1 /*
2 **
3 ** Copyright 2008, The Android Open Source Project
4 **
5 ** Licensed under the Apache License, Version 2.0 (the "License");
6 ** you may not use this file except in compliance with the License.
7 ** You may obtain a copy of the License at
8 **
9 **     http://www.apache.org/licenses/LICENSE-2.0
10 **
11 ** Unless required by applicable law or agreed to in writing, software
12 ** distributed under the License is distributed on an "AS IS" BASIS,
13 ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 ** See the License for the specific language governing permissions and
15 ** limitations under the License.
16 */
17 
18 #include <stdint.h>
19 #include <sys/limits.h>
20 #include <sys/types.h>
21 
22 #define LOG_TAG "KeystoreService"
23 #include <utils/Log.h>
24 
25 #include <binder/Parcel.h>
26 #include <binder/IPCThreadState.h>
27 #include <binder/IServiceManager.h>
28 
29 #include <keystore/IKeystoreService.h>
30 
31 namespace android {
32 
33 const ssize_t MAX_GENERATE_ARGS = 3;
34 static keymaster_key_param_t* readParamList(const Parcel& in, size_t* length);
35 
KeystoreArg(const void * data,size_t len)36 KeystoreArg::KeystoreArg(const void* data, size_t len)
37     : mData(data), mSize(len) {
38 }
39 
~KeystoreArg()40 KeystoreArg::~KeystoreArg() {
41 }
42 
data() const43 const void *KeystoreArg::data() const {
44     return mData;
45 }
46 
size() const47 size_t KeystoreArg::size() const {
48     return mSize;
49 }
50 
OperationResult()51 OperationResult::OperationResult() : resultCode(0), token(), handle(0), inputConsumed(0),
52     data(NULL), dataLength(0) {
53 }
54 
~OperationResult()55 OperationResult::~OperationResult() {
56 }
57 
readFromParcel(const Parcel & in)58 void OperationResult::readFromParcel(const Parcel& in) {
59     resultCode = in.readInt32();
60     token = in.readStrongBinder();
61     handle = static_cast<keymaster_operation_handle_t>(in.readInt64());
62     inputConsumed = in.readInt32();
63     ssize_t length = in.readInt32();
64     dataLength = 0;
65     if (length > 0) {
66         const void* buf = in.readInplace(length);
67         if (buf) {
68             data.reset(reinterpret_cast<uint8_t*>(malloc(length)));
69             if (data.get()) {
70                 memcpy(data.get(), buf, length);
71                 dataLength = (size_t) length;
72             } else {
73                 ALOGE("Failed to allocate OperationResult buffer");
74             }
75         } else {
76             ALOGE("Failed to readInplace OperationResult data");
77         }
78     }
79     outParams.readFromParcel(in);
80 }
81 
writeToParcel(Parcel * out) const82 void OperationResult::writeToParcel(Parcel* out) const {
83     out->writeInt32(resultCode);
84     out->writeStrongBinder(token);
85     out->writeInt64(handle);
86     out->writeInt32(inputConsumed);
87     out->writeInt32(dataLength);
88     if (dataLength && data) {
89         void* buf = out->writeInplace(dataLength);
90         if (buf) {
91             memcpy(buf, data.get(), dataLength);
92         } else {
93             ALOGE("Failed to writeInplace OperationResult data.");
94         }
95     }
96     outParams.writeToParcel(out);
97 }
98 
ExportResult()99 ExportResult::ExportResult() : resultCode(0), exportData(NULL), dataLength(0) {
100 }
101 
~ExportResult()102 ExportResult::~ExportResult() {
103 }
104 
readFromParcel(const Parcel & in)105 void ExportResult::readFromParcel(const Parcel& in) {
106     resultCode = in.readInt32();
107     ssize_t length = in.readInt32();
108     dataLength = 0;
109     if (length > 0) {
110         const void* buf = in.readInplace(length);
111         if (buf) {
112             exportData.reset(reinterpret_cast<uint8_t*>(malloc(length)));
113             if (exportData.get()) {
114                 memcpy(exportData.get(), buf, length);
115                 dataLength = (size_t) length;
116             } else {
117                 ALOGE("Failed to allocate ExportData buffer");
118             }
119         } else {
120             ALOGE("Failed to readInplace ExportData data");
121         }
122     }
123 }
124 
writeToParcel(Parcel * out) const125 void ExportResult::writeToParcel(Parcel* out) const {
126     out->writeInt32(resultCode);
127     out->writeInt32(dataLength);
128     if (exportData && dataLength) {
129         void* buf = out->writeInplace(dataLength);
130         if (buf) {
131             memcpy(buf, exportData.get(), dataLength);
132         } else {
133             ALOGE("Failed to writeInplace ExportResult data.");
134         }
135     }
136 }
137 
KeymasterArguments()138 KeymasterArguments::KeymasterArguments() {
139 }
140 
~KeymasterArguments()141 KeymasterArguments::~KeymasterArguments() {
142     keymaster_free_param_values(params.data(), params.size());
143 }
144 
readFromParcel(const Parcel & in)145 void KeymasterArguments::readFromParcel(const Parcel& in) {
146     ssize_t length = in.readInt32();
147     size_t ulength = (size_t) length;
148     if (length < 0) {
149         ulength = 0;
150     }
151     keymaster_free_param_values(params.data(), params.size());
152     params.clear();
153     for(size_t i = 0; i < ulength; i++) {
154         keymaster_key_param_t param;
155         if (!readKeymasterArgumentFromParcel(in, &param)) {
156             ALOGE("Error reading keymaster argument from parcel");
157             break;
158         }
159         params.push_back(param);
160     }
161 }
162 
writeToParcel(Parcel * out) const163 void KeymasterArguments::writeToParcel(Parcel* out) const {
164     out->writeInt32(params.size());
165     for (auto param : params) {
166         out->writeInt32(1);
167         writeKeymasterArgumentToParcel(param, out);
168     }
169 }
170 
KeyCharacteristics()171 KeyCharacteristics::KeyCharacteristics() {
172     memset((void*) &characteristics, 0, sizeof(characteristics));
173 }
174 
~KeyCharacteristics()175 KeyCharacteristics::~KeyCharacteristics() {
176     keymaster_free_characteristics(&characteristics);
177 }
178 
readFromParcel(const Parcel & in)179 void KeyCharacteristics::readFromParcel(const Parcel& in) {
180     size_t length = 0;
181     keymaster_key_param_t* params = readParamList(in, &length);
182     characteristics.sw_enforced.params = params;
183     characteristics.sw_enforced.length = length;
184 
185     params = readParamList(in, &length);
186     characteristics.hw_enforced.params = params;
187     characteristics.hw_enforced.length = length;
188 }
189 
writeToParcel(Parcel * out) const190 void KeyCharacteristics::writeToParcel(Parcel* out) const {
191     if (characteristics.sw_enforced.params) {
192         out->writeInt32(characteristics.sw_enforced.length);
193         for (size_t i = 0; i < characteristics.sw_enforced.length; i++) {
194             out->writeInt32(1);
195             writeKeymasterArgumentToParcel(characteristics.sw_enforced.params[i], out);
196         }
197     } else {
198         out->writeInt32(0);
199     }
200     if (characteristics.hw_enforced.params) {
201         out->writeInt32(characteristics.hw_enforced.length);
202         for (size_t i = 0; i < characteristics.hw_enforced.length; i++) {
203             out->writeInt32(1);
204             writeKeymasterArgumentToParcel(characteristics.hw_enforced.params[i], out);
205         }
206     } else {
207         out->writeInt32(0);
208     }
209 }
210 
writeKeymasterArgumentToParcel(const keymaster_key_param_t & param,Parcel * out)211 void writeKeymasterArgumentToParcel(const keymaster_key_param_t& param, Parcel* out) {
212     switch (keymaster_tag_get_type(param.tag)) {
213         case KM_ENUM:
214         case KM_ENUM_REP: {
215             out->writeInt32(param.tag);
216             out->writeInt32(param.enumerated);
217             break;
218         }
219         case KM_UINT:
220         case KM_UINT_REP: {
221             out->writeInt32(param.tag);
222             out->writeInt32(param.integer);
223             break;
224         }
225         case KM_ULONG:
226         case KM_ULONG_REP: {
227             out->writeInt32(param.tag);
228             out->writeInt64(param.long_integer);
229             break;
230         }
231         case KM_DATE: {
232             out->writeInt32(param.tag);
233             out->writeInt64(param.date_time);
234             break;
235         }
236         case KM_BOOL: {
237             out->writeInt32(param.tag);
238             break;
239         }
240         case KM_BIGNUM:
241         case KM_BYTES: {
242             out->writeInt32(param.tag);
243             out->writeInt32(param.blob.data_length);
244             void* buf = out->writeInplace(param.blob.data_length);
245             if (buf) {
246                 memcpy(buf, param.blob.data, param.blob.data_length);
247             } else {
248                 ALOGE("Failed to writeInplace keymaster blob param");
249             }
250             break;
251         }
252         default: {
253             ALOGE("Failed to write argument: Unsupported keymaster_tag_t %d", param.tag);
254         }
255     }
256 }
257 
258 
readKeymasterArgumentFromParcel(const Parcel & in,keymaster_key_param_t * out)259 bool readKeymasterArgumentFromParcel(const Parcel& in, keymaster_key_param_t* out) {
260     if (in.readInt32() == 0) {
261         return false;
262     }
263     keymaster_tag_t tag = static_cast<keymaster_tag_t>(in.readInt32());
264     switch (keymaster_tag_get_type(tag)) {
265         case KM_ENUM:
266         case KM_ENUM_REP: {
267             uint32_t value = in.readInt32();
268             *out = keymaster_param_enum(tag, value);
269             break;
270         }
271         case KM_UINT:
272         case KM_UINT_REP: {
273             uint32_t value = in.readInt32();
274             *out = keymaster_param_int(tag, value);
275             break;
276         }
277         case KM_ULONG:
278         case KM_ULONG_REP: {
279             uint64_t value = in.readInt64();
280             *out = keymaster_param_long(tag, value);
281             break;
282         }
283         case KM_DATE: {
284             uint64_t value = in.readInt64();
285             *out = keymaster_param_date(tag, value);
286             break;
287         }
288         case KM_BOOL: {
289             *out = keymaster_param_bool(tag);
290             break;
291         }
292         case KM_BIGNUM:
293         case KM_BYTES: {
294             ssize_t length = in.readInt32();
295             uint8_t* data = NULL;
296             size_t ulength = 0;
297             if (length >= 0) {
298                 ulength = (size_t) length;
299                 // use malloc here so we can use keymaster_free_param_values
300                 // consistently.
301                 data = reinterpret_cast<uint8_t*>(malloc(ulength));
302                 const void* buf = in.readInplace(ulength);
303                 if (!buf || !data) {
304                     ALOGE("Failed to allocate buffer for keymaster blob param");
305                     return false;
306                 }
307                 memcpy(data, buf, ulength);
308             }
309             *out = keymaster_param_blob(tag, data, ulength);
310             break;
311         }
312         default: {
313             ALOGE("Unsupported keymaster_tag_t %d", tag);
314             return false;
315         }
316     }
317     return true;
318 }
319 
320 /**
321  * Read a byte array from in. The data at *data is still owned by the parcel
322  */
readByteArray(const Parcel & in,const uint8_t ** data,size_t * length)323 static void readByteArray(const Parcel& in, const uint8_t** data, size_t* length) {
324     ssize_t slength = in.readInt32();
325     if (slength > 0) {
326         *data = reinterpret_cast<const uint8_t*>(in.readInplace(slength));
327         if (*data) {
328             *length = static_cast<size_t>(slength);
329         } else {
330             *length = 0;
331         }
332     } else {
333         *data = NULL;
334         *length = 0;
335     }
336 }
337 
338 // Read a keymaster_key_param_t* from a Parcel for use in a
339 // keymaster_key_characteristics_t. This will be free'd by calling
340 // keymaster_free_key_characteristics.
readParamList(const Parcel & in,size_t * length)341 static keymaster_key_param_t* readParamList(const Parcel& in, size_t* length) {
342     ssize_t slength = in.readInt32();
343     *length = 0;
344     if (slength < 0) {
345         return NULL;
346     }
347     *length = (size_t) slength;
348     if (*length >= UINT_MAX / sizeof(keymaster_key_param_t)) {
349         return NULL;
350     }
351     keymaster_key_param_t* list =
352             reinterpret_cast<keymaster_key_param_t*>(malloc(*length *
353                                                             sizeof(keymaster_key_param_t)));
354     if (!list) {
355         ALOGD("Failed to allocate buffer for generateKey outCharacteristics");
356         goto err;
357     }
358     for (size_t i = 0; i < *length ; i++) {
359         if (!readKeymasterArgumentFromParcel(in, &list[i])) {
360             ALOGE("Failed to read keymaster argument");
361             keymaster_free_param_values(list, i);
362             goto err;
363         }
364     }
365     return list;
366 err:
367     free(list);
368     return NULL;
369 }
370 
readKeymasterBlob(const Parcel & in)371 static std::unique_ptr<keymaster_blob_t> readKeymasterBlob(const Parcel& in) {
372     std::unique_ptr<keymaster_blob_t> blob;
373     if (in.readInt32() != 1) {
374         blob.reset(NULL);
375         return blob;
376     }
377     ssize_t length = in.readInt32();
378     blob.reset(new keymaster_blob_t);
379     if (length > 0) {
380         blob->data = reinterpret_cast<const uint8_t*>(in.readInplace(length));
381         if (blob->data) {
382             blob->data_length = static_cast<size_t>(length);
383         } else {
384             blob->data_length = 0;
385         }
386     } else {
387         blob->data = NULL;
388         blob->data_length = 0;
389     }
390     return blob;
391 }
392 
393 class BpKeystoreService: public BpInterface<IKeystoreService>
394 {
395 public:
BpKeystoreService(const sp<IBinder> & impl)396     BpKeystoreService(const sp<IBinder>& impl)
397         : BpInterface<IKeystoreService>(impl)
398     {
399     }
400 
401     // test ping
getState(int32_t userId)402     virtual int32_t getState(int32_t userId)
403     {
404         Parcel data, reply;
405         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
406         data.writeInt32(userId);
407         status_t status = remote()->transact(BnKeystoreService::GET_STATE, data, &reply);
408         if (status != NO_ERROR) {
409             ALOGD("getState() could not contact remote: %d\n", status);
410             return -1;
411         }
412         int32_t err = reply.readExceptionCode();
413         int32_t ret = reply.readInt32();
414         if (err < 0) {
415             ALOGD("getState() caught exception %d\n", err);
416             return -1;
417         }
418         return ret;
419     }
420 
get(const String16 & name,uint8_t ** item,size_t * itemLength)421     virtual int32_t get(const String16& name, uint8_t** item, size_t* itemLength)
422     {
423         Parcel data, reply;
424         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
425         data.writeString16(name);
426         status_t status = remote()->transact(BnKeystoreService::GET, data, &reply);
427         if (status != NO_ERROR) {
428             ALOGD("get() could not contact remote: %d\n", status);
429             return -1;
430         }
431         int32_t err = reply.readExceptionCode();
432         ssize_t len = reply.readInt32();
433         if (len >= 0 && (size_t) len <= reply.dataAvail()) {
434             size_t ulen = (size_t) len;
435             const void* buf = reply.readInplace(ulen);
436             *item = (uint8_t*) malloc(ulen);
437             if (*item != NULL) {
438                 memcpy(*item, buf, ulen);
439                 *itemLength = ulen;
440             } else {
441                 ALOGE("out of memory allocating output array in get");
442                 *itemLength = 0;
443             }
444         } else {
445             *itemLength = 0;
446         }
447         if (err < 0) {
448             ALOGD("get() caught exception %d\n", err);
449             return -1;
450         }
451         return 0;
452     }
453 
insert(const String16 & name,const uint8_t * item,size_t itemLength,int uid,int32_t flags)454     virtual int32_t insert(const String16& name, const uint8_t* item, size_t itemLength, int uid,
455             int32_t flags)
456     {
457         Parcel data, reply;
458         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
459         data.writeString16(name);
460         data.writeInt32(itemLength);
461         void* buf = data.writeInplace(itemLength);
462         memcpy(buf, item, itemLength);
463         data.writeInt32(uid);
464         data.writeInt32(flags);
465         status_t status = remote()->transact(BnKeystoreService::INSERT, data, &reply);
466         if (status != NO_ERROR) {
467             ALOGD("import() could not contact remote: %d\n", status);
468             return -1;
469         }
470         int32_t err = reply.readExceptionCode();
471         int32_t ret = reply.readInt32();
472         if (err < 0) {
473             ALOGD("import() caught exception %d\n", err);
474             return -1;
475         }
476         return ret;
477     }
478 
del(const String16 & name,int uid)479     virtual int32_t del(const String16& name, int uid)
480     {
481         Parcel data, reply;
482         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
483         data.writeString16(name);
484         data.writeInt32(uid);
485         status_t status = remote()->transact(BnKeystoreService::DEL, data, &reply);
486         if (status != NO_ERROR) {
487             ALOGD("del() could not contact remote: %d\n", status);
488             return -1;
489         }
490         int32_t err = reply.readExceptionCode();
491         int32_t ret = reply.readInt32();
492         if (err < 0) {
493             ALOGD("del() caught exception %d\n", err);
494             return -1;
495         }
496         return ret;
497     }
498 
exist(const String16 & name,int uid)499     virtual int32_t exist(const String16& name, int uid)
500     {
501         Parcel data, reply;
502         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
503         data.writeString16(name);
504         data.writeInt32(uid);
505         status_t status = remote()->transact(BnKeystoreService::EXIST, data, &reply);
506         if (status != NO_ERROR) {
507             ALOGD("exist() could not contact remote: %d\n", status);
508             return -1;
509         }
510         int32_t err = reply.readExceptionCode();
511         int32_t ret = reply.readInt32();
512         if (err < 0) {
513             ALOGD("exist() caught exception %d\n", err);
514             return -1;
515         }
516         return ret;
517     }
518 
list(const String16 & prefix,int uid,Vector<String16> * matches)519     virtual int32_t list(const String16& prefix, int uid, Vector<String16>* matches)
520     {
521         Parcel data, reply;
522         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
523         data.writeString16(prefix);
524         data.writeInt32(uid);
525         status_t status = remote()->transact(BnKeystoreService::LIST, data, &reply);
526         if (status != NO_ERROR) {
527             ALOGD("list() could not contact remote: %d\n", status);
528             return -1;
529         }
530         int32_t err = reply.readExceptionCode();
531         int32_t numMatches = reply.readInt32();
532         for (int32_t i = 0; i < numMatches; i++) {
533             matches->push(reply.readString16());
534         }
535         int32_t ret = reply.readInt32();
536         if (err < 0) {
537             ALOGD("list() caught exception %d\n", err);
538             return -1;
539         }
540         return ret;
541     }
542 
reset()543     virtual int32_t reset()
544     {
545         Parcel data, reply;
546         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
547         status_t status = remote()->transact(BnKeystoreService::RESET, data, &reply);
548         if (status != NO_ERROR) {
549             ALOGD("reset() could not contact remote: %d\n", status);
550             return -1;
551         }
552         int32_t err = reply.readExceptionCode();
553         int32_t ret = reply.readInt32();
554         if (err < 0) {
555             ALOGD("reset() caught exception %d\n", err);
556             return -1;
557         }
558         return ret;
559     }
560 
onUserPasswordChanged(int32_t userId,const String16 & password)561     virtual int32_t onUserPasswordChanged(int32_t userId, const String16& password)
562     {
563         Parcel data, reply;
564         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
565         data.writeInt32(userId);
566         data.writeString16(password);
567         status_t status = remote()->transact(BnKeystoreService::ON_USER_PASSWORD_CHANGED, data,
568                                              &reply);
569         if (status != NO_ERROR) {
570             ALOGD("onUserPasswordChanged() could not contact remote: %d\n", status);
571             return -1;
572         }
573         int32_t err = reply.readExceptionCode();
574         int32_t ret = reply.readInt32();
575         if (err < 0) {
576             ALOGD("onUserPasswordChanged() caught exception %d\n", err);
577             return -1;
578         }
579         return ret;
580     }
581 
lock(int32_t userId)582     virtual int32_t lock(int32_t userId)
583     {
584         Parcel data, reply;
585         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
586         data.writeInt32(userId);
587         status_t status = remote()->transact(BnKeystoreService::LOCK, data, &reply);
588         if (status != NO_ERROR) {
589             ALOGD("lock() could not contact remote: %d\n", status);
590             return -1;
591         }
592         int32_t err = reply.readExceptionCode();
593         int32_t ret = reply.readInt32();
594         if (err < 0) {
595             ALOGD("lock() caught exception %d\n", err);
596             return -1;
597         }
598         return ret;
599     }
600 
unlock(int32_t userId,const String16 & password)601     virtual int32_t unlock(int32_t userId, const String16& password)
602     {
603         Parcel data, reply;
604         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
605         data.writeInt32(userId);
606         data.writeString16(password);
607         status_t status = remote()->transact(BnKeystoreService::UNLOCK, data, &reply);
608         if (status != NO_ERROR) {
609             ALOGD("unlock() could not contact remote: %d\n", status);
610             return -1;
611         }
612         int32_t err = reply.readExceptionCode();
613         int32_t ret = reply.readInt32();
614         if (err < 0) {
615             ALOGD("unlock() caught exception %d\n", err);
616             return -1;
617         }
618         return ret;
619     }
620 
isEmpty(int32_t userId)621     virtual bool isEmpty(int32_t userId)
622     {
623         Parcel data, reply;
624         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
625         data.writeInt32(userId);
626         status_t status = remote()->transact(BnKeystoreService::IS_EMPTY, data, &reply);
627         if (status != NO_ERROR) {
628             ALOGD("isEmpty() could not contact remote: %d\n", status);
629             return false;
630         }
631         int32_t err = reply.readExceptionCode();
632         int32_t ret = reply.readInt32();
633         if (err < 0) {
634             ALOGD("isEmpty() caught exception %d\n", err);
635             return false;
636         }
637         return ret != 0;
638     }
639 
generate(const String16 & name,int32_t uid,int32_t keyType,int32_t keySize,int32_t flags,Vector<sp<KeystoreArg>> * args)640     virtual int32_t generate(const String16& name, int32_t uid, int32_t keyType, int32_t keySize,
641             int32_t flags, Vector<sp<KeystoreArg> >* args)
642     {
643         Parcel data, reply;
644         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
645         data.writeString16(name);
646         data.writeInt32(uid);
647         data.writeInt32(keyType);
648         data.writeInt32(keySize);
649         data.writeInt32(flags);
650         data.writeInt32(1);
651         data.writeInt32(args->size());
652         for (Vector<sp<KeystoreArg> >::iterator it = args->begin(); it != args->end(); ++it) {
653             sp<KeystoreArg> item = *it;
654             size_t keyLength = item->size();
655             data.writeInt32(keyLength);
656             void* buf = data.writeInplace(keyLength);
657             memcpy(buf, item->data(), keyLength);
658         }
659         status_t status = remote()->transact(BnKeystoreService::GENERATE, data, &reply);
660         if (status != NO_ERROR) {
661             ALOGD("generate() could not contact remote: %d\n", status);
662             return -1;
663         }
664         int32_t err = reply.readExceptionCode();
665         int32_t ret = reply.readInt32();
666         if (err < 0) {
667             ALOGD("generate() caught exception %d\n", err);
668             return -1;
669         }
670         return ret;
671     }
672 
import(const String16 & name,const uint8_t * key,size_t keyLength,int uid,int flags)673     virtual int32_t import(const String16& name, const uint8_t* key, size_t keyLength, int uid,
674             int flags)
675     {
676         Parcel data, reply;
677         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
678         data.writeString16(name);
679         data.writeInt32(keyLength);
680         void* buf = data.writeInplace(keyLength);
681         memcpy(buf, key, keyLength);
682         data.writeInt32(uid);
683         data.writeInt32(flags);
684         status_t status = remote()->transact(BnKeystoreService::IMPORT, data, &reply);
685         if (status != NO_ERROR) {
686             ALOGD("import() could not contact remote: %d\n", status);
687             return -1;
688         }
689         int32_t err = reply.readExceptionCode();
690         int32_t ret = reply.readInt32();
691         if (err < 0) {
692             ALOGD("import() caught exception %d\n", err);
693             return -1;
694         }
695         return ret;
696     }
697 
sign(const String16 & name,const uint8_t * in,size_t inLength,uint8_t ** out,size_t * outLength)698     virtual int32_t sign(const String16& name, const uint8_t* in, size_t inLength, uint8_t** out,
699             size_t* outLength)
700     {
701         Parcel data, reply;
702         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
703         data.writeString16(name);
704         data.writeInt32(inLength);
705         void* buf = data.writeInplace(inLength);
706         memcpy(buf, in, inLength);
707         status_t status = remote()->transact(BnKeystoreService::SIGN, data, &reply);
708         if (status != NO_ERROR) {
709             ALOGD("import() could not contact remote: %d\n", status);
710             return -1;
711         }
712         int32_t err = reply.readExceptionCode();
713         ssize_t len = reply.readInt32();
714         if (len >= 0 && (size_t) len <= reply.dataAvail()) {
715             size_t ulen = (size_t) len;
716             const void* outBuf = reply.readInplace(ulen);
717             *out = (uint8_t*) malloc(ulen);
718             if (*out != NULL) {
719                 memcpy((void*) *out, outBuf, ulen);
720                 *outLength = ulen;
721             } else {
722                 ALOGE("out of memory allocating output array in sign");
723                 *outLength = 0;
724             }
725         } else {
726             *outLength = 0;
727         }
728         if (err < 0) {
729             ALOGD("import() caught exception %d\n", err);
730             return -1;
731         }
732         return 0;
733     }
734 
verify(const String16 & name,const uint8_t * in,size_t inLength,const uint8_t * signature,size_t signatureLength)735     virtual int32_t verify(const String16& name, const uint8_t* in, size_t inLength,
736             const uint8_t* signature, size_t signatureLength)
737     {
738         Parcel data, reply;
739         void* buf;
740 
741         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
742         data.writeString16(name);
743         data.writeInt32(inLength);
744         buf = data.writeInplace(inLength);
745         memcpy(buf, in, inLength);
746         data.writeInt32(signatureLength);
747         buf = data.writeInplace(signatureLength);
748         memcpy(buf, signature, signatureLength);
749         status_t status = remote()->transact(BnKeystoreService::VERIFY, data, &reply);
750         if (status != NO_ERROR) {
751             ALOGD("verify() could not contact remote: %d\n", status);
752             return -1;
753         }
754         int32_t err = reply.readExceptionCode();
755         int32_t ret = reply.readInt32();
756         if (err < 0) {
757             ALOGD("verify() caught exception %d\n", err);
758             return -1;
759         }
760         return ret;
761     }
762 
get_pubkey(const String16 & name,uint8_t ** pubkey,size_t * pubkeyLength)763     virtual int32_t get_pubkey(const String16& name, uint8_t** pubkey, size_t* pubkeyLength)
764     {
765         Parcel data, reply;
766         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
767         data.writeString16(name);
768         status_t status = remote()->transact(BnKeystoreService::GET_PUBKEY, data, &reply);
769         if (status != NO_ERROR) {
770             ALOGD("get_pubkey() could not contact remote: %d\n", status);
771             return -1;
772         }
773         int32_t err = reply.readExceptionCode();
774         ssize_t len = reply.readInt32();
775         if (len >= 0 && (size_t) len <= reply.dataAvail()) {
776             size_t ulen = (size_t) len;
777             const void* buf = reply.readInplace(ulen);
778             *pubkey = (uint8_t*) malloc(ulen);
779             if (*pubkey != NULL) {
780                 memcpy(*pubkey, buf, ulen);
781                 *pubkeyLength = ulen;
782             } else {
783                 ALOGE("out of memory allocating output array in get_pubkey");
784                 *pubkeyLength = 0;
785             }
786         } else {
787             *pubkeyLength = 0;
788         }
789         if (err < 0) {
790             ALOGD("get_pubkey() caught exception %d\n", err);
791             return -1;
792         }
793         return 0;
794      }
795 
grant(const String16 & name,int32_t granteeUid)796     virtual int32_t grant(const String16& name, int32_t granteeUid)
797     {
798         Parcel data, reply;
799         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
800         data.writeString16(name);
801         data.writeInt32(granteeUid);
802         status_t status = remote()->transact(BnKeystoreService::GRANT, data, &reply);
803         if (status != NO_ERROR) {
804             ALOGD("grant() could not contact remote: %d\n", status);
805             return -1;
806         }
807         int32_t err = reply.readExceptionCode();
808         int32_t ret = reply.readInt32();
809         if (err < 0) {
810             ALOGD("grant() caught exception %d\n", err);
811             return -1;
812         }
813         return ret;
814     }
815 
ungrant(const String16 & name,int32_t granteeUid)816     virtual int32_t ungrant(const String16& name, int32_t granteeUid)
817     {
818         Parcel data, reply;
819         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
820         data.writeString16(name);
821         data.writeInt32(granteeUid);
822         status_t status = remote()->transact(BnKeystoreService::UNGRANT, data, &reply);
823         if (status != NO_ERROR) {
824             ALOGD("ungrant() could not contact remote: %d\n", status);
825             return -1;
826         }
827         int32_t err = reply.readExceptionCode();
828         int32_t ret = reply.readInt32();
829         if (err < 0) {
830             ALOGD("ungrant() caught exception %d\n", err);
831             return -1;
832         }
833         return ret;
834     }
835 
getmtime(const String16 & name)836     int64_t getmtime(const String16& name)
837     {
838         Parcel data, reply;
839         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
840         data.writeString16(name);
841         status_t status = remote()->transact(BnKeystoreService::GETMTIME, data, &reply);
842         if (status != NO_ERROR) {
843             ALOGD("getmtime() could not contact remote: %d\n", status);
844             return -1;
845         }
846         int32_t err = reply.readExceptionCode();
847         int64_t ret = reply.readInt64();
848         if (err < 0) {
849             ALOGD("getmtime() caught exception %d\n", err);
850             return -1;
851         }
852         return ret;
853     }
854 
duplicate(const String16 & srcKey,int32_t srcUid,const String16 & destKey,int32_t destUid)855     virtual int32_t duplicate(const String16& srcKey, int32_t srcUid, const String16& destKey,
856             int32_t destUid)
857     {
858         Parcel data, reply;
859         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
860         data.writeString16(srcKey);
861         data.writeInt32(srcUid);
862         data.writeString16(destKey);
863         data.writeInt32(destUid);
864         status_t status = remote()->transact(BnKeystoreService::DUPLICATE, data, &reply);
865         if (status != NO_ERROR) {
866             ALOGD("duplicate() could not contact remote: %d\n", status);
867             return -1;
868         }
869         int32_t err = reply.readExceptionCode();
870         int32_t ret = reply.readInt32();
871         if (err < 0) {
872             ALOGD("duplicate() caught exception %d\n", err);
873             return -1;
874         }
875         return ret;
876     }
877 
is_hardware_backed(const String16 & keyType)878     virtual int32_t is_hardware_backed(const String16& keyType)
879     {
880         Parcel data, reply;
881         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
882         data.writeString16(keyType);
883         status_t status = remote()->transact(BnKeystoreService::IS_HARDWARE_BACKED, data, &reply);
884         if (status != NO_ERROR) {
885             ALOGD("is_hardware_backed() could not contact remote: %d\n", status);
886             return -1;
887         }
888         int32_t err = reply.readExceptionCode();
889         int32_t ret = reply.readInt32();
890         if (err < 0) {
891             ALOGD("is_hardware_backed() caught exception %d\n", err);
892             return -1;
893         }
894         return ret;
895     }
896 
clear_uid(int64_t uid)897     virtual int32_t clear_uid(int64_t uid)
898     {
899         Parcel data, reply;
900         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
901         data.writeInt64(uid);
902         status_t status = remote()->transact(BnKeystoreService::CLEAR_UID, data, &reply);
903         if (status != NO_ERROR) {
904             ALOGD("clear_uid() could not contact remote: %d\n", status);
905             return -1;
906         }
907         int32_t err = reply.readExceptionCode();
908         int32_t ret = reply.readInt32();
909         if (err < 0) {
910             ALOGD("clear_uid() caught exception %d\n", err);
911             return -1;
912         }
913         return ret;
914     }
915 
addRngEntropy(const uint8_t * buf,size_t bufLength)916     virtual int32_t addRngEntropy(const uint8_t* buf, size_t bufLength)
917     {
918         Parcel data, reply;
919         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
920         data.writeByteArray(bufLength, buf);
921         status_t status = remote()->transact(BnKeystoreService::ADD_RNG_ENTROPY, data, &reply);
922         if (status != NO_ERROR) {
923             ALOGD("addRngEntropy() could not contact remote: %d\n", status);
924             return -1;
925         }
926         int32_t err = reply.readExceptionCode();
927         int32_t ret = reply.readInt32();
928         if (err < 0) {
929             ALOGD("addRngEntropy() caught exception %d\n", err);
930             return -1;
931         }
932         return ret;
933     };
934 
generateKey(const String16 & name,const KeymasterArguments & params,const uint8_t * entropy,size_t entropyLength,int uid,int flags,KeyCharacteristics * outCharacteristics)935     virtual int32_t generateKey(const String16& name, const KeymasterArguments& params,
936                                 const uint8_t* entropy, size_t entropyLength, int uid, int flags,
937                                 KeyCharacteristics* outCharacteristics)
938     {
939         Parcel data, reply;
940         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
941         data.writeString16(name);
942         data.writeInt32(1);
943         params.writeToParcel(&data);
944         data.writeByteArray(entropyLength, entropy);
945         data.writeInt32(uid);
946         data.writeInt32(flags);
947         status_t status = remote()->transact(BnKeystoreService::GENERATE_KEY, data, &reply);
948         if (status != NO_ERROR) {
949             ALOGD("generateKey() could not contact remote: %d\n", status);
950             return KM_ERROR_UNKNOWN_ERROR;
951         }
952         int32_t err = reply.readExceptionCode();
953         int32_t ret = reply.readInt32();
954         if (err < 0) {
955             ALOGD("generateKey() caught exception %d\n", err);
956             return KM_ERROR_UNKNOWN_ERROR;
957         }
958         if (reply.readInt32() != 0 && outCharacteristics) {
959             outCharacteristics->readFromParcel(reply);
960         }
961         return ret;
962     }
getKeyCharacteristics(const String16 & name,const keymaster_blob_t * clientId,const keymaster_blob_t * appData,KeyCharacteristics * outCharacteristics)963     virtual int32_t getKeyCharacteristics(const String16& name,
964                                           const keymaster_blob_t* clientId,
965                                           const keymaster_blob_t* appData,
966                                           KeyCharacteristics* outCharacteristics)
967     {
968         Parcel data, reply;
969         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
970         data.writeString16(name);
971         if (clientId) {
972             data.writeByteArray(clientId->data_length, clientId->data);
973         } else {
974             data.writeInt32(-1);
975         }
976         if (appData) {
977             data.writeByteArray(appData->data_length, appData->data);
978         } else {
979             data.writeInt32(-1);
980         }
981         status_t status = remote()->transact(BnKeystoreService::GET_KEY_CHARACTERISTICS,
982                                              data, &reply);
983         if (status != NO_ERROR) {
984             ALOGD("getKeyCharacteristics() could not contact remote: %d\n", status);
985             return KM_ERROR_UNKNOWN_ERROR;
986         }
987         int32_t err = reply.readExceptionCode();
988         int32_t ret = reply.readInt32();
989         if (err < 0) {
990             ALOGD("getKeyCharacteristics() caught exception %d\n", err);
991             return KM_ERROR_UNKNOWN_ERROR;
992         }
993         if (reply.readInt32() != 0 && outCharacteristics) {
994             outCharacteristics->readFromParcel(reply);
995         }
996         return ret;
997     }
importKey(const String16 & name,const KeymasterArguments & params,keymaster_key_format_t format,const uint8_t * keyData,size_t keyLength,int uid,int flags,KeyCharacteristics * outCharacteristics)998     virtual int32_t importKey(const String16& name, const KeymasterArguments&  params,
999                               keymaster_key_format_t format, const uint8_t *keyData,
1000                               size_t keyLength, int uid, int flags,
1001                               KeyCharacteristics* outCharacteristics)
1002     {
1003         Parcel data, reply;
1004         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1005         data.writeString16(name);
1006         data.writeInt32(1);
1007         params.writeToParcel(&data);
1008         data.writeInt32(format);
1009         data.writeByteArray(keyLength, keyData);
1010         data.writeInt32(uid);
1011         data.writeInt32(flags);
1012         status_t status = remote()->transact(BnKeystoreService::IMPORT_KEY, data, &reply);
1013         if (status != NO_ERROR) {
1014             ALOGD("importKey() could not contact remote: %d\n", status);
1015             return KM_ERROR_UNKNOWN_ERROR;
1016         }
1017         int32_t err = reply.readExceptionCode();
1018         int32_t ret = reply.readInt32();
1019         if (err < 0) {
1020             ALOGD("importKey() caught exception %d\n", err);
1021             return KM_ERROR_UNKNOWN_ERROR;
1022         }
1023         if (reply.readInt32() != 0 && outCharacteristics) {
1024             outCharacteristics->readFromParcel(reply);
1025         }
1026         return ret;
1027     }
1028 
exportKey(const String16 & name,keymaster_key_format_t format,const keymaster_blob_t * clientId,const keymaster_blob_t * appData,ExportResult * result)1029     virtual void exportKey(const String16& name, keymaster_key_format_t format,
1030                            const keymaster_blob_t* clientId,
1031                            const keymaster_blob_t* appData, ExportResult* result)
1032     {
1033         if (!result) {
1034             return;
1035         }
1036 
1037         Parcel data, reply;
1038         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1039         data.writeString16(name);
1040         data.writeInt32(format);
1041         if (clientId) {
1042             data.writeByteArray(clientId->data_length, clientId->data);
1043         } else {
1044             data.writeInt32(-1);
1045         }
1046         if (appData) {
1047             data.writeByteArray(appData->data_length, appData->data);
1048         } else {
1049             data.writeInt32(-1);
1050         }
1051         status_t status = remote()->transact(BnKeystoreService::EXPORT_KEY, data, &reply);
1052         if (status != NO_ERROR) {
1053             ALOGD("exportKey() could not contact remote: %d\n", status);
1054             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1055             return;
1056         }
1057         int32_t err = reply.readExceptionCode();
1058         if (err < 0) {
1059             ALOGD("exportKey() caught exception %d\n", err);
1060             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1061             return;
1062         }
1063         if (reply.readInt32() != 0) {
1064             result->readFromParcel(reply);
1065         }
1066     }
1067 
begin(const sp<IBinder> & appToken,const String16 & name,keymaster_purpose_t purpose,bool pruneable,const KeymasterArguments & params,const uint8_t * entropy,size_t entropyLength,OperationResult * result)1068     virtual void begin(const sp<IBinder>& appToken, const String16& name,
1069                        keymaster_purpose_t purpose, bool pruneable,
1070                        const KeymasterArguments& params, const uint8_t* entropy,
1071                        size_t entropyLength, OperationResult* result)
1072     {
1073         if (!result) {
1074             return;
1075         }
1076         Parcel data, reply;
1077         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1078         data.writeStrongBinder(appToken);
1079         data.writeString16(name);
1080         data.writeInt32(purpose);
1081         data.writeInt32(pruneable ? 1 : 0);
1082         data.writeInt32(1);
1083         params.writeToParcel(&data);
1084         data.writeByteArray(entropyLength, entropy);
1085         status_t status = remote()->transact(BnKeystoreService::BEGIN, data, &reply);
1086         if (status != NO_ERROR) {
1087             ALOGD("begin() could not contact remote: %d\n", status);
1088             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1089             return;
1090         }
1091         int32_t err = reply.readExceptionCode();
1092         if (err < 0) {
1093             ALOGD("begin() caught exception %d\n", err);
1094             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1095             return;
1096         }
1097         if (reply.readInt32() != 0) {
1098             result->readFromParcel(reply);
1099         }
1100     }
1101 
update(const sp<IBinder> & token,const KeymasterArguments & params,const uint8_t * opData,size_t dataLength,OperationResult * result)1102     virtual void update(const sp<IBinder>& token, const KeymasterArguments& params,
1103                         const uint8_t* opData, size_t dataLength, OperationResult* result)
1104     {
1105         if (!result) {
1106             return;
1107         }
1108         Parcel data, reply;
1109         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1110         data.writeStrongBinder(token);
1111         data.writeInt32(1);
1112         params.writeToParcel(&data);
1113         data.writeByteArray(dataLength, opData);
1114         status_t status = remote()->transact(BnKeystoreService::UPDATE, data, &reply);
1115         if (status != NO_ERROR) {
1116             ALOGD("update() could not contact remote: %d\n", status);
1117             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1118             return;
1119         }
1120         int32_t err = reply.readExceptionCode();
1121         if (err < 0) {
1122             ALOGD("update() caught exception %d\n", err);
1123             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1124             return;
1125         }
1126         if (reply.readInt32() != 0) {
1127             result->readFromParcel(reply);
1128         }
1129     }
1130 
finish(const sp<IBinder> & token,const KeymasterArguments & params,const uint8_t * signature,size_t signatureLength,const uint8_t * entropy,size_t entropyLength,OperationResult * result)1131     virtual void finish(const sp<IBinder>& token, const KeymasterArguments& params,
1132                         const uint8_t* signature, size_t signatureLength,
1133                         const uint8_t* entropy, size_t entropyLength,
1134                         OperationResult* result)
1135     {
1136         if (!result) {
1137             return;
1138         }
1139         Parcel data, reply;
1140         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1141         data.writeStrongBinder(token);
1142         data.writeInt32(1);
1143         params.writeToParcel(&data);
1144         data.writeByteArray(signatureLength, signature);
1145         data.writeByteArray(entropyLength, entropy);
1146         status_t status = remote()->transact(BnKeystoreService::FINISH, data, &reply);
1147         if (status != NO_ERROR) {
1148             ALOGD("finish() could not contact remote: %d\n", status);
1149             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1150             return;
1151         }
1152         int32_t err = reply.readExceptionCode();
1153         if (err < 0) {
1154             ALOGD("finish() caught exception %d\n", err);
1155             result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1156             return;
1157         }
1158         if (reply.readInt32() != 0) {
1159             result->readFromParcel(reply);
1160         }
1161     }
1162 
abort(const sp<IBinder> & token)1163     virtual int32_t abort(const sp<IBinder>& token)
1164     {
1165         Parcel data, reply;
1166         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1167         data.writeStrongBinder(token);
1168         status_t status = remote()->transact(BnKeystoreService::ABORT, data, &reply);
1169         if (status != NO_ERROR) {
1170             ALOGD("abort() could not contact remote: %d\n", status);
1171             return KM_ERROR_UNKNOWN_ERROR;
1172         }
1173         int32_t err = reply.readExceptionCode();
1174         int32_t ret = reply.readInt32();
1175         if (err < 0) {
1176             ALOGD("abort() caught exception %d\n", err);
1177             return KM_ERROR_UNKNOWN_ERROR;
1178         }
1179         return ret;
1180     }
1181 
isOperationAuthorized(const sp<IBinder> & token)1182     virtual bool isOperationAuthorized(const sp<IBinder>& token)
1183     {
1184         Parcel data, reply;
1185         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1186         data.writeStrongBinder(token);
1187         status_t status = remote()->transact(BnKeystoreService::IS_OPERATION_AUTHORIZED, data,
1188                                              &reply);
1189         if (status != NO_ERROR) {
1190             ALOGD("isOperationAuthorized() could not contact remote: %d\n", status);
1191             return false;
1192         }
1193         int32_t err = reply.readExceptionCode();
1194         int32_t ret = reply.readInt32();
1195         if (err < 0) {
1196             ALOGD("isOperationAuthorized() caught exception %d\n", err);
1197             return false;
1198         }
1199         return ret == 1;
1200     }
1201 
addAuthToken(const uint8_t * token,size_t length)1202     virtual int32_t addAuthToken(const uint8_t* token, size_t length)
1203     {
1204         Parcel data, reply;
1205         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1206         data.writeByteArray(length, token);
1207         status_t status = remote()->transact(BnKeystoreService::ADD_AUTH_TOKEN, data, &reply);
1208         if (status != NO_ERROR) {
1209             ALOGD("addAuthToken() could not contact remote: %d\n", status);
1210             return -1;
1211         }
1212         int32_t err = reply.readExceptionCode();
1213         int32_t ret = reply.readInt32();
1214         if (err < 0) {
1215             ALOGD("addAuthToken() caught exception %d\n", err);
1216             return -1;
1217         }
1218         return ret;
1219     };
1220 
onUserAdded(int32_t userId,int32_t parentId)1221     virtual int32_t onUserAdded(int32_t userId, int32_t parentId)
1222     {
1223         Parcel data, reply;
1224         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1225         data.writeInt32(userId);
1226         data.writeInt32(parentId);
1227         status_t status = remote()->transact(BnKeystoreService::ON_USER_ADDED, data, &reply);
1228         if (status != NO_ERROR) {
1229             ALOGD("onUserAdded() could not contact remote: %d\n", status);
1230             return -1;
1231         }
1232         int32_t err = reply.readExceptionCode();
1233         int32_t ret = reply.readInt32();
1234         if (err < 0) {
1235             ALOGD("onUserAdded() caught exception %d\n", err);
1236             return -1;
1237         }
1238         return ret;
1239     }
1240 
onUserRemoved(int32_t userId)1241     virtual int32_t onUserRemoved(int32_t userId)
1242     {
1243         Parcel data, reply;
1244         data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1245         data.writeInt32(userId);
1246         status_t status = remote()->transact(BnKeystoreService::ON_USER_REMOVED, data, &reply);
1247         if (status != NO_ERROR) {
1248             ALOGD("onUserRemoved() could not contact remote: %d\n", status);
1249             return -1;
1250         }
1251         int32_t err = reply.readExceptionCode();
1252         int32_t ret = reply.readInt32();
1253         if (err < 0) {
1254             ALOGD("onUserRemoved() caught exception %d\n", err);
1255             return -1;
1256         }
1257         return ret;
1258     }
1259 
1260 };
1261 
1262 IMPLEMENT_META_INTERFACE(KeystoreService, "android.security.IKeystoreService");
1263 
1264 // ----------------------------------------------------------------------
1265 
onTransact(uint32_t code,const Parcel & data,Parcel * reply,uint32_t flags)1266 status_t BnKeystoreService::onTransact(
1267     uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
1268 {
1269     switch(code) {
1270         case GET_STATE: {
1271             CHECK_INTERFACE(IKeystoreService, data, reply);
1272             int32_t userId = data.readInt32();
1273             int32_t ret = getState(userId);
1274             reply->writeNoException();
1275             reply->writeInt32(ret);
1276             return NO_ERROR;
1277         } break;
1278         case GET: {
1279             CHECK_INTERFACE(IKeystoreService, data, reply);
1280             String16 name = data.readString16();
1281             void* out = NULL;
1282             size_t outSize = 0;
1283             int32_t ret = get(name, (uint8_t**) &out, &outSize);
1284             reply->writeNoException();
1285             if (ret == 1) {
1286                 reply->writeInt32(outSize);
1287                 void* buf = reply->writeInplace(outSize);
1288                 memcpy(buf, out, outSize);
1289                 free(out);
1290             } else {
1291                 reply->writeInt32(-1);
1292             }
1293             return NO_ERROR;
1294         } break;
1295         case INSERT: {
1296             CHECK_INTERFACE(IKeystoreService, data, reply);
1297             String16 name = data.readString16();
1298             ssize_t inSize = data.readInt32();
1299             const void* in;
1300             if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1301                 in = data.readInplace(inSize);
1302             } else {
1303                 in = NULL;
1304                 inSize = 0;
1305             }
1306             int uid = data.readInt32();
1307             int32_t flags = data.readInt32();
1308             int32_t ret = insert(name, (const uint8_t*) in, (size_t) inSize, uid, flags);
1309             reply->writeNoException();
1310             reply->writeInt32(ret);
1311             return NO_ERROR;
1312         } break;
1313         case DEL: {
1314             CHECK_INTERFACE(IKeystoreService, data, reply);
1315             String16 name = data.readString16();
1316             int uid = data.readInt32();
1317             int32_t ret = del(name, uid);
1318             reply->writeNoException();
1319             reply->writeInt32(ret);
1320             return NO_ERROR;
1321         } break;
1322         case EXIST: {
1323             CHECK_INTERFACE(IKeystoreService, data, reply);
1324             String16 name = data.readString16();
1325             int uid = data.readInt32();
1326             int32_t ret = exist(name, uid);
1327             reply->writeNoException();
1328             reply->writeInt32(ret);
1329             return NO_ERROR;
1330         } break;
1331         case LIST: {
1332             CHECK_INTERFACE(IKeystoreService, data, reply);
1333             String16 prefix = data.readString16();
1334             int uid = data.readInt32();
1335             Vector<String16> matches;
1336             int32_t ret = list(prefix, uid, &matches);
1337             reply->writeNoException();
1338             reply->writeInt32(matches.size());
1339             Vector<String16>::const_iterator it = matches.begin();
1340             for (; it != matches.end(); ++it) {
1341                 reply->writeString16(*it);
1342             }
1343             reply->writeInt32(ret);
1344             return NO_ERROR;
1345         } break;
1346         case RESET: {
1347             CHECK_INTERFACE(IKeystoreService, data, reply);
1348             int32_t ret = reset();
1349             reply->writeNoException();
1350             reply->writeInt32(ret);
1351             return NO_ERROR;
1352         } break;
1353         case ON_USER_PASSWORD_CHANGED: {
1354             CHECK_INTERFACE(IKeystoreService, data, reply);
1355             int32_t userId = data.readInt32();
1356             String16 pass = data.readString16();
1357             int32_t ret = onUserPasswordChanged(userId, pass);
1358             reply->writeNoException();
1359             reply->writeInt32(ret);
1360             return NO_ERROR;
1361         } break;
1362         case LOCK: {
1363             CHECK_INTERFACE(IKeystoreService, data, reply);
1364             int32_t userId = data.readInt32();
1365             int32_t ret = lock(userId);
1366             reply->writeNoException();
1367             reply->writeInt32(ret);
1368             return NO_ERROR;
1369         } break;
1370         case UNLOCK: {
1371             CHECK_INTERFACE(IKeystoreService, data, reply);
1372             int32_t userId = data.readInt32();
1373             String16 pass = data.readString16();
1374             int32_t ret = unlock(userId, pass);
1375             reply->writeNoException();
1376             reply->writeInt32(ret);
1377             return NO_ERROR;
1378         } break;
1379         case IS_EMPTY: {
1380             CHECK_INTERFACE(IKeystoreService, data, reply);
1381             int32_t userId = data.readInt32();
1382             bool ret = isEmpty(userId);
1383             reply->writeNoException();
1384             reply->writeInt32(ret ? 1 : 0);
1385             return NO_ERROR;
1386         } break;
1387         case GENERATE: {
1388             CHECK_INTERFACE(IKeystoreService, data, reply);
1389             String16 name = data.readString16();
1390             int32_t uid = data.readInt32();
1391             int32_t keyType = data.readInt32();
1392             int32_t keySize = data.readInt32();
1393             int32_t flags = data.readInt32();
1394             Vector<sp<KeystoreArg> > args;
1395             int32_t argsPresent = data.readInt32();
1396             if (argsPresent == 1) {
1397                 ssize_t numArgs = data.readInt32();
1398                 if (numArgs > MAX_GENERATE_ARGS) {
1399                     return BAD_VALUE;
1400                 }
1401                 if (numArgs > 0) {
1402                     for (size_t i = 0; i < (size_t) numArgs; i++) {
1403                         ssize_t inSize = data.readInt32();
1404                         if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1405                             sp<KeystoreArg> arg = new KeystoreArg(data.readInplace(inSize),
1406                                                                   inSize);
1407                             args.push_back(arg);
1408                         } else {
1409                             args.push_back(NULL);
1410                         }
1411                     }
1412                 }
1413             }
1414             int32_t ret = generate(name, uid, keyType, keySize, flags, &args);
1415             reply->writeNoException();
1416             reply->writeInt32(ret);
1417             return NO_ERROR;
1418         } break;
1419         case IMPORT: {
1420             CHECK_INTERFACE(IKeystoreService, data, reply);
1421             String16 name = data.readString16();
1422             ssize_t inSize = data.readInt32();
1423             const void* in;
1424             if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1425                 in = data.readInplace(inSize);
1426             } else {
1427                 in = NULL;
1428                 inSize = 0;
1429             }
1430             int uid = data.readInt32();
1431             int32_t flags = data.readInt32();
1432             int32_t ret = import(name, (const uint8_t*) in, (size_t) inSize, uid, flags);
1433             reply->writeNoException();
1434             reply->writeInt32(ret);
1435             return NO_ERROR;
1436         } break;
1437         case SIGN: {
1438             CHECK_INTERFACE(IKeystoreService, data, reply);
1439             String16 name = data.readString16();
1440             ssize_t inSize = data.readInt32();
1441             const void* in;
1442             if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1443                 in = data.readInplace(inSize);
1444             } else {
1445                 in = NULL;
1446                 inSize = 0;
1447             }
1448             void* out = NULL;
1449             size_t outSize = 0;
1450             int32_t ret = sign(name, (const uint8_t*) in, (size_t) inSize, (uint8_t**) &out, &outSize);
1451             reply->writeNoException();
1452             if (outSize > 0 && out != NULL) {
1453                 reply->writeInt32(outSize);
1454                 void* buf = reply->writeInplace(outSize);
1455                 memcpy(buf, out, outSize);
1456                 delete[] reinterpret_cast<uint8_t*>(out);
1457             } else {
1458                 reply->writeInt32(-1);
1459             }
1460             reply->writeInt32(ret);
1461             return NO_ERROR;
1462         } break;
1463         case VERIFY: {
1464             CHECK_INTERFACE(IKeystoreService, data, reply);
1465             String16 name = data.readString16();
1466             ssize_t inSize = data.readInt32();
1467             const void* in;
1468             if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1469                 in = data.readInplace(inSize);
1470             } else {
1471                 in = NULL;
1472                 inSize = 0;
1473             }
1474             ssize_t sigSize = data.readInt32();
1475             const void* sig;
1476             if (sigSize >= 0 && (size_t) sigSize <= data.dataAvail()) {
1477                 sig = data.readInplace(sigSize);
1478             } else {
1479                 sig = NULL;
1480                 sigSize = 0;
1481             }
1482             bool ret = verify(name, (const uint8_t*) in, (size_t) inSize, (const uint8_t*) sig,
1483                     (size_t) sigSize);
1484             reply->writeNoException();
1485             reply->writeInt32(ret ? 1 : 0);
1486             return NO_ERROR;
1487         } break;
1488         case GET_PUBKEY: {
1489             CHECK_INTERFACE(IKeystoreService, data, reply);
1490             String16 name = data.readString16();
1491             void* out = NULL;
1492             size_t outSize = 0;
1493             int32_t ret = get_pubkey(name, (unsigned char**) &out, &outSize);
1494             reply->writeNoException();
1495             if (outSize > 0 && out != NULL) {
1496                 reply->writeInt32(outSize);
1497                 void* buf = reply->writeInplace(outSize);
1498                 memcpy(buf, out, outSize);
1499                 free(out);
1500             } else {
1501                 reply->writeInt32(-1);
1502             }
1503             reply->writeInt32(ret);
1504             return NO_ERROR;
1505         } break;
1506         case GRANT: {
1507             CHECK_INTERFACE(IKeystoreService, data, reply);
1508             String16 name = data.readString16();
1509             int32_t granteeUid = data.readInt32();
1510             int32_t ret = grant(name, granteeUid);
1511             reply->writeNoException();
1512             reply->writeInt32(ret);
1513             return NO_ERROR;
1514         } break;
1515         case UNGRANT: {
1516             CHECK_INTERFACE(IKeystoreService, data, reply);
1517             String16 name = data.readString16();
1518             int32_t granteeUid = data.readInt32();
1519             int32_t ret = ungrant(name, granteeUid);
1520             reply->writeNoException();
1521             reply->writeInt32(ret);
1522             return NO_ERROR;
1523         } break;
1524         case GETMTIME: {
1525             CHECK_INTERFACE(IKeystoreService, data, reply);
1526             String16 name = data.readString16();
1527             int64_t ret = getmtime(name);
1528             reply->writeNoException();
1529             reply->writeInt64(ret);
1530             return NO_ERROR;
1531         } break;
1532         case DUPLICATE: {
1533             CHECK_INTERFACE(IKeystoreService, data, reply);
1534             String16 srcKey = data.readString16();
1535             int32_t srcUid = data.readInt32();
1536             String16 destKey = data.readString16();
1537             int32_t destUid = data.readInt32();
1538             int32_t ret = duplicate(srcKey, srcUid, destKey, destUid);
1539             reply->writeNoException();
1540             reply->writeInt32(ret);
1541             return NO_ERROR;
1542         } break;
1543         case IS_HARDWARE_BACKED: {
1544             CHECK_INTERFACE(IKeystoreService, data, reply);
1545             String16 keyType = data.readString16();
1546             int32_t ret = is_hardware_backed(keyType);
1547             reply->writeNoException();
1548             reply->writeInt32(ret);
1549             return NO_ERROR;
1550         }
1551         case CLEAR_UID: {
1552             CHECK_INTERFACE(IKeystoreService, data, reply);
1553             int64_t uid = data.readInt64();
1554             int32_t ret = clear_uid(uid);
1555             reply->writeNoException();
1556             reply->writeInt32(ret);
1557             return NO_ERROR;
1558         }
1559         case ADD_RNG_ENTROPY: {
1560             CHECK_INTERFACE(IKeystoreService, data, reply);
1561             const uint8_t* bytes = NULL;
1562             size_t size = 0;
1563             readByteArray(data, &bytes, &size);
1564             int32_t ret = addRngEntropy(bytes, size);
1565             reply->writeNoException();
1566             reply->writeInt32(ret);
1567             return NO_ERROR;
1568         }
1569         case GENERATE_KEY: {
1570             CHECK_INTERFACE(IKeystoreService, data, reply);
1571             String16 name = data.readString16();
1572             KeymasterArguments args;
1573             if (data.readInt32() != 0) {
1574                 args.readFromParcel(data);
1575             }
1576             const uint8_t* entropy = NULL;
1577             size_t entropyLength = 0;
1578             readByteArray(data, &entropy, &entropyLength);
1579             int32_t uid = data.readInt32();
1580             int32_t flags = data.readInt32();
1581             KeyCharacteristics outCharacteristics;
1582             int32_t ret = generateKey(name, args, entropy, entropyLength, uid, flags,
1583                                       &outCharacteristics);
1584             reply->writeNoException();
1585             reply->writeInt32(ret);
1586             reply->writeInt32(1);
1587             outCharacteristics.writeToParcel(reply);
1588             return NO_ERROR;
1589         }
1590         case GET_KEY_CHARACTERISTICS: {
1591             CHECK_INTERFACE(IKeystoreService, data, reply);
1592             String16 name = data.readString16();
1593             std::unique_ptr<keymaster_blob_t> clientId = readKeymasterBlob(data);
1594             std::unique_ptr<keymaster_blob_t> appData = readKeymasterBlob(data);
1595             KeyCharacteristics outCharacteristics;
1596             int ret = getKeyCharacteristics(name, clientId.get(), appData.get(),
1597                                             &outCharacteristics);
1598             reply->writeNoException();
1599             reply->writeInt32(ret);
1600             reply->writeInt32(1);
1601             outCharacteristics.writeToParcel(reply);
1602             return NO_ERROR;
1603         }
1604         case IMPORT_KEY: {
1605             CHECK_INTERFACE(IKeystoreService, data, reply);
1606             String16 name = data.readString16();
1607             KeymasterArguments args;
1608             if (data.readInt32() != 0) {
1609                 args.readFromParcel(data);
1610             }
1611             keymaster_key_format_t format = static_cast<keymaster_key_format_t>(data.readInt32());
1612             const uint8_t* keyData = NULL;
1613             size_t keyLength = 0;
1614             readByteArray(data, &keyData, &keyLength);
1615             int32_t uid = data.readInt32();
1616             int32_t flags = data.readInt32();
1617             KeyCharacteristics outCharacteristics;
1618             int32_t ret = importKey(name, args, format, keyData, keyLength, uid, flags,
1619                                     &outCharacteristics);
1620             reply->writeNoException();
1621             reply->writeInt32(ret);
1622             reply->writeInt32(1);
1623             outCharacteristics.writeToParcel(reply);
1624 
1625             return NO_ERROR;
1626         }
1627         case EXPORT_KEY: {
1628             CHECK_INTERFACE(IKeystoreService, data, reply);
1629             String16 name = data.readString16();
1630             keymaster_key_format_t format = static_cast<keymaster_key_format_t>(data.readInt32());
1631             std::unique_ptr<keymaster_blob_t> clientId = readKeymasterBlob(data);
1632             std::unique_ptr<keymaster_blob_t> appData = readKeymasterBlob(data);
1633             ExportResult result;
1634             exportKey(name, format, clientId.get(), appData.get(), &result);
1635             reply->writeNoException();
1636             reply->writeInt32(1);
1637             result.writeToParcel(reply);
1638 
1639             return NO_ERROR;
1640         }
1641         case BEGIN: {
1642             CHECK_INTERFACE(IKeystoreService, data, reply);
1643             sp<IBinder> token = data.readStrongBinder();
1644             String16 name = data.readString16();
1645             keymaster_purpose_t purpose = static_cast<keymaster_purpose_t>(data.readInt32());
1646             bool pruneable = data.readInt32() != 0;
1647             KeymasterArguments args;
1648             if (data.readInt32() != 0) {
1649                 args.readFromParcel(data);
1650             }
1651             const uint8_t* entropy = NULL;
1652             size_t entropyLength = 0;
1653             readByteArray(data, &entropy, &entropyLength);
1654             OperationResult result;
1655             begin(token, name, purpose, pruneable, args, entropy, entropyLength, &result);
1656             reply->writeNoException();
1657             reply->writeInt32(1);
1658             result.writeToParcel(reply);
1659 
1660             return NO_ERROR;
1661         }
1662         case UPDATE: {
1663             CHECK_INTERFACE(IKeystoreService, data, reply);
1664             sp<IBinder> token = data.readStrongBinder();
1665             KeymasterArguments args;
1666             if (data.readInt32() != 0) {
1667                 args.readFromParcel(data);
1668             }
1669             const uint8_t* buf = NULL;
1670             size_t bufLength = 0;
1671             readByteArray(data, &buf, &bufLength);
1672             OperationResult result;
1673             update(token, args, buf, bufLength, &result);
1674             reply->writeNoException();
1675             reply->writeInt32(1);
1676             result.writeToParcel(reply);
1677 
1678             return NO_ERROR;
1679         }
1680         case FINISH: {
1681             CHECK_INTERFACE(IKeystoreService, data, reply);
1682             sp<IBinder> token = data.readStrongBinder();
1683             KeymasterArguments args;
1684             if (data.readInt32() != 0) {
1685                 args.readFromParcel(data);
1686             }
1687             const uint8_t* signature = NULL;
1688             size_t signatureLength = 0;
1689             readByteArray(data, &signature, &signatureLength);
1690             const uint8_t* entropy = NULL;
1691             size_t entropyLength = 0;
1692             readByteArray(data, &entropy, &entropyLength);
1693             OperationResult result;
1694             finish(token, args, signature, signatureLength, entropy, entropyLength,  &result);
1695             reply->writeNoException();
1696             reply->writeInt32(1);
1697             result.writeToParcel(reply);
1698 
1699             return NO_ERROR;
1700         }
1701         case ABORT: {
1702             CHECK_INTERFACE(IKeystoreService, data, reply);
1703             sp<IBinder> token = data.readStrongBinder();
1704             int32_t result = abort(token);
1705             reply->writeNoException();
1706             reply->writeInt32(result);
1707 
1708             return NO_ERROR;
1709         }
1710         case IS_OPERATION_AUTHORIZED: {
1711             CHECK_INTERFACE(IKeystoreService, data, reply);
1712             sp<IBinder> token = data.readStrongBinder();
1713             bool result = isOperationAuthorized(token);
1714             reply->writeNoException();
1715             reply->writeInt32(result ? 1 : 0);
1716 
1717             return NO_ERROR;
1718         }
1719         case ADD_AUTH_TOKEN: {
1720             CHECK_INTERFACE(IKeystoreService, data, reply);
1721             const uint8_t* token_bytes = NULL;
1722             size_t size = 0;
1723             readByteArray(data, &token_bytes, &size);
1724             int32_t result = addAuthToken(token_bytes, size);
1725             reply->writeNoException();
1726             reply->writeInt32(result);
1727 
1728             return NO_ERROR;
1729         }
1730         case ON_USER_ADDED: {
1731             CHECK_INTERFACE(IKeystoreService, data, reply);
1732             int32_t userId = data.readInt32();
1733             int32_t parentId = data.readInt32();
1734             int32_t result = onUserAdded(userId, parentId);
1735             reply->writeNoException();
1736             reply->writeInt32(result);
1737 
1738             return NO_ERROR;
1739         }
1740         case ON_USER_REMOVED: {
1741             CHECK_INTERFACE(IKeystoreService, data, reply);
1742             int32_t userId = data.readInt32();
1743             int32_t result = onUserRemoved(userId);
1744             reply->writeNoException();
1745             reply->writeInt32(result);
1746 
1747             return NO_ERROR;
1748         }
1749         default:
1750             return BBinder::onTransact(code, data, reply, flags);
1751     }
1752 }
1753 
1754 // ----------------------------------------------------------------------------
1755 
1756 }; // namespace android
1757