From 449eaa6d03ee73e598f0f11fd358877f38483dfd Mon Sep 17 00:00:00 2001 From: Subrahmanyaman Date: Tue, 31 May 2022 22:15:35 +0000 Subject: [PATCH] If Any of the SystemProperties, ROT or any of the required persistant data is not set. Then return INVALID_DATA error. --- .../keymaster/KMAndroidSEProvider.java | 12 ++--- .../javacard/keymaster/KMRepository.java | 49 ++++++++++++------- 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java index 57a2cb38..c348a009 100644 --- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java +++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java @@ -1226,16 +1226,14 @@ private short getProvisionDataBufferOffset(byte dataType) { } return 0; } - + private void persistProvisionData(byte[] buf, short off, short len, short maxSize, short copyToOff) { if (len > maxSize) { KMException.throwIt(KMError.INVALID_INPUT_LENGTH); } - JCSystem.beginTransaction(); - Util.arrayCopyNonAtomic(buf, off, provisionData, Util.setShort(provisionData, copyToOff, len), len); - JCSystem.commitTransaction(); + Util.arrayCopy(buf, off, provisionData, Util.setShort(provisionData, copyToOff, len), len); } - + private void persistCertificateChain(byte[] certChain, short certChainOff, short certChainLen) { persistProvisionData(certChain, certChainOff, certChainLen, KMConfigurations.CERT_CHAIN_MAX_SIZE, CERT_CHAIN_OFFSET); @@ -1264,9 +1262,7 @@ public void persistProvisionData(byte[] buffer, short certChainOff, short certCh // Next single byte holds the byte string header. // Next 3 bytes holds the total length of the certificate chain. // clear buffer. - JCSystem.beginTransaction(); - Util.arrayFillNonAtomic(provisionData, (short) 0, (short) provisionData.length, (byte) 0); - JCSystem.commitTransaction(); + Util.arrayFill(provisionData, (short) 0, (short) provisionData.length, (byte) 0); // Persist data. persistCertificateChain(buffer, certChainOff, certChainLen); persistCertficateIssuer(buffer, certIssuerOff, certIssuerLen); diff --git a/Applet/src/com/android/javacard/keymaster/KMRepository.java b/Applet/src/com/android/javacard/keymaster/KMRepository.java index 3479594b..2d0ca043 100644 --- a/Applet/src/com/android/javacard/keymaster/KMRepository.java +++ b/Applet/src/com/android/javacard/keymaster/KMRepository.java @@ -509,19 +509,15 @@ private void writeDataEntry(byte bufType, short id, byte[] buf, short offset, sh JCSystem.beginTransaction(); Util.setShort(dataTable, (short) (id + DATA_INDEX_ENTRY_OFFSET), dataPtr); Util.setShort(dataTable, (short) (id + DATA_INDEX_ENTRY_LENGTH), len); - Util.arrayCopyNonAtomic(buf, offset, dataTable, dataPtr, len); JCSystem.commitTransaction(); // End Transaction + Util.arrayCopy(buf, offset, dataTable, dataPtr, len); } else { if (len != dataLen) { KMException.throwIt(KMError.UNKNOWN_ERROR); } dataPtr = Util.getShort(dataTable, (short) (id + DATA_INDEX_ENTRY_OFFSET)); - // Begin Transaction - JCSystem.beginTransaction(); - Util.arrayCopyNonAtomic(buf, offset, dataTable, dataPtr, len); - JCSystem.commitTransaction(); - // End Transaction + Util.arrayCopy(buf, offset, dataTable, dataPtr, len); } } @@ -535,7 +531,11 @@ public byte[] getHeap() { } public short getHmacNonce() { - return readData(HMAC_NONCE); + short blob = readData(HMAC_NONCE); + if (blob == KMType.INVALID_VALUE) { + KMException.throwIt(KMError.INVALID_DATA); + } + return blob; } public short getComputedHmacKey() { @@ -598,8 +598,9 @@ public short getOsVersion() { return KMInteger.uint_32( KMByteBlob.cast(blob).getBuffer(), KMByteBlob.cast(blob).getStartOff()); } else { - return KMInteger.uint_32(zero, (short) 0); + KMException.throwIt(KMError.INVALID_DATA); } + return KMType.INVALID_VALUE; } public short getVendorPatchLevel() { @@ -608,8 +609,9 @@ public short getVendorPatchLevel() { return KMInteger.uint_32( KMByteBlob.cast(blob).getBuffer(), KMByteBlob.cast(blob).getStartOff()); } else { - return KMInteger.uint_32(zero, (short) 0); + KMException.throwIt(KMError.INVALID_DATA); } + return KMType.INVALID_VALUE; } public short getBootPatchLevel() { @@ -618,8 +620,9 @@ public short getBootPatchLevel() { return KMInteger.uint_32( KMByteBlob.cast(blob).getBuffer(), KMByteBlob.cast(blob).getStartOff()); } else { - return KMInteger.uint_32(zero, (short) 0); + KMException.throwIt(KMError.INVALID_DATA); } + return KMType.INVALID_VALUE; } public short getOsPatch() { @@ -628,15 +631,16 @@ public short getOsPatch() { return KMInteger.uint_32( KMByteBlob.cast(blob).getBuffer(), KMByteBlob.cast(blob).getStartOff()); } else { - return KMInteger.uint_32(zero, (short) 0); + KMException.throwIt(KMError.INVALID_DATA); } + return KMType.INVALID_VALUE; } public short readROT(short version) { short totalLength = 0; short length = dataLength(BOOT_VERIFIED_BOOT_KEY); if (length == 0) { - return KMType.INVALID_VALUE; + KMException.throwIt(KMError.INVALID_DATA); } totalLength += length; // As per specification The root of trust @@ -646,16 +650,16 @@ public short readROT(short version) { // the root of trust. if ((length = dataLength(BOOT_VERIFIED_BOOT_HASH)) == 0) { - return KMType.INVALID_VALUE; + KMException.throwIt(KMError.INVALID_DATA); } totalLength += length; } if ((length = dataLength(BOOT_VERIFIED_BOOT_STATE)) == 0) { - return KMType.INVALID_VALUE; + KMException.throwIt(KMError.INVALID_DATA); } totalLength += length; if ((length = dataLength(BOOT_DEVICE_LOCKED_STATUS)) == 0) { - return KMType.INVALID_VALUE; + KMException.throwIt(KMError.INVALID_DATA); } totalLength += length; @@ -679,11 +683,19 @@ public short readROT(short version) { } public short getVerifiedBootKey() { - return readData(BOOT_VERIFIED_BOOT_KEY); + short blob = readData(BOOT_VERIFIED_BOOT_KEY); + if (blob == KMType.INVALID_VALUE) { + KMException.throwIt(KMError.INVALID_DATA); + } + return blob; } public short getVerifiedBootHash() { - return readData(BOOT_VERIFIED_BOOT_HASH); + short blob = readData(BOOT_VERIFIED_BOOT_HASH); + if (blob == KMType.INVALID_VALUE) { + KMException.throwIt(KMError.INVALID_DATA); + } + return blob; } public boolean getBootLoaderLock() { @@ -724,8 +736,9 @@ public short getDeviceTimeStamp() { return KMInteger.uint_64(KMByteBlob.cast(blob).getBuffer(), KMByteBlob.cast(blob).getStartOff()); } else { - return KMInteger.uint_64(zero, (short) 0); + KMException.throwIt(KMError.INVALID_DATA); } + return blob; } public void setOsVersion(byte[] buf, short start, short len) {