Re: [PATCH v2 00/10] Hardware wrapped key support for qcom ice and ufs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 19/07/2023 18:04, Gaurav Kashyap wrote:
These patches add support to Qualcomm ICE (Inline Crypto Enginr) for hardware
wrapped keys using Qualcomm Hardware Key Manager (HWKM) and are made on top
of a rebased version  Eric Bigger's set of changes to support wrapped keys in
fscrypt and block below:
https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=wrapped-keys-v7
(The rebased patches are not uploaded here)

Ref v1 here:
https://lore.kernel.org/linux-scsi/20211206225725.77512-1-quic_gaurkash@xxxxxxxxxxx/

Explanation and use of hardware-wrapped-keys can be found here:
Documentation/block/inline-encryption.rst

This patch is organized as follows:

Patch 1 - Prepares ICE and storage layers (UFS and EMMC) to pass around wrapped keys.
Patch 2 - Adds a new SCM api to support deriving software secret when wrapped keys are used
Patch 3-4 - Adds support for wrapped keys in the ICE driver. This includes adding HWKM support
Patch 5-6 - Adds support for wrapped keys in UFS
Patch 7-10 - Supports generate, prepare and import functionality in ICE and UFS

NOTE: MMC will have similar changes to UFS and will be uploaded in a different patchset
       Patch 3, 4, 8, 10 will have MMC equivalents.

Testing:
Test platform: SM8550 MTP
Engineering trustzone image is required to test this feature only
for SM8550. For SM8650 onwards, all trustzone changes to support this
will be part of the released images.

AFAIU, Prior to these proposed changes in scm, HWKM was done with help of TA(Trusted Application) for generate, import, unwrap ... functionality.

1. What is the reason for moving this from TA to new smc calls?

Is this because of missing smckinvoke support in upstream?

How scalable is this approach? Are we going to add new sec sys calls to every interface to TA?

2. How are the older SoCs going to deal with this, given that you are changing drivers that are common across these?

Have you tested these patches on any older platforms?

What happens if someone want to add support to wrapped keys to this platforms in upstream, How is that going to be handled?

As I understand with this, we will endup with two possible solutions over time in upstream.


thanks,
--srini

The engineering changes primarily contain hooks to generate, import and
prepare keys for HW wrapped disk encryption.

The changes were tested by mounting initramfs and running the fscryptctl
tool (Ref: https://github.com/ebiggers/fscryptctl/tree/wip-wrapped-keys) to
generate and prepare keys, as well as to set policies on folders, which
consequently invokes disk encryption flows through UFS.

Gaurav Kashyap (10):
   ice, ufs, mmc: use blk_crypto_key for program_key
   qcom_scm: scm call for deriving a software secret
   soc: qcom: ice: add hwkm support in ice
   soc: qcom: ice: support for hardware wrapped keys
   ufs: core: support wrapped keys in ufs core
   ufs: host: wrapped keys support in ufs qcom
   qcom_scm: scm call for create, prepare and import keys
   ufs: core: add support for generate, import and prepare keys
   soc: qcom: support for generate, import and prepare key
   ufs: host: support for generate, import and prepare key

  drivers/firmware/qcom_scm.c            | 292 +++++++++++++++++++++++
  drivers/firmware/qcom_scm.h            |   4 +
  drivers/mmc/host/cqhci-crypto.c        |   7 +-
  drivers/mmc/host/cqhci.h               |   2 +
  drivers/mmc/host/sdhci-msm.c           |   6 +-
  drivers/soc/qcom/ice.c                 | 309 +++++++++++++++++++++++--
  drivers/ufs/core/ufshcd-crypto.c       |  92 +++++++-
  drivers/ufs/host/ufs-qcom.c            |  63 ++++-
  include/linux/firmware/qcom/qcom_scm.h |  13 ++
  include/soc/qcom/ice.h                 |  18 +-
  include/ufs/ufshcd.h                   |  25 ++
  11 files changed, 797 insertions(+), 34 deletions(-)




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [Linux for Sparc]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux