1 /*
2 * Copyright 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "TrustyKeymaster"
18
19 #include <assert.h>
20 #include <errno.h>
21 #include <openssl/evp.h>
22 #include <openssl/x509.h>
23 #include <stddef.h>
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <time.h>
28
29 #include <algorithm>
30 #include <type_traits>
31
32 #include <hardware/keymaster2.h>
33 #include <keymaster/authorization_set.h>
34 #include <log/log.h>
35
36 #include <trusty_keymaster/ipc/keymaster_ipc.h>
37 #include <trusty_keymaster/ipc/trusty_keymaster_ipc.h>
38 #include <trusty_keymaster/legacy/trusty_keymaster_device.h>
39
40 const size_t kMaximumAttestationChallengeLength = 128;
41 const size_t kMaximumFinishInputLength = 2048;
42
43 namespace keymaster {
44
TrustyKeymasterDevice(const hw_module_t * module)45 TrustyKeymasterDevice::TrustyKeymasterDevice(const hw_module_t* module) {
46 static_assert(std::is_standard_layout<TrustyKeymasterDevice>::value,
47 "TrustyKeymasterDevice must be standard layout");
48 static_assert(offsetof(TrustyKeymasterDevice, device_) == 0,
49 "device_ must be the first member of TrustyKeymasterDevice");
50 static_assert(offsetof(TrustyKeymasterDevice, device_.common) == 0,
51 "common must be the first member of keymaster2_device");
52
53 ALOGI("Creating device");
54 ALOGD("Device address: %p", this);
55
56 device_ = {};
57
58 device_.common.tag = HARDWARE_DEVICE_TAG;
59 device_.common.version = 1;
60 device_.common.module = const_cast<hw_module_t*>(module);
61 device_.common.close = close_device;
62
63 device_.flags = KEYMASTER_SUPPORTS_EC;
64
65 device_.configure = configure;
66 device_.add_rng_entropy = add_rng_entropy;
67 device_.generate_key = generate_key;
68 device_.get_key_characteristics = get_key_characteristics;
69 device_.import_key = import_key;
70 device_.export_key = export_key;
71 device_.attest_key = attest_key;
72 device_.upgrade_key = upgrade_key;
73 device_.delete_key = delete_key;
74 device_.delete_all_keys = delete_all_keys;
75 device_.begin = begin;
76 device_.update = update;
77 device_.finish = finish;
78 device_.abort = abort;
79
80 int rc = trusty_keymaster_connect();
81 error_ = translate_error(rc);
82 if (rc < 0) {
83 ALOGE("failed to connect to keymaster (%d)", rc);
84 return;
85 }
86
87 GetVersionRequest version_request;
88 GetVersionResponse version_response;
89 error_ = trusty_keymaster_send(KM_GET_VERSION, version_request, &version_response);
90 if (error_ == KM_ERROR_INVALID_ARGUMENT || error_ == KM_ERROR_UNIMPLEMENTED) {
91 ALOGE("\"Bad parameters\" error on GetVersion call. Version 0 is not supported.");
92 error_ = KM_ERROR_VERSION_MISMATCH;
93 return;
94 }
95 message_version_ = MessageVersion(version_response.major_ver, version_response.minor_ver,
96 version_response.subminor_ver);
97 if (message_version_ < 0) {
98 // Can't translate version? Keymaster implementation must be newer.
99 ALOGE("Keymaster version %d.%d.%d not supported.", version_response.major_ver,
100 version_response.minor_ver, version_response.subminor_ver);
101 error_ = KM_ERROR_VERSION_MISMATCH;
102 }
103 }
104
~TrustyKeymasterDevice()105 TrustyKeymasterDevice::~TrustyKeymasterDevice() {
106 trusty_keymaster_disconnect();
107 }
108
109 namespace {
110
111 // Allocates a new buffer with malloc and copies the contents of |buffer| to it. Caller takes
112 // ownership of the returned buffer.
DuplicateBuffer(const uint8_t * buffer,size_t size)113 uint8_t* DuplicateBuffer(const uint8_t* buffer, size_t size) {
114 uint8_t* tmp = reinterpret_cast<uint8_t*>(malloc(size));
115 if (tmp) {
116 memcpy(tmp, buffer, size);
117 }
118 return tmp;
119 }
120
121 template <typename RequestType>
AddClientAndAppData(const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,RequestType * request)122 void AddClientAndAppData(const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
123 RequestType* request) {
124 request->additional_params.Clear();
125 if (client_id && client_id->data_length > 0) {
126 request->additional_params.push_back(TAG_APPLICATION_ID, *client_id);
127 }
128 if (app_data && app_data->data_length > 0) {
129 request->additional_params.push_back(TAG_APPLICATION_DATA, *app_data);
130 }
131 }
132
133 } // unnamed namespace
134
configure(const keymaster_key_param_set_t * params)135 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster_key_param_set_t* params) {
136 ALOGD("Device received configure\n");
137
138 if (error_ != KM_ERROR_OK) {
139 return error_;
140 }
141 if (!params) {
142 return KM_ERROR_UNEXPECTED_NULL_POINTER;
143 }
144
145 AuthorizationSet params_copy(*params);
146 ConfigureRequest request(message_version_);
147 if (!params_copy.GetTagValue(TAG_OS_VERSION, &request.os_version) ||
148 !params_copy.GetTagValue(TAG_OS_PATCHLEVEL, &request.os_patchlevel)) {
149 ALOGD("Configuration parameters must contain OS version and patch level");
150 return KM_ERROR_INVALID_ARGUMENT;
151 }
152
153 ConfigureResponse response(message_version_);
154 keymaster_error_t err = trusty_keymaster_send(KM_CONFIGURE, request, &response);
155 if (err != KM_ERROR_OK) {
156 return err;
157 }
158
159 return KM_ERROR_OK;
160 }
161
add_rng_entropy(const uint8_t * data,size_t data_length)162 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const uint8_t* data, size_t data_length) {
163 ALOGD("Device received add_rng_entropy");
164
165 if (error_ != KM_ERROR_OK) {
166 return error_;
167 }
168
169 AddEntropyRequest request(message_version_);
170 request.random_data.Reinitialize(data, data_length);
171 AddEntropyResponse response(message_version_);
172 return trusty_keymaster_send(KM_ADD_RNG_ENTROPY, request, &response);
173 }
174
generate_key(const keymaster_key_param_set_t * params,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)175 keymaster_error_t TrustyKeymasterDevice::generate_key(
176 const keymaster_key_param_set_t* params, keymaster_key_blob_t* key_blob,
177 keymaster_key_characteristics_t* characteristics) {
178 ALOGD("Device received generate_key");
179
180 if (error_ != KM_ERROR_OK) {
181 return error_;
182 }
183 if (!params) {
184 return KM_ERROR_UNEXPECTED_NULL_POINTER;
185 }
186 if (!key_blob) {
187 return KM_ERROR_OUTPUT_PARAMETER_NULL;
188 }
189
190 GenerateKeyRequest request(message_version_);
191 request.key_description.Reinitialize(*params);
192 request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
193
194 GenerateKeyResponse response(message_version_);
195 keymaster_error_t err = trusty_keymaster_send(KM_GENERATE_KEY, request, &response);
196 if (err != KM_ERROR_OK) {
197 return err;
198 }
199
200 key_blob->key_material_size = response.key_blob.key_material_size;
201 key_blob->key_material =
202 DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
203 if (!key_blob->key_material) {
204 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
205 }
206
207 if (characteristics) {
208 response.enforced.CopyToParamSet(&characteristics->hw_enforced);
209 response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
210 }
211
212 return KM_ERROR_OK;
213 }
214
get_key_characteristics(const keymaster_key_blob_t * key_blob,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_key_characteristics_t * characteristics)215 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
216 const keymaster_key_blob_t* key_blob, const keymaster_blob_t* client_id,
217 const keymaster_blob_t* app_data, keymaster_key_characteristics_t* characteristics) {
218 ALOGD("Device received get_key_characteristics");
219
220 if (error_ != KM_ERROR_OK) {
221 return error_;
222 }
223 if (!key_blob || !key_blob->key_material) {
224 return KM_ERROR_UNEXPECTED_NULL_POINTER;
225 }
226 if (!characteristics) {
227 return KM_ERROR_OUTPUT_PARAMETER_NULL;
228 }
229
230 GetKeyCharacteristicsRequest request(message_version_);
231 request.SetKeyMaterial(*key_blob);
232 AddClientAndAppData(client_id, app_data, &request);
233
234 GetKeyCharacteristicsResponse response(message_version_);
235 keymaster_error_t err = trusty_keymaster_send(KM_GET_KEY_CHARACTERISTICS, request, &response);
236 if (err != KM_ERROR_OK) {
237 return err;
238 }
239
240 response.enforced.CopyToParamSet(&characteristics->hw_enforced);
241 response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
242
243 return KM_ERROR_OK;
244 }
245
import_key(const keymaster_key_param_set_t * params,keymaster_key_format_t key_format,const keymaster_blob_t * key_data,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)246 keymaster_error_t TrustyKeymasterDevice::import_key(
247 const keymaster_key_param_set_t* params, keymaster_key_format_t key_format,
248 const keymaster_blob_t* key_data, keymaster_key_blob_t* key_blob,
249 keymaster_key_characteristics_t* characteristics) {
250 ALOGD("Device received import_key");
251
252 if (error_ != KM_ERROR_OK) {
253 return error_;
254 }
255 if (!params || !key_data) {
256 return KM_ERROR_UNEXPECTED_NULL_POINTER;
257 }
258 if (!key_blob) {
259 return KM_ERROR_OUTPUT_PARAMETER_NULL;
260 }
261
262 ImportKeyRequest request(message_version_);
263 request.key_description.Reinitialize(*params);
264 request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
265
266 request.key_format = key_format;
267 request.SetKeyMaterial(key_data->data, key_data->data_length);
268
269 ImportKeyResponse response(message_version_);
270 keymaster_error_t err = trusty_keymaster_send(KM_IMPORT_KEY, request, &response);
271 if (err != KM_ERROR_OK) {
272 return err;
273 }
274
275 key_blob->key_material_size = response.key_blob.key_material_size;
276 key_blob->key_material =
277 DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
278 if (!key_blob->key_material) {
279 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
280 }
281
282 if (characteristics) {
283 response.enforced.CopyToParamSet(&characteristics->hw_enforced);
284 response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
285 }
286
287 return KM_ERROR_OK;
288 }
289
export_key(keymaster_key_format_t export_format,const keymaster_key_blob_t * key_to_export,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_blob_t * export_data)290 keymaster_error_t TrustyKeymasterDevice::export_key(keymaster_key_format_t export_format,
291 const keymaster_key_blob_t* key_to_export,
292 const keymaster_blob_t* client_id,
293 const keymaster_blob_t* app_data,
294 keymaster_blob_t* export_data) {
295 ALOGD("Device received export_key");
296
297 if (error_ != KM_ERROR_OK) {
298 return error_;
299 }
300 if (!key_to_export || !key_to_export->key_material) {
301 return KM_ERROR_UNEXPECTED_NULL_POINTER;
302 }
303 if (!export_data) {
304 return KM_ERROR_OUTPUT_PARAMETER_NULL;
305 }
306
307 export_data->data = nullptr;
308 export_data->data_length = 0;
309
310 ExportKeyRequest request(message_version_);
311 request.key_format = export_format;
312 request.SetKeyMaterial(*key_to_export);
313 AddClientAndAppData(client_id, app_data, &request);
314
315 ExportKeyResponse response(message_version_);
316 keymaster_error_t err = trusty_keymaster_send(KM_EXPORT_KEY, request, &response);
317 if (err != KM_ERROR_OK) {
318 return err;
319 }
320
321 export_data->data_length = response.key_data_length;
322 export_data->data = DuplicateBuffer(response.key_data, response.key_data_length);
323 if (!export_data->data) {
324 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
325 }
326
327 return KM_ERROR_OK;
328 }
329
attest_key(const keymaster_key_blob_t * key_to_attest,const keymaster_key_param_set_t * attest_params,keymaster_cert_chain_t * cert_chain)330 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster_key_blob_t* key_to_attest,
331 const keymaster_key_param_set_t* attest_params,
332 keymaster_cert_chain_t* cert_chain) {
333 ALOGD("Device received attest_key");
334
335 if (error_ != KM_ERROR_OK) {
336 return error_;
337 }
338 if (!key_to_attest || !attest_params) {
339 return KM_ERROR_UNEXPECTED_NULL_POINTER;
340 }
341 if (!cert_chain) {
342 return KM_ERROR_OUTPUT_PARAMETER_NULL;
343 }
344
345 cert_chain->entry_count = 0;
346 cert_chain->entries = nullptr;
347
348 AttestKeyRequest request(message_version_);
349 request.SetKeyMaterial(*key_to_attest);
350 request.attest_params.Reinitialize(*attest_params);
351
352 keymaster_blob_t attestation_challenge = {};
353 request.attest_params.GetTagValue(TAG_ATTESTATION_CHALLENGE, &attestation_challenge);
354 if (attestation_challenge.data_length > kMaximumAttestationChallengeLength) {
355 ALOGE("%zu-byte attestation challenge; only %zu bytes allowed",
356 attestation_challenge.data_length, kMaximumAttestationChallengeLength);
357 return KM_ERROR_INVALID_INPUT_LENGTH;
358 }
359
360 AttestKeyResponse response(message_version_);
361 keymaster_error_t err = trusty_keymaster_send(KM_ATTEST_KEY, request, &response);
362 if (err != KM_ERROR_OK) {
363 return err;
364 }
365
366 // Allocate and clear storage for cert_chain.
367 keymaster_cert_chain_t& rsp_chain = response.certificate_chain;
368 cert_chain->entries = reinterpret_cast<keymaster_blob_t*>(
369 malloc(rsp_chain.entry_count * sizeof(*cert_chain->entries)));
370 if (!cert_chain->entries) {
371 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
372 }
373 cert_chain->entry_count = rsp_chain.entry_count;
374 for (keymaster_blob_t& entry : array_range(cert_chain->entries, cert_chain->entry_count)) {
375 entry = {};
376 }
377
378 // Copy cert_chain contents
379 size_t i = 0;
380 for (keymaster_blob_t& entry : array_range(rsp_chain.entries, rsp_chain.entry_count)) {
381 cert_chain->entries[i].data = DuplicateBuffer(entry.data, entry.data_length);
382 if (!cert_chain->entries[i].data) {
383 keymaster_free_cert_chain(cert_chain);
384 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
385 }
386 cert_chain->entries[i].data_length = entry.data_length;
387 ++i;
388 }
389
390 return KM_ERROR_OK;
391 }
392
upgrade_key(const keymaster_key_blob_t * key_to_upgrade,const keymaster_key_param_set_t * upgrade_params,keymaster_key_blob_t * upgraded_key)393 keymaster_error_t TrustyKeymasterDevice::upgrade_key(
394 const keymaster_key_blob_t* key_to_upgrade, const keymaster_key_param_set_t* upgrade_params,
395 keymaster_key_blob_t* upgraded_key) {
396 ALOGD("Device received upgrade_key");
397
398 if (error_ != KM_ERROR_OK) {
399 return error_;
400 }
401 if (!key_to_upgrade || !upgrade_params) {
402 return KM_ERROR_UNEXPECTED_NULL_POINTER;
403 }
404 if (!upgraded_key) {
405 return KM_ERROR_OUTPUT_PARAMETER_NULL;
406 }
407
408 UpgradeKeyRequest request(message_version_);
409 request.SetKeyMaterial(*key_to_upgrade);
410 request.upgrade_params.Reinitialize(*upgrade_params);
411
412 UpgradeKeyResponse response(message_version_);
413 keymaster_error_t err = trusty_keymaster_send(KM_UPGRADE_KEY, request, &response);
414 if (err != KM_ERROR_OK) {
415 return err;
416 }
417
418 upgraded_key->key_material_size = response.upgraded_key.key_material_size;
419 upgraded_key->key_material = DuplicateBuffer(response.upgraded_key.key_material,
420 response.upgraded_key.key_material_size);
421 if (!upgraded_key->key_material) {
422 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
423 }
424
425 return KM_ERROR_OK;
426 }
427
begin(keymaster_purpose_t purpose,const keymaster_key_blob_t * key,const keymaster_key_param_set_t * in_params,keymaster_key_param_set_t * out_params,keymaster_operation_handle_t * operation_handle)428 keymaster_error_t TrustyKeymasterDevice::begin(keymaster_purpose_t purpose,
429 const keymaster_key_blob_t* key,
430 const keymaster_key_param_set_t* in_params,
431 keymaster_key_param_set_t* out_params,
432 keymaster_operation_handle_t* operation_handle) {
433 ALOGD("Device received begin");
434
435 if (error_ != KM_ERROR_OK) {
436 return error_;
437 }
438 if (!key || !key->key_material) {
439 return KM_ERROR_UNEXPECTED_NULL_POINTER;
440 }
441 if (!operation_handle) {
442 return KM_ERROR_OUTPUT_PARAMETER_NULL;
443 }
444
445 if (out_params) {
446 *out_params = {};
447 }
448
449 BeginOperationRequest request(message_version_);
450 request.purpose = purpose;
451 request.SetKeyMaterial(*key);
452 request.additional_params.Reinitialize(*in_params);
453
454 BeginOperationResponse response(message_version_);
455 keymaster_error_t err = trusty_keymaster_send(KM_BEGIN_OPERATION, request, &response);
456 if (err != KM_ERROR_OK) {
457 return err;
458 }
459
460 if (response.output_params.size() > 0) {
461 if (out_params) {
462 response.output_params.CopyToParamSet(out_params);
463 } else {
464 return KM_ERROR_OUTPUT_PARAMETER_NULL;
465 }
466 }
467 *operation_handle = response.op_handle;
468
469 return KM_ERROR_OK;
470 }
471
update(keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,size_t * input_consumed,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)472 keymaster_error_t TrustyKeymasterDevice::update(keymaster_operation_handle_t operation_handle,
473 const keymaster_key_param_set_t* in_params,
474 const keymaster_blob_t* input,
475 size_t* input_consumed,
476 keymaster_key_param_set_t* out_params,
477 keymaster_blob_t* output) {
478 ALOGD("Device received update");
479
480 if (error_ != KM_ERROR_OK) {
481 return error_;
482 }
483 if (!input) {
484 return KM_ERROR_UNEXPECTED_NULL_POINTER;
485 }
486 if (!input_consumed) {
487 return KM_ERROR_OUTPUT_PARAMETER_NULL;
488 }
489
490 if (out_params) {
491 *out_params = {};
492 }
493 if (output) {
494 *output = {};
495 }
496
497 UpdateOperationRequest request(message_version_);
498 request.op_handle = operation_handle;
499 if (in_params) {
500 request.additional_params.Reinitialize(*in_params);
501 }
502 if (input && input->data_length > 0) {
503 size_t max_input_size = TRUSTY_KEYMASTER_SEND_BUF_SIZE - request.SerializedSize();
504 request.input.Reinitialize(input->data, std::min(input->data_length, max_input_size));
505 }
506
507 UpdateOperationResponse response(message_version_);
508 keymaster_error_t err = trusty_keymaster_send(KM_UPDATE_OPERATION, request, &response);
509 if (err != KM_ERROR_OK) {
510 return err;
511 }
512
513 if (response.output_params.size() > 0) {
514 if (out_params) {
515 response.output_params.CopyToParamSet(out_params);
516 } else {
517 return KM_ERROR_OUTPUT_PARAMETER_NULL;
518 }
519 }
520 *input_consumed = response.input_consumed;
521 if (output) {
522 output->data_length = response.output.available_read();
523 output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
524 if (!output->data) {
525 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
526 }
527 } else if (response.output.available_read() > 0) {
528 return KM_ERROR_OUTPUT_PARAMETER_NULL;
529 }
530
531 return KM_ERROR_OK;
532 }
533
finish(keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,const keymaster_blob_t * signature,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)534 keymaster_error_t TrustyKeymasterDevice::finish(keymaster_operation_handle_t operation_handle,
535 const keymaster_key_param_set_t* in_params,
536 const keymaster_blob_t* input,
537 const keymaster_blob_t* signature,
538 keymaster_key_param_set_t* out_params,
539 keymaster_blob_t* output) {
540 ALOGD("Device received finish");
541
542 if (error_ != KM_ERROR_OK) {
543 return error_;
544 }
545 if (input && input->data_length > kMaximumFinishInputLength) {
546 ALOGE("%zu-byte input to finish; only %zu bytes allowed", input->data_length,
547 kMaximumFinishInputLength);
548 return KM_ERROR_INVALID_INPUT_LENGTH;
549 }
550
551 if (out_params) {
552 *out_params = {};
553 }
554 if (output) {
555 *output = {};
556 }
557
558 FinishOperationRequest request(message_version_);
559 request.op_handle = operation_handle;
560 if (signature && signature->data && signature->data_length > 0) {
561 request.signature.Reinitialize(signature->data, signature->data_length);
562 }
563 if (input && input->data && input->data_length) {
564 request.input.Reinitialize(input->data, input->data_length);
565 }
566 if (in_params) {
567 request.additional_params.Reinitialize(*in_params);
568 }
569
570 FinishOperationResponse response(message_version_);
571 keymaster_error_t err = trusty_keymaster_send(KM_FINISH_OPERATION, request, &response);
572 if (err != KM_ERROR_OK) {
573 return err;
574 }
575
576 if (response.output_params.size() > 0) {
577 if (out_params) {
578 response.output_params.CopyToParamSet(out_params);
579 } else {
580 return KM_ERROR_OUTPUT_PARAMETER_NULL;
581 }
582 }
583 if (output) {
584 output->data_length = response.output.available_read();
585 output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
586 if (!output->data) {
587 return KM_ERROR_MEMORY_ALLOCATION_FAILED;
588 }
589 } else if (response.output.available_read() > 0) {
590 return KM_ERROR_OUTPUT_PARAMETER_NULL;
591 }
592
593 return KM_ERROR_OK;
594 }
595
abort(keymaster_operation_handle_t operation_handle)596 keymaster_error_t TrustyKeymasterDevice::abort(keymaster_operation_handle_t operation_handle) {
597 ALOGD("Device received abort");
598
599 if (error_ != KM_ERROR_OK) {
600 return error_;
601 }
602
603 AbortOperationRequest request(message_version_);
604 request.op_handle = operation_handle;
605 AbortOperationResponse response(message_version_);
606 return trusty_keymaster_send(KM_ABORT_OPERATION, request, &response);
607 }
608
delete_key(const keymaster_key_blob_t * key)609 keymaster_error_t TrustyKeymasterDevice::delete_key(const keymaster_key_blob_t* key) {
610 ALOGD("Device received delete_key");
611
612 if (error_ != KM_ERROR_OK) {
613 return error_;
614 }
615
616 if (!key || !key->key_material)
617 return KM_ERROR_UNEXPECTED_NULL_POINTER;
618
619 DeleteKeyRequest request(message_version_);
620 request.SetKeyMaterial(*key);
621 DeleteKeyResponse response(message_version_);
622 return trusty_keymaster_send(KM_DELETE_KEY, request, &response);
623 }
624
delete_all_keys()625 keymaster_error_t TrustyKeymasterDevice::delete_all_keys() {
626 ALOGD("Device received delete_all_key");
627
628 if (error_ != KM_ERROR_OK) {
629 return error_;
630 }
631
632 DeleteAllKeysRequest request(message_version_);
633 DeleteAllKeysResponse response(message_version_);
634 return trusty_keymaster_send(KM_DELETE_ALL_KEYS, request, &response);
635 }
636
hw_device()637 hw_device_t* TrustyKeymasterDevice::hw_device() {
638 return &device_.common;
639 }
640
convert_device(const keymaster2_device_t * dev)641 static inline TrustyKeymasterDevice* convert_device(const keymaster2_device_t* dev) {
642 return reinterpret_cast<TrustyKeymasterDevice*>(const_cast<keymaster2_device_t*>(dev));
643 }
644
645 /* static */
close_device(hw_device_t * dev)646 int TrustyKeymasterDevice::close_device(hw_device_t* dev) {
647 delete reinterpret_cast<TrustyKeymasterDevice*>(dev);
648 return 0;
649 }
650
651 /* static */
configure(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params)652 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster2_device_t* dev,
653 const keymaster_key_param_set_t* params) {
654 return convert_device(dev)->configure(params);
655 }
656
657 /* static */
add_rng_entropy(const keymaster2_device_t * dev,const uint8_t * data,size_t data_length)658 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const keymaster2_device_t* dev,
659 const uint8_t* data, size_t data_length) {
660 return convert_device(dev)->add_rng_entropy(data, data_length);
661 }
662
663 /* static */
generate_key(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)664 keymaster_error_t TrustyKeymasterDevice::generate_key(
665 const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
666 keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
667 return convert_device(dev)->generate_key(params, key_blob, characteristics);
668 }
669
670 /* static */
get_key_characteristics(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_blob,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_key_characteristics_t * characteristics)671 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
672 const keymaster2_device_t* dev, const keymaster_key_blob_t* key_blob,
673 const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
674 keymaster_key_characteristics_t* characteristics) {
675 return convert_device(dev)->get_key_characteristics(key_blob, client_id, app_data,
676 characteristics);
677 }
678
679 /* static */
import_key(const keymaster2_device_t * dev,const keymaster_key_param_set_t * params,keymaster_key_format_t key_format,const keymaster_blob_t * key_data,keymaster_key_blob_t * key_blob,keymaster_key_characteristics_t * characteristics)680 keymaster_error_t TrustyKeymasterDevice::import_key(
681 const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
682 keymaster_key_format_t key_format, const keymaster_blob_t* key_data,
683 keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
684 return convert_device(dev)->import_key(params, key_format, key_data, key_blob, characteristics);
685 }
686
687 /* static */
export_key(const keymaster2_device_t * dev,keymaster_key_format_t export_format,const keymaster_key_blob_t * key_to_export,const keymaster_blob_t * client_id,const keymaster_blob_t * app_data,keymaster_blob_t * export_data)688 keymaster_error_t TrustyKeymasterDevice::export_key(const keymaster2_device_t* dev,
689 keymaster_key_format_t export_format,
690 const keymaster_key_blob_t* key_to_export,
691 const keymaster_blob_t* client_id,
692 const keymaster_blob_t* app_data,
693 keymaster_blob_t* export_data) {
694 return convert_device(dev)->export_key(export_format, key_to_export, client_id, app_data,
695 export_data);
696 }
697
698 /* static */
attest_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_to_attest,const keymaster_key_param_set_t * attest_params,keymaster_cert_chain_t * cert_chain)699 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster2_device_t* dev,
700 const keymaster_key_blob_t* key_to_attest,
701 const keymaster_key_param_set_t* attest_params,
702 keymaster_cert_chain_t* cert_chain) {
703 return convert_device(dev)->attest_key(key_to_attest, attest_params, cert_chain);
704 }
705
706 /* static */
upgrade_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key_to_upgrade,const keymaster_key_param_set_t * upgrade_params,keymaster_key_blob_t * upgraded_key)707 keymaster_error_t TrustyKeymasterDevice::upgrade_key(
708 const keymaster2_device_t* dev, const keymaster_key_blob_t* key_to_upgrade,
709 const keymaster_key_param_set_t* upgrade_params, keymaster_key_blob_t* upgraded_key) {
710 return convert_device(dev)->upgrade_key(key_to_upgrade, upgrade_params, upgraded_key);
711 }
712
713 /* static */
begin(const keymaster2_device_t * dev,keymaster_purpose_t purpose,const keymaster_key_blob_t * key,const keymaster_key_param_set_t * in_params,keymaster_key_param_set_t * out_params,keymaster_operation_handle_t * operation_handle)714 keymaster_error_t TrustyKeymasterDevice::begin(const keymaster2_device_t* dev,
715 keymaster_purpose_t purpose,
716 const keymaster_key_blob_t* key,
717 const keymaster_key_param_set_t* in_params,
718 keymaster_key_param_set_t* out_params,
719 keymaster_operation_handle_t* operation_handle) {
720 return convert_device(dev)->begin(purpose, key, in_params, out_params, operation_handle);
721 }
722
723 /* static */
update(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,size_t * input_consumed,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)724 keymaster_error_t TrustyKeymasterDevice::update(
725 const keymaster2_device_t* dev, keymaster_operation_handle_t operation_handle,
726 const keymaster_key_param_set_t* in_params, const keymaster_blob_t* input,
727 size_t* input_consumed, keymaster_key_param_set_t* out_params, keymaster_blob_t* output) {
728 return convert_device(dev)->update(operation_handle, in_params, input, input_consumed,
729 out_params, output);
730 }
731
732 /* static */
finish(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle,const keymaster_key_param_set_t * in_params,const keymaster_blob_t * input,const keymaster_blob_t * signature,keymaster_key_param_set_t * out_params,keymaster_blob_t * output)733 keymaster_error_t TrustyKeymasterDevice::finish(const keymaster2_device_t* dev,
734 keymaster_operation_handle_t operation_handle,
735 const keymaster_key_param_set_t* in_params,
736 const keymaster_blob_t* input,
737 const keymaster_blob_t* signature,
738 keymaster_key_param_set_t* out_params,
739 keymaster_blob_t* output) {
740 return convert_device(dev)->finish(operation_handle, in_params, input, signature, out_params,
741 output);
742 }
743
744 /* static */
abort(const keymaster2_device_t * dev,keymaster_operation_handle_t operation_handle)745 keymaster_error_t TrustyKeymasterDevice::abort(const keymaster2_device_t* dev,
746 keymaster_operation_handle_t operation_handle) {
747 return convert_device(dev)->abort(operation_handle);
748 }
749
750 /* static */
delete_key(const keymaster2_device_t * dev,const keymaster_key_blob_t * key)751 keymaster_error_t TrustyKeymasterDevice::delete_key(const keymaster2_device_t* dev,
752 const keymaster_key_blob_t* key) {
753 return convert_device(dev)->delete_key(key);
754 }
755
756 /* static */
delete_all_keys(const keymaster2_device_t * dev)757 keymaster_error_t TrustyKeymasterDevice::delete_all_keys(const keymaster2_device_t* dev) {
758 return convert_device(dev)->delete_all_keys();
759 }
760
761 } // namespace keymaster
762