OemLock.cpp

#include "OemLock.h"

#include <android-base/properties.h>
#include <android-base/logging.h>
#include <cstring>

namespace aidl {
namespace android {
namespace hardware {
namespace oemlock {

const char* OemLock::kCarrierUnlockProp = "ro.boot.carrier_unlock_allowed";
const char* OemLock::kDeviceUnlockProp = "persist.vendor.oemlock.device_unlock_allowed";
const char* OemLock::kUnlockAbilityProp = "fastboot.unlock_ability";

OemLock::OemLock() : mAllowedByCarrier(false), mAllowedByDevice(false), mTeeInitialized(false) {
    // Initialize TEE context for TA AVB communication first
    if (!initTeeContext()) {
        LOG(WARNING) << "Failed to initialize TEE context, using fallback mode";
    }
    
    // Initialize from persistent properties
    mAllowedByCarrier = isCarrierUnlockAllowed();
    mAllowedByDevice = isDeviceUnlockAllowed();
    
    // Verify consistency with TA AVB persist storage
    uint32_t unlock_ability_value;
    if (readPersistValue(UNLOCK_ABILITY_KEY, &unlock_ability_value)) {
        bool combined_unlock_ability = (unlock_ability_value == 1);
        bool expected_combined = mAllowedByCarrier && mAllowedByDevice;
        
        if (combined_unlock_ability != expected_combined) {
            LOG(INFO) << "Syncing unlock ability: TA AVB=" << unlock_ability_value 
                     << ", expected=" << (expected_combined ? "1" : "0")
                     << " (carrier=" << (mAllowedByCarrier ? "true" : "false")
                     << ", device=" << (mAllowedByDevice ? "true" : "false") << ")";
            
            // Sync the TA AVB value with the current state
            writePersistValue(UNLOCK_ABILITY_KEY, expected_combined ? 1 : 0);
        }
    } else {
        // Initialize TA AVB with current state if not found
        bool expected_combined = mAllowedByCarrier && mAllowedByDevice;
        writePersistValue(UNLOCK_ABILITY_KEY, expected_combined ? 1 : 0);
        LOG(INFO) << "Initialized TA AVB unlock ability to " << (expected_combined ? "1" : "0");
    }
    
    LOG(INFO) << "OPTEE OemLock HAL initialized (carrier=" 
              << (mAllowedByCarrier ? "true" : "false") 
              << ", device=" << (mAllowedByDevice ? "true" : "false") << ")";
}

OemLock::~OemLock() {
    cleanupTeeContext();
}

::ndk::ScopedAStatus OemLock::getName(std::string* out_name) {
    *out_name = "OPTEE OemLock HAL";
    return ::ndk::ScopedAStatus::ok();
}

::ndk::ScopedAStatus OemLock::setOemUnlockAllowedByCarrier(bool in_allowed, const std::vector<uint8_t>& in_signature, OemLockSecureStatus* _aidl_return) {
    // For Optee implementation, we don't verify carrier signature
    // In production, this should verify the carrier signature
    LOG(INFO) << "setOemUnlockAllowedByCarrier: " << (in_allowed ? "true" : "false");
    
    if (!setCarrierUnlockAllowed(in_allowed)) {
        LOG(ERROR) << "Failed to set carrier unlock allowed";
        *_aidl_return = OemLockSecureStatus::FAILED;
        return ::ndk::ScopedAStatus::ok();
    }
    
    mAllowedByCarrier = in_allowed;
    *_aidl_return = OemLockSecureStatus::OK;
    return ::ndk::ScopedAStatus::ok();
}

::ndk::ScopedAStatus OemLock::isOemUnlockAllowedByCarrier(bool* out_allowed) {
    *out_allowed = mAllowedByCarrier;
    LOG(INFO) << "isOemUnlockAllowedByCarrier: " << (*out_allowed ? "true" : "false");
    return ::ndk::ScopedAStatus::ok();
}

::ndk::ScopedAStatus OemLock::setOemUnlockAllowedByDevice(bool in_allowed) {
    LOG(INFO) << "setOemUnlockAllowedByDevice: " << (in_allowed ? "true" : "false");
    
    mAllowedByDevice = in_allowed;
    
    // Calculate final unlock state
    bool combined_allowed = mAllowedByCarrier && mAllowedByDevice;
    
    // Write unlock ability directly to TA AVB persist storage
    uint32_t unlock_ability_value = combined_allowed ? 1 : 0;
    if (!writePersistValue(UNLOCK_ABILITY_KEY, unlock_ability_value)) {
        LOG(ERROR) << "Failed to set unlock ability in TA AVB persist storage";
        return ::ndk::ScopedAStatus::fromServiceSpecificError(-1);
    }
    
    // Also write to legacy lock state for backward compatibility
    uint32_t lock_state = combined_allowed ? 0 : 1;
    if (!invokeAvbCommand(TA_AVB_CMD_WRITE_LOCK_STATE, &lock_state, true)) {
        LOG(WARNING) << "Failed to set legacy lock state in TA AVB";
        // Don't fail here, persist value is the primary mechanism
    }
    
    // Persist in Android property for consistency
    if (!setDeviceUnlockAllowed(in_allowed)) {
        LOG(WARNING) << "Failed to persist device unlock property";
    }
    
    // Remove dependency on environment variable - U-Boot now reads from TA AVB
    LOG(INFO) << "TA AVB unlock_ability set to: " << unlock_ability_value 
              << " (combined: carrier=" << (mAllowedByCarrier ? "true" : "false")
              << ", device=" << (mAllowedByDevice ? "true" : "false") << ")";
    
    return ::ndk::ScopedAStatus::ok();
}

::ndk::ScopedAStatus OemLock::isOemUnlockAllowedByDevice(bool* out_allowed) {
    // Read unlock ability directly from TA AVB persist storage
    uint32_t unlock_ability_value;
    if (readPersistValue(UNLOCK_ABILITY_KEY, &unlock_ability_value)) {
        // Extract device state from combined unlock ability
        // Since unlock_ability = carrier_allowed && device_allowed
        // we need to verify against our cached state
        bool combined_unlock_ability = (unlock_ability_value == 1);
        
        // For device unlock, return cached device state
        // The persist value shows the combined result
        *out_allowed = mAllowedByDevice;
        
        LOG(INFO) << "TA AVB unlock_ability: " << unlock_ability_value 
                  << ", device_allowed: " << (*out_allowed ? "true" : "false")
                  << ", carrier_allowed: " << (mAllowedByCarrier ? "true" : "false")
                  << ", combined_result: " << (combined_unlock_ability ? "true" : "false");
                  
        // Verify consistency
        bool expected_combined = mAllowedByCarrier && mAllowedByDevice;
        if (combined_unlock_ability != expected_combined) {
            LOG(WARNING) << "Inconsistency detected: persist value says " 
                        << (combined_unlock_ability ? "unlocked" : "locked")
                        << " but local state suggests " 
                        << (expected_combined ? "unlocked" : "locked");
        }
    } else {
        // Fallback on cached value
        *out_allowed = mAllowedByDevice;
        LOG(WARNING) << "Failed to read unlock ability from TA AVB, using cached value";
    }
    
    return ::ndk::ScopedAStatus::ok();
}

bool OemLock::isCarrierUnlockAllowed() {
    return ::android::base::GetBoolProperty(kCarrierUnlockProp, true);
}

bool OemLock::isDeviceUnlockAllowed() {
    return ::android::base::GetBoolProperty(kDeviceUnlockProp, false);
}

bool OemLock::setCarrierUnlockAllowed(bool allowed) {
    // For Production implementation, carrier unlock property is read-only
    // It should be set during manufacturing/provisioning
    LOG(WARNING) << "Carrier unlock property is read-only";
    return true;
}

bool OemLock::setDeviceUnlockAllowed(bool allowed) {
    std::string value = allowed ? "true" : "false";
    return ::android::base::SetProperty(kDeviceUnlockProp, value);
}

bool OemLock::getDeviceLockState(bool* locked) {
    // Read device lock state from bootloader/TA AVB
    // This implementation reads from a property that should be set
    // by the bootloader based on TA AVB state
    
    std::string lock_state = ::android::base::GetProperty("ro.boot.flash.locked", "1");
    *locked = (lock_state == "1");
    
    LOG(INFO) << "Device lock state: " << (*locked ? "LOCKED" : "UNLOCKED");
    return true;
}

bool OemLock::setDeviceLockState(bool locked) {
    // Device lock state is controlled by bootloader via fastboot commands
    // This HAL doesn't directly control the device lock state
    LOG(WARNING) << "Device lock state is controlled by bootloader";
    return true;
}

bool OemLock::initTeeContext() {
    if (mTeeInitialized) return true;
    
    TEEC_Result result = TEEC_InitializeContext(nullptr, &mTeeContext);
    if (result != TEEC_SUCCESS) {
        LOG(ERROR) << "Failed to initialize TEE context: " << std::hex << result;
        return false;
    }
    
    mTeeInitialized = true;
    LOG(INFO) << "TEE context initialized successfully";
    return true;
}

void OemLock::cleanupTeeContext() {
    if (mTeeInitialized) {
        TEEC_FinalizeContext(&mTeeContext);
        mTeeInitialized = false;
        LOG(INFO) << "TEE context finalized";
    }
}

bool OemLock::invokeAvbCommand(uint32_t cmd, uint32_t *lock_state, bool write) {
    if (!initTeeContext()) return false;
    
    TEEC_Session session;
    TEEC_Operation operation;
    TEEC_Result result;
    
    // Open session with TA AVB
    memset(&operation, 0, sizeof(operation));
    result = TEEC_OpenSession(&mTeeContext, &session, &TA_AVB_UUID,
                              TEEC_LOGIN_PUBLIC, nullptr, nullptr, nullptr);
    if (result != TEEC_SUCCESS) {
        LOG(ERROR) << "Failed to open TA AVB session: " << std::hex << result;
        return false;
    }
    
    // Prepare operation
    memset(&operation, 0, sizeof(operation));
    operation.paramTypes = TEEC_PARAM_TYPES(
        write ? TEEC_VALUE_INPUT : TEEC_VALUE_OUTPUT,
        TEEC_NONE, TEEC_NONE, TEEC_NONE);
    
    if (write) {
        operation.params[0].value.a = *lock_state;
        LOG(INFO) << "Writing lock_state " << *lock_state << " to TA AVB";
    }
    
    // Invoke TA command
    result = TEEC_InvokeCommand(&session, cmd, &operation, nullptr);
    
    if (result == TEEC_SUCCESS) {
        if (!write) {
            *lock_state = operation.params[0].value.a;
            LOG(INFO) << "Read lock_state " << *lock_state << " from TA AVB";
        }
        LOG(INFO) << "TA AVB command " << cmd << " executed successfully";
    } else {
        LOG(ERROR) << "TA AVB command " << cmd << " failed: " << std::hex << result;
    }
    
    TEEC_CloseSession(&session);
    return (result == TEEC_SUCCESS);
}

bool OemLock::readPersistValue(const char* key, uint32_t* value) {
    if (!initTeeContext()) return false;
    
    TEEC_Session session;
    TEEC_Operation operation;
    TEEC_Result result;
    
    // Open session with TA AVB
    memset(&operation, 0, sizeof(operation));
    result = TEEC_OpenSession(&mTeeContext, &session, &TA_AVB_UUID,
                              TEEC_LOGIN_PUBLIC, nullptr, nullptr, nullptr);
    if (result != TEEC_SUCCESS) {
        LOG(ERROR) << "Failed to open TA AVB session: " << std::hex << result;
        return false;
    }
    
    // Prepare operation for reading persist value
    memset(&operation, 0, sizeof(operation));
    operation.paramTypes = TEEC_PARAM_TYPES(
        TEEC_MEMREF_TEMP_INPUT,   // key name
        TEEC_MEMREF_TEMP_INOUT,   // value buffer
        TEEC_NONE, TEEC_NONE);
    
    // Set key name
    operation.params[0].tmpref.buffer = (void*)key;
    operation.params[0].tmpref.size = strlen(key);
    
    // Set value buffer
    operation.params[1].tmpref.buffer = value;
    operation.params[1].tmpref.size = sizeof(*value);
    
    // Invoke TA command
    result = TEEC_InvokeCommand(&session, TA_AVB_CMD_READ_PERSIST_VALUE, &operation, nullptr);
    
    if (result == TEEC_SUCCESS) {
        LOG(INFO) << "Read persist value '" << key << "': " << *value;
    } else if (result == TEEC_ERROR_ITEM_NOT_FOUND) {
        LOG(INFO) << "Persist value '" << key << "' not found, using default";
        *value = 0; // Default value
        result = TEEC_SUCCESS;
    } else {
        LOG(ERROR) << "Failed to read persist value '" << key << "': " << std::hex << result;
    }
    
    TEEC_CloseSession(&session);
    return (result == TEEC_SUCCESS);
}

bool OemLock::writePersistValue(const char* key, uint32_t value) {
    if (!initTeeContext()) return false;
    
    TEEC_Session session;
    TEEC_Operation operation;
    TEEC_Result result;
    
    // Open session with TA AVB
    memset(&operation, 0, sizeof(operation));
    result = TEEC_OpenSession(&mTeeContext, &session, &TA_AVB_UUID,
                              TEEC_LOGIN_PUBLIC, nullptr, nullptr, nullptr);
    if (result != TEEC_SUCCESS) {
        LOG(ERROR) << "Failed to open TA AVB session: " << std::hex << result;
        return false;
    }
    
    // Prepare operation for writing persist value
    memset(&operation, 0, sizeof(operation));
    operation.paramTypes = TEEC_PARAM_TYPES(
        TEEC_MEMREF_TEMP_INPUT,   // key name
        TEEC_MEMREF_TEMP_INPUT,   // value to write
        TEEC_NONE, TEEC_NONE);
    
    // Set key name
    operation.params[0].tmpref.buffer = (void*)key;
    operation.params[0].tmpref.size = strlen(key);
    
    // Set value to write
    operation.params[1].tmpref.buffer = &value;
    operation.params[1].tmpref.size = sizeof(value);
    
    // Invoke TA command
    result = TEEC_InvokeCommand(&session, TA_AVB_CMD_WRITE_PERSIST_VALUE, &operation, nullptr);
    
    if (result == TEEC_SUCCESS) {
        LOG(INFO) << "Wrote persist value '" << key << "': " << value;
    } else {
        LOG(ERROR) << "Failed to write persist value '" << key << "': " << std::hex << result;
    }
    
    TEEC_CloseSession(&session);
    return (result == TEEC_SUCCESS);
}

}  // namespace oemlock
}  // namespace hardware
}  // namespace android
}  // namespace aidl