Add support for Hardware key manager v1 based In-line Crypto Engine - #42
Draft
Harshal Dev (harshaldev27) wants to merge 14 commits into
Draft
Add support for Hardware key manager v1 based In-line Crypto Engine#42Harshal Dev (harshaldev27) wants to merge 14 commits into
Harshal Dev (harshaldev27) wants to merge 14 commits into
Conversation
Change all register offsets in hwkm_regs.h to group-relative and add HWKM_MASTER_*_REGS_OFFSET and HWKM_CRYPTO0_*_REGS_OFFSET constants to locate each register group within its instance's MMIO window. Callers add the appropriate offset at the call site, making the same register definitions reusable across master and any slave. Also extract run_fifo_transaction() from master_run_transaction() so the FIFO protocol can be reused by any slave. Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Enable the CRYPTO0 general-purpose crypto engine (GPCE) key manager slave so that keys can be provisioned into CRYPTO0 key slots via the existing HWKM transaction protocol. Map the CRYPTO0 MMIO window, configure the KM slave at boot, and extend the transaction layer to dispatch to the GPCE slave alongside the existing KM master. Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Add AES-ECB and AES-CBC support using the CRYPTO0 CE block. The driver registers with the OP-TEE drvcrypt cipher API and verifies hardware availability at registration time. Each cipher has an independent Kconfig knob and both share the same CE shared helper layer (ce.c). Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Enable CFG_QCOM_CE_AES_ECB and CFG_QCOM_CE_AES_CBC for Lemans to activate the AES-ECB and AES-CBC hardware cipher providers. Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Add AES-GCM AEAD support using the CRYPTO0 CE block, registered with the OP-TEE drvcrypt authenc API. AES-128 and AES-256 use the hardware. AES-192 falls back to the software GCM implementation via crypto_aes_gcm_alloc_ctx(). For 96-bit nonces J0 = nonce||0x00000001 per NIST SP 800-38D. For non-96-bit nonces, J0 is derived via the CE hardware GHASH engine. The FIFO loop is byte-stream oriented so non-block-aligned payloads are handled without padding constraints on the caller. All polling loops are bounded by a 1-second timeout. Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Enable the CRYPTO0 AES-GCM hardware AEAD provider on Lemans by setting CFG_QCOM_CE_AES_GCM=y. Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Add support for generating the SWAP and TPKEY during driver init. The TPKEY is used to wrap keys before transporting them to the HWMK slaves, such as the General Purpose Crypto Engine (GPCE) and the Inline Crypto Engine (ICE). The SWAP key is used for wrapping and exporting keys from the hardware key manager to software. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add support for the Inline Crypto Engine (ICE) slave to the hardware key manager (HWKM). This allows HWKM to issue commands to ICE and provision keys via its existing transaction protocol. Since the clock and power for ICE are controlled by Linux, it must be (re)configured before dispatching any transactions to it. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Export the interface to the Qualcomm hardware key manager (HWKM) drivers by moving the hwkm.h and hwkm_errno.h files to include/drivers/ path. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add a pseudo-TA for the Qualcomm Inline Crypto Engine (ICE) that lets the kernel inline-crypt path generate a wrapped L4 key derived from the unique key derivation key (UKDK) available with the Hardware Key manager for inline storage encryption. Only the REE kernel may open a session on this PTA. The PTA is gated by CFG_ICE_FS_ENC_PTA and is not built unless a platform enables it. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add support for importing and wrapping a key with a UKDK-derived L4 key. The wrapped key is returned to the REE which can use it as a storage key. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add support for exporting a key after un-wrapping it with a UKDK-derived L4 key and re-wrapping with an ephemeral key (also a HW derived UKDK L4 key). This ties the storage key with a per boot generated random seed. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add support for programming an ephemerally wrapped key into a specified inline crypto engine (ICE) key slot. The key is first unwrapped via the ephemeral key, and then wrapped by a TP (transport) key before being imported into the ICE hardware block via the hardware key manager. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Add support for invalidating a previously programmed key from the inline crypto engine's (ICE) key slot via the hardware key manager. Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>
Harshal Dev (harshaldev27)
force-pushed
the
ice-hwkm-v1
branch
from
August 14, 2026 14:30
845359e to
8b15785
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for HWKM v1 based In-line Crypto Engine Psuedo-TA