RE: [PATCH v2 00/10] Hardware wrapped key support for qcom ice and ufs

["Gaurav Kashyap (QUIC)" <quic_gaurkash@quicinc.com>]

Hey Eric, thanks for your reply. Pleasure working with you again.

Please find answers inline

-----Original Message-----
From: Eric Biggers <ebiggers@kernel.org> 
Sent: Wednesday, July 19, 2023 7:56 PM
To: Gaurav Kashyap (QUIC) <quic_gaurkash@quicinc.com>
Cc: linux-scsi@vger.kernel.org; linux-arm-msm@vger.kernel.org; linux-mmc@vger.kernel.org; linux-block@vger.kernel.org; linux-fscrypt@vger.kernel.org; Om Prakash Singh <omprsing@qti.qualcomm.com>; Prasad Sodagudi (QUIC) <quic_psodagud@quicinc.com>; Arun Menon (SSG) <avmenon@quicinc.com>; abel.vesa@linaro.org; Seshu Madhavi Puppala (QUIC) <quic_spuppala@quicinc.com>
Subject: Re: [PATCH v2 00/10] Hardware wrapped key support for qcom ice and ufs

Hi Gaurav,

On Wed, Jul 19, 2023 at 10:04:14AM -0700, Gaurav Kashyap wrote:
> These patches add support to Qualcomm ICE (Inline Crypto Enginr) for 
> hardware wrapped keys using Qualcomm Hardware Key Manager (HWKM) and 
> are made on top of a rebased version  Eric Bigger's set of changes to 
> support wrapped keys in fscrypt and block below:
> https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=wrapped-key
> s-v7 (The rebased patches are not uploaded here)
> 
> Ref v1 here:
> https://lore.kernel.org/linux-scsi/20211206225725.77512-1-quic_gaurkas
> h@quicinc.com/
> 
> Explanation and use of hardware-wrapped-keys can be found here:
> Documentation/block/inline-encryption.rst
> 
> This patch is organized as follows:
> 
> Patch 1 - Prepares ICE and storage layers (UFS and EMMC) to pass around wrapped keys.
> Patch 2 - Adds a new SCM api to support deriving software secret when 
> wrapped keys are used Patch 3-4 - Adds support for wrapped keys in the 
> ICE driver. This includes adding HWKM support Patch 5-6 - Adds support 
> for wrapped keys in UFS Patch 7-10 - Supports generate, prepare and 
> import functionality in ICE and UFS
> 
> NOTE: MMC will have similar changes to UFS and will be uploaded in a different patchset
>       Patch 3, 4, 8, 10 will have MMC equivalents.
> 
> Testing:
> Test platform: SM8550 MTP
> Engineering trustzone image is required to test this feature only for 
> SM8550. For SM8650 onwards, all trustzone changes to support this will 
> be part of the released images.
> The engineering changes primarily contain hooks to generate, import 
> and prepare keys for HW wrapped disk encryption.
> 
> The changes were tested by mounting initramfs and running the 
> fscryptctl tool (Ref: 
> https://github.com/ebiggers/fscryptctl/tree/wip-wrapped-keys) to 
> generate and prepare keys, as well as to set policies on folders, which consequently invokes disk encryption flows through UFS.
> 
> Gaurav Kashyap (10):
>   ice, ufs, mmc: use blk_crypto_key for program_key
>   qcom_scm: scm call for deriving a software secret
>   soc: qcom: ice: add hwkm support in ice
>   soc: qcom: ice: support for hardware wrapped keys
>   ufs: core: support wrapped keys in ufs core
>   ufs: host: wrapped keys support in ufs qcom
>   qcom_scm: scm call for create, prepare and import keys
>   ufs: core: add support for generate, import and prepare keys
>   soc: qcom: support for generate, import and prepare key
>   ufs: host: support for generate, import and prepare key
> 
>  drivers/firmware/qcom_scm.c            | 292 +++++++++++++++++++++++
>  drivers/firmware/qcom_scm.h            |   4 +
>  drivers/mmc/host/cqhci-crypto.c        |   7 +-
>  drivers/mmc/host/cqhci.h               |   2 +
>  drivers/mmc/host/sdhci-msm.c           |   6 +-
>  drivers/soc/qcom/ice.c                 | 309 +++++++++++++++++++++++--
>  drivers/ufs/core/ufshcd-crypto.c       |  92 +++++++-
>  drivers/ufs/host/ufs-qcom.c            |  63 ++++-
>  include/linux/firmware/qcom/qcom_scm.h |  13 ++
>  include/soc/qcom/ice.h                 |  18 +-
>  include/ufs/ufshcd.h                   |  25 ++
>  11 files changed, 797 insertions(+), 34 deletions(-)


Thank you for continuing to work on this!

According to your cover letter, this feature requires a custom TrustZone image to work on SM8550.  Will that image be made available outside Qualcomm?
--> Unfortunately, I don't think there is a way to do that. You can still request for one through our customer engineering team like before.

Also according to your cover letter, this feature will work on SM8650 out of the box.  That's great to hear.  However, SM8650 does not appear to be publicly available yet or have any upstream kernel support.  Do you know approximately when a SM8650 development board will become available to the general public?
--> I meant it will be available in the future releases. As of today, I don't have any information on the timelines

Also, can you please make available a git branch somewhere that contains your patchset?  It sounds like this depends on https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=wrapped-keys-v7, but actually a version of it that you've rebased, which I don't have access to.
Without being able to apply your patchset, I can't properly review it.
--> As for the fscrypt patches,
      I have not changed much functionally from the v7 patch, just merge conflicts.
      I will update this thread once I figure out a git location.

Thanks!

- Eric