Merge "Add UDS certificate requirements to RKP docs" into main
diff --git a/Android.bp b/Android.bp
index baf3291..68115aa 100644
--- a/Android.bp
+++ b/Android.bp
@@ -86,3 +86,9 @@
"VtsHalHidlTargetTestBase",
],
}
+
+dirgroup {
+ name: "trusty_dirgroup_hardware_interfaces",
+ dirs: ["."],
+ visibility: ["//trusty/vendor/google/aosp/scripts"],
+}
diff --git a/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp
index 81f18b2..4166fdc 100644
--- a/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp
+++ b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp
@@ -48,7 +48,8 @@
}
bool IvnAndroidDeviceService::init() {
- std::ifstream configStream(mConfigPath);
+ std::string configPathStr(mConfigPath);
+ std::ifstream configStream(configPathStr);
if (!configStream) {
LOG(ERROR) << "couldn't open " << mConfigPath << " for parsing.";
return false;
diff --git a/boot/aidl/client/BootControlClient.cpp b/boot/aidl/client/BootControlClient.cpp
index dca98c6..10f0ffe 100644
--- a/boot/aidl/client/BootControlClient.cpp
+++ b/boot/aidl/client/BootControlClient.cpp
@@ -69,8 +69,8 @@
explicit BootControlClientAidl(std::shared_ptr<IBootControl> module)
: module_(module),
boot_control_death_recipient(AIBinder_DeathRecipient_new(onBootControlServiceDied)) {
- binder_status_t status = AIBinder_linkToDeath(module->asBinder().get(),
- boot_control_death_recipient, nullptr);
+ binder_status_t status =
+ AIBinder_linkToDeath(module->asBinder().get(), boot_control_death_recipient, this);
if (status != STATUS_OK) {
LOG(ERROR) << "Could not link to binder death";
return;
diff --git a/cas/1.2/default/Android.bp b/cas/1.2/default/Android.bp
index 38561fd..5bc8bad 100644
--- a/cas/1.2/default/Android.bp
+++ b/cas/1.2/default/Android.bp
@@ -46,6 +46,7 @@
vintf_fragments: ["android.hardware.cas@1.2-service.xml"],
defaults: ["cas_service_defaults@1.2"],
init_rc: ["android.hardware.cas@1.2-service.rc"],
+ overrides: ["com.android.hardware.cas"],
}
cc_binary {
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index 6a3fa32..df5e5b1 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -21,6 +21,65 @@
default_applicable_licenses: ["hardware_interfaces_license"],
}
+// Device framework compatibility matrix (common to all FCM versions)
+// Reference: https://source.android.com/docs/core/architecture/vintf/comp-matrices
+vintf_compatibility_matrix {
+ name: "framework_compatibility_matrix.device.xml",
+ stem: "compatibility_matrix.device.xml",
+ type: "device_fcm",
+}
+
+// Phony target that installs all system compatibility matrix files
+SYSTEM_MATRIX_DEPS = [
+ "framework_compatibility_matrix.5.xml",
+ "framework_compatibility_matrix.6.xml",
+ "framework_compatibility_matrix.7.xml",
+ "framework_compatibility_matrix.8.xml",
+ "framework_compatibility_matrix.202404.xml",
+ "framework_compatibility_matrix.device.xml",
+]
+
+phony {
+ name: "system_compatibility_matrix.xml",
+ required: SYSTEM_MATRIX_DEPS,
+ product_variables: {
+ release_aidl_use_unfrozen: {
+ required: [
+ "framework_compatibility_matrix.202504.xml",
+ ],
+ },
+ },
+}
+
+// Product Compatibility Matrix
+vintf_compatibility_matrix {
+ name: "product_compatibility_matrix.xml",
+ stem: "compatibility_matrix.xml",
+ product_specific: true,
+ type: "product_fcm",
+}
+
+// Phony target that installs all framework compatibility matrix files (system + product)
+FRAMEWORK_MATRIX_DEPS = SYSTEM_MATRIX_DEPS + ["product_compatibility_matrix.xml"]
+
+phony {
+ name: "framework_compatibility_matrix.xml",
+ required: FRAMEWORK_MATRIX_DEPS,
+ product_variables: {
+ release_aidl_use_unfrozen: {
+ required: [
+ "framework_compatibility_matrix.202504.xml",
+ ],
+ },
+ },
+}
+
+////////////////////////////////////////////
+// AUTO GENERATED MODULES
+// DO NOT ADD MORE MODULES BELOW THIS LINE
+////////////////////////////////////////////
+
+// System compatibility matrices
vintf_compatibility_matrix {
name: "framework_compatibility_matrix.5.xml",
stem: "compatibility_matrix.5.xml",
@@ -90,58 +149,4 @@
kernel_configs: [
"kernel_config_w_6.next",
],
-
-}
-
-// Device framework compatibility matrix (common to all FCM versions)
-// Reference: https://source.android.com/docs/core/architecture/vintf/comp-matrices
-vintf_compatibility_matrix {
- name: "framework_compatibility_matrix.device.xml",
- stem: "compatibility_matrix.device.xml",
- type: "device_fcm",
-}
-
-// Phony target that installs all system compatibility matrix files
-SYSTEM_MATRIX_DEPS = [
- "framework_compatibility_matrix.5.xml",
- "framework_compatibility_matrix.6.xml",
- "framework_compatibility_matrix.7.xml",
- "framework_compatibility_matrix.8.xml",
- "framework_compatibility_matrix.202404.xml",
- "framework_compatibility_matrix.device.xml",
-]
-
-phony {
- name: "system_compatibility_matrix.xml",
- required: SYSTEM_MATRIX_DEPS,
- product_variables: {
- release_aidl_use_unfrozen: {
- required: [
- "framework_compatibility_matrix.202504.xml",
- ],
- },
- },
-}
-
-// Product Compatibility Matrix
-vintf_compatibility_matrix {
- name: "product_compatibility_matrix.xml",
- stem: "compatibility_matrix.xml",
- product_specific: true,
- type: "product_fcm",
-}
-
-// Phony target that installs all framework compatibility matrix files (system + product)
-FRAMEWORK_MATRIX_DEPS = SYSTEM_MATRIX_DEPS + ["product_compatibility_matrix.xml"]
-
-phony {
- name: "framework_compatibility_matrix.xml",
- required: FRAMEWORK_MATRIX_DEPS,
- product_variables: {
- release_aidl_use_unfrozen: {
- required: [
- "framework_compatibility_matrix.202504.xml",
- ],
- },
- },
}
diff --git a/drm/1.0/vts/functional/Android.bp b/drm/1.0/vts/functional/Android.bp
index e0c6fa5..73612df 100644
--- a/drm/1.0/vts/functional/Android.bp
+++ b/drm/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/drm/1.1/vts/functional/Android.bp b/drm/1.1/vts/functional/Android.bp
index b539fa2..aeb0443 100644
--- a/drm/1.1/vts/functional/Android.bp
+++ b/drm/1.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/drm/1.2/vts/functional/Android.bp b/drm/1.2/vts/functional/Android.bp
index 9ceb1a3..f6fb528 100644
--- a/drm/1.2/vts/functional/Android.bp
+++ b/drm/1.2/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/drm/1.3/vts/functional/Android.bp b/drm/1.3/vts/functional/Android.bp
index 3db23e3..a9ebd80 100644
--- a/drm/1.3/vts/functional/Android.bp
+++ b/drm/1.3/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/drm/1.4/vts/functional/Android.bp b/drm/1.4/vts/functional/Android.bp
index 89edab7..0662a0f 100644
--- a/drm/1.4/vts/functional/Android.bp
+++ b/drm/1.4/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/drm/aidl/vts/Android.bp b/drm/aidl/vts/Android.bp
index 5139036..e813bd1 100644
--- a/drm/aidl/vts/Android.bp
+++ b/drm/aidl/vts/Android.bp
@@ -14,6 +14,7 @@
// limitations under the License.
//
package {
+ default_team: "trendy_team_android_media_drm",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/gnss/1.0/vts/functional/Android.bp b/gnss/1.0/vts/functional/Android.bp
index f27732a..b1093a6 100644
--- a/gnss/1.0/vts/functional/Android.bp
+++ b/gnss/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_location_time",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/gnss/1.1/vts/functional/Android.bp b/gnss/1.1/vts/functional/Android.bp
index f9fcbf1..65c752c 100644
--- a/gnss/1.1/vts/functional/Android.bp
+++ b/gnss/1.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_location_time",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/gnss/2.0/vts/functional/Android.bp b/gnss/2.0/vts/functional/Android.bp
index 0b54308..4ca3063 100644
--- a/gnss/2.0/vts/functional/Android.bp
+++ b/gnss/2.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_location_time",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/gnss/2.1/vts/functional/Android.bp b/gnss/2.1/vts/functional/Android.bp
index 9906b27..af66037 100644
--- a/gnss/2.1/vts/functional/Android.bp
+++ b/gnss/2.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_location_time",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/gnss/aidl/vts/Android.bp b/gnss/aidl/vts/Android.bp
index fd1d853..2bd6f07 100644
--- a/gnss/aidl/vts/Android.bp
+++ b/gnss/aidl/vts/Android.bp
@@ -13,6 +13,7 @@
// limitations under the License.
package {
+ default_team: "trendy_team_location_time",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/health/storage/OWNERS b/health/storage/OWNERS
index 7af8d99..ec1fd8f 100644
--- a/health/storage/OWNERS
+++ b/health/storage/OWNERS
@@ -1,6 +1,9 @@
# Bug component: 30545
+# Don't inherit owners from hardware/interfaces/health/
set noparent
+# But inherit from hardware/interfaces
+include platform/hardware/interfaces:/OWNERS
jaegeuk@google.com
elsk@google.com
diff --git a/keymaster/4.0/vts/performance/Android.bp b/keymaster/4.0/vts/performance/Android.bp
index d7342ad..8f26871 100644
--- a/keymaster/4.0/vts/performance/Android.bp
+++ b/keymaster/4.0/vts/performance/Android.bp
@@ -33,6 +33,5 @@
"android.hardware.keymaster@4.0",
"libkeymaster4support",
"libsoftkeymasterdevice",
- "libchrome"
],
}
diff --git a/keymaster/4.0/vts/performance/Benchmark.cpp b/keymaster/4.0/vts/performance/Benchmark.cpp
index e5fdff2..723b543 100644
--- a/keymaster/4.0/vts/performance/Benchmark.cpp
+++ b/keymaster/4.0/vts/performance/Benchmark.cpp
@@ -16,6 +16,8 @@
#define LOG_TAG "keymaster_benchmark"
+#include <getopt.h>
+
#include <android/hardware/keymaster/4.0/IKeymasterDevice.h>
#include <android/hardware/keymaster/4.0/types.h>
#include <keymaster/keymaster_configuration.h>
@@ -36,8 +38,6 @@
#include <benchmark/benchmark.h>
#include <hidl/Status.h>
-#include <base/command_line.h>
-
namespace android {
namespace hardware {
namespace keymaster {
@@ -700,14 +700,26 @@
} // namespace hardware
} // namespace android
+namespace {
+
+std::string ParseCommandLineFlags(int argc, char** argv) {
+ std::string service_name = "default";
+ static struct option long_options[] = {{"service_name", required_argument, 0, 's'},
+ {0, 0, 0, 0}};
+ int opt;
+ while ((opt = getopt_long(argc, argv, "s:", long_options, nullptr)) != -1) {
+ if (opt == 's') {
+ service_name = optarg;
+ }
+ }
+ return service_name;
+}
+
+} // namespace
+
int main(int argc, char** argv) {
::benchmark::Initialize(&argc, argv);
- base::CommandLine::Init(argc, argv);
- base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
- auto service_name = command_line->GetSwitchValueASCII("service_name");
- if (service_name.empty()) {
- service_name = "default";
- }
+ std::string service_name = ParseCommandLineFlags(argc, argv);
android::hardware::keymaster::V4_0::test::keymaster =
android::hardware::keymaster::V4_0::test::KeymasterWrapper::newInstance(service_name);
if (!android::hardware::keymaster::V4_0::test::keymaster) {
diff --git a/secure_element/1.0/vts/functional/Android.bp b/secure_element/1.0/vts/functional/Android.bp
index 735d7c9..25ce050 100644
--- a/secure_element/1.0/vts/functional/Android.bp
+++ b/secure_element/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_pixel_connectivity_nfc",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/secure_element/1.1/vts/functional/Android.bp b/secure_element/1.1/vts/functional/Android.bp
index d63e7c4..ad7f97c 100644
--- a/secure_element/1.1/vts/functional/Android.bp
+++ b/secure_element/1.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_pixel_connectivity_nfc",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/secure_element/1.2/vts/functional/Android.bp b/secure_element/1.2/vts/functional/Android.bp
index 63a0a19..5a01851 100644
--- a/secure_element/1.2/vts/functional/Android.bp
+++ b/secure_element/1.2/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_pixel_connectivity_nfc",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/secure_element/aidl/Android.bp b/secure_element/aidl/Android.bp
index 655487d..1145305 100644
--- a/secure_element/aidl/Android.bp
+++ b/secure_element/aidl/Android.bp
@@ -1,4 +1,5 @@
package {
+ default_team: "trendy_team_pixel_connectivity_nfc",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/security/keymint/support/fuzzer/keymint_remote_prov_fuzzer.cpp b/security/keymint/support/fuzzer/keymint_remote_prov_fuzzer.cpp
index 6bd986c..9b74fbb 100644
--- a/security/keymint/support/fuzzer/keymint_remote_prov_fuzzer.cpp
+++ b/security/keymint/support/fuzzer/keymint_remote_prov_fuzzer.cpp
@@ -79,9 +79,13 @@
while (mFdp.remaining_bytes()) {
auto invokeProvAPI = mFdp.PickValueInArray<const std::function<void()>>({
- [&]() { verifyFactoryCsr(cborKeysToSign, csr, gRPC.get(), challenge); },
- [&]() { verifyProductionCsr(cborKeysToSign, csr, gRPC.get(), challenge); },
- [&]() { isCsrWithProperDiceChain(csr); },
+ [&]() {
+ verifyFactoryCsr(cborKeysToSign, csr, gRPC.get(), kServiceName, challenge);
+ },
+ [&]() {
+ verifyProductionCsr(cborKeysToSign, csr, gRPC.get(), kServiceName, challenge);
+ },
+ [&]() { isCsrWithProperDiceChain(csr, kServiceName); },
});
invokeProvAPI();
}
diff --git a/security/keymint/support/include/remote_prov/remote_prov_utils.h b/security/keymint/support/include/remote_prov/remote_prov_utils.h
index 141f243..b56c90a 100644
--- a/security/keymint/support/include/remote_prov/remote_prov_utils.h
+++ b/security/keymint/support/include/remote_prov/remote_prov_utils.h
@@ -89,6 +89,11 @@
*/
bytevec randomBytes(size_t numBytes);
+const std::string DEFAULT_INSTANCE_NAME =
+ "android.hardware.security.keymint.IRemotelyProvisionedComponent/default";
+const std::string RKPVM_INSTANCE_NAME =
+ "android.hardware.security.keymint.IRemotelyProvisionedComponent/avf";
+
struct EekChain {
bytevec chain;
bytevec last_pubkey;
@@ -160,7 +165,8 @@
const DeviceInfo& deviceInfo, const cppbor::Array& keysToSign,
const std::vector<uint8_t>& keysToSignMac, const ProtectedData& protectedData,
const EekChain& eekChain, const std::vector<uint8_t>& eekId, int32_t supportedEekCurve,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge);
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge);
/**
* Verify the protected data as if the device is a final production sample.
*/
@@ -168,8 +174,8 @@
const DeviceInfo& deviceInfo, const cppbor::Array& keysToSign,
const std::vector<uint8_t>& keysToSignMac, const ProtectedData& protectedData,
const EekChain& eekChain, const std::vector<uint8_t>& eekId, int32_t supportedEekCurve,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowAnyMode = false);
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowAnyMode = false);
/**
* Verify the CSR as if the device is still early in the factory process and may not
@@ -177,22 +183,24 @@
*/
ErrMsgOr<std::unique_ptr<cppbor::Array>> verifyFactoryCsr(
const cppbor::Array& keysToSign, const std::vector<uint8_t>& csr,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowDegenerate = true);
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowDegenerate = true);
/**
* Verify the CSR as if the device is a final production sample.
*/
ErrMsgOr<std::unique_ptr<cppbor::Array>> verifyProductionCsr(
const cppbor::Array& keysToSign, const std::vector<uint8_t>& csr,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowAnyMode = false);
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowAnyMode = false);
/** Checks whether the CSR has a proper DICE chain. */
-ErrMsgOr<bool> isCsrWithProperDiceChain(const std::vector<uint8_t>& csr);
+ErrMsgOr<bool> isCsrWithProperDiceChain(const std::vector<uint8_t>& csr,
+ const std::string& instanceName);
/** Verify the DICE chain. */
ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc,
hwtrust::DiceChain::Kind kind, bool allowAnyMode,
- bool allowDegenerate);
+ bool allowDegenerate,
+ const std::string& instanceName);
} // namespace aidl::android::hardware::security::keymint::remote_prov
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index a679340..497f478 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -52,6 +52,14 @@
using X509_Ptr = bssl::UniquePtr<X509>;
using CRYPTO_BUFFER_Ptr = bssl::UniquePtr<CRYPTO_BUFFER>;
+std::string device_suffix(const std::string& name) {
+ size_t pos = name.find('/');
+ if (pos == std::string::npos) {
+ return name;
+ }
+ return name.substr(pos + 1);
+}
+
ErrMsgOr<bytevec> ecKeyGetPrivateKey(const EC_KEY* ecKey) {
// Extract private key.
const BIGNUM* bignum = EC_KEY_get0_private_key(ecKey);
@@ -325,7 +333,8 @@
ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc,
hwtrust::DiceChain::Kind kind, bool allowAnyMode,
- bool allowDegenerate) {
+ bool allowDegenerate,
+ const std::string& instanceName) {
auto encodedBcc = bcc->encode();
// Use ro.build.type instead of ro.debuggable because ro.debuggable=1 for VTS testing
@@ -334,7 +343,8 @@
allowAnyMode = true;
}
- auto chain = hwtrust::DiceChain::Verify(encodedBcc, kind, allowAnyMode);
+ auto chain =
+ hwtrust::DiceChain::Verify(encodedBcc, kind, allowAnyMode, device_suffix(instanceName));
if (!chain.ok()) return chain.error().message();
if (!allowDegenerate && !chain->IsProper()) {
@@ -649,8 +659,8 @@
const DeviceInfo& deviceInfo, const cppbor::Array& keysToSign,
const std::vector<uint8_t>& keysToSignMac, const ProtectedData& protectedData,
const EekChain& eekChain, const std::vector<uint8_t>& eekId, int32_t supportedEekCurve,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool isFactory, bool allowAnyMode = false) {
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool isFactory, bool allowAnyMode = false) {
auto [parsedProtectedData, _, protDataErrMsg] = cppbor::parse(protectedData.protectedData);
if (!parsedProtectedData) {
return protDataErrMsg;
@@ -707,7 +717,7 @@
// BCC is [ pubkey, + BccEntry]
auto bccContents = validateBcc(bcc->asArray(), hwtrust::DiceChain::Kind::kVsr13, allowAnyMode,
- /*allowDegenerate=*/true);
+ /*allowDegenerate=*/true, instanceName);
if (!bccContents) {
return bccContents.message() + "\n" + prettyPrint(bcc.get());
}
@@ -750,9 +760,10 @@
const DeviceInfo& deviceInfo, const cppbor::Array& keysToSign,
const std::vector<uint8_t>& keysToSignMac, const ProtectedData& protectedData,
const EekChain& eekChain, const std::vector<uint8_t>& eekId, int32_t supportedEekCurve,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge) {
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge) {
return verifyProtectedData(deviceInfo, keysToSign, keysToSignMac, protectedData, eekChain,
- eekId, supportedEekCurve, provisionable, challenge,
+ eekId, supportedEekCurve, provisionable, instanceName, challenge,
/*isFactory=*/true);
}
@@ -760,10 +771,10 @@
const DeviceInfo& deviceInfo, const cppbor::Array& keysToSign,
const std::vector<uint8_t>& keysToSignMac, const ProtectedData& protectedData,
const EekChain& eekChain, const std::vector<uint8_t>& eekId, int32_t supportedEekCurve,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowAnyMode) {
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowAnyMode) {
return verifyProtectedData(deviceInfo, keysToSign, keysToSignMac, protectedData, eekChain,
- eekId, supportedEekCurve, provisionable, challenge,
+ eekId, supportedEekCurve, provisionable, instanceName, challenge,
/*isFactory=*/false, allowAnyMode);
}
@@ -1003,6 +1014,7 @@
ErrMsgOr<bytevec> parseAndValidateAuthenticatedRequest(const std::vector<uint8_t>& request,
const std::vector<uint8_t>& challenge,
+ const std::string& instanceName,
bool allowAnyMode = false,
bool allowDegenerate = true) {
auto [parsedRequest, _, csrErrMsg] = cppbor::parse(request);
@@ -1042,7 +1054,8 @@
return diceChainKind.message();
}
- auto diceContents = validateBcc(diceCertChain, *diceChainKind, allowAnyMode, allowDegenerate);
+ auto diceContents =
+ validateBcc(diceCertChain, *diceChainKind, allowAnyMode, allowDegenerate, instanceName);
if (!diceContents) {
return diceContents.message() + "\n" + prettyPrint(diceCertChain);
}
@@ -1071,6 +1084,7 @@
ErrMsgOr<std::unique_ptr<cppbor::Array>> verifyCsr(const cppbor::Array& keysToSign,
const std::vector<uint8_t>& csr,
IRemotelyProvisionedComponent* provisionable,
+ const std::string& instanceName,
const std::vector<uint8_t>& challenge,
bool isFactory, bool allowAnyMode = false,
bool allowDegenerate = true) {
@@ -1081,8 +1095,8 @@
") does not match expected version (3).";
}
- auto csrPayload =
- parseAndValidateAuthenticatedRequest(csr, challenge, allowAnyMode, allowDegenerate);
+ auto csrPayload = parseAndValidateAuthenticatedRequest(csr, challenge, instanceName,
+ allowAnyMode, allowDegenerate);
if (!csrPayload) {
return csrPayload.message();
}
@@ -1092,20 +1106,22 @@
ErrMsgOr<std::unique_ptr<cppbor::Array>> verifyFactoryCsr(
const cppbor::Array& keysToSign, const std::vector<uint8_t>& csr,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowDegenerate) {
- return verifyCsr(keysToSign, csr, provisionable, challenge, /*isFactory=*/true,
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowDegenerate) {
+ return verifyCsr(keysToSign, csr, provisionable, instanceName, challenge, /*isFactory=*/true,
/*allowAnyMode=*/false, allowDegenerate);
}
ErrMsgOr<std::unique_ptr<cppbor::Array>> verifyProductionCsr(
const cppbor::Array& keysToSign, const std::vector<uint8_t>& csr,
- IRemotelyProvisionedComponent* provisionable, const std::vector<uint8_t>& challenge,
- bool allowAnyMode) {
- return verifyCsr(keysToSign, csr, provisionable, challenge, /*isFactory=*/false, allowAnyMode);
+ IRemotelyProvisionedComponent* provisionable, const std::string& instanceName,
+ const std::vector<uint8_t>& challenge, bool allowAnyMode) {
+ return verifyCsr(keysToSign, csr, provisionable, instanceName, challenge, /*isFactory=*/false,
+ allowAnyMode);
}
-ErrMsgOr<bool> isCsrWithProperDiceChain(const std::vector<uint8_t>& csr) {
+ErrMsgOr<bool> isCsrWithProperDiceChain(const std::vector<uint8_t>& csr,
+ const std::string& instanceName) {
auto [parsedRequest, _, csrErrMsg] = cppbor::parse(csr);
if (!parsedRequest) {
return csrErrMsg;
@@ -1136,8 +1152,8 @@
}
auto encodedDiceChain = diceCertChain->encode();
- auto chain =
- hwtrust::DiceChain::Verify(encodedDiceChain, *diceChainKind, /*allowAnyMode=*/false);
+ auto chain = hwtrust::DiceChain::Verify(encodedDiceChain, *diceChainKind,
+ /*allowAnyMode=*/false, device_suffix(instanceName));
if (!chain.ok()) return chain.error().message();
return chain->IsProper();
}
diff --git a/security/keymint/support/remote_prov_utils_test.cpp b/security/keymint/support/remote_prov_utils_test.cpp
index 82121cb..8b18b29 100644
--- a/security/keymint/support/remote_prov_utils_test.cpp
+++ b/security/keymint/support/remote_prov_utils_test.cpp
@@ -298,9 +298,11 @@
ASSERT_TRUE(bcc) << "Error: " << errMsg;
EXPECT_TRUE(validateBcc(bcc->asArray(), hwtrust::DiceChain::Kind::kVsr16,
- /*allowAnyMode=*/false, /*allowDegenerate=*/true));
+ /*allowAnyMode=*/false, /*allowDegenerate=*/true,
+ DEFAULT_INSTANCE_NAME));
EXPECT_FALSE(validateBcc(bcc->asArray(), hwtrust::DiceChain::Kind::kVsr16,
- /*allowAnyMode=*/false, /*allowDegenerate=*/false));
+ /*allowAnyMode=*/false, /*allowDegenerate=*/false,
+ DEFAULT_INSTANCE_NAME));
}
} // namespace
} // namespace aidl::android::hardware::security::keymint::remote_prov
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index f68ff91..8f918af 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -55,10 +55,7 @@
constexpr uint8_t MIN_CHALLENGE_SIZE = 0;
constexpr uint8_t MAX_CHALLENGE_SIZE = 64;
-const string DEFAULT_INSTANCE_NAME =
- "android.hardware.security.keymint.IRemotelyProvisionedComponent/default";
-const string RKP_VM_INSTANCE_NAME =
- "android.hardware.security.keymint.IRemotelyProvisionedComponent/avf";
+
const string KEYMINT_STRONGBOX_INSTANCE_NAME =
"android.hardware.security.keymint.IKeyMintDevice/strongbox";
@@ -188,7 +185,7 @@
}
ASSERT_NE(provisionable_, nullptr);
auto status = provisionable_->getHardwareInfo(&rpcHardwareInfo);
- isRkpVmInstance_ = GetParam() == RKP_VM_INSTANCE_NAME;
+ isRkpVmInstance_ = GetParam() == RKPVM_INSTANCE_NAME;
if (isRkpVmInstance_) {
if (status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
GTEST_SKIP() << "The RKP VM is not supported on this system.";
@@ -227,7 +224,7 @@
RpcHardwareInfo hwInfo;
auto status = rpc->getHardwareInfo(&hwInfo);
- if (hal == RKP_VM_INSTANCE_NAME && status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
+ if (hal == RKPVM_INSTANCE_NAME && status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
GTEST_SKIP() << "The RKP VM is not supported on this system.";
}
ASSERT_TRUE(status.isOk());
@@ -268,7 +265,7 @@
auto status = rpc->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);
EXPECT_TRUE(status.isOk()) << status.getDescription();
- auto result = isCsrWithProperDiceChain(csr);
+ auto result = isCsrWithProperDiceChain(csr, DEFAULT_INSTANCE_NAME);
ASSERT_TRUE(result) << result.message();
ASSERT_TRUE(*result);
}
@@ -494,7 +491,7 @@
auto result = verifyProductionProtectedData(
deviceInfo, cppbor::Array(), keysToSignMac, protectedData, testEekChain_, eekId_,
- rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ rpcHardwareInfo.supportedEekCurve, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -517,9 +514,10 @@
&protectedData, &keysToSignMac);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto firstBcc = verifyProductionProtectedData(
- deviceInfo, /*keysToSign=*/cppbor::Array(), keysToSignMac, protectedData, testEekChain_,
- eekId_, rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ auto firstBcc = verifyProductionProtectedData(deviceInfo, /*keysToSign=*/cppbor::Array(),
+ keysToSignMac, protectedData, testEekChain_,
+ eekId_, rpcHardwareInfo.supportedEekCurve,
+ provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(firstBcc) << firstBcc.message();
status = provisionable_->generateCertificateRequest(
@@ -527,9 +525,10 @@
&protectedData, &keysToSignMac);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto secondBcc = verifyProductionProtectedData(
- deviceInfo, /*keysToSign=*/cppbor::Array(), keysToSignMac, protectedData, testEekChain_,
- eekId_, rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ auto secondBcc = verifyProductionProtectedData(deviceInfo, /*keysToSign=*/cppbor::Array(),
+ keysToSignMac, protectedData, testEekChain_,
+ eekId_, rpcHardwareInfo.supportedEekCurve,
+ provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(secondBcc) << secondBcc.message();
// Verify that none of the keys in the first BCC are repeated in the second one.
@@ -579,7 +578,7 @@
auto result = verifyProductionProtectedData(
deviceInfo, cborKeysToSign_, keysToSignMac, protectedData, testEekChain_, eekId_,
- rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ rpcHardwareInfo.supportedEekCurve, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -767,8 +766,8 @@
provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), challenge,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), GetParam(),
+ challenge, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -789,8 +788,8 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -820,15 +819,15 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto firstCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto firstCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(firstCsr) << firstCsr.message();
status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto secondCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto secondCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(secondCsr) << secondCsr.message();
ASSERT_EQ(**firstCsr, **secondCsr);
@@ -846,8 +845,8 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
@@ -977,7 +976,8 @@
provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge_, &csr);
ASSERT_TRUE(irpcStatus.isOk()) << irpcStatus.getDescription();
- auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), challenge_);
+ auto result =
+ verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
std::unique_ptr<cppbor::Array> csrPayload = std::move(*result);
diff --git a/soundtrigger/2.0/vts/functional/Android.bp b/soundtrigger/2.0/vts/functional/Android.bp
index 403fa9b..dde1aa1 100644
--- a/soundtrigger/2.0/vts/functional/Android.bp
+++ b/soundtrigger/2.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_audio_framework",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/soundtrigger/2.1/vts/functional/Android.bp b/soundtrigger/2.1/vts/functional/Android.bp
index b013350..3e475e6 100644
--- a/soundtrigger/2.1/vts/functional/Android.bp
+++ b/soundtrigger/2.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_audio_framework",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/soundtrigger/2.2/vts/functional/Android.bp b/soundtrigger/2.2/vts/functional/Android.bp
index faf6d58..3502545 100644
--- a/soundtrigger/2.2/vts/functional/Android.bp
+++ b/soundtrigger/2.2/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_audio_framework",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/soundtrigger/2.3/vts/functional/Android.bp b/soundtrigger/2.3/vts/functional/Android.bp
index e613db5..23cbe85 100644
--- a/soundtrigger/2.3/vts/functional/Android.bp
+++ b/soundtrigger/2.3/vts/functional/Android.bp
@@ -15,6 +15,7 @@
//
package {
+ default_team: "trendy_team_android_media_audio_framework",
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.xml b/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.xml
index 0525876..b5eb843 100644
--- a/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.xml
+++ b/threadnetwork/aidl/vts/VtsHalThreadNetworkTargetTest.xml
@@ -13,11 +13,12 @@
See the License for the specific language governing permissions and
limitations under the License.
-->
+
<configuration description="Runs VtsHalThreadNetworkTargetTest.">
<target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
- <option name="run-command" value="cmd thread_network force-stop-ot-daemon enabled" />
+ <option name="run-command" value="if pm list features |grep 'android.hardware.thread_network'; then cmd thread_network force-stop-ot-daemon enabled; fi" />
<option name="run-command" value="cmd bluetooth_manager enable" />
- <option name="teardown-command" value="cmd thread_network force-stop-ot-daemon disabled" />
+ <option name="teardown-command" value="if pm list features |grep 'android.hardware.thread_network'; then cmd thread_network force-stop-ot-daemon disabled; fi" />
</target_preparer>
<target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
<option name="cleanup" value="true" />