Home | History | Annotate | Download | only in trusty 
      1 /*
      2  * Copyright 2014 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define LOG_TAG "TrustyKeymaster"
     18 
     19 #include <assert.h>
     20 #include <errno.h>
     21 #include <openssl/evp.h>
     22 #include <openssl/x509.h>
     23 #include <stddef.h>
     24 #include <stdio.h>
     25 #include <stdlib.h>
     26 #include <string.h>
     27 #include <time.h>
     28 
     29 #include <algorithm>
     30 #include <type_traits>
     31 
     32 #include <hardware/keymaster2.h>
     33 #include <keymaster/authorization_set.h>
     34 #include <log/log.h>
     35 
     36 #include "keymaster_ipc.h"
     37 #include "trusty_keymaster_device.h"
     38 #include "trusty_keymaster_ipc.h"
     39 
     40 #define MY_PAGE_SIZE (PAGE_SIZE * 128)
     41 const uint32_t RECV_BUF_SIZE = MY_PAGE_SIZE;
     42 const uint32_t SEND_BUF_SIZE = (MY_PAGE_SIZE - sizeof(struct keymaster_message) - 16 /* tipc header */);
     43 
     44 const size_t kMaximumAttestationChallengeLength = 128;
     45 const size_t kMaximumFinishInputLength = 2048 * 1024;
     46 
     47 namespace keymaster {
     48 
     49 static keymaster_error_t translate_error(int err) {
     50     switch (err) {
     51         case 0:
     52             return KM_ERROR_OK;
     53         case -EPERM:
     54         case -EACCES:
     55             return KM_ERROR_SECURE_HW_ACCESS_DENIED;
     56 
     57         case -ECANCELED:
     58             return KM_ERROR_OPERATION_CANCELLED;
     59 
     60         case -ENODEV:
     61             return KM_ERROR_UNIMPLEMENTED;
     62 
     63         case -ENOMEM:
     64             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
     65 
     66         case -EBUSY:
     67             return KM_ERROR_SECURE_HW_BUSY;
     68 
     69         case -EIO:
     70             return KM_ERROR_SECURE_HW_COMMUNICATION_FAILED;
     71 
     72         case -EOVERFLOW:
     73             return KM_ERROR_INVALID_INPUT_LENGTH;
     74 
     75         default:
     76             return KM_ERROR_UNKNOWN_ERROR;
     77     }
     78 }
     79 
     80 TrustyKeymasterDevice::TrustyKeymasterDevice(const hw_module_t* module) {
     81     static_assert(std::is_standard_layout<TrustyKeymasterDevice>::value,
     82                   "TrustyKeymasterDevice must be standard layout");
     83     static_assert(offsetof(TrustyKeymasterDevice, device_) == 0,
     84                   "device_ must be the first member of TrustyKeymasterDevice");
     85     static_assert(offsetof(TrustyKeymasterDevice, device_.common) == 0,
     86                   "common must be the first member of keymaster2_device");
     87 
     88     ALOGI("Creating device");
     89     ALOGD("Device address: %p", this);
     90 
     91     device_ = {};
     92 
     93     device_.common.tag = HARDWARE_DEVICE_TAG;
     94     device_.common.version = 1;
     95     device_.common.module = const_cast<hw_module_t*>(module);
     96     device_.common.close = close_device;
     97 
     98     device_.flags = KEYMASTER_SUPPORTS_EC | KEYMASTER_BLOBS_ARE_STANDALONE ;
     99 
    100     device_.configure = configure;
    101     device_.add_rng_entropy = add_rng_entropy;
    102     device_.generate_key = generate_key;
    103     device_.get_key_characteristics = get_key_characteristics;
    104     device_.import_key = import_key;
    105     device_.export_key = export_key;
    106     device_.attest_key = attest_key;
    107     device_.upgrade_key = upgrade_key;
    108     device_.delete_key = nullptr;
    109     device_.delete_all_keys = nullptr;
    110     device_.begin = begin;
    111     device_.update = update;
    112     device_.finish = finish;
    113     device_.abort = abort;
    114 
    115     GetVersionRequest version_request;
    116     GetVersionResponse version_response;
    117     error_ = Send(KM_GET_VERSION, version_request, &version_response);
    118     if (error_ == KM_ERROR_INVALID_ARGUMENT || error_ == KM_ERROR_UNIMPLEMENTED) {
    119         ALOGE("\"Bad parameters\" error on GetVersion call.  Version 0 is not supported.");
    120         error_ = KM_ERROR_VERSION_MISMATCH;
    121         return;
    122     }
    123     message_version_ = MessageVersion(version_response.major_ver, version_response.minor_ver,
    124                                       version_response.subminor_ver);
    125     if (message_version_ < 0) {
    126         // Can't translate version?  Keymaster implementation must be newer.
    127         ALOGE("Keymaster version %d.%d.%d not supported.", version_response.major_ver,
    128               version_response.minor_ver, version_response.subminor_ver);
    129         error_ = KM_ERROR_VERSION_MISMATCH;
    130     }
    131 }
    132 
    133 TrustyKeymasterDevice::~TrustyKeymasterDevice() {
    134     trusty_keymaster_disconnect();
    135 }
    136 
    137 namespace {
    138 
    139 // Allocates a new buffer with malloc and copies the contents of |buffer| to it. Caller takes
    140 // ownership of the returned buffer.
    141 uint8_t* DuplicateBuffer(const uint8_t* buffer, size_t size) {
    142     uint8_t* tmp = reinterpret_cast<uint8_t*>(malloc(size));
    143     if (tmp) {
    144         memcpy(tmp, buffer, size);
    145     }
    146     return tmp;
    147 }
    148 
    149 template <typename RequestType>
    150 void AddClientAndAppData(const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
    151                          RequestType* request) {
    152     request->additional_params.Clear();
    153     if (client_id) {
    154         request->additional_params.push_back(TAG_APPLICATION_ID, *client_id);
    155     }
    156     if (app_data) {
    157         request->additional_params.push_back(TAG_APPLICATION_DATA, *app_data);
    158     }
    159 }
    160 
    161 }  //  unnamed namespace
    162 
    163 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster_key_param_set_t* params) {
    164     ALOGD("Device received configure\n");
    165 
    166     if (error_ != KM_ERROR_OK) {
    167         return error_;
    168     }
    169     if (!params) {
    170         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    171     }
    172 
    173     AuthorizationSet params_copy(*params);
    174     ConfigureRequest request;
    175     if (!params_copy.GetTagValue(TAG_OS_VERSION, &request.os_version) ||
    176         !params_copy.GetTagValue(TAG_OS_PATCHLEVEL, &request.os_patchlevel)) {
    177         ALOGD("Configuration parameters must contain OS version and patch level");
    178         return KM_ERROR_INVALID_ARGUMENT;
    179     }
    180 
    181     ConfigureResponse response;
    182     keymaster_error_t err = Send(KM_CONFIGURE, request, &response);
    183     return err;
    184 }
    185 
    186 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const uint8_t* data, size_t data_length) {
    187     ALOGD("Device received add_rng_entropy");
    188 
    189     if (error_ != KM_ERROR_OK) {
    190         return error_;
    191     }
    192 
    193     AddEntropyRequest request;
    194     request.random_data.Reinitialize(data, data_length);
    195     AddEntropyResponse response;
    196     return Send(KM_ADD_RNG_ENTROPY, request, &response);
    197 }
    198 
    199 keymaster_error_t TrustyKeymasterDevice::generate_key(
    200     const keymaster_key_param_set_t* params, keymaster_key_blob_t* key_blob,
    201     keymaster_key_characteristics_t* characteristics) {
    202     ALOGD("Device received generate_key");
    203 
    204     if (error_ != KM_ERROR_OK) {
    205         return error_;
    206     }
    207     if (!params) {
    208         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    209     }
    210     if (!key_blob) {
    211         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    212     }
    213 
    214     GenerateKeyRequest request(message_version_);
    215     request.key_description.Reinitialize(*params);
    216     //request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
    217 
    218     GenerateKeyResponse response(message_version_);
    219     keymaster_error_t err = Send(KM_GENERATE_KEY, request, &response);
    220     if (err != KM_ERROR_OK) {
    221         ALOGD("Device generate_key return error code %d", err);
    222         return err;
    223     }
    224 
    225     key_blob->key_material_size = response.key_blob.key_material_size;
    226     key_blob->key_material =
    227         DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
    228     if (!key_blob->key_material) {
    229         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    230     }
    231 
    232     if (characteristics) {
    233         response.enforced.CopyToParamSet(&characteristics->hw_enforced);
    234         response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
    235     }
    236 
    237     return KM_ERROR_OK;
    238 }
    239 
    240 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
    241     const keymaster_key_blob_t* key_blob, const keymaster_blob_t* client_id,
    242     const keymaster_blob_t* app_data, keymaster_key_characteristics_t* characteristics) {
    243     ALOGD("Device received get_key_characteristics");
    244 
    245     if (error_ != KM_ERROR_OK) {
    246         return error_;
    247     }
    248     if (!key_blob || !key_blob->key_material) {
    249         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    250     }
    251     if (!characteristics) {
    252         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    253     }
    254 
    255     GetKeyCharacteristicsRequest request;
    256     request.SetKeyMaterial(*key_blob);
    257     AddClientAndAppData(client_id, app_data, &request);
    258 
    259     GetKeyCharacteristicsResponse response;
    260     keymaster_error_t err = Send(KM_GET_KEY_CHARACTERISTICS, request, &response);
    261     if (err != KM_ERROR_OK) {
    262         return err;
    263     }
    264 
    265     response.enforced.CopyToParamSet(&characteristics->hw_enforced);
    266     response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
    267 
    268     return KM_ERROR_OK;
    269 }
    270 
    271 keymaster_error_t TrustyKeymasterDevice::import_key(
    272     const keymaster_key_param_set_t* params, keymaster_key_format_t key_format,
    273     const keymaster_blob_t* key_data, keymaster_key_blob_t* key_blob,
    274     keymaster_key_characteristics_t* characteristics) {
    275     ALOGD("Device received import_key");
    276 
    277     if (error_ != KM_ERROR_OK) {
    278         return error_;
    279     }
    280     if (!params || !key_data) {
    281         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    282     }
    283     if (!key_blob) {
    284         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    285     }
    286 
    287     ImportKeyRequest request(message_version_);
    288     request.key_description.Reinitialize(*params);
    289     //request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
    290 
    291     request.key_format = key_format;
    292     request.SetKeyMaterial(key_data->data, key_data->data_length);
    293 
    294     ImportKeyResponse response(message_version_);
    295     keymaster_error_t err = Send(KM_IMPORT_KEY, request, &response);
    296     if (err != KM_ERROR_OK) {
    297         return err;
    298     }
    299 
    300     key_blob->key_material_size = response.key_blob.key_material_size;
    301     key_blob->key_material =
    302         DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
    303     if (!key_blob->key_material) {
    304         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    305     }
    306 
    307     if (characteristics) {
    308         response.enforced.CopyToParamSet(&characteristics->hw_enforced);
    309         response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
    310     }
    311 
    312     return KM_ERROR_OK;
    313 }
    314 
    315 keymaster_error_t TrustyKeymasterDevice::export_key(keymaster_key_format_t export_format,
    316                                                     const keymaster_key_blob_t* key_to_export,
    317                                                     const keymaster_blob_t* client_id,
    318                                                     const keymaster_blob_t* app_data,
    319                                                     keymaster_blob_t* export_data) {
    320     ALOGD("Device received export_key");
    321 
    322     if (error_ != KM_ERROR_OK) {
    323         return error_;
    324     }
    325     if (!key_to_export || !key_to_export->key_material) {
    326         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    327     }
    328     if (!export_data) {
    329         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    330     }
    331 
    332     export_data->data = nullptr;
    333     export_data->data_length = 0;
    334 
    335     ExportKeyRequest request(message_version_);
    336     request.key_format = export_format;
    337     request.SetKeyMaterial(*key_to_export);
    338     AddClientAndAppData(client_id, app_data, &request);
    339 
    340     ExportKeyResponse response(message_version_);
    341     keymaster_error_t err = Send(KM_EXPORT_KEY, request, &response);
    342     if (err != KM_ERROR_OK) {
    343         return err;
    344     }
    345 
    346     export_data->data_length = response.key_data_length;
    347     export_data->data = DuplicateBuffer(response.key_data, response.key_data_length);
    348     if (!export_data->data) {
    349         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    350     }
    351 
    352     return KM_ERROR_OK;
    353 }
    354 
    355 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster_key_blob_t* key_to_attest,
    356                                                     const keymaster_key_param_set_t* attest_params,
    357                                                     keymaster_cert_chain_t* cert_chain) {
    358     ALOGD("Device received attest_key");
    359 
    360     if (error_ != KM_ERROR_OK) {
    361         return error_;
    362     }
    363     if (!key_to_attest || !attest_params) {
    364         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    365     }
    366     if (!cert_chain) {
    367         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    368     }
    369 
    370     cert_chain->entry_count = 0;
    371     cert_chain->entries = nullptr;
    372 
    373     AttestKeyRequest request;
    374     request.SetKeyMaterial(*key_to_attest);
    375     request.attest_params.Reinitialize(*attest_params);
    376 
    377     keymaster_blob_t attestation_challenge = {};
    378     request.attest_params.GetTagValue(TAG_ATTESTATION_CHALLENGE, &attestation_challenge);
    379     if (attestation_challenge.data_length > kMaximumAttestationChallengeLength) {
    380         ALOGE("%zu-byte attestation challenge; only %zu bytes allowed",
    381               attestation_challenge.data_length, kMaximumAttestationChallengeLength);
    382         return KM_ERROR_INVALID_INPUT_LENGTH;
    383     }
    384 
    385     AttestKeyResponse response;
    386     keymaster_error_t err = Send(KM_ATTEST_KEY, request, &response);
    387     if (err != KM_ERROR_OK) {
    388         return err;
    389     }
    390 
    391     // Allocate and clear storage for cert_chain.
    392     keymaster_cert_chain_t& rsp_chain = response.certificate_chain;
    393     cert_chain->entries = reinterpret_cast<keymaster_blob_t*>(
    394         malloc(rsp_chain.entry_count * sizeof(*cert_chain->entries)));
    395     if (!cert_chain->entries) {
    396         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    397     }
    398     cert_chain->entry_count = rsp_chain.entry_count;
    399     for (keymaster_blob_t& entry : array_range(cert_chain->entries, cert_chain->entry_count)) {
    400         entry = {};
    401     }
    402 
    403     // Copy cert_chain contents
    404     size_t i = 0;
    405     for (keymaster_blob_t& entry : array_range(rsp_chain.entries, rsp_chain.entry_count)) {
    406         cert_chain->entries[i].data = DuplicateBuffer(entry.data, entry.data_length);
    407         if (!cert_chain->entries[i].data) {
    408             keymaster_free_cert_chain(cert_chain);
    409             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    410         }
    411         cert_chain->entries[i].data_length = entry.data_length;
    412         ++i;
    413     }
    414 
    415     return KM_ERROR_OK;
    416 }
    417 
    418 keymaster_error_t TrustyKeymasterDevice::upgrade_key(const keymaster_key_blob_t* key_to_upgrade,
    419                                                      const keymaster_key_param_set_t* upgrade_params,
    420                                                      keymaster_key_blob_t* upgraded_key) {
    421     ALOGD("Device received upgrade_key");
    422 
    423     if (error_ != KM_ERROR_OK) {
    424         return error_;
    425     }
    426     if (!key_to_upgrade || !upgrade_params) {
    427         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    428     }
    429     if (!upgraded_key) {
    430         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    431     }
    432 
    433     UpgradeKeyRequest request;
    434     request.SetKeyMaterial(*key_to_upgrade);
    435     request.upgrade_params.Reinitialize(*upgrade_params);
    436 
    437     UpgradeKeyResponse response;
    438     keymaster_error_t err = Send(KM_UPGRADE_KEY, request, &response);
    439     if (err != KM_ERROR_OK) {
    440         return err;
    441     }
    442 
    443     upgraded_key->key_material_size = response.upgraded_key.key_material_size;
    444     upgraded_key->key_material = DuplicateBuffer(response.upgraded_key.key_material,
    445                                                  response.upgraded_key.key_material_size);
    446     if (!upgraded_key->key_material) {
    447         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    448     }
    449 
    450     return KM_ERROR_OK;
    451 }
    452 
    453 keymaster_error_t TrustyKeymasterDevice::begin(keymaster_purpose_t purpose,
    454                                                const keymaster_key_blob_t* key,
    455                                                const keymaster_key_param_set_t* in_params,
    456                                                keymaster_key_param_set_t* out_params,
    457                                                keymaster_operation_handle_t* operation_handle) {
    458     ALOGD("Device received begin");
    459 
    460     if (error_ != KM_ERROR_OK) {
    461         return error_;
    462     }
    463     if (!key || !key->key_material) {
    464         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    465     }
    466     if (!operation_handle) {
    467         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    468     }
    469 
    470     if (out_params) {
    471         *out_params = {};
    472     }
    473 
    474     BeginOperationRequest request;
    475     request.purpose = purpose;
    476     request.SetKeyMaterial(*key);
    477     request.additional_params.Reinitialize(*in_params);
    478 
    479     BeginOperationResponse response;
    480     keymaster_error_t err = Send(KM_BEGIN_OPERATION, request, &response);
    481     if (err != KM_ERROR_OK) {
    482         return err;
    483     }
    484 
    485     if (response.output_params.size() > 0) {
    486         if (out_params) {
    487             response.output_params.CopyToParamSet(out_params);
    488         } else {
    489             return KM_ERROR_OUTPUT_PARAMETER_NULL;
    490         }
    491     }
    492     *operation_handle = response.op_handle;
    493 
    494     return KM_ERROR_OK;
    495 }
    496 
    497 keymaster_error_t TrustyKeymasterDevice::update(keymaster_operation_handle_t operation_handle,
    498                                                 const keymaster_key_param_set_t* in_params,
    499                                                 const keymaster_blob_t* input,
    500                                                 size_t* input_consumed,
    501                                                 keymaster_key_param_set_t* out_params,
    502                                                 keymaster_blob_t* output) {
    503     ALOGD("Device received update");
    504 
    505     if (error_ != KM_ERROR_OK) {
    506         return error_;
    507     }
    508     if (!input) {
    509         return KM_ERROR_UNEXPECTED_NULL_POINTER;
    510     }
    511     if (!input_consumed) {
    512         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    513     }
    514 
    515     if (out_params) {
    516         *out_params = {};
    517     }
    518     if (output) {
    519         *output = {};
    520     }
    521 
    522     UpdateOperationRequest request;
    523     request.op_handle = operation_handle;
    524     if (in_params) {
    525         request.additional_params.Reinitialize(*in_params);
    526     }
    527     if (input && input->data_length > 0) {
    528         size_t max_input_size = SEND_BUF_SIZE - request.SerializedSize();
    529         request.input.Reinitialize(input->data, std::min(input->data_length, max_input_size));
    530     }
    531 
    532     UpdateOperationResponse response;
    533     keymaster_error_t err = Send(KM_UPDATE_OPERATION, request, &response);
    534     if (err != KM_ERROR_OK) {
    535         return err;
    536     }
    537 
    538     if (response.output_params.size() > 0) {
    539         if (out_params) {
    540             response.output_params.CopyToParamSet(out_params);
    541         } else {
    542             return KM_ERROR_OUTPUT_PARAMETER_NULL;
    543         }
    544     }
    545     *input_consumed = response.input_consumed;
    546     if (output) {
    547         output->data_length = response.output.available_read();
    548         output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
    549         if (!output->data) {
    550             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    551         }
    552     } else if (response.output.available_read() > 0) {
    553         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    554     }
    555 
    556     return KM_ERROR_OK;
    557 }
    558 
    559 keymaster_error_t TrustyKeymasterDevice::finish(keymaster_operation_handle_t operation_handle,
    560                                                 const keymaster_key_param_set_t* in_params,
    561                                                 const keymaster_blob_t* input,
    562                                                 const keymaster_blob_t* signature,
    563                                                 keymaster_key_param_set_t* out_params,
    564                                                 keymaster_blob_t* output) {
    565     ALOGE("Device received finish");
    566 
    567     if (error_ != KM_ERROR_OK) {
    568         return error_;
    569     }
    570     if (input && input->data_length > kMaximumFinishInputLength) {
    571     ALOGE("here %s at %d", __func__, __LINE__);
    572         return KM_ERROR_INVALID_ARGUMENT;
    573     }
    574 
    575     if (out_params) {
    576         *out_params = {};
    577     }
    578     if (output) {
    579         *output = {};
    580     }
    581 
    582     FinishOperationRequest request;
    583     request.op_handle = operation_handle;
    584     if (signature && signature->data && signature->data_length > 0) {
    585         request.signature.Reinitialize(signature->data, signature->data_length);
    586         ALOGE("here %s at %d signature length %d", __func__, __LINE__,
    587                 (int)(signature->data_length));
    588     }
    589     if (input && input->data && input->data_length) {
    590         request.input.Reinitialize(input->data, input->data_length);
    591         ALOGE("here %s at %d input data length %d", __func__, __LINE__,
    592                 (int)(input->data_length));
    593     }
    594     if (in_params) {
    595         request.additional_params.Reinitialize(*in_params);
    596     }
    597 
    598     FinishOperationResponse response;
    599     keymaster_error_t err = Send(KM_FINISH_OPERATION, request, &response);
    600     if (err != KM_ERROR_OK) {
    601     ALOGE("here %s at %d", __func__, __LINE__);
    602         return err;
    603     }
    604 
    605     if (response.output_params.size() > 0) {
    606         if (out_params) {
    607             response.output_params.CopyToParamSet(out_params);
    608         } else {
    609     ALOGE("here %s at %d", __func__, __LINE__);
    610             return KM_ERROR_OUTPUT_PARAMETER_NULL;
    611         }
    612     }
    613     if (output) {
    614         output->data_length = response.output.available_read();
    615         output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
    616         if (!output->data) {
    617             ALOGE("here %s at %d", __func__, __LINE__);
    618             return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    619         } else {
    620             ALOGE("here %s at %d output data length %d", __func__, __LINE__,
    621                     (int)(output->data_length));
    622         }
    623     } else if (response.output.available_read() > 0) {
    624         ALOGE("here %s at %d", __func__, __LINE__);
    625         return KM_ERROR_OUTPUT_PARAMETER_NULL;
    626     }
    627 
    628     ALOGE("OK here %s at %d", __func__, __LINE__);
    629     return KM_ERROR_OK;
    630 }
    631 
    632 keymaster_error_t TrustyKeymasterDevice::abort(keymaster_operation_handle_t operation_handle) {
    633     ALOGD("Device received abort");
    634 
    635     if (error_ != KM_ERROR_OK) {
    636         return error_;
    637     }
    638 
    639     AbortOperationRequest request;
    640     request.op_handle = operation_handle;
    641     AbortOperationResponse response;
    642     return Send(KM_ABORT_OPERATION, request, &response);
    643 }
    644 
    645 hw_device_t* TrustyKeymasterDevice::hw_device() {
    646     return &device_.common;
    647 }
    648 
    649 static inline TrustyKeymasterDevice* convert_device(const keymaster2_device_t* dev) {
    650     return reinterpret_cast<TrustyKeymasterDevice*>(const_cast<keymaster2_device_t*>(dev));
    651 }
    652 
    653 /* static */
    654 int TrustyKeymasterDevice::close_device(hw_device_t* dev) {
    655     delete reinterpret_cast<TrustyKeymasterDevice*>(dev);
    656     return 0;
    657 }
    658 
    659 /* static */
    660 keymaster_error_t TrustyKeymasterDevice::configure(const keymaster2_device_t* dev,
    661                                                    const keymaster_key_param_set_t* params) {
    662     return convert_device(dev)->configure(params);
    663 }
    664 
    665 /* static */
    666 keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const keymaster2_device_t* dev,
    667                                                          const uint8_t* data, size_t data_length) {
    668     return convert_device(dev)->add_rng_entropy(data, data_length);
    669 }
    670 
    671 /* static */
    672 keymaster_error_t TrustyKeymasterDevice::generate_key(
    673     const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
    674     keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
    675     return convert_device(dev)->generate_key(params, key_blob, characteristics);
    676 }
    677 
    678 /* static */
    679 keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
    680     const keymaster2_device_t* dev, const keymaster_key_blob_t* key_blob,
    681     const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
    682     keymaster_key_characteristics_t* characteristics) {
    683     return convert_device(dev)->get_key_characteristics(key_blob, client_id, app_data,
    684                                                         characteristics);
    685 }
    686 
    687 /* static */
    688 keymaster_error_t TrustyKeymasterDevice::import_key(
    689     const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
    690     keymaster_key_format_t key_format, const keymaster_blob_t* key_data,
    691     keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
    692     return convert_device(dev)->import_key(params, key_format, key_data, key_blob, characteristics);
    693 }
    694 
    695 /* static */
    696 keymaster_error_t TrustyKeymasterDevice::export_key(const keymaster2_device_t* dev,
    697                                                     keymaster_key_format_t export_format,
    698                                                     const keymaster_key_blob_t* key_to_export,
    699                                                     const keymaster_blob_t* client_id,
    700                                                     const keymaster_blob_t* app_data,
    701                                                     keymaster_blob_t* export_data) {
    702     return convert_device(dev)->export_key(export_format, key_to_export, client_id, app_data,
    703                                            export_data);
    704 }
    705 
    706 /* static */
    707 keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster2_device_t* dev,
    708                                                     const keymaster_key_blob_t* key_to_attest,
    709                                                     const keymaster_key_param_set_t* attest_params,
    710                                                     keymaster_cert_chain_t* cert_chain) {
    711     return convert_device(dev)->attest_key(key_to_attest, attest_params, cert_chain);
    712 }
    713 
    714 /* static */
    715 keymaster_error_t TrustyKeymasterDevice::upgrade_key(const keymaster2_device_t* dev,
    716                                                      const keymaster_key_blob_t* key_to_upgrade,
    717                                                      const keymaster_key_param_set_t* upgrade_params,
    718                                                      keymaster_key_blob_t* upgraded_key) {
    719     return convert_device(dev)->upgrade_key(key_to_upgrade, upgrade_params, upgraded_key);
    720 }
    721 
    722 /* static */
    723 keymaster_error_t TrustyKeymasterDevice::begin(const keymaster2_device_t* dev,
    724                                                keymaster_purpose_t purpose,
    725                                                const keymaster_key_blob_t* key,
    726                                                const keymaster_key_param_set_t* in_params,
    727                                                keymaster_key_param_set_t* out_params,
    728                                                keymaster_operation_handle_t* operation_handle) {
    729     return convert_device(dev)->begin(purpose, key, in_params, out_params, operation_handle);
    730 }
    731 
    732 /* static */
    733 keymaster_error_t TrustyKeymasterDevice::update(
    734     const keymaster2_device_t* dev, keymaster_operation_handle_t operation_handle,
    735     const keymaster_key_param_set_t* in_params, const keymaster_blob_t* input,
    736     size_t* input_consumed, keymaster_key_param_set_t* out_params, keymaster_blob_t* output) {
    737     return convert_device(dev)->update(operation_handle, in_params, input, input_consumed,
    738                                        out_params, output);
    739 }
    740 
    741 /* static */
    742 keymaster_error_t TrustyKeymasterDevice::finish(const keymaster2_device_t* dev,
    743                                                 keymaster_operation_handle_t operation_handle,
    744                                                 const keymaster_key_param_set_t* in_params,
    745                                                 const keymaster_blob_t* input,
    746                                                 const keymaster_blob_t* signature,
    747                                                 keymaster_key_param_set_t* out_params,
    748                                                 keymaster_blob_t* output) {
    749     return convert_device(dev)->finish(operation_handle, in_params, input, signature, out_params,
    750                                        output);
    751 }
    752 
    753 /* static */
    754 keymaster_error_t TrustyKeymasterDevice::abort(const keymaster2_device_t* dev,
    755                                                keymaster_operation_handle_t operation_handle) {
    756     return convert_device(dev)->abort(operation_handle);
    757 }
    758 
    759 keymaster_error_t TrustyKeymasterDevice::Send(uint32_t command, const Serializable& req,
    760                                               KeymasterResponse* rsp) {
    761     uint32_t req_size = req.SerializedSize();
    762     if (req_size > SEND_BUF_SIZE) {
    763         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
    764     }
    765     uint8_t send_buf[SEND_BUF_SIZE];
    766     Eraser send_buf_eraser(send_buf, SEND_BUF_SIZE);
    767     req.Serialize(send_buf, send_buf + req_size);
    768 
    769     // Send it
    770     uint8_t recv_buf[RECV_BUF_SIZE];
    771     Eraser recv_buf_eraser(recv_buf, RECV_BUF_SIZE);
    772     uint32_t rsp_size = RECV_BUF_SIZE;
    773     // ALOGE("Sending %d byte request\n", (int)req.SerializedSize());
    774     int rc = trusty_keymaster_call(command, send_buf, req_size, recv_buf, &rsp_size);
    775     if (rc < 0) {
    776         ALOGE("tipc error: %d\n", rc);
    777         return translate_error(rc);
    778     } else {
    779         ALOGE("Received %d byte response\n", (int)rsp_size);
    780     }
    781 
    782     const uint8_t* p = recv_buf;
    783     if (!rsp->Deserialize(&p, p + rsp_size)) {
    784         ALOGE("Error deserializing response of size %d\n", (int)rsp_size);
    785         return KM_ERROR_UNKNOWN_ERROR;
    786     } else if (rsp->error != KM_ERROR_OK) {
    787         ALOGE("Error: Response of size %d contained error code %d\n", (int)rsp_size, (int)rsp->error);
    788         return rsp->error;
    789     }
    790     return rsp->error;
    791 }
    792 
    793 }  // namespace keymaster
    794