request.SetKeyMaterial(*key_to_export);
313     AddClientAndAppData(client_id, app_data, &request);
314 
315     ExportKeyResponse response(message_version_);
316     keymaster_error_t err = trusty_keymaster_send(KM_EXPORT_KEY, request, &response);
317     if (err != KM_ERROR_OK) {
318         return err;
319     }
320 
321     export_data->data_length = response.key_data_length;
322     export_data->data = DuplicateBuffer(response.key_data, response.key_data_length);
323     if (!export_data->data) {
324         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
325     }
326 
327     return KM_ERROR_OK;
328 }
329 
attest_key(const keymaster_key_blob_t * key_to_attest,const keymaster_key_param_set_t * attest_params,keymaster_cert_chain_t * cert_chain)330 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster_key_blob_t* key_to_attest,
331                                                     const keymaster_key_param_set_t* attest_params,
332                                                     keymaster_cert_chain_t* cert_chain) {
333     ALOGD("Device received attest_key");
334 
335     if (error_ != KM_ERROR_OK) {
336         return error_;
337     }
338     if (!key_to_attest || !attest_params) {
339         return KM_ERROR_UNEXPECTED_NULL_POINTER;
340     }
341     if (!cert_chain) {
342         return KM_ERROR_OUTPUT_PARAMETER_NULL;
343     }
344 
345     cert_chain->entry_count = 0;
346     cert_chain->entries = nullptr;
347 
348     AttestKeyRequest request(message_version_);
349     request.SetKeyMaterial(*key_to_attest);
350     request.attest_params.Reinitialize(*attest_params);
351 
352     keymaster_blob_t attestation_challenge = {};
353     request.attest_params.GetTagValue(TAG_ATTESTATION_CHALLENGE, &attestation_challenge);
354     if (attestation_challenge.data_length > kMaximumAttestationChallengeLength) {
355         ALOGE("%zu-byte attestation challenge; only %zu bytes allowed",
356               attestation_challenge.data_length, kMaximumAttestationChallengeLength);
357         return KM_ERROR_INVALID_INPUT_LENGTH;
358     }
359 
360     AttestKeyResponse response(message_version_);
361     keymaster_error_t err = trusty_keymaster_send(KM_ATTEST_KEY, request, &response);
362     if (err != KM_ERROR_OK) {
363         return err;
364     }
365 
366     // Allocate and clear storage for cert_chain.
367     keymaster_cert_chain_t& rsp_chain = response.certificate_chain;
368     cert_chain->entries = reinterpret_cast<keymaster_blob_t*>(
369             malloc(rsp_chain.entry_count * sizeof(*cert_chain->entries)));
370     if (!cert_chain->entries) {
371         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
372     }
373     cert_chain->entry_count = rsp_chain.entry_count;
374     for (keymaster_blob_t& entry : array_range(cert_chain->entries, cert_chain->entry_count)) {
375         entry = {};
376     }
377 
378     // Copy cert_chain contents
379     size_t i = 0;
380     for (keymaster_blob_t& entry : array_range(rsp_chain.entries, rsp_chain.entry_count)) {
381         cert_chain->entries[i].data = DuplicateBuffer(entry.data, entry.data_length);
382         if (!cert_chain->entries[i].data) {
383             keymaster_free_cert_chain(cert_chain);
384             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
385         }
386         cert_chain->entries[i].data_length = entry.data_length;
387         ++i;
388     }
389 
390     return KM_ERROR_OK;
391 }
392 
upgrade_key(const keymaster_key_blob_t * key_to_upgrade,const keymaster_key_param_set_t * upgrade_params,keymaster_key_blob_t * upgraded_key)393 keymaster_error_t TrustyKeymasterDevice::upgrade_key(
394         const keymaster_key_blob_t* key_to_upgrade, const keymaster_key_param_set_t* upgrade_params,
395         keymaster_key_blob_t* upgraded_key) {
396     ALOGD("Device received upgrade_key");
397 
398     if (error_ != KM_ERROR_OK) {
399         return error_;
400     }
401     if (!key_to_upgrade || !upgrade_params) {
402         return KM_ERROR_UNEXPECTED_NULL_POINTER;
403     }
404     if (!upgraded_key) {
405         return KM_ERROR_OUTPUT_PARAMETER_NULL;
406     }
407 
408     UpgradeKeyRequest request(message_version_);
409     request.SetKeyMaterial(*key_to_upgrade);
410     request.upgrade_params.Reinitialize(*upgrade_params);
411 
412     UpgradeKeyResponse response(message_version_);
413     keymaster_error_t err = trusty_keymaster_send(KM_UPGRADE_KEY, request, &response);
414     if (err != KM_ERROR_OK) {
415         return err;
416     }
417 
418     upgraded_key->key_material_size = response.upgraded_key.key_material_size;
419     upgraded_key->key_material = DuplicateBuffer(response.upgraded_key.key_material,
420                                                  response.upgraded_key.key_material_size);
421     if (!upgraded_key->key_material) {
422         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
423     }
424 
425     return KM_ERROR_OK;
426 }
427 
begin(keymaster_purpose_t purpose,const keymaster_key_blob_t * key,const keymaster_key_param_set_t * in_params,keymaster_key_param_set_t * out_params,keymaster_operation_handle_t * operation_handle)428 keymaster_error_t TrustyKeymasterDevice::begin(keymaster_purpose_t purpose,
429                                                const keymaster_key_blob_t* key,
430                                                const keymaster_key_param_set_t* in_params,
431                                                keymaster_key_param_set_t* out_params,
432                                                keymaster_operation_handle_t* operation_handle) {
433     ALOGD("Device received begin");
434 
435     if (error_ != KM_ERROR_OK) {
436         return error_;
437     }
438     if (!key || !key->key_material) {
439         return KM_ERROR_UNEXPECTED_NULL_POINTER;
440     }
441     if (!operation_handle) {
442         return KM_ERROR_OUTPUT_PARAMETER_NULL;
443     }
444 
445     if (out_params) {
446         *out_params = {};
447     }
448 
449     BeginOperationRequest request(message_version_);
450     request.purpose = purpose;
451     request.SetKeyMaterial(*key);
452     request.additional_params.Reinitialize(*in_params);
453 
454     BeginOperationResponse response(message_version_);
455     keymaster_error_t err = trusty_keymaster_send(KM_BEGIN_OPERATION, request, &response);
456     if (err != KM_ERROR_OK) {
457         return err;
458     }
459 
460     if (response.output_params.size() > 0) {
461         if (out_params) {
462             response.output_params.CopyToParamSet(out_params);
463         } else {
464             return KM_ERROR_OUTPUT_PARAMETER_NULL;
465         }
466     }
467     *operation_handle = response.op_handle;
468 
469     return KM_ERROR_OK;
470 }
471 
update(keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,size_t * input_consumed,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)472 keymaster_error_t TrustyKeymasterDevice::update(keymaster_operation_handle_t operation_handle,
473                                                 const keymaster_key_param_set_t* in_params,
474                                                 const keymaster_blob_t* input,
475                                                 size_t* input_consumed,
476                                                 keymaster_key_param_set_t* out_params,
477                                                 keymaster_blob_t* output) {
478     ALOGD("Device received update");
479 
480     if (error_ != KM_ERROR_OK) {
481         return error_;
482     }
483     if (!input) {
484         return KM_ERROR_UNEXPECTED_NULL_POINTER;
485     }
486     if (!input_consumed) {
487         return KM_ERROR_OUTPUT_PARAMETER_NULL;
488     }
489 
490     if (out_params) {
491         *out_params = {};
492     }
493     if (output) {
494         *output = {};
495     }
496 
497     UpdateOperationRequest request(message_version_);
498     request.op_handle = operation_handle;
499     if (in_params) {
500         request.additional_params.Reinitialize(*in_params);
501     }
502     if (input && input->data_length > 0) {
503         size_t max_input_size = TRUSTY_KEYMASTER_SEND_BUF_SIZE - request.SerializedSize();
504         request.input.Reinitialize(input->data, std::min(input->data_length, max_input_size));
505     }
506 
507     UpdateOperationResponse response(message_version_);
508     keymaster_error_t err = trusty_keymaster_send(KM_UPDATE_OPERATION, request, &response);
509     if (err != KM_ERROR_OK) {
510         return err;
511     }
512 
513     if (response.output_params.size() > 0) {
514         if (out_params) {
515             response.output_params.CopyToParamSet(out_params);
516         } else {
517             return KM_ERROR_OUTPUT_PARAMETER_NULL;
518         }
519     }
520     *input_consumed = response.input_consumed;
521     if (output) {
522         output->data_length = response.output.available_read();
523         output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
524         if (!output->data) {
525             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
526         }
527     } else if (response.output.available_read() > 0) {
528         return KM_ERROR_OUTPUT_PARAMETER_NULL;
529     }
530 
531     return KM_ERROR_OK;
532 }
533 
finish(keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,const keymaster_blob_t * signature,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)534 keymaster_error_t TrustyKeymasterDevice::finish(keymaster_operation_handle_t operation_handle,
535                                                 const keymaster_key_param_set_t* in_params,
536                                                 const keymaster_blob_t* input,
537                                                 const keymaster_blob_t* signature,
538                                                 keymaster_key_param_set_t* out_params,
539                                                 keymaster_blob_t* output) {
540     ALOGD("Device received finish");
541 
542     if (error_ != KM_ERROR_OK) {
543         return error_;
544     }
545     if (input && input->data_length > kMaximumFinishInputLength) {
546         ALOGE("%zu-byte input to finish; only %zu bytes allowed", input->data_length,
547               kMaximumFinishInputLength);
548         return KM_ERROR_INVALID_INPUT_LENGTH;
549     }
550 
551     if (out_params) {
552         *out_params = {};
553     }
554     if (output) {
555         *output = {};
556     }
557 
558     FinishOperationRequest request(message_version_);
559     request.op_handle = operation_handle;
560     if (signature && signature->data && signature->data_length > 0) {
561         request.signature.Reinitialize(signature->data, signature->data_length);
562     }
563     if (input && input->data && input->data_length) {
564         request.input.Reinitialize(input->data, input->data_length);
565     }
566     if (in_params) {
567         request.additional_params.Reinitialize(*in_params);
568     }
569 
570     FinishOperationResponse response(message_version_);
571     keymaster_error_t err = trusty_keymaster_send(KM_FINISH_OPERATION, request, &response);
572     if (err != KM_ERROR_OK) {
573         return err;
574     }
575 
576     if (response.output_params.size() > 0) {
577         if (out_params) {
578             response.output_params.CopyToParamSet(out_params);
579         } else {
580             return KM_ERROR_OUTPUT_PARAMETER_NULL;
581         }
582     }
583     if (output) {
584         output->data_length = response.output.available_read();
585         output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
586         if (!output->data) {
587             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
588         }
589     } else if (response.output.available_read() > 0) {
590         return KM_ERROR_OUTPUT_PARAMETER_NULL;
591     }
592 
593     return KM_ERROR_OK;
594 }
595 
abort(keymaster_operation_handle_t operation_handle)596 keymaster_error_t TrustyKeymasterDevice::abort(keymaster_operation_handle_t operation_handle) {
597     ALOGD("Device received abort");
598 
599     if (error_ != KM_ERROR_OK) {
600         return error_;
601     }
602 
603     AbortOperationRequest request(message_version_);
604     request.op_handle = operation_handle;
605     AbortOperationResponse response(message_version_);
606     return trusty_keymaster_send(KM_ABORT_OPERATION, request, &response);
607 }
608 
delete_key(const keymaster_key_blob_t * key)609 keymaster_error_t TrustyKeymasterDevice::delete_key(const keymaster_key_blob_t* key) {
610     ALOGD("Device received delete_key");
611 
612     if (error_ != KM_ERROR_OK) {
613         return error_;
614     }
615 
616     if (!key || !key->key_material)
617         return KM_ERROR_UNEXPECTED_NULL_POINTER;
618 
619     DeleteKeyRequest request(message_version_);
620     request.SetKeyMaterial(*key);
621     DeleteKeyResponse response(message_version_);
622     return trusty_keymaster_send(KM_DELETE_KEY, request, &response);
623 }
624 
delete_all_keys()625 keymaster_error_t TrustyKeymasterDevice::delete_all_keys() {
626     ALOGD("Device received delete_all_key");
627 
628     if (error_ != KM_ERROR_OK) {
629         return error_;
630     }
631 
632     DeleteAllKeysRequest request(message_version_);
633     DeleteAllKeysResponse response(message_version_);
634     return trusty_keymaster_send(KM_DELETE_ALL_KEYS, request, &response);
635 }
636 
hw_device()637 hw_device_t* TrustyKeymasterDevice::hw_device() {
638     return &device_.common;
639 }
640 
convert_device(const keymaster2_device_t * dev)641 static inline TrustyKeymasterDevice* convert_device(const keymaster2_device_t* dev) {
642     return reinterpret_cast<TrustyKeymasterDevice*>(const_cast<keymaster2_device_t*>(dev));
643 }
644 
645 /* static */
close_device(hw_device_t * dev)646 int TrustyKeymasterDevice::close_device(hw_device_t* dev) {
647     delete reinterpret_cast<TrustyKeymasterDevice*>(dev);
648     return 0;
649 }
650 
651 /* static */
configure(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params)652 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster2_device_t* dev,
653                                                    const keymaster_key_param_set_t* params) {
654     return convert_device(dev)->configure(params);
655 }
656 
657 /* static */
add_rng_entropy(const keymaster2_device_t * dev,const uint8_t * data,size_t data_length)658 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const keymaster2_device_t* dev,
659                                                          const uint8_t* data, size_t data_length) {
660     return convert_device(dev)->add_rng_entropy(data, data_length);
661 }
662 
663 /* static */
generate_key(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)664 keymaster_error_t TrustyKeymasterDevice::generate_key(
665         const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
666         keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
667     return convert_device(dev)->generate_key(params, key_blob, characteristics);
668 }
669 
670 /* static */
get_key_characteristics(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_blob,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_key_characteristics_t * characteristics)671 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
672         const keymaster2_device_t* dev, const keymaster_key_blob_t* key_blob,
673         const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
674         keymaster_key_characteristics_t* characteristics) {
675     return convert_device(dev)->get_key_characteristics(key_blob, client_id, app_data,
676                                                         characteristics);
677 }
678 
679 /* static */
import_key(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params,keymaster_key_format_t key_format,const keymaster_blob_t * key_data,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)680 keymaster_error_t TrustyKeymasterDevice::import_key(
681         const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
682         keymaster_key_format_t key_format, const keymaster_blob_t* key_data,
683         keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
684     return convert_device(dev)->import_key(params, key_format, key_data, key_blob, characteristics);
685 }
686 
687 /* static */
export_key(const keymaster2_device_t * dev,keymaster_key_format_t export_format,const keymaster_key_blob_t * key_to_export,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_blob_t * export_data)688 keymaster_error_t TrustyKeymasterDevice::export_key(const keymaster2_device_t* dev,
689                                                     keymaster_key_format_t export_format,
690                                                     const keymaster_key_blob_t* key_to_export,
691                                                     const keymaster_blob_t* client_id,
692                                                     const keymaster_blob_t* app_data,
693                                                     keymaster_blob_t* export_data) {
694     return convert_device(dev)->export_key(export_format, key_to_export, client_id, app_data,
695                                            export_data);
696 }
697 
698 /* static */
attest_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_to_attest,const keymaster_key_param_set_t * attest_params,keymaster_cert_chain_t * cert_chain)699 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster2_device_t* dev,
700                                                     const keymaster_key_blob_t* key_to_attest,
701                                                     const keymaster_key_param_set_t* attest_params,
702                                                     keymaster_cert_chain_t* cert_chain) {
703     return convert_device(dev)->attest_key(key_to_attest, attest_params, cert_chain);
704 }
705 
706 /* static */
upgrade_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_to_upgrade,const keymaster_key_param_set_t * upgrade_params,keymaster_key_blob_t * upgraded_key)707 keymaster_error_t TrustyKeymasterDevice::upgrade_key(
708         const keymaster2_device_t* dev, const keymaster_key_blob_t* key_to_upgrade,
709         const keymaster_key_param_set_t* upgrade_params, keymaster_key_blob_t* upgraded_key) {
710     return convert_device(dev)->upgrade_key(key_to_upgrade, upgrade_params, upgraded_key);
711 }
712 
713 /* static */
begin(const keymaster2_device_t * dev,keymaster_purpose_t purpose,const keymaster_key_blob_t * key,const keymaster_key_param_set_t * in_params,keymaster_key_param_set_t * out_params,keymaster_operation_handle_t * operation_handle)714 keymaster_error_t TrustyKeymasterDevice::begin(const keymaster2_device_t* dev,
715                                                keymaster_purpose_t purpose,
716                                                const keymaster_key_blob_t* key,
717                                                const keymaster_key_param_set_t* in_params,
718                                                keymaster_key_param_set_t* out_params,
719                                                keymaster_operation_handle_t* operation_handle) {
720     return convert_device(dev)->begin(purpose, key, in_params, out_params, operation_handle);
721 }
722 
723 /* static */
update(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,size_t * input_consumed,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)724 keymaster_error_t TrustyKeymasterDevice::update(
725         const keymaster2_device_t* dev, keymaster_operation_handle_t operation_handle,
726         const keymaster_key_param_set_t* in_params, const keymaster_blob_t* input,
727         size_t* input_consumed, keymaster_key_param_set_t* out_params, keymaster_blob_t* output) {
728     return convert_device(dev)->update(operation_handle, in_params, input, input_consumed,
729                                        out_params, output);
730 }
731 
732 /* static */
finish(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,const keymaster_blob_t * signature,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)733 keymaster_error_t TrustyKeymasterDevice::finish(const keymaster2_device_t* dev,
734                                                 keymaster_operation_handle_t operation_handle,
735                                                 const keymaster_key_param_set_t* in_params,
736                                                 const keymaster_blob_t* input,
737                                                 const keymaster_blob_t* signature,
738                                                 keymaster_key_param_set_t* out_params,
739                                                 keymaster_blob_t* output) {
740     return convert_device(dev)->finish(operation_handle, in_params, input, signature, out_params,
741                                        output);
742 }
743 
744 /* static */
abort(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle)745 keymaster_error_t TrustyKeymasterDevice::abort(const keymaster2_device_t* dev,
746                                                keymaster_operation_handle_t operation_handle) {
747     return convert_device(dev)->abort(operation_handle);
748 }
749 
750 /* static */
delete_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key)751 keymaster_error_t TrustyKeymasterDevice::delete_key(const keymaster2_device_t* dev,
752                                                const keymaster_key_blob_t* key) {
753    return convert_device(dev)->delete_key(key);
754 }
755 
756 /* static */
delete_all_keys(const keymaster2_device_t * dev)757 keymaster_error_t TrustyKeymasterDevice::delete_all_keys(const keymaster2_device_t* dev) {
758    return convert_device(dev)->delete_all_keys();
759 }
760 
761 }  // namespace keymaster
762