1 /*
2 * Copyright 2023 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 #include "host/commands/secure_env/oemlock/oemlock.h"
19
20 namespace cuttlefish {
21 namespace oemlock {
22 namespace {
23
24 constexpr char kStateKey[] = "oemlock_state";
25 constexpr int kAllowedByCarrierBit = 0;
26 constexpr int kAllowedByDeviceBit = 1;
27 constexpr int kOemLockedBit = 2;
28
29 // Default state is allowed_by_carrier = true
30 // allowed_by_device = true
31 // locked = false
32 constexpr uint8_t kDefaultState =
33 0 | (1 << kAllowedByCarrierBit) | (1 << kAllowedByDeviceBit);
34
InitializeDefaultState(secure_env::Storage & storage)35 Result<void> InitializeDefaultState(secure_env::Storage& storage) {
36 if (storage.Exists()) {
37 return {};
38 };
39 auto data = CF_EXPECT(
40 secure_env::CreateStorageData(&kDefaultState, sizeof(kDefaultState)));
41 CF_EXPECT(storage.Write(kStateKey, *data));
42 return {};
43 }
44
ReadFlag(secure_env::Storage & storage,int bit)45 Result<bool> ReadFlag(secure_env::Storage& storage, int bit) {
46 auto data = CF_EXPECT(storage.Read(kStateKey));
47 auto state = CF_EXPECT(data->asUint8());
48 return (state >> bit) & 1;
49 }
50
WriteFlag(secure_env::Storage & storage,int bit,bool value)51 Result<void> WriteFlag(secure_env::Storage& storage, int bit, bool value) {
52 auto data = CF_EXPECT(storage.Read(kStateKey));
53 auto state = CF_EXPECT(data->asUint8());
54 value ? state |= (1 << bit) : state &= ~(1 << bit);
55 auto data_to_write =
56 CF_EXPECT(secure_env::CreateStorageData(&state, sizeof(state)));
57 CF_EXPECT(storage.Write(kStateKey, *data_to_write));
58 return {};
59 }
60
61 } // namespace
62
OemLock(secure_env::Storage & storage)63 OemLock::OemLock(secure_env::Storage& storage) : storage_(storage) {
64 auto result = InitializeDefaultState(storage_);
65 if (!result.ok()) {
66 LOG(FATAL) << "Failed to initialize default state for OemLock TEE storage: "
67 << result.error().FormatForEnv();
68 }
69 }
70
IsOemUnlockAllowedByCarrier() const71 Result<bool> OemLock::IsOemUnlockAllowedByCarrier() const {
72 return CF_EXPECT(ReadFlag(storage_, kAllowedByCarrierBit));
73 }
74
IsOemUnlockAllowedByDevice() const75 Result<bool> OemLock::IsOemUnlockAllowedByDevice() const {
76 return CF_EXPECT(ReadFlag(storage_, kAllowedByDeviceBit));
77 }
78
IsOemUnlockAllowed() const79 Result<bool> OemLock::IsOemUnlockAllowed() const {
80 auto data = CF_EXPECT(storage_.Read(kStateKey));
81 auto state = CF_EXPECT(data->asUint8());
82 const bool allowed_by_device = (state >> kAllowedByDeviceBit) & 1;
83 const bool allowed_by_carrier = (state >> kAllowedByCarrierBit) & 1;
84 return allowed_by_device && allowed_by_carrier;
85 }
86
IsOemLocked() const87 Result<bool> OemLock::IsOemLocked() const {
88 return CF_EXPECT(ReadFlag(storage_, kOemLockedBit));
89 }
90
SetOemUnlockAllowedByCarrier(bool allowed)91 Result<void> OemLock::SetOemUnlockAllowedByCarrier(bool allowed) {
92 CF_EXPECT(WriteFlag(storage_, kAllowedByCarrierBit, allowed));
93 return {};
94 }
95
SetOemUnlockAllowedByDevice(bool allowed)96 Result<void> OemLock::SetOemUnlockAllowedByDevice(bool allowed) {
97 CF_EXPECT(WriteFlag(storage_, kAllowedByDeviceBit, allowed));
98 return {};
99 }
100
SetOemLocked(bool locked)101 Result<void> OemLock::SetOemLocked(bool locked) {
102 CF_EXPECT(WriteFlag(storage_, kOemLockedBit, locked));
103 return {};
104 }
105
106 } // namespace oemlock
107 } // namespace cuttlefish
108