From 18cf62712cf3fd1197ca15e2a7d4d1dd67131213 Mon Sep 17 00:00:00 2001 From: Shawn Willden Date: Tue, 7 Jun 2022 13:17:48 -0600 Subject: Implement GetRootOfTrust Bug: 219076736 Test: VtsAidlKeyMintTargetTest Change-Id: I8485360f253ca20f008c5df5090e79c1781fbb4f Merged-In: I8485360f253ca20f008c5df5090e79c1781fbb4f Ignore-AOSP-First: already present in aosp/master --- trusty/keymaster/TrustyKeymaster.cpp | 6 ++++++ .../include/trusty_keymaster/TrustyKeymaster.h | 1 + .../include/trusty_keymaster/ipc/keymaster_ipc.h | 1 + trusty/keymaster/keymint/TrustyKeyMintDevice.cpp | 17 ++++++++++++++--- 4 files changed, 22 insertions(+), 3 deletions(-) diff --git a/trusty/keymaster/TrustyKeymaster.cpp b/trusty/keymaster/TrustyKeymaster.cpp index cdfbd9003..e77940a1f 100644 --- a/trusty/keymaster/TrustyKeymaster.cpp +++ b/trusty/keymaster/TrustyKeymaster.cpp @@ -279,4 +279,10 @@ ConfigureVendorPatchlevelResponse TrustyKeymaster::ConfigureVendorPatchlevel( return response; } +GetRootOfTrustResponse TrustyKeymaster::GetRootOfTrust(const GetRootOfTrustRequest& request) { + GetRootOfTrustResponse response(message_version()); + ForwardCommand(KM_GET_ROOT_OF_TRUST, request, &response); + return response; +} + } // namespace keymaster diff --git a/trusty/keymaster/include/trusty_keymaster/TrustyKeymaster.h b/trusty/keymaster/include/trusty_keymaster/TrustyKeymaster.h index f80e02f37..9f4f39bf5 100644 --- a/trusty/keymaster/include/trusty_keymaster/TrustyKeymaster.h +++ b/trusty/keymaster/include/trusty_keymaster/TrustyKeymaster.h @@ -66,6 +66,7 @@ class TrustyKeymaster { DeviceLockedResponse DeviceLocked(const DeviceLockedRequest& request); ConfigureVendorPatchlevelResponse ConfigureVendorPatchlevel( const ConfigureVendorPatchlevelRequest& request); + GetRootOfTrustResponse GetRootOfTrust(const GetRootOfTrustRequest& request); uint32_t message_version() const { return message_version_; } diff --git a/trusty/keymaster/include/trusty_keymaster/ipc/keymaster_ipc.h b/trusty/keymaster/include/trusty_keymaster/ipc/keymaster_ipc.h index fa475ae90..bf0cb703f 100644 --- a/trusty/keymaster/include/trusty_keymaster/ipc/keymaster_ipc.h +++ b/trusty/keymaster/include/trusty_keymaster/ipc/keymaster_ipc.h @@ -59,6 +59,7 @@ enum keymaster_command : uint32_t { KM_GENERATE_RKP_KEY = (31 << KEYMASTER_REQ_SHIFT), KM_GENERATE_CSR = (32 << KEYMASTER_REQ_SHIFT), KM_CONFIGURE_VENDOR_PATCHLEVEL = (33 << KEYMASTER_REQ_SHIFT), + KM_GET_ROOT_OF_TRUST = (34 << KEYMASTER_REQ_SHIFT), // Bootloader/provisioning calls. KM_SET_BOOT_PARAMS = (0x1000 << KEYMASTER_REQ_SHIFT), diff --git a/trusty/keymaster/keymint/TrustyKeyMintDevice.cpp b/trusty/keymaster/keymint/TrustyKeyMintDevice.cpp index 44780e835..7d58162cc 100644 --- a/trusty/keymaster/keymint/TrustyKeyMintDevice.cpp +++ b/trusty/keymaster/keymint/TrustyKeyMintDevice.cpp @@ -325,9 +325,20 @@ ScopedAStatus TrustyKeyMintDevice::getRootOfTrustChallenge(array* / return kmError2ScopedAStatus(KM_ERROR_UNIMPLEMENTED); } -ScopedAStatus TrustyKeyMintDevice::getRootOfTrust(const array& /* challenge */, - vector* /* rootOfTrust */) { - return kmError2ScopedAStatus(KM_ERROR_UNIMPLEMENTED); +ScopedAStatus TrustyKeyMintDevice::getRootOfTrust(const array& challenge, + vector* rootOfTrust) { + if (!rootOfTrust) { + return kmError2ScopedAStatus(KM_ERROR_UNEXPECTED_NULL_POINTER); + } + keymaster::GetRootOfTrustRequest request(impl_->message_version(), + {challenge.begin(), challenge.end()}); + keymaster::GetRootOfTrustResponse response = impl_->GetRootOfTrust(request); + if (response.error != KM_ERROR_OK) { + return kmError2ScopedAStatus(response.error); + } + + *rootOfTrust = std::move(response.rootOfTrust); + return ScopedAStatus::ok(); } ScopedAStatus TrustyKeyMintDevice::sendRootOfTrust(const vector& /* rootOfTrust */) { -- cgit v1.2.3 From ae04e7ede1d6e5dd914e3be099b85b586cefa905 Mon Sep 17 00:00:00 2001 From: Akilesh Kailash Date: Wed, 8 Jun 2022 04:52:29 +0000 Subject: libsnapshot: Fix vts_libsnapshot_test for GRF with Vendor on S If the vendor partition is on S and system partition is on T, certain tests in vts_libsnapshot_test used to fail. This is primarily because of inconsistent check between daemon and vts test. vts test checks the userspace.snapshots.enabled property which is true on T but never checks if the underlying vendor partition is on S. Hence, vts test will enable userspace snapshots. However, daemon checks the vendor partition and disables userspace snapshots thereby leading to inconsistency. This is only a problem on vts tests. The underlying OTA on devices works fine as we have the vendor partition check. Bug: 236311008 Test: vts_libsnapshot_test on S vendor and T system vts_libsnapshot_test on T vendor and T system Ignore-AOSP-First: cherry-pick from aosp Signed-off-by: Akilesh Kailash Change-Id: Iad4f299bd2e07c9c01f5fbee6a20e2f01bf1778a --- fs_mgr/libsnapshot/snapshot.cpp | 17 +++++++++++++++-- fs_mgr/libsnapshot/snapshot_test.cpp | 23 ++++++++++++++++++----- 2 files changed, 33 insertions(+), 7 deletions(-) diff --git a/fs_mgr/libsnapshot/snapshot.cpp b/fs_mgr/libsnapshot/snapshot.cpp index a83f535b2..019b64a44 100644 --- a/fs_mgr/libsnapshot/snapshot.cpp +++ b/fs_mgr/libsnapshot/snapshot.cpp @@ -3273,8 +3273,21 @@ Return SnapshotManager::CreateUpdateSnapshots(const DeltaArchiveManifest& manife snapuserd_client_ = nullptr; } } else { - status.set_userspace_snapshots(!IsDmSnapshotTestingEnabled()); - if (IsDmSnapshotTestingEnabled()) { + bool userSnapshotsEnabled = true; + const std::string UNKNOWN = "unknown"; + const std::string vendor_release = android::base::GetProperty( + "ro.vendor.build.version.release_or_codename", UNKNOWN); + + // No user-space snapshots if vendor partition is on Android 12 + if (vendor_release.find("12") != std::string::npos) { + LOG(INFO) << "Userspace snapshots disabled as vendor partition is on Android: " + << vendor_release; + userSnapshotsEnabled = false; + } + + userSnapshotsEnabled = (userSnapshotsEnabled && !IsDmSnapshotTestingEnabled()); + status.set_userspace_snapshots(userSnapshotsEnabled); + if (!userSnapshotsEnabled) { is_snapshot_userspace_ = false; LOG(INFO) << "User-space snapshots disabled for testing"; } else { diff --git a/fs_mgr/libsnapshot/snapshot_test.cpp b/fs_mgr/libsnapshot/snapshot_test.cpp index 36abf712b..6a348b4e5 100644 --- a/fs_mgr/libsnapshot/snapshot_test.cpp +++ b/fs_mgr/libsnapshot/snapshot_test.cpp @@ -91,7 +91,7 @@ std::string fake_super; void MountMetadata(); bool ShouldUseCompression(); -bool ShouldUseUserspaceSnapshots(); +bool IsDaemonRequired(); class SnapshotTest : public ::testing::Test { public: @@ -1208,7 +1208,7 @@ TEST_F(SnapshotUpdateTest, FullUpdateFlow) { // Initiate the merge and wait for it to be completed. ASSERT_TRUE(init->InitiateMerge()); - ASSERT_EQ(init->IsSnapuserdRequired(), ShouldUseUserspaceSnapshots()); + ASSERT_EQ(init->IsSnapuserdRequired(), IsDaemonRequired()); { // We should have started in SECOND_PHASE since nothing shrinks. ASSERT_TRUE(AcquireLock()); @@ -1342,7 +1342,7 @@ TEST_F(SnapshotUpdateTest, SpaceSwapUpdate) { // Initiate the merge and wait for it to be completed. ASSERT_TRUE(init->InitiateMerge()); - ASSERT_EQ(init->IsSnapuserdRequired(), ShouldUseUserspaceSnapshots()); + ASSERT_EQ(init->IsSnapuserdRequired(), IsDaemonRequired()); { // Check that the merge phase is FIRST_PHASE until at least one call // to ProcessUpdateState() occurs. @@ -1450,7 +1450,7 @@ TEST_F(SnapshotUpdateTest, ConsistencyCheckResume) { // Initiate the merge and wait for it to be completed. ASSERT_TRUE(init->InitiateMerge()); - ASSERT_EQ(init->IsSnapuserdRequired(), ShouldUseUserspaceSnapshots()); + ASSERT_EQ(init->IsSnapuserdRequired(), IsDaemonRequired()); { // Check that the merge phase is FIRST_PHASE until at least one call // to ProcessUpdateState() occurs. @@ -2750,13 +2750,26 @@ void SnapshotTestEnvironment::TearDown() { } } -bool ShouldUseUserspaceSnapshots() { +bool IsDaemonRequired() { if (FLAGS_force_config == "dmsnap") { return false; } + + const std::string UNKNOWN = "unknown"; + const std::string vendor_release = + android::base::GetProperty("ro.vendor.build.version.release_or_codename", UNKNOWN); + + // No userspace snapshots if vendor partition is on Android 12 + // However, for GRF devices, snapuserd daemon will be on + // vendor ramdisk in Android 12. + if (vendor_release.find("12") != std::string::npos) { + return true; + } + if (!FLAGS_force_config.empty()) { return true; } + return IsUserspaceSnapshotsEnabled(); } -- cgit v1.2.3