Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8416f71c authored by Shay's avatar Shay Committed by Gerrit - the friendly Code Review server
Browse files

pfk: Added support for virtualized ICE 



Added pfk_ice_virt.c which sends hab requests to BE in host,
instead of sending scm calls directly to TZ.
Also, removed the hardcoded size of key cache table,
and made it configurable.

Change-Id: I942c3886c2fb93846bcdf15b19eabb3bc83e05ba
Signed-off-by: default avatarShay <shayn@codeaurora.org>
parent 2ba5ea33

drivers/block/virtio_blk.c

+159 −2
Original line number Diff line number Diff line
@@ -15,6 +15,8 @@ 
#include <linux/blk-mq.h>

#include <linux/blk-mq-virtio.h>

#include <linux/numa.h>

#include <linux/pfk.h>

#include <crypto/ice.h>



#define PART_BITS 4

#define VQ_NAME_LEN 16
@@ -23,6 +25,9 @@ static int major; 
static DEFINE_IDA(vd_index_ida);



static struct workqueue_struct *virtblk_wq;

#ifdef CONFIG_PFK_VIRTUALIZED

static struct workqueue_struct *ice_workqueue;

#endif



struct virtio_blk_vq {

	struct virtqueue *vq;
@@ -42,6 +47,14 @@ struct virtio_blk { 
	/* Process context for config space updates */

	struct work_struct config_work;



#ifdef CONFIG_PFK_VIRTUALIZED

	/* Process context for virtual ICE configuration */

	spinlock_t ice_work_lock;

	struct work_struct ice_cfg_work;

	struct request *req_pending;

	bool work_pending;

#endif



	/* What host tells us, plus 2 for header & tailer. */

	unsigned int sg_elems;
@@ -176,6 +189,7 @@ static inline void virtblk_request_done(struct request *req) 
{

	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);





	switch (req_op(req)) {

	case REQ_OP_SCSI_IN:

	case REQ_OP_SCSI_OUT:
@@ -183,6 +197,16 @@ static inline void virtblk_request_done(struct request *req) 
		break;

	}



#ifdef CONFIG_PFK_VIRTUALIZED

{

	bool ice_activated;

	int ret = pfk_load_key_end(req->bio, &ice_activated);



	if (ice_activated && ret != 0)

		pr_err("%s:  pfk_load_key_end returned %d\n", __func__, ret);

}

#endif



	blk_mq_end_request(req, virtblk_result(vbr));

}
@@ -214,6 +238,68 @@ static void virtblk_done(struct virtqueue *vq) 
	spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);

}



static blk_status_t virtblk_handle_ice(struct virtio_blk *vblk,

		struct request *req)

{

	blk_status_t retval = BLK_STS_OK;

#ifdef CONFIG_PFK_VIRTUALIZED

	int err;

	bool activate_ice = false;

	struct ice_crypto_setting pfk_crypto_data = {0};

	unsigned long flags;

	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);



	spin_lock_irqsave(&vblk->ice_work_lock, flags);

	do {

		err = pfk_load_key_start(req->bio, &pfk_crypto_data,

				&activate_ice, true);

		if (activate_ice) {

			/* ice is activated - error flow */

			if (err) {

				if (err != -EAGAIN) {

					retval = BLK_STS_IOERR;

					if (err != -EBUSY)

						pr_err("%s: pfk_load_key_start err = %d\n",

								__func__, err);

					break;

				}

				/* ice is activated -

				 * need to rerun in non atomic context

				 */

				if (!ice_workqueue) {

					pr_err("%s: error %d workqueue NULL\n",

							__func__, err);

					retval = BLK_STS_NOTSUPP;

					break;

				}

				if (!vblk->work_pending) {

					vblk->req_pending = req;



					if (!queue_work(ice_workqueue,

							&vblk->ice_cfg_work)) {

						vblk->req_pending = NULL;

						retval = BLK_STS_IOERR;

						break;

					}

					vblk->work_pending = true;

				}

				retval = BLK_STS_RESOURCE;

				break;

			}

			/* ice is activated - successful flow */

			vbr->out_hdr.ice_info.ice_slot =

					pfk_crypto_data.key_index;

			vbr->out_hdr.ice_info.activate = true;

		} else {

			/* ice is not activated */

			vbr->out_hdr.ice_info.activate = false;

		}

	} while (0);

	spin_unlock_irqrestore(&vblk->ice_work_lock, flags);

#endif

	return retval;

}



static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,

			   const struct blk_mq_queue_data *bd)

{
@@ -226,6 +312,7 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, 
	int err;

	bool notify = false;

	u32 type;

	blk_status_t retval;



	BUG_ON(req->nr_phys_segments + 2 > vblk->sg_elems);
@@ -254,6 +341,10 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, 
		0 : cpu_to_virtio64(vblk->vdev, blk_rq_pos(req));

	vbr->out_hdr.ioprio = cpu_to_virtio32(vblk->vdev, req_get_ioprio(req));



	retval = virtblk_handle_ice(vblk, req);

	if (retval != BLK_STS_OK)

		return retval;



	blk_mq_start_request(req);



	num = blk_rq_map_sg(hctx->queue, req, vbr->sg);
@@ -413,6 +504,42 @@ static void virtblk_config_changed_work(struct work_struct *work) 
	kobject_uevent_env(&disk_to_dev(vblk->disk)->kobj, KOBJ_CHANGE, envp);

}



#ifdef CONFIG_PFK_VIRTUALIZED

static void virtblk_ice_work(struct work_struct *work)

{

	bool activate_ice = false;

	struct ice_crypto_setting pfk_crypto_data = {0};

	int err;

	unsigned long flags;

	struct bio *bio;

	struct virtio_blk *vblk =

			container_of(work, struct virtio_blk, ice_cfg_work);



	spin_lock_irqsave(&vblk->ice_work_lock, flags);



	if (!vblk->req_pending) {

		vblk->work_pending = false;

		spin_unlock_irqrestore(&vblk->ice_work_lock, flags);

		return;

	}



	bio = vblk->req_pending->bio;

	spin_unlock_irqrestore(&vblk->ice_work_lock, flags);



	/* config_start is called again as previous attempt returned -EAGAIN,

	 * this call shall now take care of the necessary key setup.

	 */



	err = pfk_load_key_start(bio, &pfk_crypto_data,

			&activate_ice, false);



	spin_lock_irqsave(&vblk->ice_work_lock, flags);

	vblk->req_pending = NULL;

	vblk->work_pending = false;

	spin_unlock_irqrestore(&vblk->ice_work_lock, flags);

}

#endif



static void virtblk_config_changed(struct virtio_device *vdev)

{

	struct virtio_blk *vblk = vdev->priv;
@@ -468,6 +595,10 @@ static int init_vq(struct virtio_blk *vblk) 
	}

	vblk->num_vqs = num_vqs;



#ifdef CONFIG_PFK_VIRTUALIZED

	spin_lock_init(&vblk->ice_work_lock);

#endif



out:

	kfree(vqs);

	kfree(callbacks);
@@ -662,6 +793,11 @@ static int virtblk_probe(struct virtio_device *vdev) 


	INIT_WORK(&vblk->config_work, virtblk_config_changed_work);



#ifdef CONFIG_PFK_VIRTUALIZED

	INIT_WORK(&vblk->ice_cfg_work, virtblk_ice_work);

	vblk->work_pending = false;

#endif



	err = init_vq(vblk);

	if (err)

		goto out_free_vblk;
@@ -738,6 +874,11 @@ static int virtblk_probe(struct virtio_device *vdev) 
	/* No real sector limit. */

	blk_queue_max_hw_sectors(q, -1U);



	/* Set inline encryption. */

#ifdef CONFIG_PFK_VIRTUALIZED

	queue_flag_set_unlocked(QUEUE_FLAG_INLINECRYPT, q);

#endif



	/* Host can optionally specify maximum segment size and number of

	 * segments. */

	err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SIZE_MAX,
@@ -920,9 +1061,18 @@ static int __init init(void) 
{

	int error;



	virtblk_wq = alloc_workqueue("virtio-blk", 0, 0);

	if (!virtblk_wq)

#ifdef CONFIG_PFK_VIRTUALIZED

	ice_workqueue = alloc_workqueue("virtio-blk-ice",

			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_FREEZABLE, 0);

	if (!ice_workqueue)

		return -ENOMEM;

#endif



	virtblk_wq = alloc_workqueue("virtio-blk", 0, 0);

	if (!virtblk_wq) {

		error = -ENOMEM;

		goto out_destroy_ice_workqueue;

	}



	major = register_blkdev(0, "virtblk");

	if (major < 0) {
@@ -939,6 +1089,10 @@ static int __init init(void) 
	unregister_blkdev(major, "virtblk");

out_destroy_workqueue:

	destroy_workqueue(virtblk_wq);

out_destroy_ice_workqueue:

#ifdef CONFIG_PFK_VIRTUALIZED

	destroy_workqueue(ice_workqueue);

#endif

	return error;

}
@@ -947,6 +1101,9 @@ static void __exit fini(void) 
	unregister_virtio_driver(&virtio_blk);

	unregister_blkdev(major, "virtblk");

	destroy_workqueue(virtblk_wq);

#ifdef CONFIG_PFK_VIRTUALIZED

	destroy_workqueue(ice_workqueue);

#endif

}

module_init(init);

module_exit(fini);

include/uapi/linux/virtio_blk.h

+8 −1
Original line number Diff line number Diff line
@@ -131,7 +131,14 @@ struct virtio_blk_outhdr { 
	__virtio32 ioprio;

	/* Sector (ie. 512 byte offset) */

	__virtio64 sector;

};

#ifdef CONFIG_PFK_VIRTUALIZED

	struct virtio_ice_info {

		__u8  ice_slot;

		__u8  activate;

		__u16 reserved;

	} ice_info;

#endif

} __attribute__ ((packed));



#ifndef VIRTIO_BLK_NO_LEGACY

struct virtio_scsi_inhdr {

security/pfe/Kconfig

+11 −0
Original line number Diff line number Diff line
@@ -36,4 +36,15 @@ config PFK_WRAPPED_KEY_SUPPORTED 
		Adds wrapped key support in PFK driver. Instead of setting

		the key directly in ICE, it unwraps the key and sets the key

		in ICE.



config PFK_VIRTUALIZED

	bool "Per-File-Key driver virtualized version"

	depends on SECURITY

	depends on SECURITY_SELINUX

	depends on QSEECOM

	depends on PFK

	depends on MSM_HAB

	help

		Makes the driver to use the hypervisor back end for ICE HW

		operation virtualization instead of calling directly to TZ.

endmenu

security/pfe/Makefile

+6 −1
Original line number Diff line number Diff line
@@ -7,4 +7,9 @@ ccflags-y += -Ifs/crypto 
ccflags-y += -Idrivers/misc



obj-$(CONFIG_PFT) += pft.o

obj-$(CONFIG_PFK) += pfk.o pfk_kc.o pfk_ice.o pfk_ext4.o pfk_f2fs.o
 
obj-$(CONFIG_PFK) += pfk.o pfk_kc.o pfk_ext4.o pfk_f2fs.o

ifdef CONFIG_PFK_VIRTUALIZED

obj-$(CONFIG_PFK_VIRTUALIZED) += pfk_ice_virt.o

else

obj-$(CONFIG_PFK) += pfk_ice.o

endif

security/pfe/pfk.c

+3 −3
Original line number Diff line number Diff line
@@ -111,8 +111,8 @@ static int __init pfk_init(void) 
	if (ret != 0)

		goto fail;



	ret = pfk_kc_init();

	if (ret != 0) {

	ret = pfk_kc_init(true);

	if (ret != 0 && ret != -EAGAIN) {

		pr_err("could init pfk key cache, error %d\n", ret);

		pfk_ext4_deinit();

		pfk_f2fs_deinit();
@@ -300,7 +300,7 @@ static int pfk_get_key_for_bio(const struct bio *bio, 
	 * 4K dun - For ext4 ufs, f2fs ufs and f2fs emmc

	 */



	if (data_unit) {

	if (data_unit && bio) {

		if (!bio_dun(bio) && !memcmp(s_type, "sdcc", strlen("sdcc")))

			*data_unit = 1 << ICE_CRYPTO_DATA_UNIT_512_B;

		else