1 /*
2 * Copyright (C) 2025 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 mod accessor;
18
19 use alloc::rc::Rc;
20 use rpcbinder::RpcServer;
21 use std::ffi::CStr;
22 use tipc::{service_dispatcher, Manager, PortCfg};
23
24 pub use accessor::{AuthMgrAccessor, SecurityConfig};
25
26 const SECURE_STORAGE_SERVICE_NAME: &str =
27 "android.hardware.security.see.storage.ISecureStorage/default";
28 const SECURE_STORAGE_TARGET_PORT: &CStr = c"com.android.hardware.security.see.storage";
29 const HWKEY_SERVICE_NAME: &str = "android.hardware.security.see.hwcrypto.IHwCryptoKey/default";
30 const HWKEY_TARGET_PORT: &CStr = c"com.android.trusty.rust.hwcryptohal.V1";
31
32 const PORT_COUNT: usize = 2;
33 const CONNECTION_COUNT: usize = 6;
34
35 type AuthMgrAccessorService = rpcbinder::RpcServer;
36
37 service_dispatcher! {
38 pub enum AuthMgrFeDispatcher {
39 AuthMgrAccessorService,
40 }
41 }
42
add_server_to_authmgr_dispatcher( dispatcher: &mut AuthMgrFeDispatcher<PORT_COUNT>, service_name: &'static str, target_port: &'static CStr, )43 fn add_server_to_authmgr_dispatcher(
44 dispatcher: &mut AuthMgrFeDispatcher<PORT_COUNT>,
45 service_name: &'static str,
46 target_port: &'static CStr,
47 ) {
48 let accessor_server = RpcServer::new_per_session(move |uuid| {
49 Some(
50 AuthMgrAccessor::new_binder(service_name, get_security_config(target_port), uuid)
51 .as_binder(),
52 )
53 });
54 let serving_port = service_manager::service_name_to_trusty_port(service_name)
55 .expect("Port name to be derivable from service name");
56 let service_cfg =
57 PortCfg::new(serving_port).expect("Service port should be valid").allow_ta_connect();
58
59 dispatcher
60 .add_service(Rc::new(accessor_server), service_cfg)
61 .expect("RPC service should add to dispatcher");
62 }
63
64 #[cfg(feature = "authmgrfe_mode_insecure")]
get_security_config(target_port: &'static CStr) -> SecurityConfig65 fn get_security_config(target_port: &'static CStr) -> SecurityConfig {
66 log::warn!("Using authmgr-fe SecurityConfig::Insecure - no authentication or authorization for trusted services.");
67 SecurityConfig::Insecure { target_port }
68 }
69
70 #[cfg(not(feature = "authmgrfe_mode_insecure"))]
get_security_config(_target_port: &'static CStr) -> SecurityConfig71 fn get_security_config(_target_port: &'static CStr) -> SecurityConfig {
72 log::info!("Using authmgr-fe SecurityConfig::Secure.");
73 SecurityConfig::Secure
74 }
75
init_and_start_loop() -> tipc::Result<()>76 pub fn init_and_start_loop() -> tipc::Result<()> {
77 let mut dispatcher =
78 AuthMgrFeDispatcher::<PORT_COUNT>::new().expect("Dispatcher creation should not fail");
79
80 add_server_to_authmgr_dispatcher(
81 &mut dispatcher,
82 SECURE_STORAGE_SERVICE_NAME,
83 SECURE_STORAGE_TARGET_PORT,
84 );
85 add_server_to_authmgr_dispatcher(&mut dispatcher, HWKEY_SERVICE_NAME, HWKEY_TARGET_PORT);
86
87 Manager::<_, _, PORT_COUNT, CONNECTION_COUNT>::new_with_dispatcher(dispatcher, [])
88 .expect("Service manager should be created")
89 .run_event_loop()
90 }
91
92 #[cfg(test)]
93 mod tests {
94 use super::*;
95 use binder::IBinder;
96 use test::*;
97 use service_manager::*;
98 use android_hardware_security_see_storage::aidl::android::hardware::security::see::storage::ISecureStorage::ISecureStorage;
99
100 test::init!();
101
102 #[test]
test_get_secure_storage_binder()103 fn test_get_secure_storage_binder() {
104 let ss: Result<binder::Strong<dyn ISecureStorage>, binder::StatusCode> =
105 wait_for_interface(SECURE_STORAGE_SERVICE_NAME);
106
107 assert_ok!(ss.expect("secure storage interface to be resolved").as_binder().ping_binder());
108 }
109 }
110