From b5a8a775be0008ed85af982a606e087d4e133f52 Mon Sep 17 00:00:00 2001 From: bvenkateswarlu Date: Wed, 3 Mar 2021 22:55:33 +0000 Subject: [PATCH 1/3] Clear all the operation state in setBootParams --- .../javacard/keymaster/KMKeymasterApplet.java | 7 +++++++ .../javacard/keymaster/KMRepository.java | 20 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java index 6d5acb36..b79cabaa 100644 --- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java +++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java @@ -3142,6 +3142,10 @@ private void updateKeyParameters(byte[] ptrArr, short len) { } // This command is executed to set the boot parameters. + // releaseAllOperations has to be called on every boot, so + // it is called from inside setBootParams. Later in future if + // setBootParams is removed, then make sure that releaseAllOperations + // is moved to a place where it is called on every boot. private void processSetBootParamsCmd(APDU apdu) { receiveIncoming(apdu); byte[] scratchPad = apdu.getBuffer(); @@ -3230,6 +3234,9 @@ private void processSetBootParamsCmd(APDU apdu) { repository.clearComputedHmac(); repository.clearHmacNonce(); + //Clear all the operation state. + repository.releaseAllOperations(); + // Hmac is cleared, so generate a new Hmac nonce. seProvider.newRandomNumber(scratchPad, (short) 0, KMRepository.HMAC_SEED_NONCE_SIZE); repository.initHmacNonce(scratchPad, (short) 0, KMRepository.HMAC_SEED_NONCE_SIZE); diff --git a/Applet/src/com/android/javacard/keymaster/KMRepository.java b/Applet/src/com/android/javacard/keymaster/KMRepository.java index 204fe312..5c3ed151 100644 --- a/Applet/src/com/android/javacard/keymaster/KMRepository.java +++ b/Applet/src/com/android/javacard/keymaster/KMRepository.java @@ -256,6 +256,26 @@ public void releaseOperation(KMOperationState op) { } } + public void releaseAllOperations() { + short index = 0; + byte[] var; + while (index < MAX_OPS) { + var = ((byte[]) ((Object[]) operationStateTable[index])[0]); + if (var[OPERATION_HANDLE_STATUS_OFFSET] == 1) { + Object[] slot = (Object[]) ((Object[]) operationStateTable[index])[1]; + Object[] ops = ((Object[]) slot[1]); + ((KMOperation) ops[0]).abort(); + JCSystem.beginTransaction(); + Util.arrayFillNonAtomic((byte[]) slot[0], (short) 0, + (short) ((byte[]) slot[0]).length, (byte) 0); + Util.arrayFillNonAtomic(var, (short) 0, (short) var.length, (byte) 0); + ops[0] = null; + JCSystem.commitTransaction(); + } + index++; + } + } + public void initComputedHmac(byte[] key, short start, short len) { if (len != COMPUTED_HMAC_KEY_SIZE) { KMException.throwIt(KMError.INVALID_INPUT_LENGTH); From 361f2db8f401719ba4092fdb4c41e000dd61bf43 Mon Sep 17 00:00:00 2001 From: BKSSM Venkateswarlu Date: Thu, 4 Mar 2021 14:11:39 +0000 Subject: [PATCH 2/3] update the variable name from var to oprHandleBuf --- .../src/com/android/javacard/keymaster/KMRepository.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Applet/src/com/android/javacard/keymaster/KMRepository.java b/Applet/src/com/android/javacard/keymaster/KMRepository.java index 5c3ed151..a5df9ce2 100644 --- a/Applet/src/com/android/javacard/keymaster/KMRepository.java +++ b/Applet/src/com/android/javacard/keymaster/KMRepository.java @@ -258,17 +258,17 @@ public void releaseOperation(KMOperationState op) { public void releaseAllOperations() { short index = 0; - byte[] var; + byte[] oprHandleBuf; while (index < MAX_OPS) { - var = ((byte[]) ((Object[]) operationStateTable[index])[0]); - if (var[OPERATION_HANDLE_STATUS_OFFSET] == 1) { + oprHandleBuf = ((byte[]) ((Object[]) operationStateTable[index])[0]); + if (oprHandleBuf[OPERATION_HANDLE_STATUS_OFFSET] == 1) { Object[] slot = (Object[]) ((Object[]) operationStateTable[index])[1]; Object[] ops = ((Object[]) slot[1]); ((KMOperation) ops[0]).abort(); JCSystem.beginTransaction(); Util.arrayFillNonAtomic((byte[]) slot[0], (short) 0, (short) ((byte[]) slot[0]).length, (byte) 0); - Util.arrayFillNonAtomic(var, (short) 0, (short) var.length, (byte) 0); + Util.arrayFillNonAtomic(oprHandleBuf, (short) 0, (short) oprHandleBuf.length, (byte) 0); ops[0] = null; JCSystem.commitTransaction(); } From de31bf66b54b629c99d70dad841bc371a56c6a51 Mon Sep 17 00:00:00 2001 From: BKSSM Venkateswarlu Date: Thu, 4 Mar 2021 18:21:15 +0000 Subject: [PATCH 3/3] 1. In releaseOperation, renamed the variable name 'var' 2. clearing the operation handle is moved under begin/commit transaction. --- .../com/android/javacard/keymaster/KMRepository.java | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/Applet/src/com/android/javacard/keymaster/KMRepository.java b/Applet/src/com/android/javacard/keymaster/KMRepository.java index a5df9ce2..94bde080 100644 --- a/Applet/src/com/android/javacard/keymaster/KMRepository.java +++ b/Applet/src/com/android/javacard/keymaster/KMRepository.java @@ -233,7 +233,7 @@ public void persistOperation(byte[] data, short opHandle, KMOperation op) { public void releaseOperation(KMOperationState op) { short index = 0; - byte[] var; + byte[] oprHandleBuf; short buf = KMByteBlob.instance(OPERATION_HANDLE_SIZE); getOperationHandle( op.getHandle(), @@ -241,14 +241,16 @@ public void releaseOperation(KMOperationState op) { KMByteBlob.cast(buf).getStartOff(), KMByteBlob.cast(buf).length()); while (index < MAX_OPS) { - var = ((byte[]) ((Object[]) operationStateTable[index])[0]); - if ((var[OPERATION_HANDLE_STATUS_OFFSET] == 1) && - (0 == Util.arrayCompare(var, + oprHandleBuf = ((byte[]) ((Object[]) operationStateTable[index])[0]); + if ((oprHandleBuf[OPERATION_HANDLE_STATUS_OFFSET] == 1) && + (0 == Util.arrayCompare(oprHandleBuf, OPERATION_HANDLE_OFFSET, KMByteBlob.cast(buf).getBuffer(), KMByteBlob.cast(buf).getStartOff(), KMByteBlob.cast(buf).length()))) { - Util.arrayFillNonAtomic(var, (short) 0, (short) var.length, (byte) 0); + JCSystem.beginTransaction(); + Util.arrayFillNonAtomic(oprHandleBuf, (short) 0, (short) oprHandleBuf.length, (byte) 0); + JCSystem.commitTransaction(); op.release(); break; }