tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge changes from topic "add-km-41"

Browse source 
am: f66777ad50

Change-Id: I936540f9f9956a01c8c03fc1db6c54ffe81f3489
This commit is contained in:
Shawn Willden 2019-11-21 14:53:57 -08:00 committed by android-build-merger
commit 7f7e9608dc
15 changed files with 458 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
compatibility_matrices/compatibility_matrix.current.xml
View file

@ -256,7 +256,7 @@
<hal format="hidl" optional="false">
<name>android.hardware.keymaster</name>
<version>3.0</version>
<version>4.0</version>
<version>4.0-1</version>
<interface>
<name>IKeymasterDevice</name>
<instance>default</instance>
@ -264,7 +264,7 @@
</hal>
<hal format="hidl" optional="true">
<name>android.hardware.keymaster</name>
<version>4.0</version>
<version>4.0-1</version>
<interface>
<name>IKeymasterDevice</name>
<instance>strongbox</instance>

19
keymaster/4.1/Android.bp Normal file
View file

@ -0,0 +1,19 @@
// This file is autogenerated by hidl-gen -Landroidbp.
hidl_interface {
name: "android.hardware.keymaster@4.1",
root: "android.hardware",
vndk: {
enabled: true,
},
srcs: [
"types.hal",
"IKeymasterDevice.hal",
"IOperation.hal",
],
interfaces: [
"android.hardware.keymaster@4.0",
"android.hidl.base@1.0",
],
gen_java: false,
}

70
keymaster/4.1/IKeymasterDevice.hal Normal file
View file

@ -0,0 +1,70 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.keymaster@4.1;
import @4.0::ErrorCode;
import @4.0::HardwareAuthToken;
import @4.0::IKeymasterDevice;
import @4.0::KeyParameter;
import @4.0::KeyPurpose;
import @4.0::OperationHandle;
import IOperation;
/**
* @4.1::IKeymasterDevice is a minor extension to @4.0::IKeymasterDevice. It adds support for
*
* - Partial hardware enforcment of UNLOCKED_DEVICE_REQUIRED keys;
* - Device-unique attestaion;
* - Early boot only keys;
* - Better cleanup of operations when clients die without completing or aborting them.
*/
interface IKeymasterDevice extends @4.0::IKeymasterDevice {
/**
* Called by client to notify the IKeymasterDevice that the device is now locked, and keys with
* the UNLOCKED_DEVICE_REQUIRED tag should no longer be usable. When this function is called,
* the IKeymasterDevice should note the current timestamp, and attempts to use
* UNLOCKED_DEVICE_REQUIRED keys must be rejected with Error::DEVICE_LOCKED until an
* authentication token with a later timestamp is presented. If the `passwordOnly' argument is
* set to true the sufficiently-recent authentication token must indicate that the user
* authenticated with a password, not a biometric.
*
* @param passwordOnly specifies whether the device must be unlocked with a password, rather
* than a biometric, before UNLOCKED_DEVICE_REQUIRED keys can be used.
*/
deviceLocked(bool passwordOnly) generates (ErrorCode error);
/**
* Called by client to notify the IKeymasterDevice that the device has left the early boot
* state, and that keys with the EARLY_BOOT_ONLY tag may no longer be used. All attempts to use
* an EARLY_BOOT_ONLY key after this method is called must fail with Error::INVALID_KEY_BLOB.
*/
earlyBootEnded() generates (ErrorCode error);
/**
* Begins a cryptographic operation. beginOp() is a variation on begin(). beginOp() has
* identical functionality to begin, but instead of an OperationHandle it returns an IOperation
* object. An IKeymasterDevice HAL service must call linkToDeath() on the Operation before
* returning it, and the provided hidl_death_recipient, if called, must abort() the operation.
* This is to ensure that in the event a client crashes while an operation is in progress, the
* operation slot is freed and available for use by other clients.
*
* @4.1::IKeymasterDevices must implement both beginOp() and begin().
*/
beginOp(KeyPurpose purpose, vec<uint8_t> keyBlob, vec<KeyParameter> inParams,
HardwareAuthToken authToken)
generates (ErrorCode error, vec<KeyParameter> outParam, IOperation operation);
};

31
keymaster/4.1/IOperation.hal Normal file
View file

@ -0,0 +1,31 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.keymaster@4.1;
import @4.0::ErrorCode;
import @4.0::OperationHandle;
/**
* IOperation represents an in-progress IKeymasterDevice operation. It is returned by
* IKeymasterDevice.beginOp().
*/
interface IOperation {
/**
* Returns the operation handle to be used as an authentication challenge.
*/
getOperationChallenge() generates (ErrorCode error, OperationHandle operation);
};

38
keymaster/4.1/default/Android.bp Normal file
View file

@ -0,0 +1,38 @@
//
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
cc_binary {
name: "android.hardware.keymaster@4.1-service",
defaults: ["hidl_defaults"],
relative_install_path: "hw",
vendor: true,
init_rc: ["android.hardware.keymaster@4.1-service.rc"],
srcs: ["service.cpp"],
shared_libs: [
"android.hardware.keymaster@4.0",
"android.hardware.keymaster@4.1",
"libbase",
"libcutils",
"libhardware",
"libhidlbase",
"libkeymaster4",
"libkeymaster41",
"liblog",
"libutils",
],
}

2
keymaster/4.1/default/OWNERS Normal file
View file

@ -0,0 +1,2 @@
jdanis@google.com
swillden@google.com

6
keymaster/4.1/default/android.hardware.keymaster@4.1-service.rc Normal file
View file

@ -0,0 +1,6 @@
service vendor.keymaster-4-1 /vendor/bin/hw/android.hardware.keymaster@4.1-service
interface android.hardware.keymaster@4.0::IKeymasterDevice default
interface android.hardware.keymaster@4.1::IKeymasterDevice default
class early_hal
user system
group system drmrpc

35
keymaster/4.1/default/service.cpp Normal file
View file

@ -0,0 +1,35 @@
/*
** Copyright 2019, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
** http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/
#include <android-base/logging.h>
#include <android/hardware/keymaster/4.1/IKeymasterDevice.h>
#include <hidl/HidlTransportSupport.h>
#include <AndroidKeymaster41Device.h>
using android::hardware::keymaster::V4_0::SecurityLevel;
int main() {
::android::hardware::configureRpcThreadpool(1, true /* willJoinThreadpool */);
auto keymaster = ::keymaster::V4_1::CreateKeymasterDevice(SecurityLevel::SOFTWARE);
auto status = keymaster->registerAsService();
if (status != android::OK) {
LOG(FATAL) << "Could not register service for Keymaster 4.1 (" << status << ")";
}
android::hardware::joinRpcThreadpool();
return -1; // Should never get here.
}

32
keymaster/4.1/support/Android.bp Normal file
View file

@ -0,0 +1,32 @@
//
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
cc_library {
name: "libkeymaster4_1support",
vendor_available: true,
cflags: [
"-Wall",
"-Wextra",
"-Werror",
],
export_include_dirs: ["include"],
shared_libs: [
"android.hardware.keymaster@3.0",
"android.hardware.keymaster@4.0",
"android.hardware.keymaster@4.1",
"libkeymaster4support",
]
}

32
keymaster/4.1/support/include/keymasterV4_1/authorization_set.h Normal file
View file

@ -0,0 +1,32 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_AUTHORIZATION_SET_H_
#define HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_AUTHORIZATION_SET_H_
#include <keymasterV4_0/authorization_set.h>
#include <keymasterV4_1/keymaster_tags.h>
namespace android::hardware::keymaster::V4_1 {
using V4_0::AuthorizationSet;
using V4_0::AuthorizationSetBuilder;
using V4_0::KeyParameter;
} // namespace android::hardware::keymaster::V4_1
#endif // HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_AUTHORIZATION_SET_H_

96
keymaster/4.1/support/include/keymasterV4_1/keymaster_tags.h Normal file
View file

@ -0,0 +1,96 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_KEYMASTER_TAGS_H_
#define HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_KEYMASTER_TAGS_H_
#include <android/hardware/keymaster/4.1/types.h>
#include <keymasterV4_0/keymaster_tags.h>
namespace android::hardware::keymaster::V4_1 {
using V4_0::BlockMode;
using V4_0::Digest;
using V4_0::EcCurve;
using V4_0::ErrorCode;
using V4_0::HardwareAuthToken;
using V4_0::KeyParameter;
using V4_0::PaddingMode;
using V4_0::TagType;
using V4_0::VerificationToken;
using V4_0::TypedTag;
using V4_0::TAG_ACTIVE_DATETIME;
using V4_0::TAG_ALGORITHM;
using V4_0::TAG_ALLOW_WHILE_ON_BODY;
using V4_0::TAG_APPLICATION_DATA;
using V4_0::TAG_APPLICATION_ID;
using V4_0::TAG_ASSOCIATED_DATA;
using V4_0::TAG_ATTESTATION_APPLICATION_ID;
using V4_0::TAG_ATTESTATION_CHALLENGE;
using V4_0::TAG_AUTH_TIMEOUT;
using V4_0::TAG_BLOB_USAGE_REQUIREMENTS;
using V4_0::TAG_BLOCK_MODE;
using V4_0::TAG_BOOT_PATCHLEVEL;
using V4_0::TAG_BOOTLOADER_ONLY;
using V4_0::TAG_CALLER_NONCE;
using V4_0::TAG_CONFIRMATION_TOKEN;
using V4_0::TAG_CREATION_DATETIME;
using V4_0::TAG_DIGEST;
using V4_0::TAG_EC_CURVE;
using V4_0::TAG_HARDWARE_TYPE;
using V4_0::TAG_INCLUDE_UNIQUE_ID;
using V4_0::TAG_INVALID;
using V4_0::TAG_KEY_SIZE;
using V4_0::TAG_MAC_LENGTH;
using V4_0::TAG_MAX_USES_PER_BOOT;
using V4_0::TAG_MIN_MAC_LENGTH;
using V4_0::TAG_MIN_SECONDS_BETWEEN_OPS;
using V4_0::TAG_NO_AUTH_REQUIRED;
using V4_0::TAG_NONCE;
using V4_0::TAG_ORIGIN;
using V4_0::TAG_ORIGINATION_EXPIRE_DATETIME;
using V4_0::TAG_OS_PATCHLEVEL;
using V4_0::TAG_OS_VERSION;
using V4_0::TAG_PADDING;
using V4_0::TAG_PURPOSE;
using V4_0::TAG_RESET_SINCE_ID_ROTATION;
using V4_0::TAG_ROLLBACK_RESISTANCE;
using V4_0::TAG_ROOT_OF_TRUST;
using V4_0::TAG_RSA_PUBLIC_EXPONENT;
using V4_0::TAG_TRUSTED_CONFIRMATION_REQUIRED;
using V4_0::TAG_TRUSTED_USER_PRESENCE_REQUIRED;
using V4_0::TAG_UNIQUE_ID;
using V4_0::TAG_UNLOCKED_DEVICE_REQUIRED;
using V4_0::TAG_USAGE_EXPIRE_DATETIME;
using V4_0::TAG_USER_AUTH_TYPE;
using V4_0::TAG_USER_ID;
using V4_0::TAG_USER_SECURE_ID;
using V4_0::TAG_VENDOR_PATCHLEVEL;
#define DECLARE_KM_4_1_TYPED_TAG(name) \
typedef typename V4_0::Tag2TypedTag<(static_cast<V4_0::Tag>(V4_1::Tag::name))>::type \
TAG_##name##_t; \
static TAG_##name##_t TAG_##name;
DECLARE_KM_4_1_TYPED_TAG(EARLY_BOOT_ONLY);
DECLARE_KM_4_1_TYPED_TAG(DEVICE_UNIQUE_ATTESTATION);
} // namespace android::hardware::keymaster::V4_1
#endif // HARDWARE_INTERFACES_KEYMASTER_V4_1_SUPPORT_INCLUDE_KEYMASTER_TAGS_H_

42
keymaster/4.1/types.hal Normal file
View file

@ -0,0 +1,42 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.keymaster@4.1;
import @4.0::ErrorCode;
import @4.0::Tag;
import @4.0::TagType;
enum Tag : @4.0::Tag {
/**
* Keys tagged with EARLY_BOOT_ONLY may only be used, or created, during early boot, until
* IKeymasterDevice::earlyBootEnded() is called.
*/
EARLY_BOOT_ONLY = TagType:BOOL | 305,
/**
* DEVICE_UNIQUE_ATTESTATION is an argument to IKeymasterDevice::attestKey(). It indicates that
* attestation using a device-unique key is requested, rather than a batch key. Only
* SecurityLevel::STRONGBOX IKeymasterDevices may support device-unique attestations.
* SecurityLevel::TRUSTED_ENVIRONMENT IKeymasterDevices must return ErrorCode::INVALID_ARGUMENT
* if they receive DEVICE_UNIQUE_ATTESTATION. SecurityLevel::STRONGBOX IKeymasterDevices need
* not support DEVICE_UNIQUE_ATTESTATION, and return ErrorCode::CANNOT_ATTEST_IDS if they do not
* support it.
*
* IKeymasterDevice implementations that support device-unique attestation MUST add the
* DEVICE_UNIQUE_ATTESTATION tag to device-unique attestations.
*/
DEVICE_UNIQUE_ATTESTATION = TagType:BOOL | 720,
};

2
keymaster/4.1/vts/OWNERS Normal file
View file

@ -0,0 +1,2 @@
jdanis@google.com
swillden@google.com

30
keymaster/4.1/vts/functional/Android.bp Normal file
View file

@ -0,0 +1,30 @@
//
// Copyright (C) 2019 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
cc_test {
name: "VtsHalKeymasterV4_1TargetTest",
defaults: ["VtsHalTargetTestDefaults"],
srcs: [
"EarlyBootKeyTest.cpp",
],
static_libs: [
"android.hardware.keymaster@4.0",
"android.hardware.keymaster@4.1",
"libkeymaster4support",
"libkeymaster4_1support",
],
test_suites: ["vts-core"],
}

21
keymaster/4.1/vts/functional/EarlyBootKeyTest.cpp Normal file
View file

@ -0,0 +1,21 @@
/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
namespace android::hardware::keymaster::V4_1::test {
// TODO(swillden): Put tests here.
} // namespace android::hardware::keymaster::V4_1::test