| Message ID | 20241202-wrapped-keys-v7-0-67c3ca3f3282@linaro.org |
|---|---|
| Headers | show |
| Series | Hardware wrapped key support for QCom ICE and UFS core | expand |
On Mon, Dec 02, 2024 at 01:02:16PM +0100, Bartosz Golaszewski wrote: > The previous iteration[1] has been on the list for many weeks without > receiving any comments - neither positive nor negative. If there are no > objections - could we start discussing how to make these patches go > upstream for v6.14? The way to do it will be for the block patches to be taken through the block tree first. That will unblock the rest, which can be taken through their respective trees in subsequent cycles. I'm really hoping to be able to test these patches with upstream myself, which I'm not able to do yet. I'll try to leave some review comments on the parts not authored by me the mean time. Anyway, thanks for continuing to work on this. > Tested on sm8650-qrd. > > How to test: > > Use the wip-wrapped-keys branch from https://github.com/ebiggers/fscryptctl > to build a custom fscryptctl that supports generating wrapped keys. > > Enable the following config options: > CONFIG_BLK_INLINE_ENCRYPTION=y > CONFIG_QCOM_INLINE_CRYPTO_ENGINE=m > CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y > CONFIG_SCSI_UFS_CRYPTO=y > > $ mkfs.ext4 -F -O encrypt,stable_inodes /dev/disk/by-partlabel/userdata > $ mount /dev/disk/by-partlabel/userdata -o inlinecrypt /mnt > $ fscryptctl generate_hw_wrapped_key /dev/disk/by-partlabel/userdata > /mnt/key.longterm > $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/userdata < /mnt/key.longterm > /tmp/key.ephemeral > $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) > $ rm -rf /mnt/dir > $ mkdir /mnt/dir > $ fscryptctl set_policy --hw-wrapped-key --iv-ino-lblk-64 "$KEYID" /mnt/dir > $ dmesg > /mnt/dir/test.txt > $ sync > > Reboot the board > > $ mount /dev/disk/by-partlabel/userdata -o inlinecrypt /mnt > $ ls /mnt/dir > $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/userdata < /mnt/key.longterm > /tmp/key.ephemeral > $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) > $ fscryptctl set_policy --hw-wrapped-key --iv-ino-lblk-64 "$KEYID" /mnt/dir > $ cat /mnt/dir/test.txt # File should now be decrypted That doesn't verify that the encryption is being done correctly, which is the most important thing to test. For that we'll need to resurrect the following patchset for xfstests: https://lore.kernel.org/fstests/20220228074722.77008-1-ebiggers@kernel.org/ - Eric
On 12/2/24 11:36 AM, Eric Biggers wrote: > On Mon, Dec 02, 2024 at 01:02:16PM +0100, Bartosz Golaszewski wrote: >> The previous iteration[1] has been on the list for many weeks without >> receiving any comments - neither positive nor negative. If there are no >> objections - could we start discussing how to make these patches go >> upstream for v6.14? > > The way to do it will be for the block patches to be taken through the block > tree first. That will unblock the rest, which can be taken through their > respective trees in subsequent cycles. I can queue up patches 1..3 in a separate branch that we can both use, and that can get pulled into for-6.14/block as well. Didn't want to do that before the rest of them are ready. IOW, if it's going to be bound for 6.14, let me know, and I'll setup the branch with the patches.
The previous iteration[1] has been on the list for many weeks without receiving any comments - neither positive nor negative. If there are no objections - could we start discussing how to make these patches go upstream for v6.14? -- Hardware-wrapped keys are encrypted keys that can only be unwrapped (decrypted) and used by hardware - either by the inline encryption hardware itself, or by a dedicated hardware block that can directly provision keys to the inline encryption hardware. For more details, please see patches 1-3 in this series which extend the inline encryption docs with more information. This series adds support for wrapped keys to the block layer, fscrypt and then build upwards from there by implementing relevant callbacks in QCom SCM driver, then the ICE driver and finally in UFS core and QCom layer. Tested on sm8650-qrd. How to test: Use the wip-wrapped-keys branch from https://github.com/ebiggers/fscryptctl to build a custom fscryptctl that supports generating wrapped keys. Enable the following config options: CONFIG_BLK_INLINE_ENCRYPTION=y CONFIG_QCOM_INLINE_CRYPTO_ENGINE=m CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y CONFIG_SCSI_UFS_CRYPTO=y $ mkfs.ext4 -F -O encrypt,stable_inodes /dev/disk/by-partlabel/userdata $ mount /dev/disk/by-partlabel/userdata -o inlinecrypt /mnt $ fscryptctl generate_hw_wrapped_key /dev/disk/by-partlabel/userdata > /mnt/key.longterm $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/userdata < /mnt/key.longterm > /tmp/key.ephemeral $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) $ rm -rf /mnt/dir $ mkdir /mnt/dir $ fscryptctl set_policy --hw-wrapped-key --iv-ino-lblk-64 "$KEYID" /mnt/dir $ dmesg > /mnt/dir/test.txt $ sync Reboot the board $ mount /dev/disk/by-partlabel/userdata -o inlinecrypt /mnt $ ls /mnt/dir $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/userdata < /mnt/key.longterm > /tmp/key.ephemeral $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) $ fscryptctl set_policy --hw-wrapped-key --iv-ino-lblk-64 "$KEYID" /mnt/dir $ cat /mnt/dir/test.txt # File should now be decrypted [1] https://lore.kernel.org/all/20241011-wrapped-keys-v7-0-e3f7a752059b@linaro.org/ Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> --- Changes in v7: - use a module param in conjunction with checking the platform support at run-time to determine whether to use wrapped keys in the ICE driver - various minor refactorings, replacing magic numbers with defines etc. - fix kernel doc issues raised by autobuilders - Link to v6: https://lore.kernel.org/r/20240906-wrapped-keys-v6-0-d59e61bc0cb4@linaro.org Changes in v6: - add the wrapped key support from Eric Biggers to the series - remove the new DT property from the series and instead query the at run-time rustZone to find out if wrapped keys are supported - make the wrapped key support into a UFS capability, not a quirk - improve kerneldocs - improve and rework coding style in most patches - improve and reformat commit messages - simplify the offset calculation for CRYPTOCFG - split out the DTS changes into a separate series --- Bartosz Golaszewski (1): firmware: qcom: scm: add a call for checking wrapped key support Eric Biggers (4): blk-crypto: add basic hardware-wrapped key support blk-crypto: show supported key types in sysfs blk-crypto: add ioctls to create and prepare hardware-wrapped keys fscrypt: add support for hardware-wrapped keys Gaurav Kashyap (12): ice, ufs, mmc: use the blk_crypto_key struct when programming the key firmware: qcom: scm: add a call for deriving the software secret firmware: qcom: scm: add calls for creating, preparing and importing keys soc: qcom: ice: add HWKM support to the ICE driver soc: qcom: ice: add support for hardware wrapped keys soc: qcom: ice: add support for generating, importing and preparing keys ufs: core: add support for wrapped keys to UFS core ufs: core: add support for deriving the software secret ufs: core: add support for generating, importing and preparing keys ufs: host: add support for wrapped keys in QCom UFS ufs: host: add a callback for deriving software secrets and use it ufs: host: add support for generating, importing and preparing wrapped keys Documentation/ABI/stable/sysfs-block | 18 + Documentation/block/inline-encryption.rst | 245 +++++++++++++- Documentation/filesystems/fscrypt.rst | 154 ++++++++- Documentation/userspace-api/ioctl/ioctl-number.rst | 2 + block/blk-crypto-fallback.c | 5 +- block/blk-crypto-internal.h | 10 + block/blk-crypto-profile.c | 103 ++++++ block/blk-crypto-sysfs.c | 35 ++ block/blk-crypto.c | 194 ++++++++++- block/ioctl.c | 5 + drivers/firmware/qcom/qcom_scm.c | 233 +++++++++++++ drivers/firmware/qcom/qcom_scm.h | 4 + drivers/md/dm-table.c | 1 + drivers/mmc/host/cqhci-crypto.c | 9 +- drivers/mmc/host/cqhci.h | 2 + drivers/mmc/host/sdhci-msm.c | 6 +- drivers/soc/qcom/ice.c | 365 ++++++++++++++++++++- drivers/ufs/core/ufshcd-crypto.c | 86 ++++- drivers/ufs/host/ufs-qcom.c | 61 +++- fs/crypto/fscrypt_private.h | 71 +++- fs/crypto/hkdf.c | 4 +- fs/crypto/inline_crypt.c | 44 ++- fs/crypto/keyring.c | 124 +++++-- fs/crypto/keysetup.c | 54 ++- fs/crypto/keysetup_v1.c | 5 +- fs/crypto/policy.c | 11 +- include/linux/blk-crypto-profile.h | 73 +++++ include/linux/blk-crypto.h | 75 ++++- include/linux/firmware/qcom/qcom_scm.h | 8 + include/soc/qcom/ice.h | 18 +- include/uapi/linux/blk-crypto.h | 44 +++ include/uapi/linux/fs.h | 6 +- include/uapi/linux/fscrypt.h | 7 +- include/ufs/ufshcd.h | 21 ++ 34 files changed, 1968 insertions(+), 135 deletions(-) --- base-commit: f486c8aa16b8172f63bddc70116a0c897a7f3f02 change-id: 20241128-wrapped-keys-c7a280792075 Best regards,