1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include "Keymaster.h" 18 19 #include <android-base/logging.h> 20 #include <hardware/hardware.h> 21 #include <hardware/keymaster1.h> 22 #include <hardware/keymaster2.h> 23 24 namespace android { 25 namespace vold { 26 27 class IKeymasterDevice { 28 public: 29 IKeymasterDevice() {} 30 virtual ~IKeymasterDevice() {} 31 virtual keymaster_error_t generate_key(const keymaster_key_param_set_t* params, 32 keymaster_key_blob_t* key_blob) const = 0; 33 virtual keymaster_error_t delete_key(const keymaster_key_blob_t* key) const = 0; 34 virtual keymaster_error_t begin(keymaster_purpose_t purpose, const keymaster_key_blob_t* key, 35 const keymaster_key_param_set_t* in_params, 36 keymaster_key_param_set_t* out_params, 37 keymaster_operation_handle_t* operation_handle) const = 0; 38 virtual keymaster_error_t update(keymaster_operation_handle_t operation_handle, 39 const keymaster_key_param_set_t* in_params, 40 const keymaster_blob_t* input, size_t* input_consumed, 41 keymaster_key_param_set_t* out_params, 42 keymaster_blob_t* output) const = 0; 43 virtual keymaster_error_t finish(keymaster_operation_handle_t operation_handle, 44 const keymaster_key_param_set_t* in_params, 45 const keymaster_blob_t* signature, 46 keymaster_key_param_set_t* out_params, 47 keymaster_blob_t* output) const = 0; 48 virtual keymaster_error_t abort(keymaster_operation_handle_t operation_handle) const = 0; 49 50 protected: 51 DISALLOW_COPY_AND_ASSIGN(IKeymasterDevice); 52 }; 53 54 template <typename T> class KeymasterDevice : public IKeymasterDevice { 55 public: 56 KeymasterDevice(T* d) : mDevice{d} {} 57 keymaster_error_t generate_key(const keymaster_key_param_set_t* params, 58 keymaster_key_blob_t* key_blob) const override final { 59 return mDevice->generate_key(mDevice, params, key_blob, nullptr); 60 } 61 keymaster_error_t delete_key(const keymaster_key_blob_t* key) const override final { 62 if (mDevice->delete_key == nullptr) return KM_ERROR_OK; 63 return mDevice->delete_key(mDevice, key); 64 } 65 keymaster_error_t begin(keymaster_purpose_t purpose, const keymaster_key_blob_t* key, 66 const keymaster_key_param_set_t* in_params, 67 keymaster_key_param_set_t* out_params, 68 keymaster_operation_handle_t* operation_handle) const override final { 69 return mDevice->begin(mDevice, purpose, key, in_params, out_params, operation_handle); 70 } 71 keymaster_error_t update(keymaster_operation_handle_t operation_handle, 72 const keymaster_key_param_set_t* in_params, 73 const keymaster_blob_t* input, size_t* input_consumed, 74 keymaster_key_param_set_t* out_params, 75 keymaster_blob_t* output) const override final { 76 return mDevice->update(mDevice, operation_handle, in_params, input, input_consumed, 77 out_params, output); 78 } 79 keymaster_error_t abort(keymaster_operation_handle_t operation_handle) const override final { 80 return mDevice->abort(mDevice, operation_handle); 81 } 82 83 protected: 84 T* const mDevice; 85 }; 86 87 class Keymaster1Device : public KeymasterDevice<keymaster1_device_t> { 88 public: 89 Keymaster1Device(keymaster1_device_t* d) : KeymasterDevice<keymaster1_device_t>{d} {} 90 ~Keymaster1Device() override final { keymaster1_close(mDevice); } 91 keymaster_error_t finish(keymaster_operation_handle_t operation_handle, 92 const keymaster_key_param_set_t* in_params, 93 const keymaster_blob_t* signature, 94 keymaster_key_param_set_t* out_params, 95 keymaster_blob_t* output) const override final { 96 return mDevice->finish(mDevice, operation_handle, in_params, signature, out_params, output); 97 } 98 }; 99 100 class Keymaster2Device : public KeymasterDevice<keymaster2_device_t> { 101 public: 102 Keymaster2Device(keymaster2_device_t* d) : KeymasterDevice<keymaster2_device_t>{d} {} 103 ~Keymaster2Device() override final { keymaster2_close(mDevice); } 104 keymaster_error_t finish(keymaster_operation_handle_t operation_handle, 105 const keymaster_key_param_set_t* in_params, 106 const keymaster_blob_t* signature, 107 keymaster_key_param_set_t* out_params, 108 keymaster_blob_t* output) const override final { 109 return mDevice->finish(mDevice, operation_handle, in_params, nullptr, signature, out_params, 110 output); 111 } 112 }; 113 114 KeymasterOperation::~KeymasterOperation() { 115 if (mDevice) mDevice->abort(mOpHandle); 116 } 117 118 bool KeymasterOperation::updateCompletely(const std::string& input, std::string* output) { 119 output->clear(); 120 auto it = input.begin(); 121 while (it != input.end()) { 122 size_t toRead = static_cast<size_t>(input.end() - it); 123 keymaster_blob_t inputBlob{reinterpret_cast<const uint8_t*>(&*it), toRead}; 124 keymaster_blob_t outputBlob; 125 size_t inputConsumed; 126 auto error = 127 mDevice->update(mOpHandle, nullptr, &inputBlob, &inputConsumed, nullptr, &outputBlob); 128 if (error != KM_ERROR_OK) { 129 LOG(ERROR) << "update failed, code " << error; 130 mDevice = nullptr; 131 return false; 132 } 133 output->append(reinterpret_cast<const char*>(outputBlob.data), outputBlob.data_length); 134 free(const_cast<uint8_t*>(outputBlob.data)); 135 if (inputConsumed > toRead) { 136 LOG(ERROR) << "update reported too much input consumed"; 137 mDevice = nullptr; 138 return false; 139 } 140 it += inputConsumed; 141 } 142 return true; 143 } 144 145 bool KeymasterOperation::finish() { 146 auto error = mDevice->finish(mOpHandle, nullptr, nullptr, nullptr, nullptr); 147 mDevice = nullptr; 148 if (error != KM_ERROR_OK) { 149 LOG(ERROR) << "finish failed, code " << error; 150 return false; 151 } 152 return true; 153 } 154 155 bool KeymasterOperation::finishWithOutput(std::string* output) { 156 keymaster_blob_t outputBlob; 157 auto error = mDevice->finish(mOpHandle, nullptr, nullptr, nullptr, &outputBlob); 158 mDevice = nullptr; 159 if (error != KM_ERROR_OK) { 160 LOG(ERROR) << "finish failed, code " << error; 161 return false; 162 } 163 output->assign(reinterpret_cast<const char*>(outputBlob.data), outputBlob.data_length); 164 free(const_cast<uint8_t*>(outputBlob.data)); 165 return true; 166 } 167 168 Keymaster::Keymaster() { 169 mDevice = nullptr; 170 const hw_module_t* module; 171 int ret = hw_get_module_by_class(KEYSTORE_HARDWARE_MODULE_ID, NULL, &module); 172 if (ret != 0) { 173 LOG(ERROR) << "hw_get_module_by_class returned " << ret; 174 return; 175 } 176 if (module->module_api_version == KEYMASTER_MODULE_API_VERSION_1_0) { 177 keymaster1_device_t* device; 178 ret = keymaster1_open(module, &device); 179 if (ret != 0) { 180 LOG(ERROR) << "keymaster1_open returned " << ret; 181 return; 182 } 183 mDevice = std::make_shared<Keymaster1Device>(device); 184 } else if (module->module_api_version == KEYMASTER_MODULE_API_VERSION_2_0) { 185 keymaster2_device_t* device; 186 ret = keymaster2_open(module, &device); 187 if (ret != 0) { 188 LOG(ERROR) << "keymaster2_open returned " << ret; 189 return; 190 } 191 mDevice = std::make_shared<Keymaster2Device>(device); 192 } else { 193 LOG(ERROR) << "module_api_version is " << module->module_api_version; 194 return; 195 } 196 } 197 198 bool Keymaster::generateKey(const keymaster::AuthorizationSet& inParams, std::string* key) { 199 keymaster_key_blob_t keyBlob; 200 auto error = mDevice->generate_key(&inParams, &keyBlob); 201 if (error != KM_ERROR_OK) { 202 LOG(ERROR) << "generate_key failed, code " << error; 203 return false; 204 } 205 key->assign(reinterpret_cast<const char*>(keyBlob.key_material), keyBlob.key_material_size); 206 free(const_cast<uint8_t*>(keyBlob.key_material)); 207 return true; 208 } 209 210 bool Keymaster::deleteKey(const std::string& key) { 211 keymaster_key_blob_t keyBlob{reinterpret_cast<const uint8_t*>(key.data()), key.size()}; 212 auto error = mDevice->delete_key(&keyBlob); 213 if (error != KM_ERROR_OK) { 214 LOG(ERROR) << "delete_key failed, code " << error; 215 return false; 216 } 217 return true; 218 } 219 220 KeymasterOperation Keymaster::begin(keymaster_purpose_t purpose, const std::string& key, 221 const keymaster::AuthorizationSet& inParams, 222 keymaster::AuthorizationSet* outParams) { 223 keymaster_key_blob_t keyBlob{reinterpret_cast<const uint8_t*>(key.data()), key.size()}; 224 keymaster_operation_handle_t mOpHandle; 225 keymaster_key_param_set_t outParams_set; 226 auto error = mDevice->begin(purpose, &keyBlob, &inParams, &outParams_set, &mOpHandle); 227 if (error != KM_ERROR_OK) { 228 LOG(ERROR) << "begin failed, code " << error; 229 return KeymasterOperation(nullptr, mOpHandle); 230 } 231 outParams->Clear(); 232 outParams->push_back(outParams_set); 233 keymaster_free_param_set(&outParams_set); 234 return KeymasterOperation(mDevice, mOpHandle); 235 } 236 237 KeymasterOperation Keymaster::begin(keymaster_purpose_t purpose, const std::string& key, 238 const keymaster::AuthorizationSet& inParams) { 239 keymaster_key_blob_t keyBlob{reinterpret_cast<const uint8_t*>(key.data()), key.size()}; 240 keymaster_operation_handle_t mOpHandle; 241 auto error = mDevice->begin(purpose, &keyBlob, &inParams, nullptr, &mOpHandle); 242 if (error != KM_ERROR_OK) { 243 LOG(ERROR) << "begin failed, code " << error; 244 return KeymasterOperation(nullptr, mOpHandle); 245 } 246 return KeymasterOperation(mDevice, mOpHandle); 247 } 248 249 } // namespace vold 250 } // namespace android 251
