1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); you 5 * may not use this file except in compliance with the License. You may 6 * obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 13 * implied. See the License for the specific language governing 14 * permissions and limitations under the License. 15 */ 16 17 #include <errno.h> 18 #include <string.h> 19 #include <stdint.h> 20 21 #include <hardware/hardware.h> 22 #include <hardware/keymaster0.h> 23 24 #include <openssl/evp.h> 25 #include <openssl/bio.h> 26 #include <openssl/rsa.h> 27 #include <openssl/err.h> 28 #include <openssl/x509.h> 29 30 #include <linux/ioctl.h> 31 #include <linux/msm_ion.h> 32 #include <sys/mman.h> 33 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include <stddef.h> 37 #include <unistd.h> 38 #include <dirent.h> 39 #include <fcntl.h> 40 41 #include <sys/types.h> 42 #include <sys/stat.h> 43 #include <dlfcn.h> 44 45 #include <nativehelper/UniquePtr.h> 46 47 #include "QSEEComAPI.h" 48 #include "keymaster_qcom.h" 49 50 // For debugging 51 //#define LOG_NDEBUG 0 52 53 #define LOG_TAG "QCOMKeyMaster" 54 #include <cutils/log.h> 55 struct qcom_km_ion_info_t { 56 int32_t ion_fd; 57 int32_t ifd_data_fd; 58 struct ion_handle_data ion_alloc_handle; 59 unsigned char * ion_sbuffer; 60 uint32_t sbuf_len; 61 }; 62 63 struct qcom_keymaster_handle { 64 struct QSEECom_handle *qseecom; 65 void *libhandle; 66 int (*QSEECom_start_app)(struct QSEECom_handle ** handle, char* path, 67 char* appname, uint32_t size); 68 int (*QSEECom_shutdown_app)(struct QSEECom_handle **handle); 69 int (*QSEECom_send_cmd)(struct QSEECom_handle* handle, void *cbuf, 70 uint32_t clen, void *rbuf, uint32_t rlen); 71 int (*QSEECom_send_modified_cmd)(struct QSEECom_handle* handle, void *cbuf, 72 uint32_t clen, void *rbuf, uint32_t rlen, 73 struct QSEECom_ion_fd_info *ihandle); 74 int (*QSEECom_set_bandwidth)(struct QSEECom_handle* handle, bool high); 75 }; 76 typedef struct qcom_keymaster_handle qcom_keymaster_handle_t; 77 78 struct EVP_PKEY_Delete { 79 void operator()(EVP_PKEY* p) const { 80 EVP_PKEY_free(p); 81 } 82 }; 83 typedef UniquePtr<EVP_PKEY, EVP_PKEY_Delete> Unique_EVP_PKEY; 84 85 struct RSA_Delete { 86 void operator()(RSA* p) const { 87 RSA_free(p); 88 } 89 }; 90 typedef UniquePtr<RSA, RSA_Delete> Unique_RSA; 91 92 typedef UniquePtr<keymaster0_device_t> Unique_keymaster_device_t; 93 94 /** 95 * Many OpenSSL APIs take ownership of an argument on success but don't free the argument 96 * on failure. This means we need to tell our scoped pointers when we've transferred ownership, 97 * without triggering a warning by not using the result of release(). 98 */ 99 #define OWNERSHIP_TRANSFERRED(obj) \ 100 typeof (obj.release()) _dummy __attribute__((unused)) = obj.release() 101 102 static int qcom_km_get_keypair_public(const keymaster0_device_t* dev, 103 const uint8_t* keyBlob, const size_t keyBlobLength, 104 uint8_t** x509_data, size_t* x509_data_length) { 105 106 struct qcom_km_key_blob * keyblob_ptr = (struct qcom_km_key_blob *)keyBlob; 107 108 if (x509_data == NULL || x509_data_length == NULL) { 109 ALOGE("Output public key buffer == NULL"); 110 return -1; 111 } 112 113 if (keyBlob == NULL) { 114 ALOGE("Supplied key blob was NULL"); 115 return -1; 116 } 117 118 // Should be large enough for keyblob data: 119 if (keyBlobLength < (sizeof(qcom_km_key_blob_t))) { 120 ALOGE("key blob appears to be truncated"); 121 return -1; 122 } 123 124 if (keyblob_ptr->magic_num != KM_MAGIC_NUM) { 125 ALOGE("Cannot read key; it was not made by this keymaster"); 126 return -1; 127 } 128 129 if (keyblob_ptr->public_exponent_size == 0 ) { 130 ALOGE("Key blob appears to have incorrect exponent length"); 131 return -1; 132 } 133 if (keyblob_ptr->modulus_size == 0 ) { 134 ALOGE("Key blob appears to have incorrect modulus length"); 135 return -1; 136 } 137 138 Unique_RSA rsa(RSA_new()); 139 if (rsa.get() == NULL) { 140 ALOGE("Could not allocate RSA structure"); 141 return -1; 142 } 143 144 rsa->n = BN_bin2bn(reinterpret_cast<const unsigned char*>(keyblob_ptr->modulus), 145 keyblob_ptr->modulus_size, NULL); 146 if (rsa->n == NULL) { 147 ALOGE("Failed to initialize modulus"); 148 return -1; 149 } 150 151 rsa->e = BN_bin2bn(reinterpret_cast<const unsigned char*>(&keyblob_ptr->public_exponent), 152 keyblob_ptr->public_exponent_size, NULL); 153 if (rsa->e == NULL) { 154 ALOGE("Failed to initialize public exponent"); 155 return -1; 156 } 157 158 Unique_EVP_PKEY pkey(EVP_PKEY_new()); 159 if (pkey.get() == NULL) { 160 ALOGE("Could not allocate EVP_PKEY structure"); 161 return -1; 162 } 163 if (EVP_PKEY_assign_RSA(pkey.get(), rsa.get()) != 1) { 164 ALOGE("Failed to assign rsa parameters \n"); 165 return -1; 166 } 167 OWNERSHIP_TRANSFERRED(rsa); 168 169 int len = i2d_PUBKEY(pkey.get(), NULL); 170 if (len <= 0) { 171 ALOGE("Len returned is < 0 len = %d", len); 172 return -1; 173 } 174 175 UniquePtr<uint8_t> key(static_cast<uint8_t*>(malloc(len))); 176 if (key.get() == NULL) { 177 ALOGE("Could not allocate memory for public key data"); 178 return -1; 179 } 180 181 unsigned char* tmp = reinterpret_cast<unsigned char*>(key.get()); 182 if (i2d_PUBKEY(pkey.get(), &tmp) != len) { 183 ALOGE("Len 2 returned is < 0 len = %d", len); 184 return -1; 185 } 186 *x509_data_length = len; 187 *x509_data = key.release(); 188 189 return 0; 190 } 191 192 static int32_t qcom_km_ION_memalloc(struct qcom_km_ion_info_t *handle, 193 uint32_t size) 194 { 195 int32_t ret = 0; 196 int32_t iret = 0; 197 int32_t fd = 0; 198 unsigned char *v_addr; 199 struct ion_allocation_data ion_alloc_data; 200 int32_t ion_fd; 201 int32_t rc; 202 struct ion_fd_data ifd_data; 203 struct ion_handle_data handle_data; 204 205 /* open ION device for memory management 206 * O_DSYNC -> uncached memory 207 */ 208 if(handle == NULL){ 209 ALOGE("Error:: null handle received"); 210 return -1; 211 } 212 ion_fd = open("/dev/ion", O_RDONLY | O_DSYNC); 213 if (ion_fd < 0) { 214 ALOGE("Error::Cannot open ION device"); 215 return -1; 216 } 217 handle->ion_sbuffer = NULL; 218 handle->ifd_data_fd = 0; 219 220 /* Size of allocation */ 221 ion_alloc_data.len = (size + 4095) & (~4095); 222 223 /* 4K aligned */ 224 ion_alloc_data.align = 4096; 225 226 /* memory is allocated from EBI heap */ 227 ion_alloc_data.ION_HEAP_MASK = ION_HEAP(ION_QSECOM_HEAP_ID); 228 229 /* Set the memory to be uncached */ 230 ion_alloc_data.flags = 0; 231 232 /* IOCTL call to ION for memory request */ 233 rc = ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data); 234 if (rc) { 235 ret = -1; 236 goto alloc_fail; 237 } 238 239 if (ion_alloc_data.handle != NULL) { 240 ifd_data.handle = ion_alloc_data.handle; 241 } else { 242 ret = -1; 243 goto alloc_fail; 244 } 245 /* Call MAP ioctl to retrieve the ifd_data.fd file descriptor */ 246 rc = ioctl(ion_fd, ION_IOC_MAP, &ifd_data); 247 if (rc) { 248 ret = -1; 249 goto ioctl_fail; 250 } 251 252 /* Make the ion mmap call */ 253 v_addr = (unsigned char *)mmap(NULL, ion_alloc_data.len, 254 PROT_READ | PROT_WRITE, 255 MAP_SHARED, ifd_data.fd, 0); 256 if (v_addr == MAP_FAILED) { 257 ALOGE("Error::ION MMAP failed"); 258 ret = -1; 259 goto map_fail; 260 } 261 handle->ion_fd = ion_fd; 262 handle->ifd_data_fd = ifd_data.fd; 263 handle->ion_sbuffer = v_addr; 264 handle->ion_alloc_handle.handle = ion_alloc_data.handle; 265 handle->sbuf_len = size; 266 return ret; 267 268 map_fail: 269 if (handle->ion_sbuffer != NULL) { 270 iret = munmap(handle->ion_sbuffer, ion_alloc_data.len); 271 if (iret) 272 ALOGE("Error::Failed to unmap memory for load image. ret = %d", ret); 273 } 274 275 ioctl_fail: 276 handle_data.handle = ion_alloc_data.handle; 277 if (handle->ifd_data_fd) 278 close(handle->ifd_data_fd); 279 iret = ioctl(ion_fd, ION_IOC_FREE, &handle_data); 280 if (iret) { 281 ALOGE("Error::ION FREE ioctl returned error = %d",iret); 282 } 283 284 alloc_fail: 285 if (ion_fd > 0) 286 close(ion_fd); 287 return ret; 288 } 289 290 /** @brief: Deallocate ION memory 291 * 292 * 293 */ 294 static int32_t qcom_km_ion_dealloc(struct qcom_km_ion_info_t *handle) 295 { 296 struct ion_handle_data handle_data; 297 int32_t ret = 0; 298 299 /* Deallocate the memory for the listener */ 300 ret = munmap(handle->ion_sbuffer, (handle->sbuf_len + 4095) & (~4095)); 301 if (ret) { 302 ALOGE("Error::Unmapping ION Buffer failed with ret = %d", ret); 303 } 304 305 handle_data.handle = handle->ion_alloc_handle.handle; 306 close(handle->ifd_data_fd); 307 ret = ioctl(handle->ion_fd, ION_IOC_FREE, &handle_data); 308 if (ret) { 309 ALOGE("Error::ION Memory FREE ioctl failed with ret = %d", ret); 310 } 311 close(handle->ion_fd); 312 return ret; 313 } 314 315 static int qcom_km_generate_keypair(const keymaster0_device_t* dev, 316 const keymaster_keypair_t key_type, const void* key_params, 317 uint8_t** keyBlob, size_t* keyBlobLength) { 318 319 if (dev->context == NULL) { 320 ALOGE("qcom_km_generate_keypair: Context == NULL"); 321 return -1; 322 } 323 324 if (key_type != TYPE_RSA) { 325 ALOGE("Unsupported key type %d", key_type); 326 return -1; 327 } else if (key_params == NULL) { 328 ALOGE("key_params == null"); 329 return -1; 330 } 331 if (keyBlob == NULL || keyBlobLength == NULL) { 332 ALOGE("output key blob or length == NULL"); 333 return -1; 334 } 335 keymaster_rsa_keygen_params_t* rsa_params = (keymaster_rsa_keygen_params_t*) key_params; 336 337 keymaster_gen_keypair_cmd_t *send_cmd = NULL; 338 keymaster_gen_keypair_resp_t *resp = NULL; 339 struct QSEECom_handle *handle = NULL; 340 struct qcom_keymaster_handle *km_handle =(struct qcom_keymaster_handle *)dev->context; 341 int ret = 0; 342 343 handle = (struct QSEECom_handle *)(km_handle->qseecom); 344 send_cmd = (keymaster_gen_keypair_cmd_t *)handle->ion_sbuffer; 345 resp = (keymaster_gen_keypair_resp_t *)(handle->ion_sbuffer + 346 QSEECOM_ALIGN(sizeof(keymaster_gen_keypair_cmd_t))); 347 send_cmd->cmd_id = KEYMASTER_GENERATE_KEYPAIR; 348 send_cmd->key_type = key_type; 349 send_cmd->rsa_params.modulus_size = rsa_params->modulus_size; 350 send_cmd->rsa_params.public_exponent = rsa_params->public_exponent; 351 resp->status = KEYMASTER_FAILURE; 352 resp->key_blob_len = sizeof(qcom_km_key_blob_t); 353 354 ret = (*km_handle->QSEECom_set_bandwidth)(handle, true); 355 if (ret < 0) { 356 ALOGE("Generate key command failed (unable to enable clks) ret =%d", ret); 357 return -1; 358 } 359 360 ret = (*km_handle->QSEECom_send_cmd)(handle, send_cmd, 361 QSEECOM_ALIGN(sizeof(keymaster_gen_keypair_cmd_t)), resp, 362 QSEECOM_ALIGN(sizeof(keymaster_gen_keypair_resp_t))); 363 364 if((*km_handle->QSEECom_set_bandwidth)(handle, false)) 365 ALOGE("Import key command: (unable to disable clks)"); 366 367 if ( (ret < 0) || (resp->status < 0)) { 368 ALOGE("Generate key command failed resp->status = %d ret =%d", resp->status, ret); 369 return -1; 370 } else { 371 UniquePtr<unsigned char[]> keydata(new unsigned char[resp->key_blob_len]); 372 if (keydata.get() == NULL) { 373 ALOGE("could not allocate memory for key blob"); 374 return -1; 375 } 376 unsigned char* p = keydata.get(); 377 memcpy(p, (unsigned char *)(&resp->key_blob), resp->key_blob_len); 378 *keyBlob = keydata.release(); 379 *keyBlobLength = resp->key_blob_len; 380 } 381 return 0; 382 } 383 384 static int qcom_km_import_keypair(const keymaster0_device_t* dev, 385 const uint8_t* key, const size_t key_length, 386 uint8_t** keyBlob, size_t* keyBlobLength) 387 { 388 if (dev->context == NULL) { 389 ALOGE("qcom_km_import_keypair: Context == NULL"); 390 return -1; 391 } 392 393 if (key == NULL) { 394 ALOGE("Input key == NULL"); 395 return -1; 396 } else if (keyBlob == NULL || keyBlobLength == NULL) { 397 ALOGE("Output key blob or length == NULL"); 398 return -1; 399 } 400 401 struct QSEECom_ion_fd_info ion_fd_info; 402 struct qcom_km_ion_info_t ihandle; 403 int ret = 0; 404 405 ihandle.ion_fd = 0; 406 ihandle.ion_alloc_handle.handle = NULL; 407 if (qcom_km_ION_memalloc(&ihandle, QSEECOM_ALIGN(key_length)) < 0) { 408 ALOGE("ION allocation failed"); 409 return -1; 410 } 411 memset(&ion_fd_info, 0, sizeof(struct QSEECom_ion_fd_info)); 412 413 /* Populate the send data structure */ 414 ion_fd_info.data[0].fd = ihandle.ifd_data_fd; 415 ion_fd_info.data[0].cmd_buf_offset = sizeof(enum keymaster_cmd_t); 416 417 418 struct QSEECom_handle *handle = NULL; 419 keymaster_import_keypair_cmd_t *send_cmd = NULL; 420 keymaster_import_keypair_resp_t *resp = NULL; 421 struct qcom_keymaster_handle *km_handle =(struct qcom_keymaster_handle *)dev->context; 422 423 handle = (struct QSEECom_handle *)(km_handle->qseecom); 424 send_cmd = (keymaster_import_keypair_cmd_t *)handle->ion_sbuffer; 425 resp = (keymaster_import_keypair_resp_t *)(handle->ion_sbuffer + 426 QSEECOM_ALIGN(sizeof(keymaster_import_keypair_cmd_t))); 427 send_cmd->cmd_id = KEYMASTER_IMPORT_KEYPAIR; 428 send_cmd->pkcs8_key = (uint32_t)ihandle.ion_sbuffer; 429 430 memcpy((unsigned char *)ihandle.ion_sbuffer, key, key_length); 431 432 send_cmd->pkcs8_key_len = key_length; 433 resp->status = KEYMASTER_FAILURE; 434 resp->key_blob_len = sizeof(qcom_km_key_blob_t); 435 436 ret = (*km_handle->QSEECom_set_bandwidth)(handle, true); 437 if (ret < 0) { 438 ALOGE("Import key command failed (unable to enable clks) ret =%d", ret); 439 qcom_km_ion_dealloc(&ihandle); 440 return -1; 441 } 442 ret = (*km_handle->QSEECom_send_modified_cmd)(handle, send_cmd, 443 QSEECOM_ALIGN(sizeof(*send_cmd)), resp, 444 QSEECOM_ALIGN(sizeof(*resp)), &ion_fd_info); 445 446 if((*km_handle->QSEECom_set_bandwidth)(handle, false)) 447 ALOGE("Import key command: (unable to disable clks)"); 448 449 if ( (ret < 0) || (resp->status < 0)) { 450 ALOGE("Import key command failed resp->status = %d ret =%d", resp->status, ret); 451 qcom_km_ion_dealloc(&ihandle); 452 return -1; 453 } else { 454 UniquePtr<unsigned char[]> keydata(new unsigned char[resp->key_blob_len]); 455 if (keydata.get() == NULL) { 456 ALOGE("could not allocate memory for key blob"); 457 return -1; 458 } 459 unsigned char* p = keydata.get(); 460 memcpy(p, (unsigned char *)(&resp->key_blob), resp->key_blob_len); 461 *keyBlob = keydata.release(); 462 *keyBlobLength = resp->key_blob_len; 463 464 } 465 qcom_km_ion_dealloc(&ihandle); 466 return 0; 467 } 468 469 static int qcom_km_sign_data(const keymaster0_device_t* dev, 470 const void* params, 471 const uint8_t* keyBlob, const size_t keyBlobLength, 472 const uint8_t* data, const size_t dataLength, 473 uint8_t** signedData, size_t* signedDataLength) 474 { 475 if (dev->context == NULL) { 476 ALOGE("qcom_km_sign_data: Context == NULL"); 477 return -1; 478 } 479 if (dataLength > KM_KEY_SIZE_MAX) { 480 ALOGE("Input data to be signed is too long %d bytes", dataLength); 481 return -1; 482 } 483 if (data == NULL) { 484 ALOGE("input data to sign == NULL"); 485 return -1; 486 } else if (signedData == NULL || signedDataLength == NULL) { 487 ALOGE("Output signature buffer == NULL"); 488 return -1; 489 } 490 keymaster_rsa_sign_params_t* sign_params = (keymaster_rsa_sign_params_t*) params; 491 if (sign_params->digest_type != DIGEST_NONE) { 492 ALOGE("Cannot handle digest type %d", sign_params->digest_type); 493 return -1; 494 } else if (sign_params->padding_type != PADDING_NONE) { 495 ALOGE("Cannot handle padding type %d", sign_params->padding_type); 496 return -1; 497 } 498 499 struct QSEECom_handle *handle = NULL; 500 keymaster_sign_data_cmd_t *send_cmd = NULL; 501 keymaster_sign_data_resp_t *resp = NULL; 502 struct QSEECom_ion_fd_info ion_fd_info; 503 struct qcom_km_ion_info_t ihandle; 504 struct qcom_keymaster_handle *km_handle =(struct qcom_keymaster_handle *)dev->context; 505 int ret = 0; 506 507 handle = (struct QSEECom_handle *)(km_handle->qseecom); 508 ihandle.ion_fd = 0; 509 ihandle.ion_alloc_handle.handle = NULL; 510 if (qcom_km_ION_memalloc(&ihandle, dataLength) < 0) { 511 ALOGE("ION allocation failed"); 512 return -1; 513 } 514 memset(&ion_fd_info, 0, sizeof(struct QSEECom_ion_fd_info)); 515 516 /* Populate the send data structure */ 517 ion_fd_info.data[0].fd = ihandle.ifd_data_fd; 518 ion_fd_info.data[0].cmd_buf_offset = sizeof(enum keymaster_cmd_t) + 519 sizeof(qcom_km_key_blob_t) + sizeof(keymaster_rsa_sign_params_t); 520 521 send_cmd = (keymaster_sign_data_cmd_t *)handle->ion_sbuffer; 522 resp = (keymaster_sign_data_resp_t *)(handle->ion_sbuffer + 523 QSEECOM_ALIGN(sizeof(keymaster_sign_data_cmd_t))); 524 send_cmd->cmd_id = KEYMASTER_SIGN_DATA ; 525 send_cmd->sign_param.digest_type = sign_params->digest_type; 526 send_cmd->sign_param.padding_type = sign_params->padding_type; 527 memcpy((unsigned char *)(&send_cmd->key_blob), keyBlob, keyBlobLength); 528 memcpy((unsigned char *)ihandle.ion_sbuffer, data, dataLength); 529 530 send_cmd->data = (uint32_t)ihandle.ion_sbuffer; 531 send_cmd->dlen = dataLength; 532 resp->sig_len = KM_KEY_SIZE_MAX; 533 resp->status = KEYMASTER_FAILURE; 534 535 ret = (*km_handle->QSEECom_set_bandwidth)(handle, true); 536 if (ret < 0) { 537 ALOGE("Sign data command failed (unable to enable clks) ret =%d", ret); 538 qcom_km_ion_dealloc(&ihandle); 539 return -1; 540 } 541 542 ret = (*km_handle->QSEECom_send_modified_cmd)(handle, send_cmd, 543 QSEECOM_ALIGN(sizeof(*send_cmd)), resp, 544 QSEECOM_ALIGN(sizeof(*resp)), &ion_fd_info); 545 546 if((*km_handle->QSEECom_set_bandwidth)(handle, false)) 547 ALOGE("Sign data command: (unable to disable clks)"); 548 549 if ( (ret < 0) || (resp->status < 0)) { 550 ALOGE("Sign data command failed resp->status = %d ret =%d", resp->status, ret); 551 qcom_km_ion_dealloc(&ihandle); 552 return -1; 553 } else { 554 UniquePtr<uint8_t> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(resp->sig_len))); 555 if (signedDataPtr.get() == NULL) { 556 ALOGE("Sign data memory allocation failed"); 557 qcom_km_ion_dealloc(&ihandle); 558 return -1; 559 } 560 unsigned char* p = signedDataPtr.get(); 561 memcpy(p, (unsigned char *)(&resp->signed_data), resp->sig_len); 562 563 *signedDataLength = resp->sig_len; 564 *signedData = signedDataPtr.release(); 565 } 566 qcom_km_ion_dealloc(&ihandle); 567 return 0; 568 } 569 570 static int qcom_km_verify_data(const keymaster0_device_t* dev, 571 const void* params, 572 const uint8_t* keyBlob, const size_t keyBlobLength, 573 const uint8_t* signedData, const size_t signedDataLength, 574 const uint8_t* signature, const size_t signatureLength) 575 { 576 if (dev->context == NULL) { 577 ALOGE("qcom_km_verify_data: Context == NULL"); 578 return -1; 579 } 580 581 if (signedData == NULL || signature == NULL) { 582 ALOGE("data or signature buffers == NULL"); 583 return -1; 584 } 585 586 keymaster_rsa_sign_params_t* sign_params = (keymaster_rsa_sign_params_t*) params; 587 if (sign_params->digest_type != DIGEST_NONE) { 588 ALOGE("Cannot handle digest type %d", sign_params->digest_type); 589 return -1; 590 } else if (sign_params->padding_type != PADDING_NONE) { 591 ALOGE("Cannot handle padding type %d", sign_params->padding_type); 592 return -1; 593 } else if (signatureLength != signedDataLength) { 594 ALOGE("signed data length must be signature length"); 595 return -1; 596 } 597 598 struct QSEECom_handle *handle = NULL; 599 keymaster_verify_data_cmd_t *send_cmd = NULL; 600 keymaster_verify_data_resp_t *resp = NULL; 601 602 struct QSEECom_ion_fd_info ion_fd_info; 603 struct qcom_km_ion_info_t ihandle; 604 struct qcom_keymaster_handle *km_handle =(struct qcom_keymaster_handle *)dev->context; 605 int ret = 0; 606 607 handle = (struct QSEECom_handle *)(km_handle->qseecom); 608 ihandle.ion_fd = 0; 609 ihandle.ion_alloc_handle.handle = NULL; 610 if (qcom_km_ION_memalloc(&ihandle, signedDataLength + signatureLength) <0) { 611 ALOGE("ION allocation failed"); 612 return -1; 613 } 614 memset(&ion_fd_info, 0, sizeof(struct QSEECom_ion_fd_info)); 615 616 /* Populate the send data structure */ 617 ion_fd_info.data[0].fd = ihandle.ifd_data_fd; 618 ion_fd_info.data[0].cmd_buf_offset = sizeof(enum keymaster_cmd_t) + 619 sizeof(qcom_km_key_blob_t ) + sizeof(keymaster_rsa_sign_params_t); 620 621 send_cmd = (keymaster_verify_data_cmd_t *)handle->ion_sbuffer; 622 resp = (keymaster_verify_data_resp_t *)((char *)handle->ion_sbuffer + 623 sizeof(keymaster_verify_data_cmd_t)); 624 send_cmd->cmd_id = KEYMASTER_VERIFY_DATA ; 625 send_cmd->sign_param.digest_type = sign_params->digest_type; 626 send_cmd->sign_param.padding_type = sign_params->padding_type; 627 memcpy((unsigned char *)(&send_cmd->key_blob), keyBlob, keyBlobLength); 628 629 send_cmd->signed_data = (uint32_t)ihandle.ion_sbuffer; 630 send_cmd->signed_dlen = signedDataLength; 631 memcpy((unsigned char *)ihandle.ion_sbuffer, signedData, signedDataLength); 632 633 send_cmd->signature = signedDataLength; 634 send_cmd->slen = signatureLength; 635 memcpy(((unsigned char *)ihandle.ion_sbuffer + signedDataLength), 636 signature, signatureLength); 637 resp->status = KEYMASTER_FAILURE; 638 639 ret = (*km_handle->QSEECom_set_bandwidth)(handle, true); 640 if (ret < 0) { 641 ALOGE("Verify data command failed (unable to enable clks) ret =%d", ret); 642 qcom_km_ion_dealloc(&ihandle); 643 return -1; 644 } 645 646 ret = (*km_handle->QSEECom_send_modified_cmd)(handle, send_cmd, 647 QSEECOM_ALIGN(sizeof(*send_cmd)), resp, 648 QSEECOM_ALIGN(sizeof(*resp)), &ion_fd_info); 649 650 if((*km_handle->QSEECom_set_bandwidth)(handle, false)) 651 ALOGE("Verify data command: (unable to disable clks)"); 652 653 if ( (ret < 0) || (resp->status < 0)) { 654 ALOGE("Verify data command failed resp->status = %d ret =%d", resp->status, ret); 655 qcom_km_ion_dealloc(&ihandle); 656 return -1; 657 } 658 qcom_km_ion_dealloc(&ihandle); 659 return 0; 660 } 661 662 /* Close an opened OpenSSL instance */ 663 static int qcom_km_close(hw_device_t *dev) 664 { 665 keymaster0_device_t* km_dev = (keymaster0_device_t *)dev; 666 struct qcom_keymaster_handle *km_handle =(struct qcom_keymaster_handle *)km_dev->context; 667 668 if (km_handle->qseecom == NULL) { 669 ALOGE("Context == NULL"); 670 return -1; 671 } 672 (*km_handle->QSEECom_shutdown_app)((struct QSEECom_handle **)&km_handle->qseecom); 673 free(km_dev->context); 674 free(dev); 675 return 0; 676 } 677 678 static int qcom_km_get_lib_sym(qcom_keymaster_handle_t* km_handle) 679 { 680 km_handle->libhandle = dlopen("libQSEEComAPI.so", RTLD_NOW); 681 if ( km_handle->libhandle ) { 682 *(void **)(&km_handle->QSEECom_start_app) = 683 dlsym(km_handle->libhandle,"QSEECom_start_app"); 684 if (km_handle->QSEECom_start_app == NULL) { 685 ALOGE("dlsym: Error Loading QSEECom_start_app"); 686 dlclose(km_handle->libhandle ); 687 km_handle->libhandle = NULL; 688 return -1; 689 } 690 *(void **)(&km_handle->QSEECom_shutdown_app) = 691 dlsym(km_handle->libhandle,"QSEECom_shutdown_app"); 692 if (km_handle->QSEECom_shutdown_app == NULL) { 693 ALOGE("dlsym: Error Loading QSEECom_shutdown_app"); 694 dlclose(km_handle->libhandle ); 695 km_handle->libhandle = NULL; 696 return -1; 697 } 698 *(void **)(&km_handle->QSEECom_send_cmd) = 699 dlsym(km_handle->libhandle,"QSEECom_send_cmd"); 700 if (km_handle->QSEECom_send_cmd == NULL) { 701 ALOGE("dlsym: Error Loading QSEECom_send_cmd"); 702 dlclose(km_handle->libhandle ); 703 km_handle->libhandle = NULL; 704 return -1; 705 } 706 *(void **)(&km_handle->QSEECom_send_modified_cmd) = 707 dlsym(km_handle->libhandle,"QSEECom_send_modified_cmd"); 708 if (km_handle->QSEECom_send_modified_cmd == NULL) { 709 ALOGE("dlsym: Error Loading QSEECom_send_modified_cmd"); 710 dlclose(km_handle->libhandle ); 711 km_handle->libhandle = NULL; 712 return -1; 713 } 714 *(void **)(&km_handle->QSEECom_set_bandwidth) = 715 dlsym(km_handle->libhandle,"QSEECom_set_bandwidth"); 716 if (km_handle->QSEECom_set_bandwidth == NULL) { 717 ALOGE("dlsym: Error Loading QSEECom_set_bandwidth"); 718 dlclose(km_handle->libhandle ); 719 km_handle->libhandle = NULL; 720 return -1; 721 } 722 723 } else { 724 ALOGE("failed to load qseecom library"); 725 return -1; 726 } 727 return 0; 728 } 729 730 /* 731 * Generic device handling 732 */ 733 static int qcom_km_open(const hw_module_t* module, const char* name, 734 hw_device_t** device) 735 { 736 int ret = 0; 737 qcom_keymaster_handle_t* km_handle; 738 if (strcmp(name, KEYSTORE_KEYMASTER) != 0) 739 return -EINVAL; 740 741 km_handle = (qcom_keymaster_handle_t *)malloc(sizeof(qcom_keymaster_handle_t)); 742 if (km_handle == NULL) { 743 ALOGE("Memalloc for keymaster handle failed"); 744 return -1; 745 } 746 km_handle->qseecom = NULL; 747 km_handle->libhandle = NULL; 748 ret = qcom_km_get_lib_sym(km_handle); 749 if (ret) { 750 free(km_handle); 751 return -1; 752 } 753 Unique_keymaster_device_t dev(new keymaster0_device_t); 754 if (dev.get() == NULL){ 755 free(km_handle); 756 return -ENOMEM; 757 } 758 dev->context = (void *)km_handle; 759 ret = (*km_handle->QSEECom_start_app)((struct QSEECom_handle **)&km_handle->qseecom, 760 "/vendor/firmware/keymaster", "keymaster", 4096*2); 761 if (ret) { 762 ALOGE("Loading keymaster app failed"); 763 free(km_handle); 764 return -1; 765 } 766 dev->common.tag = HARDWARE_DEVICE_TAG; 767 dev->common.version = 1; 768 dev->common.module = (struct hw_module_t*) module; 769 dev->common.close = qcom_km_close; 770 dev->flags = KEYMASTER_BLOBS_ARE_STANDALONE; 771 772 dev->generate_keypair = qcom_km_generate_keypair; 773 dev->import_keypair = qcom_km_import_keypair; 774 dev->get_keypair_public = qcom_km_get_keypair_public; 775 dev->delete_keypair = NULL; 776 dev->delete_all = NULL; 777 dev->sign_data = qcom_km_sign_data; 778 dev->verify_data = qcom_km_verify_data; 779 780 *device = reinterpret_cast<hw_device_t*>(dev.release()); 781 782 return 0; 783 } 784 785 static struct hw_module_methods_t keystore_module_methods = { 786 .open = qcom_km_open, 787 }; 788 789 struct keystore_module HAL_MODULE_INFO_SYM 790 __attribute__ ((visibility ("default"))) = { 791 .common = { 792 .tag = HARDWARE_MODULE_TAG, 793 .module_api_version = QCOM_KEYMASTER_API_VERSION, 794 .hal_api_version = HARDWARE_HAL_API_VERSION, 795 .id = KEYSTORE_HARDWARE_MODULE_ID, 796 .name = "Keymaster QCOM HAL", 797 .author = "The Android Open Source Project", 798 .methods = &keystore_module_methods, 799 .dso = 0, 800 .reserved = {}, 801 }, 802 }; 803
