Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd1be5fa authored by Shivaprasad Hongal's avatar Shivaprasad Hongal Committed by Gerrit - the friendly Code Review server
Browse files

pfk: keymaster support to set/clear ice keys 



With new FBE key management changes, the keys are not
available in the clear, but wrapped with an ephemeral key
from keymaster. We cannot use a direct call to the qsee
kernel to set/clear keys as they need to be unwrapped by
keymaster first, which would then call in to the qsee kernel
to set/clear the keys.

Change-Id: Ie3fba8c0613d246efb5577ef6a0254171f082bfe
Signed-off-by: default avatarShivaprasad Hongal <shongal@codeaurora.org>
parent f6fbeafa

security/pfe/Kconfig

+13 −0
Original line number Diff line number Diff line
@@ -25,4 +25,17 @@ config PFK 
		Information is used when file is encrypted later using

		ICE or dm crypto engine



config PFK_WRAPPED_KEY_SUPPORTED

	bool "Per-File-Key driver with wrapped key support"

	depends on SECURITY

	depends on SECURITY_SELINUX

	depends on QSEECOM

	depends on PFK

	default n

	help

		Adds wrapped key support in PFK driver. Instead of setting

		the key directly from vold, it unwraps the key in a secure

		environment and sets the key in ICE. This is because the key

		is not directly available in HLOS and needs to be unwrapped

		in a secure environment.

endmenu

security/pfe/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ 
ccflags-y += -Isecurity/selinux -Isecurity/selinux/include

ccflags-y += -Ifs/ext4

ccflags-y += -Ifs/crypto

ccflags-y += -Idrivers/misc



obj-$(CONFIG_PFT) += pft.o

obj-$(CONFIG_PFK) += pfk.o pfk_kc.o pfk_ice.o pfk_ext4.o

security/pfe/pfk_ice.c

+164 −42
Original line number Diff line number Diff line
@@ -24,7 +24,7 @@ 
#include <soc/qcom/qseecomi.h>

#include <crypto/ice.h>

#include "pfk_ice.h"



#include "qseecom_kernel.h"



/**********************************/

/** global definitions		 **/
@@ -55,48 +55,120 @@ 
	TZ_SYSCALL_CREATE_PARAM_ID_1( \

	TZ_SYSCALL_PARAM_TYPE_VAL)



#define CONTEXT_SIZE 0x1000



#define KEYMASTER_UTILS_CMD_ID 0x200UL

#define KEYMASTER_SET_ICE_KEY (KEYMASTER_UTILS_CMD_ID + 18UL)

#define KEYMASTER_CLEAR_ICE_KEY (KEYMASTER_UTILS_CMD_ID + 19UL)



#define ICE_KEY_SIZE 32

#define ICE_SALT_SIZE 32



static uint8_t ice_key[ICE_KEY_SIZE];

static uint8_t ice_salt[ICE_KEY_SIZE];



int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt,

			char *storage_type)

static struct qseecom_handle *qhandle;



static int set_wrapped_key(uint32_t index, const uint8_t *key,

				const uint8_t *salt)

{

	int ret = 0;

	u32 set_req_len = 0;

	u32 set_rsp_len = 0;

	struct pfk_ice_key_req *set_req_buf;

	struct pfk_ice_key_rsp *set_rsp_buf;



	memcpy(ice_key, key, sizeof(ice_key));

	memcpy(ice_salt, salt, sizeof(ice_salt));



	if (!qhandle) {

		ret = qseecom_start_app(&qhandle, "keymaster64",

			CONTEXT_SIZE);

		if (ret) {

			pr_err("Qseecom start app failed\n");

			return ret;

		}

	}



	set_req_buf = (struct pfk_ice_key_req *) qhandle->sbuf;

	set_req_buf->cmd_id = KEYMASTER_SET_ICE_KEY;

	set_req_buf->index = index;

	set_req_buf->ice_key_offset = sizeof(struct pfk_ice_key_req);

	set_req_buf->ice_key_size = ICE_KEY_SIZE;

	set_req_buf->ice_salt_offset = set_req_buf->ice_key_offset +

					set_req_buf->ice_key_size;

	set_req_buf->ice_salt_size = ICE_SALT_SIZE;



	memcpy((uint8_t *) set_req_buf + set_req_buf->ice_key_offset, ice_key,

				set_req_buf->ice_key_size);

	memcpy((uint8_t *) set_req_buf + set_req_buf->ice_salt_offset, ice_salt,

				set_req_buf->ice_salt_size);



	set_req_len = sizeof(struct pfk_ice_key_req) + set_req_buf->ice_key_size

			+ set_req_buf->ice_salt_size;



	set_rsp_buf = (struct pfk_ice_key_rsp *) (qhandle->sbuf +

			set_req_len);

	set_rsp_len = sizeof(struct pfk_ice_key_rsp);



	ret = qseecom_send_command(qhandle,

					set_req_buf, set_req_len,

					set_rsp_buf, set_rsp_len);



	if (ret)

		pr_err("%s: Set wrapped key  error: Status %d\n", __func__,

						set_rsp_buf->ret);



	return ret;

}



static int clear_wrapped_key(uint32_t index)

{

	int ret = 0;



	u32 clear_req_len = 0;

	u32 clear_rsp_len = 0;

	struct pfk_ice_key_req *clear_req_buf;

	struct pfk_ice_key_rsp *clear_rsp_buf;



	clear_req_buf = (struct pfk_ice_key_req *) qhandle->sbuf;

	memset(clear_req_buf, 0, sizeof(qhandle->sbuf));

	clear_req_buf->cmd_id = KEYMASTER_CLEAR_ICE_KEY;

	clear_req_buf->index = index;

	clear_req_len = sizeof(struct pfk_ice_key_req);

	clear_rsp_buf = (struct pfk_ice_key_rsp *) (qhandle->sbuf +

			QSEECOM_ALIGN(clear_req_len));

	clear_rsp_len = sizeof(struct pfk_ice_key_rsp);



	ret = qseecom_send_command(qhandle, clear_req_buf, clear_req_len,

			clear_rsp_buf, clear_rsp_len);

	if (ret)

		pr_err("%s: Clear wrapped key error: Status %d\n", __func__,

					clear_rsp_buf->ret);



	return ret;

}



static int set_key(uint32_t index, const uint8_t *key, const uint8_t *salt)

{

	struct scm_desc desc = {0};

	int ret, ret1;

	int ret = 0;

	uint32_t smc_id = 0;

	char *tzbuf_key = (char *)ice_key;

	char *tzbuf_salt = (char *)ice_salt;

	char *s_type = storage_type;

	uint32_t smc_id = 0;

	u32 tzbuflen_key = sizeof(ice_key);

	u32 tzbuflen_salt = sizeof(ice_salt);



	if (index < MIN_ICE_KEY_INDEX || index > MAX_ICE_KEY_INDEX) {

		pr_err("%s Invalid index %d\n", __func__, index);

		return -EINVAL;

	}

	if (!key || !salt) {

		pr_err("%s Invalid key/salt\n", __func__);

		return -EINVAL;

	}



	if (!tzbuf_key || !tzbuf_salt) {

		pr_err("%s No Memory\n", __func__);

		return -ENOMEM;

	}



	if (s_type == NULL) {

		pr_err("%s Invalid Storage type\n", __func__);

		return -EINVAL;

	}



	memset(tzbuf_key, 0, tzbuflen_key);

	memset(tzbuf_salt, 0, tzbuflen_salt);



	memcpy(ice_key, key, tzbuflen_key);

	memcpy(ice_salt, salt, tzbuflen_salt);

	memcpy(ice_key, key, sizeof(ice_key));

	memcpy(ice_salt, salt, sizeof(ice_salt));



	dmac_flush_range(tzbuf_key, tzbuf_key + tzbuflen_key);

	dmac_flush_range(tzbuf_salt, tzbuf_salt + tzbuflen_salt);
@@ -110,13 +182,64 @@ int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt, 
	desc.args[3] = virt_to_phys(tzbuf_salt);

	desc.args[4] = tzbuflen_salt;



	ret = scm_call2(smc_id, &desc);

	if (ret)

		pr_err("%s:SCM call Error: 0x%x\n", __func__, ret);



	return ret;

}



static int clear_key(uint32_t index)

{

	struct scm_desc desc = {0};

	int ret = 0;

	uint32_t smc_id = 0;



	smc_id = TZ_ES_INVALIDATE_ICE_KEY_ID;



	desc.arginfo = TZ_ES_INVALIDATE_ICE_KEY_PARAM_ID;

	desc.args[0] = index;



	ret = scm_call2(smc_id, &desc);

	if (ret)

		pr_err("%s:SCM call Error: 0x%x\n", __func__, ret);

	return ret;

}



int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt,

			char *storage_type)

{

	int ret = 0, ret1 = 0;

	char *s_type = storage_type;



	if (index < MIN_ICE_KEY_INDEX || index > MAX_ICE_KEY_INDEX) {

		pr_err("%s Invalid index %d\n", __func__, index);

		return -EINVAL;

	}

	if (!key || !salt) {

		pr_err("%s Invalid key/salt\n", __func__);

		return -EINVAL;

	}



	if (s_type == NULL) {

		pr_err("%s Invalid Storage type\n", __func__);

		return -EINVAL;

	}



	ret = qcom_ice_setup_ice_hw((const char *)s_type, true);

	if (ret) {

		pr_err("%s: could not enable clocks: %d\n", __func__, ret);

		goto out;

	}



	ret = scm_call2(smc_id, &desc);

	if (pfk_wrapped_key_supported()) {

		pr_debug("%s: Setting wrapped key\n", __func__);

		ret = set_wrapped_key(index, key, salt);

	} else {

		pr_debug("%s: Setting keys with QSEE kernel\n", __func__);

		ret = set_key(index, key, salt);

	}



	if (ret) {

		pr_err("%s: Set Key Error: %d\n", __func__, ret);

		if (ret == -EBUSY) {
@@ -125,18 +248,18 @@ int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt, 
				goto out;

		}

		/* Try to invalidate the key to keep ICE in proper state */

		smc_id = TZ_ES_INVALIDATE_ICE_KEY_ID;

		desc.arginfo = TZ_ES_INVALIDATE_ICE_KEY_PARAM_ID;

		desc.args[0] = index;

		ret1 = scm_call2(smc_id, &desc);

		if (pfk_wrapped_key_supported())

			ret1 = clear_wrapped_key(index);

		else

			ret1 = clear_key(index);



		if (ret1)

			pr_err("%s: Invalidate Key Error: %d\n", __func__,

					ret1);

			pr_err("%s: Invalidate key error: %d\n", __func__, ret);

	}



	ret1 = qcom_ice_setup_ice_hw((const char *)s_type, false);

	if (ret1)

		pr_err("%s: Error %d disabling clocks\n", __func__, ret1);

	if (ret)

		pr_err("%s: Error %d disabling clocks\n", __func__, ret);



out:

	return ret;
@@ -144,11 +267,8 @@ int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt, 


int qti_pfk_ice_invalidate_key(uint32_t index, char *storage_type)

{

	struct scm_desc desc = {0};

	int ret = 0;



	uint32_t smc_id = 0;



	if (index < MIN_ICE_KEY_INDEX || index > MAX_ICE_KEY_INDEX) {

		pr_err("%s Invalid index %d\n", __func__, index);

		return -EINVAL;
@@ -159,20 +279,22 @@ int qti_pfk_ice_invalidate_key(uint32_t index, char *storage_type) 
		return -EINVAL;

	}



	smc_id = TZ_ES_INVALIDATE_ICE_KEY_ID;



	desc.arginfo = TZ_ES_INVALIDATE_ICE_KEY_PARAM_ID;

	desc.args[0] = index;



	ret = qcom_ice_setup_ice_hw((const char *)storage_type, true);

	if (ret) {

		pr_err("%s: could not enable clocks: 0x%x\n", __func__, ret);

		return ret;

	}



	ret = scm_call2(smc_id, &desc);

	if (pfk_wrapped_key_supported()) {

		ret = clear_wrapped_key(index);

		pr_debug("%s: Clearing wrapped key\n", __func__);

	} else {

		pr_debug("%s: Clearing keys with QSEE kernel\n", __func__);

		ret = clear_key(index);

	}



	if (ret)

		pr_err("%s: Error: 0x%x\n", __func__, ret);

		pr_err("%s: Invalidate key error: %d\n", __func__, ret);



	if (qcom_ice_setup_ice_hw((const char *)storage_type, false))

		pr_err("%s: could not disable clocks\n", __func__);

security/pfe/pfk_ice.h

+26 −0
Original line number Diff line number Diff line
@@ -22,9 +22,35 @@ 


#include <linux/types.h>



struct __attribute__ ((__packed__)) pfk_ice_key_req {

	uint32_t cmd_id;

	uint32_t index;

	uint32_t ice_key_offset;

	uint32_t ice_key_size;

	uint32_t ice_salt_offset;

	uint32_t ice_salt_size;

};



struct __attribute__ ((__packed__)) pfk_ice_key_rsp {

	uint32_t ret;

	uint32_t cmd_id;

};



int pfk_ice_init(void);

int pfk_ice_deinit(void);



#ifdef CONFIG_PFK_WRAPPED_KEY_SUPPORTED

static inline bool pfk_wrapped_key_supported(void)

{

	return true;

}

#else

static inline bool pfk_wrapped_key_supported(void)

{

	return false;

}

#endif



int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt,

			char *storage_type);

int qti_pfk_ice_invalidate_key(uint32_t index, char *storage_type);