Merge changes from topic "default_dice_hal" am: 49a1688f5e (0b05aae7) · Commits · e / os / android_hardware_interfaces

security/dice/aidl/default/Android.bp

0 → 100644

+30 −0

Original line number	Diff line number	Diff line
		package {
		// See: http://go/android-license-faq
		// A large-scale-change added 'default_applicable_licenses' to import
		// all of the 'license_kinds' from "hardware_interfaces_license"
		// to get the below license kinds:
		// SPDX-license-identifier-Apache-2.0
		default_applicable_licenses: ["hardware_interfaces_license"],
		}

		rust_binary {
		name: "android.hardware.security.dice-service.non-secure-software",
		srcs: ["service.rs"],
		relative_install_path: "hw",
		vendor: true,
		rustlibs: [
		"android.hardware.security.dice-V1-rust",
		"libdiced_open_dice_cbor",
		"libdiced_sample_inputs",
		"libdiced_vendor",
		"libandroid_logger",
		"libanyhow",
		"libbinder_rs",
		"liblog_rust",
		"libserde",
		],
		init_rc: ["android.hardware.security.dice-service.non-secure-software.rc"],
		vintf_fragments: [
		"android.hardware.security.dice-service.non-secure-software.xml",
		],
		}

security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.rc

0 → 100644

+9 −0

Original line number	Diff line number	Diff line
		service vendor.dice /vendor/bin/hw/android.hardware.security.dice-service.non-secure-software
		class early_hal
		user nobody
		# The diced HAL cannot be allowed to restart. When it crashes for any reason.
		# it loses security critical state. The only remedy is to restart the device.
		# This may be implementation depended. It is safe to restart the HAL if the
		# state change during a call to "demote" is is preserved.
		# see android/hardware/security/dice/IDiceDevice.aidl for details on "demote".
		oneshot

security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.xml

0 → 100644

+6 −0

Original line number	Diff line number	Diff line
		<manifest version="1.0" type="device">
		<hal format="aidl">
		<name>android.hardware.security.dice</name>
		<fqname>IDiceDevice/default</fqname>
		</hal>
		</manifest>
		No newline at end of file

security/dice/aidl/default/service.rs

0 → 100644

+107 −0

Original line number	Diff line number	Diff line
		// Copyright 2021, The Android Open Source Project
		//
		// Licensed under the Apache License, Version 2.0 (the "License");
		// you may not use this file except in compliance with the License.
		// You may obtain a copy of the License at
		//
		// http://www.apache.org/licenses/LICENSE-2.0
		//
		// Unless required by applicable law or agreed to in writing, software
		// distributed under the License is distributed on an "AS IS" BASIS,
		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		// See the License for the specific language governing permissions and
		// limitations under the License.

		//! Main entry point for the android.hardware.security.dice service.

		use anyhow::Result;
		use diced::{
		dice,
		hal_node::{DiceArtifacts, DiceDevice, ResidentHal, UpdatableDiceArtifacts},
		};
		use diced_sample_inputs::make_sample_bcc_and_cdis;
		use serde::{Deserialize, Serialize};
		use std::convert::TryInto;
		use std::panic;
		use std::sync::Arc;

		static DICE_HAL_SERVICE_NAME: &str = "android.hardware.security.dice.IDiceDevice/default";

		#[derive(Debug, Serialize, Deserialize, Clone)]
		struct InsecureSerializableArtifacts {
		cdi_attest: [u8; dice::CDI_SIZE],
		cdi_seal: [u8; dice::CDI_SIZE],
		bcc: Vec<u8>,
		}

		impl DiceArtifacts for InsecureSerializableArtifacts {
		fn cdi_attest(&self) -> &[u8; dice::CDI_SIZE] {
		&self.cdi_attest
		}
		fn cdi_seal(&self) -> &[u8; dice::CDI_SIZE] {
		&self.cdi_seal
		}
		fn bcc(&self) -> Vec<u8> {
		self.bcc.clone()
		}
		}

		impl UpdatableDiceArtifacts for InsecureSerializableArtifacts {
		fn with_artifacts<F, T>(&self, f: F) -> Result<T>
		where
		F: FnOnce(&dyn DiceArtifacts) -> Result<T>,
		{
		f(self)
		}
		fn update(self, new_artifacts: &impl DiceArtifacts) -> Result<Self> {
		Ok(Self {
		cdi_attest: *new_artifacts.cdi_attest(),
		cdi_seal: *new_artifacts.cdi_seal(),
		bcc: new_artifacts.bcc(),
		})
		}
		}

		fn main() {
		android_logger::init_once(
		android_logger::Config::default()
		.with_tag("android.hardware.security.dice")
		.with_min_level(log::Level::Debug),
		);
		// Redirect panic messages to logcat.
		panic::set_hook(Box::new(\|panic_info\| {
		log::error!("{}", panic_info);
		}));

		// Saying hi.
		log::info!("android.hardware.security.dice is starting.");

		let (cdi_attest, cdi_seal, bcc) =
		make_sample_bcc_and_cdis().expect("Failed to construct sample dice chain.");

		let hal_impl = Arc::new(
		unsafe {
		// Safety: ResidentHal cannot be used in multi threaded processes.
		// This service does not start a thread pool. The main thread is the only thread
		// joining the thread pool, thereby keeping the process single threaded.
		ResidentHal::new(InsecureSerializableArtifacts {
		cdi_attest: cdi_attest[..]
		.try_into()
		.expect("Failed to convert cdi_attest to array reference."),
		cdi_seal: cdi_seal[..]
		.try_into()
		.expect("Failed to convert cdi_seal to array reference."),
		bcc,
		})
		}
		.expect("Failed to create ResidentHal implementation."),
		);

		let hal = DiceDevice::new_as_binder(hal_impl).expect("Failed to construct hal service.");

		binder::add_service(DICE_HAL_SERVICE_NAME, hal.as_binder())
		.expect("Failed to register IDiceDevice Service");

		log::info!("Joining thread pool now.");
		binder::ProcessState::join_thread_pool();
		}

security/dice/aidl/vts/functional/Android.bp

0 → 100644

+54 −0

Original line number	Diff line number	Diff line
		package {
		// See: http://go/android-license-faq
		// A large-scale-change added 'default_applicable_licenses' to import
		// all of the 'license_kinds' from "hardware_interfaces_license"
		// to get the below license kinds:
		// SPDX-license-identifier-Apache-2.0
		default_applicable_licenses: ["hardware_interfaces_license"],
		}

		rust_test {
		name: "VtsAidlDiceTargetTest",
		srcs: [
		"dice_test.rs",
		],
		require_root: true,
		auto_gen_config: true,
		test_suites: [
		"general-tests",
		"vts",
		],

		rustlibs: [
		"android.hardware.security.dice-V1-rust",
		"libanyhow",
		"libbinder_rs",
		"libdiced_open_dice_cbor",
		"libdiced_sample_inputs",
		"libdiced_utils",
		"libkeystore2_vintf_rust",
		],
		}

		rust_test {
		name: "VtsAidlDiceDemoteTargetTest",
		srcs: [
		"dice_demote_test.rs",
		],

		test_config: "VtsAidlDiceDemoteTargetTest.xml",
		test_suites: [
		"general-tests",
		"vts",
		],

		rustlibs: [
		"android.hardware.security.dice-V1-rust",
		"libanyhow",
		"libbinder_rs",
		"libdiced_open_dice_cbor",
		"libdiced_sample_inputs",
		"libdiced_utils",
		"libkeystore2_vintf_rust",
		],
		}