mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
7cc6e0c34b
Qualcomm's Inline Crypto Engine (ICE) version 3.2 and later includes a
key management hardware block called the Hardware Key Manager (HWKM).
Add support for HWKM to the ICE driver. HWKM provides hardware-wrapped
key support where the ICE (storage) keys are not exposed to software and
instead are protected in hardware. Later patches will wire up this
feature to ufs-qcom and sdhci-msm using the support added in this patch.
HWKM and legacy mode are currently mutually exclusive. The selection of
which mode to use has to be made before the storage driver(s) registers
any inline encryption capable disk(s) with the block layer (i.e.,
generally at boot time) so that the appropriate crypto capabilities can
be advertised to upper layers. Therefore, make the ICE driver select
HWKM mode when the all of the following are true:
- The new module parameter qcom_ice.use_wrapped_keys=1 is specified.
- HWKM is present and is at least v2, i.e. ICE is v3.2.1 or later.
- The SCM calls needed to fully use HWKM are supported by TrustZone.
[EB: merged related patches; fixed the module parameter to work
correctly; dropped unnecessary support for HWKM v1; fixed error
handling; improved log messages, comments, and commit message;
fixed naming; merged enable and init functions; and other cleanups]
Signed-off-by: Gaurav Kashyap <quic_gaurkash@quicinc.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Co-developed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20250404231533.174419-3-ebiggers@kernel.org
Acked-by: Ulf Hansson <ulf.hansson@linaro.org> # For MMC
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
34 lines
1.2 KiB
C
34 lines
1.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Copyright (c) 2023, Linaro Limited
|
|
*/
|
|
|
|
#ifndef __QCOM_ICE_H__
|
|
#define __QCOM_ICE_H__
|
|
|
|
#include <linux/blk-crypto.h>
|
|
#include <linux/types.h>
|
|
|
|
struct qcom_ice;
|
|
|
|
int qcom_ice_enable(struct qcom_ice *ice);
|
|
int qcom_ice_resume(struct qcom_ice *ice);
|
|
int qcom_ice_suspend(struct qcom_ice *ice);
|
|
int qcom_ice_program_key(struct qcom_ice *ice, unsigned int slot,
|
|
const struct blk_crypto_key *blk_key);
|
|
int qcom_ice_evict_key(struct qcom_ice *ice, int slot);
|
|
enum blk_crypto_key_type qcom_ice_get_supported_key_type(struct qcom_ice *ice);
|
|
int qcom_ice_derive_sw_secret(struct qcom_ice *ice,
|
|
const u8 *eph_key, size_t eph_key_size,
|
|
u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]);
|
|
int qcom_ice_generate_key(struct qcom_ice *ice,
|
|
u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
|
|
int qcom_ice_prepare_key(struct qcom_ice *ice,
|
|
const u8 *lt_key, size_t lt_key_size,
|
|
u8 eph_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
|
|
int qcom_ice_import_key(struct qcom_ice *ice,
|
|
const u8 *raw_key, size_t raw_key_size,
|
|
u8 lt_key[BLK_CRYPTO_MAX_HW_WRAPPED_KEY_SIZE]);
|
|
struct qcom_ice *devm_of_qcom_ice_get(struct device *dev);
|
|
|
|
#endif /* __QCOM_ICE_H__ */
|