jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(intercept): restore updateAad SSE injection

Browse Source 
Reverts 180dc03. The updateAad SSE injection landed earlier as
the F1 quirk fix and was part of the score-4 baseline on mt6768.
It was reverted in error during the score-4-to-14 rollback; the
actual regression driver was the uncommitted DELETE_KEY absorber
which has already been dropped. Restoring to match the working
baseline.
This commit is contained in:
Enginex0
2026-05-19 14:35:12 +01:00
parent 180dc039cd
commit 9a7e4d7251
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+2 -1
View File
@@ -194,7 +194,8 @@ class KeyMintSecurityLevelInterceptor(
SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...") SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...")
val backdoor = getBackdoor(target) val backdoor = getBackdoor(target)
if (backdoor != null) { if (backdoor != null) {
val interceptor = OperationInterceptor(operation, backdoor) val isAead = parsedParams.blockMode.firstOrNull() == BlockMode.GCM
val interceptor = OperationInterceptor(operation, backdoor, isAead)
register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES) register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES)
interceptedOperations[operationBinder] = interceptor interceptedOperations[operationBinder] = interceptor
} else { } else {
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
+7 -1
View File
@@ -13,6 +13,7 @@ import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
class OperationInterceptor( class OperationInterceptor(
private val original: IKeystoreOperation, private val original: IKeystoreOperation,
private val backdoor: IBinder, private val backdoor: IBinder,
private val isAead: Boolean,
) : BinderInterceptor() { ) : BinderInterceptor() {
override fun onPreTransact( override fun onPreTransact(
@@ -27,6 +28,10 @@ class OperationInterceptor(
val methodName = transactionNames[code] ?: "unknown code=$code" val methodName = transactionNames[code] ?: "unknown code=$code"
logTransaction(txId, methodName, callingUid, callingPid, true) logTransaction(txId, methodName, callingUid, callingPid, true)
if (code == UPDATE_AAD_TRANSACTION && !isAead) {
return InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
}
if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) { if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) {
KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor) KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor)
} }
@@ -44,7 +49,8 @@ class OperationInterceptor(
private val ABORT_TRANSACTION = private val ABORT_TRANSACTION =
InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort") InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION) val INTERCEPTED_CODES =
intArrayOf(UPDATE_AAD_TRANSACTION, FINISH_TRANSACTION, ABORT_TRANSACTION)
private val transactionNames: Map<Int, String> by lazy { private val transactionNames: Map<Int, String> by lazy {
IKeystoreOperation.Stub::class IKeystoreOperation.Stub::class