tree 7361cb70c26016895cb2f903d99edf85597ef58d
parent f5446a0200ad1c9042dc40acf483f7bb5bf26d00
author David Drysdale <drysdale@google.com> 1643231028 -0800
committer David Drysdale <drysdale@google.com> 1644432831 +0000

Implement a back-level KeyMint compatibility wrapper

 - Implement a general back-level KeyMint wrapper, which forwards
   requests to either a back-level real device, or an up-level
   software device. Keyblobs from the latter are given a marker
   prefix and an authentication suffix.
 - Add an FFI wrapper function to allow calculation of HMAC-SHA256,
   so this can be used to give an authenticated suffix to wrapped
   keyblobs.
 - Abstract out the decision process for whether emulation is required
   to a EmulationDetector trait, and provide implementations for
   KeyMint V1 and for a km_compat-wrapped Keymaster.
 - Impose the KeyMint V1 wrapper whenever the real device is detected to
   be a V1 implementation.
 - Add support to the IKeystoreCompatService for returning a device for
   SecurityLevel::SOFTWARE. This device will always be the most recent
   KeyMint version.
 - Clarify what level of IKeyMint implementation gets returned from
   the IKeystoreCompatService for the other security levels.
 - Add an inner function to the km_compat code to allow unit tests
   to still work.

Co-authored-by: Janis Danisevskis <jdanis@google.com>
Bug: 194358913
Test: CtsKeystoreTestCases on oriole/bramble/cuttlefish
Change-Id: I297e8ad1cf00fd15cd5358b2760cd2ca88f53abb