IKeystoreService.cpp revision 96d6d7868303ad87f1f408c40d3c44bcb39f561e 
1/*
2**
3** Copyright 2008, The Android Open Source Project
4**
5** Licensed under the Apache License, Version 2.0 (the "License");
6** you may not use this file except in compliance with the License.
7** You may obtain a copy of the License at
8**
9**     http://www.apache.org/licenses/LICENSE-2.0
10**
11** Unless required by applicable law or agreed to in writing, software
12** distributed under the License is distributed on an "AS IS" BASIS,
13** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14** See the License for the specific language governing permissions and
15** limitations under the License.
16*/
17
18#include <stdint.h>
19#include <sys/limits.h>
20#include <sys/types.h>
21
22#define LOG_TAG "KeystoreService"
23#include <utils/Log.h>
24
25#include <binder/Parcel.h>
26#include <binder/IPCThreadState.h>
27#include <binder/IServiceManager.h>
28
29#include <keystore/IKeystoreService.h>
30
31namespace android {
32
33const ssize_t MAX_GENERATE_ARGS = 3;
34static keymaster_key_param_t* readParamList(const Parcel& in, size_t* length);
35
36KeystoreArg::KeystoreArg(const void* data, size_t len)
37    : mData(data), mSize(len) {
38}
39
40KeystoreArg::~KeystoreArg() {
41}
42
43const void *KeystoreArg::data() const {
44    return mData;
45}
46
47size_t KeystoreArg::size() const {
48    return mSize;
49}
50
51OperationResult::OperationResult() : resultCode(0), token(), handle(0), inputConsumed(0),
52    data(NULL), dataLength(0) {
53}
54
55OperationResult::~OperationResult() {
56}
57
58void OperationResult::readFromParcel(const Parcel& in) {
59    resultCode = in.readInt32();
60    token = in.readStrongBinder();
61    handle = static_cast<keymaster_operation_handle_t>(in.readInt64());
62    inputConsumed = in.readInt32();
63    ssize_t length = in.readInt32();
64    dataLength = 0;
65    if (length > 0) {
66        const void* buf = in.readInplace(length);
67        if (buf) {
68            data.reset(reinterpret_cast<uint8_t*>(malloc(length)));
69            if (data.get()) {
70                memcpy(data.get(), buf, length);
71                dataLength = (size_t) length;
72            } else {
73                ALOGE("Failed to allocate OperationResult buffer");
74            }
75        } else {
76            ALOGE("Failed to readInplace OperationResult data");
77        }
78    }
79}
80
81void OperationResult::writeToParcel(Parcel* out) const {
82    out->writeInt32(resultCode);
83    out->writeStrongBinder(token);
84    out->writeInt64(handle);
85    out->writeInt32(inputConsumed);
86    out->writeInt32(dataLength);
87    if (dataLength && data) {
88        void* buf = out->writeInplace(dataLength);
89        if (buf) {
90            memcpy(buf, data.get(), dataLength);
91        } else {
92            ALOGE("Failed to writeInplace OperationResult data.");
93        }
94    }
95}
96
97ExportResult::ExportResult() : resultCode(0), exportData(NULL), dataLength(0) {
98}
99
100ExportResult::~ExportResult() {
101}
102
103void ExportResult::readFromParcel(const Parcel& in) {
104    resultCode = in.readInt32();
105    ssize_t length = in.readInt32();
106    dataLength = 0;
107    if (length > 0) {
108        const void* buf = in.readInplace(length);
109        if (buf) {
110            exportData.reset(reinterpret_cast<uint8_t*>(malloc(length)));
111            if (exportData.get()) {
112                memcpy(exportData.get(), buf, length);
113                dataLength = (size_t) length;
114            } else {
115                ALOGE("Failed to allocate ExportData buffer");
116            }
117        } else {
118            ALOGE("Failed to readInplace ExportData data");
119        }
120    }
121}
122
123void ExportResult::writeToParcel(Parcel* out) const {
124    out->writeInt32(resultCode);
125    out->writeInt32(dataLength);
126    if (exportData && dataLength) {
127        void* buf = out->writeInplace(dataLength);
128        if (buf) {
129            memcpy(buf, exportData.get(), dataLength);
130        } else {
131            ALOGE("Failed to writeInplace ExportResult data.");
132        }
133    }
134}
135
136KeymasterArguments::KeymasterArguments() {
137}
138
139KeymasterArguments::~KeymasterArguments() {
140    keymaster_free_param_values(params.data(), params.size());
141}
142
143void KeymasterArguments::readFromParcel(const Parcel& in) {
144    ssize_t length = in.readInt32();
145    size_t ulength = (size_t) length;
146    if (length < 0) {
147        ulength = 0;
148    }
149    keymaster_free_param_values(params.data(), params.size());
150    params.clear();
151    for(size_t i = 0; i < ulength; i++) {
152        keymaster_key_param_t param;
153        if (!readKeymasterArgumentFromParcel(in, &param)) {
154            ALOGE("Error reading keymaster argument from parcel");
155            break;
156        }
157        params.push_back(param);
158    }
159}
160
161void KeymasterArguments::writeToParcel(Parcel* out) const {
162    out->writeInt32(params.size());
163    for (auto param : params) {
164        out->writeInt32(1);
165        writeKeymasterArgumentToParcel(param, out);
166    }
167}
168
169KeyCharacteristics::KeyCharacteristics() {
170    memset((void*) &characteristics, 0, sizeof(characteristics));
171}
172
173KeyCharacteristics::~KeyCharacteristics() {
174    keymaster_free_characteristics(&characteristics);
175}
176
177void KeyCharacteristics::readFromParcel(const Parcel& in) {
178    size_t length = 0;
179    keymaster_key_param_t* params = readParamList(in, &length);
180    characteristics.sw_enforced.params = params;
181    characteristics.sw_enforced.length = length;
182
183    params = readParamList(in, &length);
184    characteristics.hw_enforced.params = params;
185    characteristics.hw_enforced.length = length;
186}
187
188void KeyCharacteristics::writeToParcel(Parcel* out) const {
189    if (characteristics.sw_enforced.params) {
190        out->writeInt32(characteristics.sw_enforced.length);
191        for (size_t i = 0; i < characteristics.sw_enforced.length; i++) {
192            out->writeInt32(1);
193            writeKeymasterArgumentToParcel(characteristics.sw_enforced.params[i], out);
194        }
195    } else {
196        out->writeInt32(0);
197    }
198    if (characteristics.hw_enforced.params) {
199        out->writeInt32(characteristics.hw_enforced.length);
200        for (size_t i = 0; i < characteristics.hw_enforced.length; i++) {
201            out->writeInt32(1);
202            writeKeymasterArgumentToParcel(characteristics.hw_enforced.params[i], out);
203        }
204    } else {
205        out->writeInt32(0);
206    }
207}
208
209void writeKeymasterArgumentToParcel(const keymaster_key_param_t& param, Parcel* out) {
210    switch (keymaster_tag_get_type(param.tag)) {
211        case KM_ENUM:
212        case KM_ENUM_REP: {
213            out->writeInt32(param.tag);
214            out->writeInt32(param.enumerated);
215            break;
216        }
217        case KM_INT:
218        case KM_INT_REP: {
219            out->writeInt32(param.tag);
220            out->writeInt32(param.integer);
221            break;
222        }
223        case KM_LONG:
224        case KM_LONG_REP: {
225            out->writeInt32(param.tag);
226            out->writeInt64(param.long_integer);
227            break;
228        }
229        case KM_DATE: {
230            out->writeInt32(param.tag);
231            out->writeInt64(param.date_time);
232            break;
233        }
234        case KM_BOOL: {
235            out->writeInt32(param.tag);
236            break;
237        }
238        case KM_BIGNUM:
239        case KM_BYTES: {
240            out->writeInt32(param.tag);
241            out->writeInt32(param.blob.data_length);
242            void* buf = out->writeInplace(param.blob.data_length);
243            if (buf) {
244                memcpy(buf, param.blob.data, param.blob.data_length);
245            } else {
246                ALOGE("Failed to writeInplace keymaster blob param");
247            }
248            break;
249        }
250        default: {
251            ALOGE("Failed to write argument: Unsupported keymaster_tag_t %d", param.tag);
252        }
253    }
254}
255
256
257bool readKeymasterArgumentFromParcel(const Parcel& in, keymaster_key_param_t* out) {
258    if (in.readInt32() == 0) {
259        return false;
260    }
261    keymaster_tag_t tag = static_cast<keymaster_tag_t>(in.readInt32());
262    switch (keymaster_tag_get_type(tag)) {
263        case KM_ENUM:
264        case KM_ENUM_REP: {
265            uint32_t value = in.readInt32();
266            *out = keymaster_param_enum(tag, value);
267            break;
268        }
269        case KM_INT:
270        case KM_INT_REP: {
271            uint32_t value = in.readInt32();
272            *out = keymaster_param_int(tag, value);
273            break;
274        }
275        case KM_LONG:
276        case KM_LONG_REP: {
277            uint64_t value = in.readInt64();
278            *out = keymaster_param_long(tag, value);
279            break;
280        }
281        case KM_DATE: {
282            uint64_t value = in.readInt64();
283            *out = keymaster_param_date(tag, value);
284            break;
285        }
286        case KM_BOOL: {
287            *out = keymaster_param_bool(tag);
288            break;
289        }
290        case KM_BIGNUM:
291        case KM_BYTES: {
292            ssize_t length = in.readInt32();
293            uint8_t* data = NULL;
294            size_t ulength = 0;
295            if (length >= 0) {
296                ulength = (size_t) length;
297                // use malloc here so we can use keymaster_free_param_values
298                // consistently.
299                data = reinterpret_cast<uint8_t*>(malloc(ulength));
300                const void* buf = in.readInplace(ulength);
301                if (!buf || !data) {
302                    ALOGE("Failed to allocate buffer for keymaster blob param");
303                    return false;
304                }
305                memcpy(data, buf, ulength);
306            }
307            *out = keymaster_param_blob(tag, data, ulength);
308            break;
309        }
310        default: {
311            ALOGE("Unsupported keymaster_tag_t %d", tag);
312            return false;
313        }
314    }
315    return true;
316}
317
318/**
319 * Read a byte array from in. The data at *data is still owned by the parcel
320 */
321static void readByteArray(const Parcel& in, const uint8_t** data, size_t* length) {
322    ssize_t slength = in.readInt32();
323    if (slength > 0) {
324        *data = reinterpret_cast<const uint8_t*>(in.readInplace(slength));
325        if (*data) {
326            *length = static_cast<size_t>(slength);
327        } else {
328            *length = 0;
329        }
330    } else {
331        *data = NULL;
332        *length = 0;
333    }
334}
335
336// Read a keymaster_key_param_t* from a Parcel for use in a
337// keymaster_key_characteristics_t. This will be free'd by calling
338// keymaster_free_key_characteristics.
339static keymaster_key_param_t* readParamList(const Parcel& in, size_t* length) {
340    ssize_t slength = in.readInt32();
341    *length = 0;
342    if (slength < 0) {
343        return NULL;
344    }
345    *length = (size_t) slength;
346    if (*length >= UINT_MAX / sizeof(keymaster_key_param_t)) {
347        return NULL;
348    }
349    keymaster_key_param_t* list =
350            reinterpret_cast<keymaster_key_param_t*>(malloc(*length *
351                                                            sizeof(keymaster_key_param_t)));
352    if (!list) {
353        ALOGD("Failed to allocate buffer for generateKey outCharacteristics");
354        goto err;
355    }
356    for (size_t i = 0; i < *length ; i++) {
357        if (!readKeymasterArgumentFromParcel(in, &list[i])) {
358            ALOGE("Failed to read keymaster argument");
359            keymaster_free_param_values(list, i);
360            goto err;
361        }
362    }
363    return list;
364err:
365    free(list);
366    return NULL;
367}
368
369static std::unique_ptr<keymaster_blob_t> readKeymasterBlob(const Parcel& in) {
370    std::unique_ptr<keymaster_blob_t> blob;
371    if (in.readInt32() != 1) {
372        blob.reset(NULL);
373        return blob;
374    }
375    ssize_t length = in.readInt32();
376    blob.reset(new keymaster_blob_t);
377    if (length > 0) {
378        blob->data = reinterpret_cast<const uint8_t*>(in.readInplace(length));
379        if (blob->data) {
380            blob->data_length = static_cast<size_t>(length);
381        } else {
382            blob->data_length = 0;
383        }
384    } else {
385        blob->data = NULL;
386        blob->data_length = 0;
387    }
388    return blob;
389}
390
391class BpKeystoreService: public BpInterface<IKeystoreService>
392{
393public:
394    BpKeystoreService(const sp<IBinder>& impl)
395        : BpInterface<IKeystoreService>(impl)
396    {
397    }
398
399    // test ping
400    virtual int32_t test()
401    {
402        Parcel data, reply;
403        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
404        status_t status = remote()->transact(BnKeystoreService::TEST, data, &reply);
405        if (status != NO_ERROR) {
406            ALOGD("test() could not contact remote: %d\n", status);
407            return -1;
408        }
409        int32_t err = reply.readExceptionCode();
410        int32_t ret = reply.readInt32();
411        if (err < 0) {
412            ALOGD("test() caught exception %d\n", err);
413            return -1;
414        }
415        return ret;
416    }
417
418    virtual int32_t get(const String16& name, uint8_t** item, size_t* itemLength)
419    {
420        Parcel data, reply;
421        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
422        data.writeString16(name);
423        status_t status = remote()->transact(BnKeystoreService::GET, data, &reply);
424        if (status != NO_ERROR) {
425            ALOGD("get() could not contact remote: %d\n", status);
426            return -1;
427        }
428        int32_t err = reply.readExceptionCode();
429        ssize_t len = reply.readInt32();
430        if (len >= 0 && (size_t) len <= reply.dataAvail()) {
431            size_t ulen = (size_t) len;
432            const void* buf = reply.readInplace(ulen);
433            *item = (uint8_t*) malloc(ulen);
434            if (*item != NULL) {
435                memcpy(*item, buf, ulen);
436                *itemLength = ulen;
437            } else {
438                ALOGE("out of memory allocating output array in get");
439                *itemLength = 0;
440            }
441        } else {
442            *itemLength = 0;
443        }
444        if (err < 0) {
445            ALOGD("get() caught exception %d\n", err);
446            return -1;
447        }
448        return 0;
449    }
450
451    virtual int32_t insert(const String16& name, const uint8_t* item, size_t itemLength, int uid,
452            int32_t flags)
453    {
454        Parcel data, reply;
455        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
456        data.writeString16(name);
457        data.writeInt32(itemLength);
458        void* buf = data.writeInplace(itemLength);
459        memcpy(buf, item, itemLength);
460        data.writeInt32(uid);
461        data.writeInt32(flags);
462        status_t status = remote()->transact(BnKeystoreService::INSERT, data, &reply);
463        if (status != NO_ERROR) {
464            ALOGD("import() could not contact remote: %d\n", status);
465            return -1;
466        }
467        int32_t err = reply.readExceptionCode();
468        int32_t ret = reply.readInt32();
469        if (err < 0) {
470            ALOGD("import() caught exception %d\n", err);
471            return -1;
472        }
473        return ret;
474    }
475
476    virtual int32_t del(const String16& name, int uid)
477    {
478        Parcel data, reply;
479        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
480        data.writeString16(name);
481        data.writeInt32(uid);
482        status_t status = remote()->transact(BnKeystoreService::DEL, data, &reply);
483        if (status != NO_ERROR) {
484            ALOGD("del() could not contact remote: %d\n", status);
485            return -1;
486        }
487        int32_t err = reply.readExceptionCode();
488        int32_t ret = reply.readInt32();
489        if (err < 0) {
490            ALOGD("del() caught exception %d\n", err);
491            return -1;
492        }
493        return ret;
494    }
495
496    virtual int32_t exist(const String16& name, int uid)
497    {
498        Parcel data, reply;
499        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
500        data.writeString16(name);
501        data.writeInt32(uid);
502        status_t status = remote()->transact(BnKeystoreService::EXIST, data, &reply);
503        if (status != NO_ERROR) {
504            ALOGD("exist() could not contact remote: %d\n", status);
505            return -1;
506        }
507        int32_t err = reply.readExceptionCode();
508        int32_t ret = reply.readInt32();
509        if (err < 0) {
510            ALOGD("exist() caught exception %d\n", err);
511            return -1;
512        }
513        return ret;
514    }
515
516    virtual int32_t saw(const String16& name, int uid, Vector<String16>* matches)
517    {
518        Parcel data, reply;
519        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
520        data.writeString16(name);
521        data.writeInt32(uid);
522        status_t status = remote()->transact(BnKeystoreService::SAW, data, &reply);
523        if (status != NO_ERROR) {
524            ALOGD("saw() could not contact remote: %d\n", status);
525            return -1;
526        }
527        int32_t err = reply.readExceptionCode();
528        int32_t numMatches = reply.readInt32();
529        for (int32_t i = 0; i < numMatches; i++) {
530            matches->push(reply.readString16());
531        }
532        int32_t ret = reply.readInt32();
533        if (err < 0) {
534            ALOGD("saw() caught exception %d\n", err);
535            return -1;
536        }
537        return ret;
538    }
539
540    virtual int32_t reset()
541    {
542        Parcel data, reply;
543        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
544        status_t status = remote()->transact(BnKeystoreService::RESET, data, &reply);
545        if (status != NO_ERROR) {
546            ALOGD("reset() could not contact remote: %d\n", status);
547            return -1;
548        }
549        int32_t err = reply.readExceptionCode();
550        int32_t ret = reply.readInt32();
551        if (err < 0) {
552            ALOGD("reset() caught exception %d\n", err);
553            return -1;
554        }
555        return ret;
556    }
557
558    virtual int32_t onUserPasswordChanged(int32_t userId, const String16& password)
559    {
560        Parcel data, reply;
561        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
562        data.writeInt32(userId);
563        data.writeString16(password);
564        status_t status = remote()->transact(BnKeystoreService::ON_USER_PASSWORD_CHANGED, data,
565                                             &reply);
566        if (status != NO_ERROR) {
567            ALOGD("onUserPasswordChanged() could not contact remote: %d\n", status);
568            return -1;
569        }
570        int32_t err = reply.readExceptionCode();
571        int32_t ret = reply.readInt32();
572        if (err < 0) {
573            ALOGD("onUserPasswordChanged() caught exception %d\n", err);
574            return -1;
575        }
576        return ret;
577    }
578
579    virtual int32_t lock()
580    {
581        Parcel data, reply;
582        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
583        status_t status = remote()->transact(BnKeystoreService::LOCK, data, &reply);
584        if (status != NO_ERROR) {
585            ALOGD("lock() could not contact remote: %d\n", status);
586            return -1;
587        }
588        int32_t err = reply.readExceptionCode();
589        int32_t ret = reply.readInt32();
590        if (err < 0) {
591            ALOGD("lock() caught exception %d\n", err);
592            return -1;
593        }
594        return ret;
595    }
596
597    virtual int32_t unlock(int32_t userId, const String16& password)
598    {
599        Parcel data, reply;
600        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
601        data.writeInt32(userId);
602        data.writeString16(password);
603        status_t status = remote()->transact(BnKeystoreService::UNLOCK, data, &reply);
604        if (status != NO_ERROR) {
605            ALOGD("unlock() could not contact remote: %d\n", status);
606            return -1;
607        }
608        int32_t err = reply.readExceptionCode();
609        int32_t ret = reply.readInt32();
610        if (err < 0) {
611            ALOGD("unlock() caught exception %d\n", err);
612            return -1;
613        }
614        return ret;
615    }
616
617    virtual int32_t zero()
618    {
619        Parcel data, reply;
620        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
621        status_t status = remote()->transact(BnKeystoreService::ZERO, data, &reply);
622        if (status != NO_ERROR) {
623            ALOGD("zero() could not contact remote: %d\n", status);
624            return -1;
625        }
626        int32_t err = reply.readExceptionCode();
627        int32_t ret = reply.readInt32();
628        if (err < 0) {
629            ALOGD("zero() caught exception %d\n", err);
630            return -1;
631        }
632        return ret;
633    }
634
635    virtual int32_t generate(const String16& name, int32_t uid, int32_t keyType, int32_t keySize,
636            int32_t flags, Vector<sp<KeystoreArg> >* args)
637    {
638        Parcel data, reply;
639        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
640        data.writeString16(name);
641        data.writeInt32(uid);
642        data.writeInt32(keyType);
643        data.writeInt32(keySize);
644        data.writeInt32(flags);
645        data.writeInt32(1);
646        data.writeInt32(args->size());
647        for (Vector<sp<KeystoreArg> >::iterator it = args->begin(); it != args->end(); ++it) {
648            sp<KeystoreArg> item = *it;
649            size_t keyLength = item->size();
650            data.writeInt32(keyLength);
651            void* buf = data.writeInplace(keyLength);
652            memcpy(buf, item->data(), keyLength);
653        }
654        status_t status = remote()->transact(BnKeystoreService::GENERATE, data, &reply);
655        if (status != NO_ERROR) {
656            ALOGD("generate() could not contact remote: %d\n", status);
657            return -1;
658        }
659        int32_t err = reply.readExceptionCode();
660        int32_t ret = reply.readInt32();
661        if (err < 0) {
662            ALOGD("generate() caught exception %d\n", err);
663            return -1;
664        }
665        return ret;
666    }
667
668    virtual int32_t import(const String16& name, const uint8_t* key, size_t keyLength, int uid,
669            int flags)
670    {
671        Parcel data, reply;
672        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
673        data.writeString16(name);
674        data.writeInt32(keyLength);
675        void* buf = data.writeInplace(keyLength);
676        memcpy(buf, key, keyLength);
677        data.writeInt32(uid);
678        data.writeInt32(flags);
679        status_t status = remote()->transact(BnKeystoreService::IMPORT, data, &reply);
680        if (status != NO_ERROR) {
681            ALOGD("import() could not contact remote: %d\n", status);
682            return -1;
683        }
684        int32_t err = reply.readExceptionCode();
685        int32_t ret = reply.readInt32();
686        if (err < 0) {
687            ALOGD("import() caught exception %d\n", err);
688            return -1;
689        }
690        return ret;
691    }
692
693    virtual int32_t sign(const String16& name, const uint8_t* in, size_t inLength, uint8_t** out,
694            size_t* outLength)
695    {
696        Parcel data, reply;
697        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
698        data.writeString16(name);
699        data.writeInt32(inLength);
700        void* buf = data.writeInplace(inLength);
701        memcpy(buf, in, inLength);
702        status_t status = remote()->transact(BnKeystoreService::SIGN, data, &reply);
703        if (status != NO_ERROR) {
704            ALOGD("import() could not contact remote: %d\n", status);
705            return -1;
706        }
707        int32_t err = reply.readExceptionCode();
708        ssize_t len = reply.readInt32();
709        if (len >= 0 && (size_t) len <= reply.dataAvail()) {
710            size_t ulen = (size_t) len;
711            const void* outBuf = reply.readInplace(ulen);
712            *out = (uint8_t*) malloc(ulen);
713            if (*out != NULL) {
714                memcpy((void*) *out, outBuf, ulen);
715                *outLength = ulen;
716            } else {
717                ALOGE("out of memory allocating output array in sign");
718                *outLength = 0;
719            }
720        } else {
721            *outLength = 0;
722        }
723        if (err < 0) {
724            ALOGD("import() caught exception %d\n", err);
725            return -1;
726        }
727        return 0;
728    }
729
730    virtual int32_t verify(const String16& name, const uint8_t* in, size_t inLength,
731            const uint8_t* signature, size_t signatureLength)
732    {
733        Parcel data, reply;
734        void* buf;
735
736        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
737        data.writeString16(name);
738        data.writeInt32(inLength);
739        buf = data.writeInplace(inLength);
740        memcpy(buf, in, inLength);
741        data.writeInt32(signatureLength);
742        buf = data.writeInplace(signatureLength);
743        memcpy(buf, signature, signatureLength);
744        status_t status = remote()->transact(BnKeystoreService::VERIFY, data, &reply);
745        if (status != NO_ERROR) {
746            ALOGD("verify() could not contact remote: %d\n", status);
747            return -1;
748        }
749        int32_t err = reply.readExceptionCode();
750        int32_t ret = reply.readInt32();
751        if (err < 0) {
752            ALOGD("verify() caught exception %d\n", err);
753            return -1;
754        }
755        return ret;
756    }
757
758    virtual int32_t get_pubkey(const String16& name, uint8_t** pubkey, size_t* pubkeyLength)
759    {
760        Parcel data, reply;
761        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
762        data.writeString16(name);
763        status_t status = remote()->transact(BnKeystoreService::GET_PUBKEY, data, &reply);
764        if (status != NO_ERROR) {
765            ALOGD("get_pubkey() could not contact remote: %d\n", status);
766            return -1;
767        }
768        int32_t err = reply.readExceptionCode();
769        ssize_t len = reply.readInt32();
770        if (len >= 0 && (size_t) len <= reply.dataAvail()) {
771            size_t ulen = (size_t) len;
772            const void* buf = reply.readInplace(ulen);
773            *pubkey = (uint8_t*) malloc(ulen);
774            if (*pubkey != NULL) {
775                memcpy(*pubkey, buf, ulen);
776                *pubkeyLength = ulen;
777            } else {
778                ALOGE("out of memory allocating output array in get_pubkey");
779                *pubkeyLength = 0;
780            }
781        } else {
782            *pubkeyLength = 0;
783        }
784        if (err < 0) {
785            ALOGD("get_pubkey() caught exception %d\n", err);
786            return -1;
787        }
788        return 0;
789     }
790
791    virtual int32_t del_key(const String16& name, int uid)
792    {
793        Parcel data, reply;
794        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
795        data.writeString16(name);
796        data.writeInt32(uid);
797        status_t status = remote()->transact(BnKeystoreService::DEL_KEY, data, &reply);
798        if (status != NO_ERROR) {
799            ALOGD("del_key() could not contact remote: %d\n", status);
800            return -1;
801        }
802        int32_t err = reply.readExceptionCode();
803        int32_t ret = reply.readInt32();
804        if (err < 0) {
805            ALOGD("del_key() caught exception %d\n", err);
806            return -1;
807        }
808        return ret;
809    }
810
811    virtual int32_t grant(const String16& name, int32_t granteeUid)
812    {
813        Parcel data, reply;
814        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
815        data.writeString16(name);
816        data.writeInt32(granteeUid);
817        status_t status = remote()->transact(BnKeystoreService::GRANT, data, &reply);
818        if (status != NO_ERROR) {
819            ALOGD("grant() could not contact remote: %d\n", status);
820            return -1;
821        }
822        int32_t err = reply.readExceptionCode();
823        int32_t ret = reply.readInt32();
824        if (err < 0) {
825            ALOGD("grant() caught exception %d\n", err);
826            return -1;
827        }
828        return ret;
829    }
830
831    virtual int32_t ungrant(const String16& name, int32_t granteeUid)
832    {
833        Parcel data, reply;
834        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
835        data.writeString16(name);
836        data.writeInt32(granteeUid);
837        status_t status = remote()->transact(BnKeystoreService::UNGRANT, data, &reply);
838        if (status != NO_ERROR) {
839            ALOGD("ungrant() could not contact remote: %d\n", status);
840            return -1;
841        }
842        int32_t err = reply.readExceptionCode();
843        int32_t ret = reply.readInt32();
844        if (err < 0) {
845            ALOGD("ungrant() caught exception %d\n", err);
846            return -1;
847        }
848        return ret;
849    }
850
851    int64_t getmtime(const String16& name)
852    {
853        Parcel data, reply;
854        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
855        data.writeString16(name);
856        status_t status = remote()->transact(BnKeystoreService::GETMTIME, data, &reply);
857        if (status != NO_ERROR) {
858            ALOGD("getmtime() could not contact remote: %d\n", status);
859            return -1;
860        }
861        int32_t err = reply.readExceptionCode();
862        int64_t ret = reply.readInt64();
863        if (err < 0) {
864            ALOGD("getmtime() caught exception %d\n", err);
865            return -1;
866        }
867        return ret;
868    }
869
870    virtual int32_t duplicate(const String16& srcKey, int32_t srcUid, const String16& destKey,
871            int32_t destUid)
872    {
873        Parcel data, reply;
874        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
875        data.writeString16(srcKey);
876        data.writeInt32(srcUid);
877        data.writeString16(destKey);
878        data.writeInt32(destUid);
879        status_t status = remote()->transact(BnKeystoreService::DUPLICATE, data, &reply);
880        if (status != NO_ERROR) {
881            ALOGD("duplicate() could not contact remote: %d\n", status);
882            return -1;
883        }
884        int32_t err = reply.readExceptionCode();
885        int32_t ret = reply.readInt32();
886        if (err < 0) {
887            ALOGD("duplicate() caught exception %d\n", err);
888            return -1;
889        }
890        return ret;
891    }
892
893    virtual int32_t is_hardware_backed(const String16& keyType)
894    {
895        Parcel data, reply;
896        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
897        data.writeString16(keyType);
898        status_t status = remote()->transact(BnKeystoreService::IS_HARDWARE_BACKED, data, &reply);
899        if (status != NO_ERROR) {
900            ALOGD("is_hardware_backed() could not contact remote: %d\n", status);
901            return -1;
902        }
903        int32_t err = reply.readExceptionCode();
904        int32_t ret = reply.readInt32();
905        if (err < 0) {
906            ALOGD("is_hardware_backed() caught exception %d\n", err);
907            return -1;
908        }
909        return ret;
910    }
911
912    virtual int32_t clear_uid(int64_t uid)
913    {
914        Parcel data, reply;
915        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
916        data.writeInt64(uid);
917        status_t status = remote()->transact(BnKeystoreService::CLEAR_UID, data, &reply);
918        if (status != NO_ERROR) {
919            ALOGD("clear_uid() could not contact remote: %d\n", status);
920            return -1;
921        }
922        int32_t err = reply.readExceptionCode();
923        int32_t ret = reply.readInt32();
924        if (err < 0) {
925            ALOGD("clear_uid() caught exception %d\n", err);
926            return -1;
927        }
928        return ret;
929    }
930
931    virtual int32_t reset_uid(int32_t uid) {
932        Parcel data, reply;
933        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
934        data.writeInt32(uid);
935        status_t status = remote()->transact(BnKeystoreService::RESET_UID, data, &reply);
936        if (status != NO_ERROR) {
937            ALOGD("reset_uid() could not contact remote: %d\n", status);
938            return -1;
939        }
940        int32_t err = reply.readExceptionCode();
941        int32_t ret = reply.readInt32();
942        if (err < 0) {
943            ALOGD("reset_uid() caught exception %d\n", err);
944            return -1;
945        }
946        return ret;
947
948    }
949
950    virtual int32_t sync_uid(int32_t sourceUid, int32_t targetUid)
951    {
952        Parcel data, reply;
953        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
954        data.writeInt32(sourceUid);
955        data.writeInt32(targetUid);
956        status_t status = remote()->transact(BnKeystoreService::SYNC_UID, data, &reply);
957        if (status != NO_ERROR) {
958            ALOGD("sync_uid() could not contact remote: %d\n", status);
959            return -1;
960        }
961        int32_t err = reply.readExceptionCode();
962        int32_t ret = reply.readInt32();
963        if (err < 0) {
964            ALOGD("sync_uid() caught exception %d\n", err);
965            return -1;
966        }
967        return ret;
968    }
969
970    virtual int32_t password_uid(const String16& password, int32_t uid)
971    {
972        Parcel data, reply;
973        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
974        data.writeString16(password);
975        data.writeInt32(uid);
976        status_t status = remote()->transact(BnKeystoreService::PASSWORD_UID, data, &reply);
977        if (status != NO_ERROR) {
978            ALOGD("password_uid() could not contact remote: %d\n", status);
979            return -1;
980        }
981        int32_t err = reply.readExceptionCode();
982        int32_t ret = reply.readInt32();
983        if (err < 0) {
984            ALOGD("password_uid() caught exception %d\n", err);
985            return -1;
986        }
987        return ret;
988    }
989    virtual int32_t addRngEntropy(const uint8_t* buf, size_t bufLength)
990    {
991        Parcel data, reply;
992        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
993        data.writeByteArray(bufLength, buf);
994        status_t status = remote()->transact(BnKeystoreService::ADD_RNG_ENTROPY, data, &reply);
995        if (status != NO_ERROR) {
996            ALOGD("addRngEntropy() could not contact remote: %d\n", status);
997            return -1;
998        }
999        int32_t err = reply.readExceptionCode();
1000        int32_t ret = reply.readInt32();
1001        if (err < 0) {
1002            ALOGD("addRngEntropy() caught exception %d\n", err);
1003            return -1;
1004        }
1005        return ret;
1006    };
1007
1008    virtual int32_t generateKey(const String16& name, const KeymasterArguments& params,
1009                                const uint8_t* entropy, size_t entropyLength, int uid, int flags,
1010                                KeyCharacteristics* outCharacteristics)
1011    {
1012        Parcel data, reply;
1013        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1014        data.writeString16(name);
1015        data.writeInt32(1);
1016        params.writeToParcel(&data);
1017        data.writeByteArray(entropyLength, entropy);
1018        data.writeInt32(uid);
1019        data.writeInt32(flags);
1020        status_t status = remote()->transact(BnKeystoreService::GENERATE_KEY, data, &reply);
1021        if (status != NO_ERROR) {
1022            ALOGD("generateKey() could not contact remote: %d\n", status);
1023            return KM_ERROR_UNKNOWN_ERROR;
1024        }
1025        int32_t err = reply.readExceptionCode();
1026        int32_t ret = reply.readInt32();
1027        if (err < 0) {
1028            ALOGD("generateKey() caught exception %d\n", err);
1029            return KM_ERROR_UNKNOWN_ERROR;
1030        }
1031        if (reply.readInt32() != 0 && outCharacteristics) {
1032            outCharacteristics->readFromParcel(reply);
1033        }
1034        return ret;
1035    }
1036    virtual int32_t getKeyCharacteristics(const String16& name,
1037                                          const keymaster_blob_t* clientId,
1038                                          const keymaster_blob_t* appData,
1039                                          KeyCharacteristics* outCharacteristics)
1040    {
1041        Parcel data, reply;
1042        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1043        data.writeString16(name);
1044        if (clientId) {
1045            data.writeByteArray(clientId->data_length, clientId->data);
1046        } else {
1047            data.writeInt32(-1);
1048        }
1049        if (appData) {
1050            data.writeByteArray(appData->data_length, appData->data);
1051        } else {
1052            data.writeInt32(-1);
1053        }
1054        status_t status = remote()->transact(BnKeystoreService::GET_KEY_CHARACTERISTICS,
1055                                             data, &reply);
1056        if (status != NO_ERROR) {
1057            ALOGD("getKeyCharacteristics() could not contact remote: %d\n", status);
1058            return KM_ERROR_UNKNOWN_ERROR;
1059        }
1060        int32_t err = reply.readExceptionCode();
1061        int32_t ret = reply.readInt32();
1062        if (err < 0) {
1063            ALOGD("getKeyCharacteristics() caught exception %d\n", err);
1064            return KM_ERROR_UNKNOWN_ERROR;
1065        }
1066        if (reply.readInt32() != 0 && outCharacteristics) {
1067            outCharacteristics->readFromParcel(reply);
1068        }
1069        return ret;
1070    }
1071    virtual int32_t importKey(const String16& name, const KeymasterArguments&  params,
1072                              keymaster_key_format_t format, const uint8_t *keyData,
1073                              size_t keyLength, int uid, int flags,
1074                              KeyCharacteristics* outCharacteristics)
1075    {
1076        Parcel data, reply;
1077        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1078        data.writeString16(name);
1079        data.writeInt32(1);
1080        params.writeToParcel(&data);
1081        data.writeInt32(format);
1082        data.writeByteArray(keyLength, keyData);
1083        data.writeInt32(uid);
1084        data.writeInt32(flags);
1085        status_t status = remote()->transact(BnKeystoreService::IMPORT_KEY, data, &reply);
1086        if (status != NO_ERROR) {
1087            ALOGD("importKey() could not contact remote: %d\n", status);
1088            return KM_ERROR_UNKNOWN_ERROR;
1089        }
1090        int32_t err = reply.readExceptionCode();
1091        int32_t ret = reply.readInt32();
1092        if (err < 0) {
1093            ALOGD("importKey() caught exception %d\n", err);
1094            return KM_ERROR_UNKNOWN_ERROR;
1095        }
1096        if (reply.readInt32() != 0 && outCharacteristics) {
1097            outCharacteristics->readFromParcel(reply);
1098        }
1099        return ret;
1100    }
1101
1102    virtual void exportKey(const String16& name, keymaster_key_format_t format,
1103                           const keymaster_blob_t* clientId,
1104                           const keymaster_blob_t* appData, ExportResult* result)
1105    {
1106        if (!result) {
1107            return;
1108        }
1109
1110        Parcel data, reply;
1111        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1112        data.writeString16(name);
1113        data.writeInt32(format);
1114        if (clientId) {
1115            data.writeByteArray(clientId->data_length, clientId->data);
1116        } else {
1117            data.writeInt32(-1);
1118        }
1119        if (appData) {
1120            data.writeByteArray(appData->data_length, appData->data);
1121        } else {
1122            data.writeInt32(-1);
1123        }
1124        status_t status = remote()->transact(BnKeystoreService::EXPORT_KEY, data, &reply);
1125        if (status != NO_ERROR) {
1126            ALOGD("exportKey() could not contact remote: %d\n", status);
1127            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1128            return;
1129        }
1130        int32_t err = reply.readExceptionCode();
1131        if (err < 0) {
1132            ALOGD("exportKey() caught exception %d\n", err);
1133            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1134            return;
1135        }
1136        if (reply.readInt32() != 0) {
1137            result->readFromParcel(reply);
1138        }
1139    }
1140
1141    virtual void begin(const sp<IBinder>& appToken, const String16& name,
1142                       keymaster_purpose_t purpose, bool pruneable,
1143                       const KeymasterArguments& params, const uint8_t* entropy,
1144                       size_t entropyLength, KeymasterArguments* outParams,
1145                       OperationResult* result)
1146    {
1147        if (!result || !outParams) {
1148            return;
1149        }
1150        Parcel data, reply;
1151        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1152        data.writeStrongBinder(appToken);
1153        data.writeString16(name);
1154        data.writeInt32(purpose);
1155        data.writeInt32(pruneable ? 1 : 0);
1156        data.writeInt32(1);
1157        params.writeToParcel(&data);
1158        data.writeByteArray(entropyLength, entropy);
1159        status_t status = remote()->transact(BnKeystoreService::BEGIN, data, &reply);
1160        if (status != NO_ERROR) {
1161            ALOGD("begin() could not contact remote: %d\n", status);
1162            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1163            return;
1164        }
1165        int32_t err = reply.readExceptionCode();
1166        if (err < 0) {
1167            ALOGD("begin() caught exception %d\n", err);
1168            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1169            return;
1170        }
1171        if (reply.readInt32() != 0) {
1172            result->readFromParcel(reply);
1173        }
1174        if (reply.readInt32() != 0) {
1175            outParams->readFromParcel(reply);
1176        }
1177    }
1178
1179    virtual void update(const sp<IBinder>& token, const KeymasterArguments& params,
1180                        const uint8_t* opData, size_t dataLength, OperationResult* result)
1181    {
1182        if (!result) {
1183            return;
1184        }
1185        Parcel data, reply;
1186        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1187        data.writeStrongBinder(token);
1188        data.writeInt32(1);
1189        params.writeToParcel(&data);
1190        data.writeByteArray(dataLength, opData);
1191        status_t status = remote()->transact(BnKeystoreService::UPDATE, data, &reply);
1192        if (status != NO_ERROR) {
1193            ALOGD("update() could not contact remote: %d\n", status);
1194            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1195            return;
1196        }
1197        int32_t err = reply.readExceptionCode();
1198        if (err < 0) {
1199            ALOGD("update() caught exception %d\n", err);
1200            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1201            return;
1202        }
1203        if (reply.readInt32() != 0) {
1204            result->readFromParcel(reply);
1205        }
1206    }
1207
1208    virtual void finish(const sp<IBinder>& token, const KeymasterArguments& params,
1209                        const uint8_t* signature, size_t signatureLength, OperationResult* result)
1210    {
1211        if (!result) {
1212            return;
1213        }
1214        Parcel data, reply;
1215        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1216        data.writeStrongBinder(token);
1217        data.writeInt32(1);
1218        params.writeToParcel(&data);
1219        data.writeByteArray(signatureLength, signature);
1220        status_t status = remote()->transact(BnKeystoreService::FINISH, data, &reply);
1221        if (status != NO_ERROR) {
1222            ALOGD("finish() could not contact remote: %d\n", status);
1223            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1224            return;
1225        }
1226        int32_t err = reply.readExceptionCode();
1227        if (err < 0) {
1228            ALOGD("finish() caught exception %d\n", err);
1229            result->resultCode = KM_ERROR_UNKNOWN_ERROR;
1230            return;
1231        }
1232        if (reply.readInt32() != 0) {
1233            result->readFromParcel(reply);
1234        }
1235    }
1236
1237    virtual int32_t abort(const sp<IBinder>& token)
1238    {
1239        Parcel data, reply;
1240        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1241        data.writeStrongBinder(token);
1242        status_t status = remote()->transact(BnKeystoreService::ABORT, data, &reply);
1243        if (status != NO_ERROR) {
1244            ALOGD("abort() could not contact remote: %d\n", status);
1245            return KM_ERROR_UNKNOWN_ERROR;
1246        }
1247        int32_t err = reply.readExceptionCode();
1248        int32_t ret = reply.readInt32();
1249        if (err < 0) {
1250            ALOGD("abort() caught exception %d\n", err);
1251            return KM_ERROR_UNKNOWN_ERROR;
1252        }
1253        return ret;
1254    }
1255
1256    virtual bool isOperationAuthorized(const sp<IBinder>& token)
1257    {
1258        Parcel data, reply;
1259        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1260        data.writeStrongBinder(token);
1261        status_t status = remote()->transact(BnKeystoreService::IS_OPERATION_AUTHORIZED, data,
1262                                             &reply);
1263        if (status != NO_ERROR) {
1264            ALOGD("isOperationAuthorized() could not contact remote: %d\n", status);
1265            return false;
1266        }
1267        int32_t err = reply.readExceptionCode();
1268        int32_t ret = reply.readInt32();
1269        if (err < 0) {
1270            ALOGD("isOperationAuthorized() caught exception %d\n", err);
1271            return false;
1272        }
1273        return ret == 1;
1274    }
1275
1276    virtual int32_t addAuthToken(const uint8_t* token, size_t length)
1277    {
1278        Parcel data, reply;
1279        data.writeInterfaceToken(IKeystoreService::getInterfaceDescriptor());
1280        data.writeByteArray(length, token);
1281        status_t status = remote()->transact(BnKeystoreService::ADD_AUTH_TOKEN, data, &reply);
1282        if (status != NO_ERROR) {
1283            ALOGD("addAuthToken() could not contact remote: %d\n", status);
1284            return -1;
1285        }
1286        int32_t err = reply.readExceptionCode();
1287        int32_t ret = reply.readInt32();
1288        if (err < 0) {
1289            ALOGD("addAuthToken() caught exception %d\n", err);
1290            return -1;
1291        }
1292        return ret;
1293    };
1294};
1295
1296IMPLEMENT_META_INTERFACE(KeystoreService, "android.security.IKeystoreService");
1297
1298// ----------------------------------------------------------------------
1299
1300status_t BnKeystoreService::onTransact(
1301    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
1302{
1303    switch(code) {
1304        case TEST: {
1305            CHECK_INTERFACE(IKeystoreService, data, reply);
1306            int32_t ret = test();
1307            reply->writeNoException();
1308            reply->writeInt32(ret);
1309            return NO_ERROR;
1310        } break;
1311        case GET: {
1312            CHECK_INTERFACE(IKeystoreService, data, reply);
1313            String16 name = data.readString16();
1314            void* out = NULL;
1315            size_t outSize = 0;
1316            int32_t ret = get(name, (uint8_t**) &out, &outSize);
1317            reply->writeNoException();
1318            if (ret == 1) {
1319                reply->writeInt32(outSize);
1320                void* buf = reply->writeInplace(outSize);
1321                memcpy(buf, out, outSize);
1322                free(out);
1323            } else {
1324                reply->writeInt32(-1);
1325            }
1326            return NO_ERROR;
1327        } break;
1328        case INSERT: {
1329            CHECK_INTERFACE(IKeystoreService, data, reply);
1330            String16 name = data.readString16();
1331            ssize_t inSize = data.readInt32();
1332            const void* in;
1333            if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1334                in = data.readInplace(inSize);
1335            } else {
1336                in = NULL;
1337                inSize = 0;
1338            }
1339            int uid = data.readInt32();
1340            int32_t flags = data.readInt32();
1341            int32_t ret = insert(name, (const uint8_t*) in, (size_t) inSize, uid, flags);
1342            reply->writeNoException();
1343            reply->writeInt32(ret);
1344            return NO_ERROR;
1345        } break;
1346        case DEL: {
1347            CHECK_INTERFACE(IKeystoreService, data, reply);
1348            String16 name = data.readString16();
1349            int uid = data.readInt32();
1350            int32_t ret = del(name, uid);
1351            reply->writeNoException();
1352            reply->writeInt32(ret);
1353            return NO_ERROR;
1354        } break;
1355        case EXIST: {
1356            CHECK_INTERFACE(IKeystoreService, data, reply);
1357            String16 name = data.readString16();
1358            int uid = data.readInt32();
1359            int32_t ret = exist(name, uid);
1360            reply->writeNoException();
1361            reply->writeInt32(ret);
1362            return NO_ERROR;
1363        } break;
1364        case SAW: {
1365            CHECK_INTERFACE(IKeystoreService, data, reply);
1366            String16 name = data.readString16();
1367            int uid = data.readInt32();
1368            Vector<String16> matches;
1369            int32_t ret = saw(name, uid, &matches);
1370            reply->writeNoException();
1371            reply->writeInt32(matches.size());
1372            Vector<String16>::const_iterator it = matches.begin();
1373            for (; it != matches.end(); ++it) {
1374                reply->writeString16(*it);
1375            }
1376            reply->writeInt32(ret);
1377            return NO_ERROR;
1378        } break;
1379        case RESET: {
1380            CHECK_INTERFACE(IKeystoreService, data, reply);
1381            int32_t ret = reset();
1382            reply->writeNoException();
1383            reply->writeInt32(ret);
1384            return NO_ERROR;
1385        } break;
1386        case ON_USER_PASSWORD_CHANGED: {
1387            CHECK_INTERFACE(IKeystoreService, data, reply);
1388            int32_t userId = data.readInt32();
1389            String16 pass = data.readString16();
1390            int32_t ret = onUserPasswordChanged(userId, pass);
1391            reply->writeNoException();
1392            reply->writeInt32(ret);
1393            return NO_ERROR;
1394        } break;
1395        case LOCK: {
1396            CHECK_INTERFACE(IKeystoreService, data, reply);
1397            int32_t ret = lock();
1398            reply->writeNoException();
1399            reply->writeInt32(ret);
1400            return NO_ERROR;
1401        } break;
1402        case UNLOCK: {
1403            CHECK_INTERFACE(IKeystoreService, data, reply);
1404            int32_t userId = data.readInt32();
1405            String16 pass = data.readString16();
1406            int32_t ret = unlock(userId, pass);
1407            reply->writeNoException();
1408            reply->writeInt32(ret);
1409            return NO_ERROR;
1410        } break;
1411        case ZERO: {
1412            CHECK_INTERFACE(IKeystoreService, data, reply);
1413            int32_t ret = zero();
1414            reply->writeNoException();
1415            reply->writeInt32(ret);
1416            return NO_ERROR;
1417        } break;
1418        case GENERATE: {
1419            CHECK_INTERFACE(IKeystoreService, data, reply);
1420            String16 name = data.readString16();
1421            int32_t uid = data.readInt32();
1422            int32_t keyType = data.readInt32();
1423            int32_t keySize = data.readInt32();
1424            int32_t flags = data.readInt32();
1425            Vector<sp<KeystoreArg> > args;
1426            int32_t argsPresent = data.readInt32();
1427            if (argsPresent == 1) {
1428                ssize_t numArgs = data.readInt32();
1429                if (numArgs > MAX_GENERATE_ARGS) {
1430                    return BAD_VALUE;
1431                }
1432                if (numArgs > 0) {
1433                    for (size_t i = 0; i < (size_t) numArgs; i++) {
1434                        ssize_t inSize = data.readInt32();
1435                        if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1436                            sp<KeystoreArg> arg = new KeystoreArg(data.readInplace(inSize),
1437                                                                  inSize);
1438                            args.push_back(arg);
1439                        } else {
1440                            args.push_back(NULL);
1441                        }
1442                    }
1443                }
1444            }
1445            int32_t ret = generate(name, uid, keyType, keySize, flags, &args);
1446            reply->writeNoException();
1447            reply->writeInt32(ret);
1448            return NO_ERROR;
1449        } break;
1450        case IMPORT: {
1451            CHECK_INTERFACE(IKeystoreService, data, reply);
1452            String16 name = data.readString16();
1453            ssize_t inSize = data.readInt32();
1454            const void* in;
1455            if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1456                in = data.readInplace(inSize);
1457            } else {
1458                in = NULL;
1459                inSize = 0;
1460            }
1461            int uid = data.readInt32();
1462            int32_t flags = data.readInt32();
1463            int32_t ret = import(name, (const uint8_t*) in, (size_t) inSize, uid, flags);
1464            reply->writeNoException();
1465            reply->writeInt32(ret);
1466            return NO_ERROR;
1467        } break;
1468        case SIGN: {
1469            CHECK_INTERFACE(IKeystoreService, data, reply);
1470            String16 name = data.readString16();
1471            ssize_t inSize = data.readInt32();
1472            const void* in;
1473            if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1474                in = data.readInplace(inSize);
1475            } else {
1476                in = NULL;
1477                inSize = 0;
1478            }
1479            void* out = NULL;
1480            size_t outSize = 0;
1481            int32_t ret = sign(name, (const uint8_t*) in, (size_t) inSize, (uint8_t**) &out, &outSize);
1482            reply->writeNoException();
1483            if (outSize > 0 && out != NULL) {
1484                reply->writeInt32(outSize);
1485                void* buf = reply->writeInplace(outSize);
1486                memcpy(buf, out, outSize);
1487                free(out);
1488            } else {
1489                reply->writeInt32(-1);
1490            }
1491            reply->writeInt32(ret);
1492            return NO_ERROR;
1493        } break;
1494        case VERIFY: {
1495            CHECK_INTERFACE(IKeystoreService, data, reply);
1496            String16 name = data.readString16();
1497            ssize_t inSize = data.readInt32();
1498            const void* in;
1499            if (inSize >= 0 && (size_t) inSize <= data.dataAvail()) {
1500                in = data.readInplace(inSize);
1501            } else {
1502                in = NULL;
1503                inSize = 0;
1504            }
1505            ssize_t sigSize = data.readInt32();
1506            const void* sig;
1507            if (sigSize >= 0 && (size_t) sigSize <= data.dataAvail()) {
1508                sig = data.readInplace(sigSize);
1509            } else {
1510                sig = NULL;
1511                sigSize = 0;
1512            }
1513            bool ret = verify(name, (const uint8_t*) in, (size_t) inSize, (const uint8_t*) sig,
1514                    (size_t) sigSize);
1515            reply->writeNoException();
1516            reply->writeInt32(ret ? 1 : 0);
1517            return NO_ERROR;
1518        } break;
1519        case GET_PUBKEY: {
1520            CHECK_INTERFACE(IKeystoreService, data, reply);
1521            String16 name = data.readString16();
1522            void* out = NULL;
1523            size_t outSize = 0;
1524            int32_t ret = get_pubkey(name, (unsigned char**) &out, &outSize);
1525            reply->writeNoException();
1526            if (outSize > 0 && out != NULL) {
1527                reply->writeInt32(outSize);
1528                void* buf = reply->writeInplace(outSize);
1529                memcpy(buf, out, outSize);
1530                free(out);
1531            } else {
1532                reply->writeInt32(-1);
1533            }
1534            reply->writeInt32(ret);
1535            return NO_ERROR;
1536        } break;
1537        case DEL_KEY: {
1538            CHECK_INTERFACE(IKeystoreService, data, reply);
1539            String16 name = data.readString16();
1540            int uid = data.readInt32();
1541            int32_t ret = del_key(name, uid);
1542            reply->writeNoException();
1543            reply->writeInt32(ret);
1544            return NO_ERROR;
1545        } break;
1546        case GRANT: {
1547            CHECK_INTERFACE(IKeystoreService, data, reply);
1548            String16 name = data.readString16();
1549            int32_t granteeUid = data.readInt32();
1550            int32_t ret = grant(name, granteeUid);
1551            reply->writeNoException();
1552            reply->writeInt32(ret);
1553            return NO_ERROR;
1554        } break;
1555        case UNGRANT: {
1556            CHECK_INTERFACE(IKeystoreService, data, reply);
1557            String16 name = data.readString16();
1558            int32_t granteeUid = data.readInt32();
1559            int32_t ret = ungrant(name, granteeUid);
1560            reply->writeNoException();
1561            reply->writeInt32(ret);
1562            return NO_ERROR;
1563        } break;
1564        case GETMTIME: {
1565            CHECK_INTERFACE(IKeystoreService, data, reply);
1566            String16 name = data.readString16();
1567            int64_t ret = getmtime(name);
1568            reply->writeNoException();
1569            reply->writeInt64(ret);
1570            return NO_ERROR;
1571        } break;
1572        case DUPLICATE: {
1573            CHECK_INTERFACE(IKeystoreService, data, reply);
1574            String16 srcKey = data.readString16();
1575            int32_t srcUid = data.readInt32();
1576            String16 destKey = data.readString16();
1577            int32_t destUid = data.readInt32();
1578            int32_t ret = duplicate(srcKey, srcUid, destKey, destUid);
1579            reply->writeNoException();
1580            reply->writeInt32(ret);
1581            return NO_ERROR;
1582        } break;
1583        case IS_HARDWARE_BACKED: {
1584            CHECK_INTERFACE(IKeystoreService, data, reply);
1585            String16 keyType = data.readString16();
1586            int32_t ret = is_hardware_backed(keyType);
1587            reply->writeNoException();
1588            reply->writeInt32(ret);
1589            return NO_ERROR;
1590        }
1591        case CLEAR_UID: {
1592            CHECK_INTERFACE(IKeystoreService, data, reply);
1593            int64_t uid = data.readInt64();
1594            int32_t ret = clear_uid(uid);
1595            reply->writeNoException();
1596            reply->writeInt32(ret);
1597            return NO_ERROR;
1598        }
1599        case RESET_UID: {
1600            CHECK_INTERFACE(IKeystoreService, data, reply);
1601            int32_t uid = data.readInt32();
1602            int32_t ret = reset_uid(uid);
1603            reply->writeNoException();
1604            reply->writeInt32(ret);
1605            return NO_ERROR;
1606        }
1607        case SYNC_UID: {
1608            CHECK_INTERFACE(IKeystoreService, data, reply);
1609            int32_t sourceUid = data.readInt32();
1610            int32_t targetUid = data.readInt32();
1611            int32_t ret = sync_uid(sourceUid, targetUid);
1612            reply->writeNoException();
1613            reply->writeInt32(ret);
1614            return NO_ERROR;
1615        }
1616        case PASSWORD_UID: {
1617            CHECK_INTERFACE(IKeystoreService, data, reply);
1618            String16 password = data.readString16();
1619            int32_t uid = data.readInt32();
1620            int32_t ret = password_uid(password, uid);
1621            reply->writeNoException();
1622            reply->writeInt32(ret);
1623            return NO_ERROR;
1624        }
1625        case ADD_RNG_ENTROPY: {
1626            CHECK_INTERFACE(IKeystoreService, data, reply);
1627            const uint8_t* bytes = NULL;
1628            size_t size = 0;
1629            readByteArray(data, &bytes, &size);
1630            int32_t ret = addRngEntropy(bytes, size);
1631            reply->writeNoException();
1632            reply->writeInt32(ret);
1633            return NO_ERROR;
1634        }
1635        case GENERATE_KEY: {
1636            CHECK_INTERFACE(IKeystoreService, data, reply);
1637            String16 name = data.readString16();
1638            KeymasterArguments args;
1639            if (data.readInt32() != 0) {
1640                args.readFromParcel(data);
1641            }
1642            const uint8_t* entropy = NULL;
1643            size_t entropyLength = 0;
1644            readByteArray(data, &entropy, &entropyLength);
1645            int32_t uid = data.readInt32();
1646            int32_t flags = data.readInt32();
1647            KeyCharacteristics outCharacteristics;
1648            int32_t ret = generateKey(name, args, entropy, entropyLength, uid, flags,
1649                                      &outCharacteristics);
1650            reply->writeNoException();
1651            reply->writeInt32(ret);
1652            reply->writeInt32(1);
1653            outCharacteristics.writeToParcel(reply);
1654            return NO_ERROR;
1655        }
1656        case GET_KEY_CHARACTERISTICS: {
1657            CHECK_INTERFACE(IKeystoreService, data, reply);
1658            String16 name = data.readString16();
1659            std::unique_ptr<keymaster_blob_t> clientId = readKeymasterBlob(data);
1660            std::unique_ptr<keymaster_blob_t> appData = readKeymasterBlob(data);
1661            KeyCharacteristics outCharacteristics;
1662            int ret = getKeyCharacteristics(name, clientId.get(), appData.get(),
1663                                            &outCharacteristics);
1664            reply->writeNoException();
1665            reply->writeInt32(ret);
1666            reply->writeInt32(1);
1667            outCharacteristics.writeToParcel(reply);
1668            return NO_ERROR;
1669        }
1670        case IMPORT_KEY: {
1671            CHECK_INTERFACE(IKeystoreService, data, reply);
1672            String16 name = data.readString16();
1673            KeymasterArguments args;
1674            if (data.readInt32() != 0) {
1675                args.readFromParcel(data);
1676            }
1677            keymaster_key_format_t format = static_cast<keymaster_key_format_t>(data.readInt32());
1678            const uint8_t* keyData = NULL;
1679            size_t keyLength = 0;
1680            readByteArray(data, &keyData, &keyLength);
1681            int32_t uid = data.readInt32();
1682            int32_t flags = data.readInt32();
1683            KeyCharacteristics outCharacteristics;
1684            int32_t ret = importKey(name, args, format, keyData, keyLength, uid, flags,
1685                                    &outCharacteristics);
1686            reply->writeNoException();
1687            reply->writeInt32(ret);
1688            reply->writeInt32(1);
1689            outCharacteristics.writeToParcel(reply);
1690
1691            return NO_ERROR;
1692        }
1693        case EXPORT_KEY: {
1694            CHECK_INTERFACE(IKeystoreService, data, reply);
1695            String16 name = data.readString16();
1696            keymaster_key_format_t format = static_cast<keymaster_key_format_t>(data.readInt32());
1697            std::unique_ptr<keymaster_blob_t> clientId = readKeymasterBlob(data);
1698            std::unique_ptr<keymaster_blob_t> appData = readKeymasterBlob(data);
1699            ExportResult result;
1700            exportKey(name, format, clientId.get(), appData.get(), &result);
1701            reply->writeNoException();
1702            reply->writeInt32(1);
1703            result.writeToParcel(reply);
1704
1705            return NO_ERROR;
1706        }
1707        case BEGIN: {
1708            CHECK_INTERFACE(IKeystoreService, data, reply);
1709            sp<IBinder> token = data.readStrongBinder();
1710            String16 name = data.readString16();
1711            keymaster_purpose_t purpose = static_cast<keymaster_purpose_t>(data.readInt32());
1712            bool pruneable = data.readInt32() != 0;
1713            KeymasterArguments args;
1714            if (data.readInt32() != 0) {
1715                args.readFromParcel(data);
1716            }
1717            const uint8_t* entropy = NULL;
1718            size_t entropyLength = 0;
1719            readByteArray(data, &entropy, &entropyLength);
1720            KeymasterArguments outArgs;
1721            OperationResult result;
1722            begin(token, name, purpose, pruneable, args, entropy, entropyLength, &outArgs,
1723                  &result);
1724            reply->writeNoException();
1725            reply->writeInt32(1);
1726            result.writeToParcel(reply);
1727            reply->writeInt32(1);
1728            outArgs.writeToParcel(reply);
1729
1730            return NO_ERROR;
1731        }
1732        case UPDATE: {
1733            CHECK_INTERFACE(IKeystoreService, data, reply);
1734            sp<IBinder> token = data.readStrongBinder();
1735            KeymasterArguments args;
1736            if (data.readInt32() != 0) {
1737                args.readFromParcel(data);
1738            }
1739            const uint8_t* buf = NULL;
1740            size_t bufLength = 0;
1741            readByteArray(data, &buf, &bufLength);
1742            OperationResult result;
1743            update(token, args, buf, bufLength, &result);
1744            reply->writeNoException();
1745            reply->writeInt32(1);
1746            result.writeToParcel(reply);
1747
1748            return NO_ERROR;
1749        }
1750        case FINISH: {
1751            CHECK_INTERFACE(IKeystoreService, data, reply);
1752            sp<IBinder> token = data.readStrongBinder();
1753            KeymasterArguments args;
1754            if (data.readInt32() != 0) {
1755                args.readFromParcel(data);
1756            }
1757            const uint8_t* buf = NULL;
1758            size_t bufLength = 0;
1759            readByteArray(data, &buf, &bufLength);
1760            OperationResult result;
1761            finish(token, args, buf, bufLength, &result);
1762            reply->writeNoException();
1763            reply->writeInt32(1);
1764            result.writeToParcel(reply);
1765
1766            return NO_ERROR;
1767        }
1768        case ABORT: {
1769            CHECK_INTERFACE(IKeystoreService, data, reply);
1770            sp<IBinder> token = data.readStrongBinder();
1771            int32_t result = abort(token);
1772            reply->writeNoException();
1773            reply->writeInt32(result);
1774
1775            return NO_ERROR;
1776        }
1777        case IS_OPERATION_AUTHORIZED: {
1778            CHECK_INTERFACE(IKeystoreService, data, reply);
1779            sp<IBinder> token = data.readStrongBinder();
1780            bool result = isOperationAuthorized(token);
1781            reply->writeNoException();
1782            reply->writeInt32(result ? 1 : 0);
1783
1784            return NO_ERROR;
1785        }
1786        case ADD_AUTH_TOKEN: {
1787            CHECK_INTERFACE(IKeystoreService, data, reply);
1788            const uint8_t* token_bytes = NULL;
1789            size_t size = 0;
1790            readByteArray(data, &token_bytes, &size);
1791            int32_t result = addAuthToken(token_bytes, size);
1792            reply->writeNoException();
1793            reply->writeInt32(result);
1794
1795            return NO_ERROR;
1796        }
1797        default:
1798            return BBinder::onTransact(code, data, reply, flags);
1799    }
1800}
1801
1802// ----------------------------------------------------------------------------
1803
1804}; // namespace android
1805