1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #pragma once 18 19 #define KEYMASTER_PORT "com.android.trusty.keymaster" 20 #define KEYMASTER_MAX_BUFFER_LENGTH 4096 21 22 #include <uapi/trusty_uuid.h> 23 24 constexpr uint32_t KEYMASTER_RESP_BIT = 1; 25 constexpr uint32_t KEYMASTER_STOP_BIT = 2; 26 constexpr uint32_t KEYMASTER_REQ_SHIFT = 2; 27 28 // Commands 29 enum keymaster_command : uint32_t { 30 KM_GENERATE_KEY = (0 << KEYMASTER_REQ_SHIFT), 31 KM_BEGIN_OPERATION = (1 << KEYMASTER_REQ_SHIFT), 32 KM_UPDATE_OPERATION = (2 << KEYMASTER_REQ_SHIFT), 33 KM_FINISH_OPERATION = (3 << KEYMASTER_REQ_SHIFT), 34 KM_ABORT_OPERATION = (4 << KEYMASTER_REQ_SHIFT), 35 KM_IMPORT_KEY = (5 << KEYMASTER_REQ_SHIFT), 36 KM_EXPORT_KEY = (6 << KEYMASTER_REQ_SHIFT), 37 KM_GET_VERSION = (7 << KEYMASTER_REQ_SHIFT), 38 KM_ADD_RNG_ENTROPY = (8 << KEYMASTER_REQ_SHIFT), 39 KM_GET_SUPPORTED_ALGORITHMS = (9 << KEYMASTER_REQ_SHIFT), 40 KM_GET_SUPPORTED_BLOCK_MODES = (10 << KEYMASTER_REQ_SHIFT), 41 KM_GET_SUPPORTED_PADDING_MODES = (11 << KEYMASTER_REQ_SHIFT), 42 KM_GET_SUPPORTED_DIGESTS = (12 << KEYMASTER_REQ_SHIFT), 43 KM_GET_SUPPORTED_IMPORT_FORMATS = (13 << KEYMASTER_REQ_SHIFT), 44 KM_GET_SUPPORTED_EXPORT_FORMATS = (14 << KEYMASTER_REQ_SHIFT), 45 KM_GET_KEY_CHARACTERISTICS = (15 << KEYMASTER_REQ_SHIFT), 46 KM_ATTEST_KEY = (16 << KEYMASTER_REQ_SHIFT), 47 KM_UPGRADE_KEY = (17 << KEYMASTER_REQ_SHIFT), 48 KM_CONFIGURE = (18 << KEYMASTER_REQ_SHIFT), 49 KM_GET_HMAC_SHARING_PARAMETERS = (19 << KEYMASTER_REQ_SHIFT), 50 KM_COMPUTE_SHARED_HMAC = (20 << KEYMASTER_REQ_SHIFT), 51 KM_VERIFY_AUTHORIZATION = (21 << KEYMASTER_REQ_SHIFT), 52 KM_DELETE_KEY = (22 << KEYMASTER_REQ_SHIFT), 53 KM_DELETE_ALL_KEYS = (23 << KEYMASTER_REQ_SHIFT), 54 KM_DESTROY_ATTESTATION_IDS = (24 << KEYMASTER_REQ_SHIFT), 55 KM_IMPORT_WRAPPED_KEY = (25 << KEYMASTER_REQ_SHIFT), 56 KM_GET_VERSION_2 = (28 << KEYMASTER_REQ_SHIFT), 57 KM_EARLY_BOOT_ENDED = (29 << KEYMASTER_REQ_SHIFT), 58 KM_DEVICE_LOCKED = (30 << KEYMASTER_REQ_SHIFT), 59 KM_GENERATE_RKP_KEY = (31 << KEYMASTER_REQ_SHIFT), 60 KM_GENERATE_CSR = (32 << KEYMASTER_REQ_SHIFT), 61 KM_CONFIGURE_VENDOR_PATCHLEVEL = (33 << KEYMASTER_REQ_SHIFT), 62 KM_GET_ROOT_OF_TRUST = (34 << KEYMASTER_REQ_SHIFT), 63 KM_GET_HW_INFO = (35 << KEYMASTER_REQ_SHIFT), 64 KM_GENERATE_CSR_V2 = (36 << KEYMASTER_REQ_SHIFT), 65 66 // Bootloader calls. 67 KM_SET_BOOT_PARAMS = (0x1000 << KEYMASTER_REQ_SHIFT), 68 KM_SET_ATTESTATION_KEY = (0x2000 << KEYMASTER_REQ_SHIFT), 69 KM_APPEND_ATTESTATION_CERT_CHAIN = (0x3000 << KEYMASTER_REQ_SHIFT), 70 KM_ATAP_GET_CA_REQUEST = (0x4000 << KEYMASTER_REQ_SHIFT), 71 KM_ATAP_SET_CA_RESPONSE_BEGIN = (0x5000 << KEYMASTER_REQ_SHIFT), 72 KM_ATAP_SET_CA_RESPONSE_UPDATE = (0x6000 << KEYMASTER_REQ_SHIFT), 73 KM_ATAP_SET_CA_RESPONSE_FINISH = (0x7000 << KEYMASTER_REQ_SHIFT), 74 KM_ATAP_READ_UUID = (0x8000 << KEYMASTER_REQ_SHIFT), 75 KM_SET_PRODUCT_ID = (0x9000 << KEYMASTER_REQ_SHIFT), 76 KM_CLEAR_ATTESTATION_CERT_CHAIN = (0xa000 << KEYMASTER_REQ_SHIFT), 77 KM_SET_WRAPPED_ATTESTATION_KEY = (0xb000 << KEYMASTER_REQ_SHIFT), 78 KM_SET_ATTESTATION_IDS = (0xc000 << KEYMASTER_REQ_SHIFT), 79 KM_SET_ATTESTATION_IDS_KM3 = (0xc001 << KEYMASTER_REQ_SHIFT), 80 KM_CONFIGURE_BOOT_PATCHLEVEL = (0xd0000 << KEYMASTER_REQ_SHIFT), 81 }; 82 83 /** 84 * check uuid against the target-specific acesss policy 85 * 86 * @uuid: the uuid of the requesting client 87 */ 88 bool keymaster_check_target_access_policy(uuid_t* uuid); 89 90 /** 91 * check uuid against the target-specific acesss policy for TAs that can 92 * provision Keymaster. 93 * 94 * @uuid: the uuid of the requesting client 95 */ 96 bool keymaster_check_secure_target_access_policy_provisioning( 97 const uuid_t* uuid); 98 99 #ifdef __ANDROID__ 100 101 /** 102 * keymaster_message - Serial header for communicating with KM server 103 * @cmd: the command, one of keymaster_command. 104 * @payload: start of the serialized command specific payload 105 */ 106 struct keymaster_message { 107 uint32_t cmd; 108 uint8_t payload[0]; 109 }; 110 111 #endif 112