On Sun, Jun 16, 2024 at 05:50:58PM GMT, Gaurav Kashyap wrote: > Storage encryption has two IOCTLs for creating, importing > and preparing keys for encryption. For wrapped keys, these > IOCTLs need to interface with Qualcomm's Trustzone, which > require these SCM calls. > > generate_key: This is used to generate and return a longterm > wrapped key. Trustzone achieves this by generating > a key and then wrapping it using hwkm, returning > a wrapped keyblob. > import_key: The functionality is similar to generate, but here, > a raw key is imported into hwkm and a longterm wrapped > keyblob is returned. > prepare_key: The longterm wrapped key from import or generate > is made further secure by rewrapping it with a per-boot > ephemeral wrapped key before installing it to the linux > kernel for programming to ICE. > > Tested-by: Neil Armstrong <neil.armstrong@xxxxxxxxxx> > Signed-off-by: Gaurav Kashyap <quic_gaurkash@xxxxxxxxxxx> > --- > drivers/firmware/qcom/qcom_scm.c | 175 +++++++++++++++++++++++++ > drivers/firmware/qcom/qcom_scm.h | 3 + > include/linux/firmware/qcom/qcom_scm.h | 5 + > 3 files changed, 183 insertions(+) > > diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c > index 8f23b459c525..61a1ace3c683 100644 > --- a/drivers/firmware/qcom/qcom_scm.c > +++ b/drivers/firmware/qcom/qcom_scm.c > @@ -1309,6 +1309,181 @@ int qcom_scm_derive_sw_secret(const u8 *wkey, size_t wkey_size, > } > EXPORT_SYMBOL_GPL(qcom_scm_derive_sw_secret); > > +/** > + * qcom_scm_generate_ice_key() - Generate a wrapped key for encryption. > + * @lt_key: the wrapped key returned after key generation > + * @lt_key_size: size of the wrapped key to be returned. > + * > + * Qualcomm wrapped keys need to be generated in a trusted environment. > + * A generate key IOCTL call is used to achieve this. These are longterm > + * in nature as they need to be generated and wrapped only once per > + * requirement. > + * > + * Adds support for the create key IOCTL to interface > + * with the secure environment to generate and return a wrapped key.. This is documentation to a function, not a changelog. Also the function helps implementing the IOCTL. Please describe the call itself and its behaviour. Something like: Generate a key using built-in entropy source (or using this-and-that PRNG) inside TZ. Wrap the key using the platform-specific (board-specific?) Key Encryption Key and return to the caller. The same comment applies to other SCM calls added in this patch. -- With best wishes Dmitry
