diff --git a/core/arch/arm/plat-qcom/bobcat/arch_config.h b/core/arch/arm/plat-qcom/bobcat/arch_config.h index 937d7ae5a..d334f91f4 100644 --- a/core/arch/arm/plat-qcom/bobcat/arch_config.h +++ b/core/arch/arm/plat-qcom/bobcat/arch_config.h @@ -12,4 +12,8 @@ #define DIAG_LOG_START_INFO (IMEM_BASE + IMEM_DIAG_OFFSET) #define TCSR_BOOT_MISC_DETECT UL(0x195C100) +/* SDC1 SDCC ICE (Inline Crypto Engine) LUT keys register region */ +#define SDCC_ICE_LUT_KEYS UL(0x0780A000) +#define SDCC_ICE_LUT_KEYS_SIZE UL(0x2000) + #endif /* ARCH_CONFIG_H */ diff --git a/core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk b/core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk index 0ec62ba96..4168c1cab 100644 --- a/core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk +++ b/core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk @@ -13,3 +13,6 @@ $(call force,CFG_WITH_SOFTWARE_PRNG,n) CFG_HWRNG_PTA ?= y CFG_HWRNG_QUALITY ?= 1024 CFG_HWRNG_RATE ?= 0 + +# Enable ICE filesystem-encryption PTA +CFG_ICE_FS_ENC_PTA ?= y diff --git a/core/arch/arm/plat-qcom/bobcat/ipq52xx/target_config.h b/core/arch/arm/plat-qcom/bobcat/ipq52xx/target_config.h index 7269d7d85..7e361ab11 100644 --- a/core/arch/arm/plat-qcom/bobcat/ipq52xx/target_config.h +++ b/core/arch/arm/plat-qcom/bobcat/ipq52xx/target_config.h @@ -25,4 +25,8 @@ #define QCOM_WDT_TMR_BASE UL(0x0B117000) #define QCOM_WDT_BARK_INT_ID UL(0x23) +/* eMMC (SDCC) is the ICE-backed storage controller on ipq52xx */ +#define ICE_LUT_KEYS SDCC_ICE_LUT_KEYS +#define ICE_LUT_KEYS_SIZE SDCC_ICE_LUT_KEYS_SIZE + #endif /* TARGET_CONFIG_H */ diff --git a/core/arch/arm/plat-qcom/bobcat/ipq96xx/target.mk b/core/arch/arm/plat-qcom/bobcat/ipq96xx/target.mk index b170b60a7..f187754aa 100644 --- a/core/arch/arm/plat-qcom/bobcat/ipq96xx/target.mk +++ b/core/arch/arm/plat-qcom/bobcat/ipq96xx/target.mk @@ -9,3 +9,6 @@ CFG_QCOM_DIAG_LOG ?= $(CFG_TEE_CORE_DEBUG) CFG_TZDRAM_START ?= 0x8A680000 CFG_TZDRAM_SIZE ?= 0x280000 CFG_TEE_RAM_VA_SIZE ?= 0x280000 + +# Enable ICE filesystem-encryption PTA +CFG_ICE_FS_ENC_PTA ?= y diff --git a/core/arch/arm/plat-qcom/bobcat/ipq96xx/target_config.h b/core/arch/arm/plat-qcom/bobcat/ipq96xx/target_config.h index 50697cfd8..2565aa71e 100644 --- a/core/arch/arm/plat-qcom/bobcat/ipq96xx/target_config.h +++ b/core/arch/arm/plat-qcom/bobcat/ipq96xx/target_config.h @@ -22,4 +22,8 @@ #define QCOM_WDT_TMR_BASE UL(0x0F411000) #define QCOM_WDT_BARK_INT_ID UL(0x36) +/* eMMC (SDCC) is the ICE-backed storage controller on ipq96xx */ +#define ICE_LUT_KEYS SDCC_ICE_LUT_KEYS +#define ICE_LUT_KEYS_SIZE SDCC_ICE_LUT_KEYS_SIZE + #endif /* TARGET_CONFIG_H */ diff --git a/core/pta/qcom/ice/config.h b/core/pta/qcom/ice/config.h new file mode 100644 index 000000000..f1b78a223 --- /dev/null +++ b/core/pta/qcom/ice/config.h @@ -0,0 +1,60 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __ICE_CONFIG_H +#define __ICE_CONFIG_H + +#include +#include + +#define ICE_MAX_KEY_IDX 32 +#define ICE_CRYPTOCFG_DATA_REGS 16 + +/* Key sizes in bytes */ +#define ICE_AES128_KEY_SIZE 16 +#define ICE_AES256_KEY_SIZE 32 + +/* ICE key register layout within a slot: + * n = 0..7 : DATA key (32 bytes, 8 x 4-byte registers) + * n = 8..15 : SALT key (32 bytes, 8 x 4-byte registers) + */ +#define ICE_KEY_REG_SIZE 32 +#define ICE_KEY_DATA_REG_START 0 +#define ICE_KEY_SALT_REG_START 8 + +/* + * ICE LUT-keys register offsets from the LUT-keys base, common to eMMC/SDCC + * and UFS. The field masks are used with io_write32_off_field(), which derives + * the shift from the mask. + */ +#define ICE_CRYPTOCFG_r_n_OFF(r, n) \ + (0x0 + (0x80 * (r)) + (0x4 * (n))) +#define ICE_CRYPTOCFG_r_16_OFF(r) \ + (0x40 + (0x80 * (r))) +#define ICE_CRYPTOCFG_r_16_CFGE_BMSK 0x80000000 +#define ICE_CRYPTOCFG_r_16_CAPIDX_BMSK 0xff00 +#define ICE_CRYPTOCFG_r_16_DUSIZE_BMSK 0xff + +enum ice_capability_index_type { + ICE_CIPHER_MODE_XTS_128 = 0x0, + ICE_CIPHER_MODE_CBC_128 = 0x1, + ICE_CIPHER_MODE_ECB_128 = 0x2, + ICE_CIPHER_MODE_XTS_256 = 0x3, + ICE_CIPHER_MODE_CBC_256 = 0x4, + ICE_CIPHER_MODE_ECB_256 = 0x5 +}; + +enum ice_data_unit_type { + ICE_DATA_UNIT_SIZE_512 = 0x1, + ICE_DATA_UNIT_SIZE_1024 = 0x2, + ICE_DATA_UNIT_SIZE_2048 = 0x4, + ICE_DATA_UNIT_SIZE_4096 = 0x8, + ICE_DATA_UNIT_SIZE_8192 = 0x10, + ICE_DATA_UNIT_SIZE_16384 = 0x20, + ICE_DATA_UNIT_SIZE_32768 = 0x40, + ICE_DATA_UNIT_SIZE_65536 = 0x80 +}; + +#endif /* __ICE_CONFIG_H */ diff --git a/core/pta/qcom/ice/ice.c b/core/pta/qcom/ice/ice.c new file mode 100644 index 000000000..28b18b057 --- /dev/null +++ b/core/pta/qcom/ice/ice.c @@ -0,0 +1,68 @@ +// SPDX-License-Identifier: BSD-2-Clause +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#include +#include +#include +#include +#include + +#include "sw_keys/ice_sw_keys.h" + +/* + * Controller-agnostic entry points. These wrap the per-controller + * implementation so the dispatcher stays independent of the underlying ICE + * block. Only software-key programming exists today; a future hardware-key + * (HWKM) path can be selected here at runtime, based on the key size passed + * to the PTA, dispatching to hwkm_cmd_ice_*() instead of sw_cmd_ice_*(). + */ +static TEE_Result cmd_ice_invalidate_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]) +{ + return sw_cmd_ice_invalidate_key(param_types, params); +} + +static TEE_Result cmd_ice_set_config_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]) +{ + return sw_cmd_ice_set_config_key(param_types, params); +} + +/* PTA command dispatcher */ +static TEE_Result invoke_command(void *sess_ctx __unused, uint32_t cmd_id, + uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]) +{ + switch (cmd_id) { + case PTA_CMD_ICE_INVALIDATE_KEY: + return cmd_ice_invalidate_key(param_types, params); + case PTA_CMD_ICE_SET_CONFIG_KEY: + return cmd_ice_set_config_key(param_types, params); + default: + break; + } + + EMSG("ICE: Command not implemented: %u", cmd_id); + return TEE_ERROR_NOT_IMPLEMENTED; +} + +/* Only the REE kernel's storage-encryption path may open a session */ +static TEE_Result open_session(uint32_t param_types __unused, + TEE_Param params[TEE_NUM_PARAMS] __unused, + void **sess_ctx __unused) +{ + struct tee_ta_session *s = to_ta_session(ts_get_current_session()); + + if (s->clnt_id.login != TEE_LOGIN_REE_KERNEL) + return TEE_ERROR_ACCESS_DENIED; + + return TEE_SUCCESS; +} + +pseudo_ta_register(.uuid = PTA_QCOM_ICE_UUID, + .name = "qcom_ice.pta", + .flags = PTA_DEFAULT_FLAGS | TA_FLAG_DEVICE_ENUM, + .open_session_entry_point = open_session, + .invoke_command_entry_point = invoke_command); diff --git a/core/pta/qcom/ice/sub.mk b/core/pta/qcom/ice/sub.mk new file mode 100644 index 000000000..5d8e15910 --- /dev/null +++ b/core/pta/qcom/ice/sub.mk @@ -0,0 +1,3 @@ +srcs-y += ice.c +incdirs-y += . +subdirs-y += sw_keys diff --git a/core/pta/qcom/ice/sw_keys/ice_sw_keys.c b/core/pta/qcom/ice/sw_keys/ice_sw_keys.c new file mode 100644 index 000000000..c28cf40ba --- /dev/null +++ b/core/pta/qcom/ice/sw_keys/ice_sw_keys.c @@ -0,0 +1,304 @@ +// SPDX-License-Identifier: BSD-2-Clause +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#include +#include +#include +#include +#include +#include +#include + +#include "ice_sw_keys.h" + +/* + * Register the ICE (Inline Crypto Engine) LUT keys register region so this + * PTA can program key slots. + */ +register_phys_mem_pgdir(MEM_AREA_IO_SEC, + (ICE_LUT_KEYS & ~SMALL_PAGE_MASK), + ICE_LUT_KEYS_SIZE); + +/* + * Virtual base of the ICE LUT-keys region, resolved once on first use. + * All register accesses go through io_*_off() helpers relative to this. + */ +static vaddr_t ice_base; + +static TEE_Result ice_get_base(vaddr_t *base) +{ + if (!ice_base) { + ice_base = (vaddr_t)phys_to_virt(ICE_LUT_KEYS, MEM_AREA_IO_SEC, + ICE_LUT_KEYS_SIZE); + if (!ice_base) { + EMSG("ICE: failed to map LUT-keys region"); + return TEE_ERROR_GENERIC; + } + } + + *base = ice_base; + + return TEE_SUCCESS; +} + +/* Returns true if every byte of @key is zero, in constant time. */ +static bool ice_key_is_all_zeros(const uint8_t *key, uint32_t key_len) +{ + uint8_t zeros[ICE_AES256_KEY_SIZE] = { }; + + assert(key_len <= sizeof(zeros)); + + return !consttime_memcmp(key, zeros, key_len); +} + +/* + * Write @key_len bytes of key material into consecutive ICE CRYPTOCFG_r_n + * registers starting at @reg_start. Each 4-byte group is packed little-endian + * so the key bytes appear in natural order in the register file (key byte 0 in + * the register LSB). Remaining registers up to the slot size are zero-filled. + */ +static void ice_write_key_to_regs(vaddr_t base, uint32_t index, + uint32_t reg_start, const uint8_t *key, + uint32_t key_len) +{ + uint32_t i; + uint32_t num_words = key_len / 4; + uint32_t max_words = ICE_KEY_REG_SIZE / 4; + + for (i = 0; i < num_words && i < max_words; i++) + io_write32_off(base, + ICE_CRYPTOCFG_r_n_OFF(index, reg_start + i), + get_unaligned_le32(&key[i * 4])); + + for (; i < max_words; i++) + io_write32_off(base, + ICE_CRYPTOCFG_r_n_OFF(index, reg_start + i), + 0x0); +} + +/* + * Overwrite all data registers of key slot @index with random data. + * Fails rather than falling back to a fixed pattern if the RNG can't be + * read, so a slot is never left holding predictable "wiped" key material. + */ +static TEE_Result ice_wipe_key_regs(vaddr_t base, uint32_t index) +{ + uint8_t rand_data[ICE_AES256_KEY_SIZE * 2]; + uint32_t i; + + if (crypto_rng_read(rand_data, sizeof(rand_data)) != TEE_SUCCESS) { + EMSG("ICE: RNG read failed, refusing to wipe slot %u", index); + return TEE_ERROR_BAD_STATE; + } + + for (i = 0; i < ICE_CRYPTOCFG_DATA_REGS; i++) + io_write32_off(base, ICE_CRYPTOCFG_r_n_OFF(index, i), + get_unaligned_le32(&rand_data[i * 4])); + + return TEE_SUCCESS; +} + +/* + * Program CRYPTOCFG_r_16: cipher/capability mode (CAPIDX), the data-unit + * size for XTS tweak calculation (DUSIZE), and finally set CFGE to mark + * the slot's configuration valid/enabled. + */ +static void ice_configure_slot(vaddr_t base, uint32_t index, + uint32_t cap_index, uint32_t data_unit_size) +{ + size_t off = ICE_CRYPTOCFG_r_16_OFF(index); + + io_write32_off_field(base, off, ICE_CRYPTOCFG_r_16_CAPIDX_BMSK, + cap_index); + io_write32_off_field(base, off, ICE_CRYPTOCFG_r_16_DUSIZE_BMSK, + data_unit_size); + io_write32_off_field(base, off, ICE_CRYPTOCFG_r_16_CFGE_BMSK, 0x1); +} + +/* + * Command: tzbsp_es_invalidate_ice_key port. + * [in] params[0].value.a key slot index + */ +TEE_Result sw_cmd_ice_invalidate_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]) +{ + uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_INPUT, + TEE_PARAM_TYPE_NONE, + TEE_PARAM_TYPE_NONE, + TEE_PARAM_TYPE_NONE); + uint32_t index; + vaddr_t base; + TEE_Result res; + + if (param_types != exp_pt) { + EMSG("ICE invalidate: bad param types 0x%x", param_types); + return TEE_ERROR_BAD_PARAMETERS; + } + + index = params[0].value.a; + if (index >= ICE_MAX_KEY_IDX) { + EMSG("ICE invalidate: invalid slot %u (max %u)", index, + ICE_MAX_KEY_IDX - 1); + return TEE_ERROR_BAD_PARAMETERS; + } + + res = ice_get_base(&base); + if (res != TEE_SUCCESS) + return res; + + /* Disable the slot so ICE can't use stale key data while it is wiped */ + io_write32_off(base, ICE_CRYPTOCFG_r_16_OFF(index), 0x0); + + /* + * Security wipe: overwrite all 16 registers with random data. Leave + * the slot disabled with the wipe left incomplete if the RNG can't + * be read, rather than re-arming it below with a partially wiped key. + */ + if (ice_wipe_key_regs(base, index) != TEE_SUCCESS) + return TEE_ERROR_BAD_STATE; + + /* + * Re-arm the slot with a fixed, non-secret placeholder config + * instead of leaving it disabled with stale configuration, so an + * invalidated slot ends up in a deterministic, non-secret state. + */ + ice_configure_slot(base, index, ICE_CIPHER_MODE_XTS_256, + ICE_DATA_UNIT_SIZE_512); + dsb(); + + return TEE_SUCCESS; +} + +/* + * Command: tzbps_es_set_config_ice_key port. This platform only ever + * receives raw plaintext key bytes from the kernel; there is no + * wrapped/hardware-key variant to select between. + * [in] params[0].value.a key slot index + * [in] params[0].value.b capability index (enum ice_capability_index_type) + * [in] params[1].value.a data unit size (enum ice_data_unit_type) + * [in] params[2].memref key || salt + */ +TEE_Result sw_cmd_ice_set_config_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]) +{ + uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_INPUT, + TEE_PARAM_TYPE_VALUE_INPUT, + TEE_PARAM_TYPE_MEMREF_INPUT, + TEE_PARAM_TYPE_NONE); + uint32_t index, cap_index, data_unit_size; + const uint8_t *key_buf; + uint32_t key_buf_len, key_size, salt_size; + bool is_xts; + vaddr_t base; + TEE_Result res; + + if (param_types != exp_pt) { + EMSG("ICE set_key: bad param types 0x%x", param_types); + return TEE_ERROR_BAD_PARAMETERS; + } + + index = params[0].value.a; + cap_index = params[0].value.b; + data_unit_size = params[1].value.a; + key_buf = (const uint8_t *)params[2].memref.buffer; + key_buf_len = params[2].memref.size; + + if (index >= ICE_MAX_KEY_IDX) { + EMSG("ICE set_key: invalid slot %u (max %u)", index, + ICE_MAX_KEY_IDX - 1); + return TEE_ERROR_BAD_PARAMETERS; + } + if (!key_buf) { + EMSG("ICE set_key: NULL key buffer"); + return TEE_ERROR_BAD_PARAMETERS; + } + + /* ECB modes rejected to match set_config_ice_key_common() */ + if (cap_index > ICE_CIPHER_MODE_ECB_256 || + cap_index == ICE_CIPHER_MODE_ECB_128 || + cap_index == ICE_CIPHER_MODE_ECB_256) { + EMSG("ICE set_key: unsupported cap_index %u", cap_index); + return TEE_ERROR_BAD_PARAMETERS; + } + + switch (data_unit_size) { + case ICE_DATA_UNIT_SIZE_512: + case ICE_DATA_UNIT_SIZE_1024: + case ICE_DATA_UNIT_SIZE_2048: + case ICE_DATA_UNIT_SIZE_4096: + case ICE_DATA_UNIT_SIZE_8192: + case ICE_DATA_UNIT_SIZE_16384: + case ICE_DATA_UNIT_SIZE_32768: + case ICE_DATA_UNIT_SIZE_65536: + break; + default: + EMSG("ICE set_key: invalid data_unit_size 0x%x", + data_unit_size); + return TEE_ERROR_BAD_PARAMETERS; + } + + switch ((enum ice_capability_index_type)cap_index) { + case ICE_CIPHER_MODE_XTS_128: + key_size = ICE_AES128_KEY_SIZE; salt_size = ICE_AES128_KEY_SIZE; + is_xts = true; break; + case ICE_CIPHER_MODE_CBC_128: + key_size = ICE_AES128_KEY_SIZE; salt_size = 0; + is_xts = false; break; + case ICE_CIPHER_MODE_XTS_256: + key_size = ICE_AES256_KEY_SIZE; salt_size = ICE_AES256_KEY_SIZE; + is_xts = true; break; + case ICE_CIPHER_MODE_CBC_256: + key_size = ICE_AES256_KEY_SIZE; salt_size = 0; + is_xts = false; break; + default: + EMSG("ICE set_key: unhandled cap_index %u", cap_index); + return TEE_ERROR_BAD_PARAMETERS; + } + + if (key_buf_len < (key_size + salt_size)) { + EMSG("ICE set_key: key buf too small: got %u need %u", + key_buf_len, key_size + salt_size); + return TEE_ERROR_BAD_PARAMETERS; + } + + if (ice_key_is_all_zeros(key_buf, key_size)) { + EMSG("ICE set_key: all-zero key rejected"); + return TEE_ERROR_BAD_PARAMETERS; + } + if (is_xts && ice_key_is_all_zeros(key_buf + key_size, salt_size)) { + EMSG("ICE set_key: all-zero salt rejected"); + return TEE_ERROR_BAD_PARAMETERS; + } + + res = ice_get_base(&base); + if (res != TEE_SUCCESS) + return res; + + /* Disable the slot so ICE can't use stale key data during reconfig */ + io_write32_off(base, ICE_CRYPTOCFG_r_16_OFF(index), 0x0); + + /* Configure CRYPTOCFG_r_16 (mode/data-unit/enable) before key data */ + ice_configure_slot(base, index, cap_index, data_unit_size); + + /* + * Security wipe: overwrite all 16 registers with random data. Leave + * the slot disabled rather than enabled over an incomplete wipe if + * the RNG can't be read. + */ + if (ice_wipe_key_regs(base, index) != TEE_SUCCESS) { + io_write32_off(base, ICE_CRYPTOCFG_r_16_OFF(index), 0x0); + return TEE_ERROR_BAD_STATE; + } + + /* Program the key (and salt, for XTS) into the data registers */ + ice_write_key_to_regs(base, index, ICE_KEY_DATA_REG_START, key_buf, + key_size); + if (is_xts) + ice_write_key_to_regs(base, index, ICE_KEY_SALT_REG_START, + key_buf + key_size, salt_size); + dsb(); + + return TEE_SUCCESS; +} diff --git a/core/pta/qcom/ice/sw_keys/ice_sw_keys.h b/core/pta/qcom/ice/sw_keys/ice_sw_keys.h new file mode 100644 index 000000000..8e5ee1b41 --- /dev/null +++ b/core/pta/qcom/ice/sw_keys/ice_sw_keys.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __ICE_SW_KEYS_H +#define __ICE_SW_KEYS_H + +#include + +#include "../config.h" + +TEE_Result sw_cmd_ice_invalidate_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]); +TEE_Result sw_cmd_ice_set_config_key(uint32_t param_types, + TEE_Param params[TEE_NUM_PARAMS]); + +#endif /* __ICE_SW_KEYS_H */ diff --git a/core/pta/qcom/ice/sw_keys/sub.mk b/core/pta/qcom/ice/sw_keys/sub.mk new file mode 100644 index 000000000..754c1e626 --- /dev/null +++ b/core/pta/qcom/ice/sw_keys/sub.mk @@ -0,0 +1,2 @@ +srcs-y += ice_sw_keys.c +incdirs-y += . diff --git a/core/pta/qcom/sub.mk b/core/pta/qcom/sub.mk index 2f0ac9af9..21cdd5521 100644 --- a/core/pta/qcom/sub.mk +++ b/core/pta/qcom/sub.mk @@ -1 +1,2 @@ subdirs-$(CFG_QCOM_PAS_PTA) += pas +subdirs-$(CFG_ICE_FS_ENC_PTA) += ice diff --git a/lib/libutee/include/pta_qcom_ice.h b/lib/libutee/include/pta_qcom_ice.h new file mode 100644 index 000000000..7605067f6 --- /dev/null +++ b/lib/libutee/include/pta_qcom_ice.h @@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __PTA_QCOM_ICE_H +#define __PTA_QCOM_ICE_H + +/* + * Qualcomm ICE PTA - Filesystem Encryption using the Inline Crypto Engine + * Provides hardware key configuration for ICE-accelerated storage encryption. + * Storage-controller agnostic: caters to ICE blocks on different storage + * controllers (eMMC/SDCC, UFS, ...). + * UUID: {29e87b9e-012a-4878-a1e1-a1b90a215b16} + */ +#define PTA_QCOM_ICE_UUID \ + { 0x29e87b9e, 0x012a, 0x4878, \ + { 0xa1, 0xe1, 0xa1, 0xb9, 0x0a, 0x21, 0x5b, 0x16 } } + +/* + * Invalidate ICE key slot - overwrite key registers with random data + * [in] params[0].value.a Key slot index (0..ICE_MAX_KEY_IDX-1) + */ +#define PTA_CMD_ICE_INVALIDATE_KEY 0 + +/* + * Set ICE key slot with raw key material and full configuration + * [in] params[0].value.a Key slot index (0..ICE_MAX_KEY_IDX-1) + * [in] params[0].value.b Cap index (ice_capability_index_type) + * [in] params[1].value.a Data unit size (ice_data_unit_type) + * [in] params[2].memref.buffer Key data: key bytes followed by salt bytes + * XTS-128: 16B key + 16B salt = 32 bytes + * XTS-256: 32B key + 32B salt = 64 bytes + * CBC-128: 16B key + * CBC-256: 32B key + * [in] params[2].memref.size Total key data size + */ +#define PTA_CMD_ICE_SET_CONFIG_KEY 1 + +#endif /* __PTA_QCOM_ICE_H */