pta: qcom: ice: Add support for invalidating ICE slot key

Add support for invalidating a previously programmed key from the inline
crypto engine's (ICE) key slot via the hardware key manager.

Signed-off-by: Harshal Dev <harshal.dev@oss.qualcomm.com>

Author: harshaldev27

core/pta/qcom/ice/hwkm/ice_hwkm.c

@@ -54,6 +54,44 @@ static TEE_Result get_or_init_ephemeral_ctx(const uint8_t **ctx,
 	return TEE_SUCCESS;
 }
 
+TEE_Result clear_ice_slave_slot_hwkm(uint32_t slot)
+{
+	struct hwkm_transaction t_clear = {
+		.cmd = {
+			.op = HWKM_OP_KEY_SLOT_CLEAR,
+			.clear = {
+				.dks = 0,
+				.is_double_key = true,
+			},
+		},
+	};
+	int rc = HWKM_ERR_GENERIC;
+
+	if (slot >= ICE_MAX_KEY_IDX)
+		return TEE_ERROR_BAD_PARAMETERS;
+
+	/* Disable slot first so stale key/config cannot be used. */
+	io_write32_off_field(ICE_LUT_KEYS, ICE_CRYPTOCFG_r_16_OFF(slot),
+			     ICE_CRYPTOCFG_r_16_CFGE_BMSK,
+			     0x0);
+
+	t_clear.cmd.clear.dks = HWKM_ICE_MAP_SLOT(slot);
+
+	rc = hwkm_run_transaction(HWKM_KEY_DEST_ICE_SLAVE, &t_clear);
+	if (rc)
+		return hwkm_to_optee(rc);
+
+	if (t_clear.rsp.status != HWKM_RSP_ERR_SUCCESS &&
+	    t_clear.rsp.status != HWKM_CLEAR_ERR_DKS_SLOT_EMPTY) {
+		EMSG("ICE invalidate clear failed: slot=%u mapped=%u status=0x%x",
+		     slot, (unsigned int)t_clear.cmd.clear.dks,
+		     (unsigned int)t_clear.rsp.status);
+		return TEE_ERROR_GENERIC;
+	}
+
+	return TEE_SUCCESS;
+}
+
 /*
  * export_tpkey_wrapped_blob_from_ephemeral() - Unwrap input blob under
  * ephemeral wrapping key, then re-wrap/export under TPKEY.

core/pta/qcom/ice/hwkm/ice_hwkm.h

@@ -8,6 +8,8 @@
 
 #include <tee_api_types.h>
 
+TEE_Result clear_ice_slave_slot_hwkm(uint32_t slot);
+
 TEE_Result set_config_ice_key_using_hwkm(uint32_t slot,
 					 const uint8_t *wrapped_blob,
 					 size_t wrapped_blob_len);
@@ -20,4 +22,4 @@ TEE_Result import_and_wrap_with_hw_key(const uint8_t *in_key, size_t in_key_len,
 
 TEE_Result generate_hw_wrapped_key(uint8_t *out_blob, size_t *out_blob_len);
 
-#endif /* __ICE_HWKM_H */
+#endif /* __ICE_HWKM_H */

core/pta/qcom/ice/ice.c

@@ -11,6 +11,20 @@
 #include <drivers/hwkm.h>
 #include "hwkm/ice_hwkm.h"
 
+static TEE_Result cmd_ice_invalidate_key(uint32_t param_types,
+				  TEE_Param params[TEE_NUM_PARAMS])
+{
+	const uint32_t exp_pt = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_INPUT,
+						TEE_PARAM_TYPE_NONE,
+						TEE_PARAM_TYPE_NONE,
+						TEE_PARAM_TYPE_NONE);
+
+	if (param_types != exp_pt)
+		return TEE_ERROR_BAD_PARAMETERS;
+
+	return clear_ice_slave_slot_hwkm(params[0].value.a);
+}
+
 static TEE_Result cmd_ice_set_config_key(uint32_t param_types,
 					 TEE_Param params[TEE_NUM_PARAMS])
 {
@@ -144,6 +158,8 @@ static TEE_Result invoke_command(void *sess_ctx __unused, uint32_t cmd_id,
 				 TEE_Param params[TEE_NUM_PARAMS])
 {
 	switch (cmd_id) {
+	case PTA_CMD_ICE_INVALIDATE_KEY:
+		return cmd_ice_invalidate_key(param_types, params);
 	case PTA_CMD_ICE_SET_CONFIG_KEY:
 		return cmd_ice_set_config_key(param_types, params);
 	case PTA_CMD_ICE_GENERATE_KEY:

lib/libutee/include/pta_qcom_ice.h

@@ -17,6 +17,12 @@
 	{ 0x29e87b9e, 0x012a, 0x4878, \
 		{ 0xa1, 0xe1, 0xa1, 0xb9, 0x0a, 0x21, 0x5b, 0x16 } }
 
+/*
+ * Invalidate ICE key slot - overwrite key registers with random data
+ * [in]  params[0].value.a           Key slot index (0..ICE_MAX_KEY_IDX-1)
+ */
+#define PTA_CMD_ICE_INVALIDATE_KEY    0
+
 /*
  * Program ICE key slot with key material and full configuration
  * [in]  params[0].value.a           Key slot index (0..ICE_MAX_KEY_IDX-1)