pta: qcom: ice: add software-key ICE PTA

core/arch/arm/plat-qcom/bobcat/arch_config.h

@@ -12,4 +12,8 @@
 #define DIAG_LOG_START_INFO		(IMEM_BASE + IMEM_DIAG_OFFSET)
 #define TCSR_BOOT_MISC_DETECT		UL(0x195C100)
 
+/* SDC1 SDCC ICE (Inline Crypto Engine) LUT keys register region */
+#define SDCC_ICE_LUT_KEYS		UL(0x0780A000)
+#define SDCC_ICE_LUT_KEYS_SIZE		UL(0x2000)
+
 #endif /* ARCH_CONFIG_H */

core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk

@@ -13,3 +13,6 @@ $(call force,CFG_WITH_SOFTWARE_PRNG,n)
 CFG_HWRNG_PTA ?= y
 CFG_HWRNG_QUALITY ?= 1024
 CFG_HWRNG_RATE ?= 0
+
+# Enable ICE filesystem-encryption PTA
+CFG_ICE_FS_ENC_PTA ?= y

core/arch/arm/plat-qcom/bobcat/ipq52xx/target_config.h

@@ -25,4 +25,8 @@
 #define QCOM_WDT_TMR_BASE		UL(0x0B117000)
 #define QCOM_WDT_BARK_INT_ID		UL(0x23)
 
+/* eMMC (SDCC) is the ICE-backed storage controller on ipq52xx */
+#define ICE_LUT_KEYS			SDCC_ICE_LUT_KEYS
+#define ICE_LUT_KEYS_SIZE		SDCC_ICE_LUT_KEYS_SIZE
+
 #endif /* TARGET_CONFIG_H */

core/arch/arm/plat-qcom/bobcat/ipq96xx/target.mk

@@ -9,3 +9,6 @@ CFG_QCOM_DIAG_LOG ?= $(CFG_TEE_CORE_DEBUG)
 CFG_TZDRAM_START ?= 0x8A680000
 CFG_TZDRAM_SIZE ?= 0x280000
 CFG_TEE_RAM_VA_SIZE ?= 0x280000
+
+# Enable ICE filesystem-encryption PTA
+CFG_ICE_FS_ENC_PTA ?= y

core/arch/arm/plat-qcom/bobcat/ipq96xx/target_config.h

@@ -22,4 +22,8 @@
 #define QCOM_WDT_TMR_BASE		UL(0x0F411000)
 #define QCOM_WDT_BARK_INT_ID		UL(0x36)
 
+/* eMMC (SDCC) is the ICE-backed storage controller on ipq96xx */
+#define ICE_LUT_KEYS			SDCC_ICE_LUT_KEYS
+#define ICE_LUT_KEYS_SIZE		SDCC_ICE_LUT_KEYS_SIZE
+
 #endif /* TARGET_CONFIG_H */

core/pta/qcom/ice/config.h

@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#ifndef __ICE_CONFIG_H
+#define __ICE_CONFIG_H
+
+#include <platform_config.h>
+#include <stdint.h>
+
+#define ICE_MAX_KEY_IDX				32
+#define ICE_CRYPTOCFG_DATA_REGS			16
+
+/* Key sizes in bytes */
+#define ICE_AES128_KEY_SIZE			16
+#define ICE_AES256_KEY_SIZE			32
+
+/* ICE key register layout within a slot:
+ *   n = 0..7  : DATA key (32 bytes, 8 x 4-byte registers)
+ *   n = 8..15 : SALT key (32 bytes, 8 x 4-byte registers)
+ */
+#define ICE_KEY_REG_SIZE			32
+#define ICE_KEY_DATA_REG_START			0
+#define ICE_KEY_SALT_REG_START			8
+
+/*
+ * ICE LUT-keys register offsets from the LUT-keys base, common to eMMC/SDCC
+ * and UFS. The field masks are used with io_write32_off_field(), which derives
+ * the shift from the mask.
+ */
+#define ICE_CRYPTOCFG_r_n_OFF(r, n) \
+	(0x0 + (0x80 * (r)) + (0x4 * (n)))
+#define ICE_CRYPTOCFG_r_16_OFF(r) \
+	(0x40 + (0x80 * (r)))
+#define ICE_CRYPTOCFG_r_16_CFGE_BMSK		0x80000000
+#define ICE_CRYPTOCFG_r_16_CAPIDX_BMSK		0xff00
+#define ICE_CRYPTOCFG_r_16_DUSIZE_BMSK		0xff
+
+enum ice_capability_index_type {
+	ICE_CIPHER_MODE_XTS_128 = 0x0,
+	ICE_CIPHER_MODE_CBC_128 = 0x1,
+	ICE_CIPHER_MODE_ECB_128 = 0x2,
+	ICE_CIPHER_MODE_XTS_256 = 0x3,
+	ICE_CIPHER_MODE_CBC_256 = 0x4,
+	ICE_CIPHER_MODE_ECB_256 = 0x5
+};
+
+enum ice_data_unit_type {
+	ICE_DATA_UNIT_SIZE_512   = 0x1,
+	ICE_DATA_UNIT_SIZE_1024  = 0x2,
+	ICE_DATA_UNIT_SIZE_2048  = 0x4,
+	ICE_DATA_UNIT_SIZE_4096  = 0x8,
+	ICE_DATA_UNIT_SIZE_8192  = 0x10,
+	ICE_DATA_UNIT_SIZE_16384 = 0x20,
+	ICE_DATA_UNIT_SIZE_32768 = 0x40,
+	ICE_DATA_UNIT_SIZE_65536 = 0x80
+};
+
+#endif /* __ICE_CONFIG_H */

core/pta/qcom/ice/ice.c

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+
+#include <kernel/pseudo_ta.h>
+#include <kernel/tee_ta_manager.h>
+#include <pta_qcom_ice.h>
+#include <tee_api_defines_extensions.h>
+#include <trace.h>
+
+#include "sw_keys/ice_sw_keys.h"
+
+/*
+ * Controller-agnostic entry points. These wrap the per-controller
+ * implementation so the dispatcher stays independent of the underlying ICE
+ * block. Only software-key programming exists today; a future hardware-key
+ * (HWKM) path can be selected here at runtime, based on the key size passed
+ * to the PTA, dispatching to hwkm_cmd_ice_*() instead of sw_cmd_ice_*().
+ */
+static TEE_Result cmd_ice_invalidate_key(uint32_t param_types,
+					 TEE_Param params[TEE_NUM_PARAMS])
+{
+	return sw_cmd_ice_invalidate_key(param_types, params);
+}
+
+static TEE_Result cmd_ice_set_config_key(uint32_t param_types,
+					 TEE_Param params[TEE_NUM_PARAMS])
+{
+	return sw_cmd_ice_set_config_key(param_types, params);
+}
+
+/* PTA command dispatcher */
+static TEE_Result invoke_command(void *sess_ctx __unused, uint32_t cmd_id,
+				 uint32_t param_types,
+				 TEE_Param params[TEE_NUM_PARAMS])
+{
+	switch (cmd_id) {
+	case PTA_CMD_ICE_INVALIDATE_KEY:
+		return cmd_ice_invalidate_key(param_types, params);
+	case PTA_CMD_ICE_SET_CONFIG_KEY:
+		return cmd_ice_set_config_key(param_types, params);
+	default:
+		break;
+	}
+
+	EMSG("ICE: Command not implemented: %u", cmd_id);
+	return TEE_ERROR_NOT_IMPLEMENTED;
+}
+
+/* Only the REE kernel's storage-encryption path may open a session */
+static TEE_Result open_session(uint32_t param_types __unused,
+			       TEE_Param params[TEE_NUM_PARAMS] __unused,
+			       void **sess_ctx __unused)
+{
+	struct tee_ta_session *s = to_ta_session(ts_get_current_session());
+
+	if (s->clnt_id.login != TEE_LOGIN_REE_KERNEL)
+		return TEE_ERROR_ACCESS_DENIED;
+
+	return TEE_SUCCESS;
+}
+
+pseudo_ta_register(.uuid = PTA_QCOM_ICE_UUID,
+		   .name = "qcom_ice.pta",
+		   .flags = PTA_DEFAULT_FLAGS | TA_FLAG_DEVICE_ENUM,
+		   .open_session_entry_point = open_session,
+		   .invoke_command_entry_point = invoke_command);

core/pta/qcom/ice/sub.mk

@@ -0,0 +1,3 @@
+srcs-y += ice.c
+incdirs-y += .
+subdirs-y += sw_keys