commit bc5180be775c8831ae26cea58b0d5e4d4bb73a46
author Alice Wang <aliceywang@google.com> Tue Feb 14 16:04:55 2023 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Feb 14 16:04:55 2023 +0000
tree 963f04e21690b26e1bbb240bfc8d214b33b4ac14
parent b44d673088f753051254ea6b5f72aaa746cfe668
parent 8722d9e0d3f2e63a5b9efa3b68784d9d56a7dffc

Merge "[dice] Move DiceSign/Verify nostd/std versions to diced_open_dice"

diced/open_dice/src/bcc.rs

diff --git a/diced/open_dice/src/bcc.rs b/diced/open_dice/src/bcc.rs
index e3a96fe..3e48215 100644
--- a/diced/open_dice/src/bcc.rs
+++ b/diced/open_dice/src/bcc.rs
@@ -17,8 +17,8 @@
 use crate::dice::{Cdi, CdiValues, InputValues};
 use crate::error::{check_result, Result};
 use open_dice_bcc_bindgen::{
-    BccConfigValues, BccFormatConfigDescriptor, BccMainFlow, BCC_INPUT_COMPONENT_NAME,
-    BCC_INPUT_COMPONENT_VERSION, BCC_INPUT_RESETTABLE,
+    BccConfigValues, BccFormatConfigDescriptor, BccHandoverMainFlow, BccMainFlow,
+    BCC_INPUT_COMPONENT_NAME, BCC_INPUT_COMPONENT_VERSION, BCC_INPUT_RESETTABLE,
 };
 use std::{ffi::CStr, ptr};
 
@@ -90,3 +90,33 @@
     })?;
     Ok(next_bcc_size)
 }
+
+/// Executes the main BCC handover flow.
+///
+/// A BCC handover combines the BCC and CDIs in a single CBOR object.
+/// This function takes the current boot stage's BCC handover bundle and produces a
+/// bundle for the next stage.
+pub fn bcc_handover_main_flow(
+    current_bcc_handover: &[u8],
+    input_values: &InputValues,
+    next_bcc_handover: &mut [u8],
+) -> Result<usize> {
+    let mut next_bcc_handover_size = 0;
+    // SAFETY - The function only reads `current_bcc_handover` and writes to `next_bcc_handover`
+    // within its bounds,
+    // It also reads `input_values` as a constant input and doesn't store any pointer.
+    // The first argument can be null and is not used in the current implementation.
+    check_result(unsafe {
+        BccHandoverMainFlow(
+            ptr::null_mut(), // context
+            current_bcc_handover.as_ptr(),
+            current_bcc_handover.len(),
+            input_values.as_ptr(),
+            next_bcc_handover.len(),
+            next_bcc_handover.as_mut_ptr(),
+            &mut next_bcc_handover_size,
+        )
+    })?;
+
+    Ok(next_bcc_handover_size)
+}

diced/open_dice/src/lib.rs

diff --git a/diced/open_dice/src/lib.rs b/diced/open_dice/src/lib.rs
index 7e08956..b2a944a 100644
--- a/diced/open_dice/src/lib.rs
+++ b/diced/open_dice/src/lib.rs
@@ -27,7 +27,7 @@
 #[cfg(feature = "std")]
 mod retry;
 
-pub use bcc::{bcc_format_config_descriptor, bcc_main_flow};
+pub use bcc::{bcc_format_config_descriptor, bcc_handover_main_flow, bcc_main_flow};
 pub use dice::{
     derive_cdi_certificate_id, derive_cdi_private_key_seed, dice_main_flow, Cdi, CdiValues, Config,
     DiceMode, Hash, Hidden, InlineConfig, InputValues, PrivateKeySeed, CDI_SIZE, HASH_SIZE,

identity/CredentialStore.cpp

diff --git a/identity/CredentialStore.cpp b/identity/CredentialStore.cpp
index fea4df9..e2b3cf4 100644
--- a/identity/CredentialStore.cpp
+++ b/identity/CredentialStore.cpp
@@ -47,7 +47,7 @@
 
 bool useRkpd() {
     return android::base::GetBoolProperty("remote_provisioning.enable_rkpd",
-                                          /*default_value=*/false);
+                                          /*default_value=*/true);
 }
 
 }  // namespace

keystore2/src/attestation_key_utils.rs

diff --git a/keystore2/src/attestation_key_utils.rs b/keystore2/src/attestation_key_utils.rs
index d31fa82..8c4cdea 100644
--- a/keystore2/src/attestation_key_utils.rs
+++ b/keystore2/src/attestation_key_utils.rs
@@ -54,11 +54,9 @@
 }
 
 fn use_rkpd() -> bool {
-    let mutable_property = "persist.device_config.remote_key_provisioning_native.enable_rkpd";
-    let fixed_property = "remote_provisioning.enable_rkpd";
-    let default_value = false;
-    system_properties::read_bool(mutable_property, default_value).unwrap_or(default_value)
-        || system_properties::read_bool(fixed_property, default_value).unwrap_or(default_value)
+    let property = "remote_provisioning.enable_rkpd";
+    let default_value = true;
+    system_properties::read_bool(property, default_value).unwrap_or(default_value)
 }
 
 /// This function loads and, optionally, assigns the caller's remote provisioned