1 /*
2  * Copyright 2020, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "android.hardware.security.keymint-service.remote"
18 
19 #include <android-base/logging.h>
20 #include <android/binder_manager.h>
21 #include <android/binder_process.h>
22 
23 #include <keymaster/android_keymaster_messages.h>
24 #include <keymaster/km_version.h>
25 #include <keymaster/soft_keymaster_logger.h>
26 
27 #include <aidl/android/hardware/security/keymint/SecurityLevel.h>
28 #include <guest/hals/keymint/remote/remote_keymaster.h>
29 #include <guest/hals/keymint/remote/remote_keymint_device.h>
30 #include <guest/hals/keymint/remote/remote_remotely_provisioned_component.h>
31 #include <guest/hals/keymint/remote/remote_secure_clock.h>
32 #include <guest/hals/keymint/remote/remote_shared_secret.h>
33 #include "common/libs/fs/shared_fd.h"
34 #include "common/libs/security/keymaster_channel.h"
35 
36 namespace {
37 
38 const char device[] = "/dev/hvc3";
39 
40 using aidl::android::hardware::security::keymint::RemoteKeyMintDevice;
41 using aidl::android::hardware::security::keymint::
42     RemoteRemotelyProvisionedComponent;
43 using aidl::android::hardware::security::keymint::SecurityLevel;
44 using aidl::android::hardware::security::secureclock::RemoteSecureClock;
45 using aidl::android::hardware::security::sharedsecret::RemoteSharedSecret;
46 using keymaster::GenerateTimestampTokenRequest;
47 using keymaster::GenerateTimestampTokenResponse;
48 
49 template <typename T, class... Args>
addService(Args &&...args)50 std::shared_ptr<T> addService(Args&&... args) {
51   std::shared_ptr<T> ser =
52       ndk::SharedRefBase::make<T>(std::forward<Args>(args)...);
53   auto instanceName = std::string(T::descriptor) + "/default";
54   LOG(INFO) << "adding keymint service instance: " << instanceName;
55   binder_status_t status =
56       AServiceManager_addService(ser->asBinder().get(), instanceName.c_str());
57   CHECK(status == STATUS_OK);
58   return ser;
59 }
60 
getSecurityLevel(::keymaster::RemoteKeymaster & remote_keymaster)61 SecurityLevel getSecurityLevel(::keymaster::RemoteKeymaster& remote_keymaster) {
62   GenerateTimestampTokenRequest request(remote_keymaster.message_version());
63   GenerateTimestampTokenResponse response(remote_keymaster.message_version());
64   remote_keymaster.GenerateTimestampToken(request, &response);
65 
66   if (response.error != STATUS_OK) {
67     LOG(FATAL) << "Error getting timestamp token from remote keymaster: "
68                << response.error;
69   }
70 
71   return static_cast<SecurityLevel>(response.token.security_level);
72 }
73 
74 }  // namespace
75 
main(int,char ** argv)76 int main(int, char** argv) {
77   android::base::InitLogging(argv, android::base::KernelLogger);
78   // Zero threads seems like a useless pool, but below we'll join this thread to
79   // it, increasing the pool size to 1.
80   ABinderProcess_setThreadPoolMaxThreadCount(0);
81   // Add Keymint Service
82   auto fd = cuttlefish::SharedFD::Open(device, O_RDWR);
83   if (!fd->IsOpen()) {
84     LOG(FATAL) << "Could not connect to keymaster: " << fd->StrError();
85   }
86 
87   if (fd->SetTerminalRaw() < 0) {
88     LOG(FATAL) << "Could not make " << device
89                << " a raw terminal: " << fd->StrError();
90   }
91 
92   cuttlefish::SharedFdKeymasterChannel keymasterChannel(fd, fd);
93 
94   keymaster::RemoteKeymaster remote_keymaster(
95       &keymasterChannel, keymaster::MessageVersion(
96                              keymaster::KmVersion::KEYMINT_3, 0 /* km_date */));
97 
98   if (!remote_keymaster.Initialize()) {
99     LOG(FATAL) << "Could not initialize keymaster";
100   }
101 
102   addService<RemoteKeyMintDevice>(remote_keymaster,
103                                   getSecurityLevel(remote_keymaster));
104   addService<RemoteSecureClock>(remote_keymaster);
105   addService<RemoteSharedSecret>(remote_keymaster);
106   addService<RemoteRemotelyProvisionedComponent>(remote_keymaster);
107 
108   ABinderProcess_joinThreadPool();
109   return EXIT_FAILURE;  // should not reach
110 }
111