• State
  • Locked Locked
  • Replies 1 reply
  • Subscribers 98 subscribers
  • Views 233 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

SK-AM62P-LP: OP-TEE KeyMint HAL version mismatch (v3.0 vs v4.0) causing Android Keystore key generation failure on AAOS 16

Binil S
Prodigy 110 points

Part Number: SK-AM62P-LP
Other Parts Discussed in Thread: AM62P

Hi TI Team,

I am working on SK AM62P LP  running AAOS 16 (Android 16, Linux kernel 6.12.23-android16) and facing a critical issue with Android Keystore key generation. The OP-TEE KeyMint HAL version does not match what AAOS 16's Keystore2 expects, causing all key pair generation to fail.

Environment:

  • Board: SK AM62P LP 
  • OS: AAOS 16 (Android Automotive OS 16)
  • Kernel: 6.12.23-android16-5
  • OP-TEE version: 4.7 (86846f4fdf14f25b) (from boot log)
  • KeyMint HAL: android.hardware.security.keymint-service.optee

Problem:

When I call KeyPairGenerator.generateKeyPair() using AndroidKeyStore provider in Java, it consistently fails with:

java.security.ProviderException: Failed to construct key object from newly generated key pair.
Caused by: java.security.UnrecoverableKeyException:
           Failed to obtain X.509 form of public key. Keystore has no public certificate stored.

Root Cause Identified:

From the boot log, I can clearly see a version mismatch:

# OP-TEE KeyMint HAL reports itself as version 3.0:
optee_keymaster_hal: Initializing OpteeKeymaster as KmVersion: 300

# But AAOS 16 Keystore2 registers it as version 4.0:
keystore2: KeyMint device is current version (Some(400)) for security level: TRUSTED_ENVIRONMENT

The OP-TEE KeyMint Trusted Application (TA) is running as KmVersion 300 (KeyMint 3.0), but AAOS 16's Keystore2 expects KeyMint 4.0 (version 400). Due to this mismatch, the key generation response from OP-TEE cannot be correctly parsed by Keystore2 — the X.509 certificate is never stored, and key pair construction fails.

Additionally, during initial boot, we observed the key generation request hitting a watchdog timeout (over 5 seconds) and the following error from the OP-TEE IPC layer:

OpteeKeymaster_ipc: Request too big: 4622  Max size: 4076
optee_keymaster_hal: Cmd 88 returned error: -21
keystore2: Error::Km(r#INVALID_INPUT_LENGTH)

This indicates the OP-TEE IPC buffer size of 4076 bytes is also insufficient for the key generation request payload on this BSP build.

  1. is the recommended approach for using Android Keystore (AndroidKeyStore provider) for hardware-backed key generation on AM62P with AAOS 16?
  2. Is there an official release that has this KeyMint version mismatch resolved?
  3. Is there an updated OP-TEE KeyMint TA available for AM62P that supports KeyMint 4.0 (KmVersion 400) to be compatible with AAOS 16