ext4crypt: support wrappedkey for FBE
Qualcomm devices use a special `wrappedkey` mode for FBE. This is ported
from CAF
https://source.codeaurora.org/quic/la/platform/system/vold/commit/?h=LA.UM.7.8.r4-01000-SDM710.0&id=9229262d893a8592f7bc1b4e8a8dab7aad8df68c,
originally by folks at Mokee for vold
https://mokeedev.review/c/MoKee/android_system_vold/+/34102.
This patch ports the above changes to `ext4crypt`, which we can use in
recovery. Note that since we do not have `fs_mgr` in the recovery, we
cannot read the `wrappedkey` flag from fstab. Instead, similar to
`fbe.contents`, we use a special property `fbe.data.wrappedkey` to
indicate support for wrappedkey mode. Devices that need to use this
should set this property to `true` to activate corresponding code.
Change-Id: I79c2855d577156670b45c10c7c7b1fcd9fece8d9
diff --git a/crypto/ext4crypt/KeyStorage4.h b/crypto/ext4crypt/KeyStorage4.h
index 35ff65e..f74865f 100644
--- a/crypto/ext4crypt/KeyStorage4.h
+++ b/crypto/ext4crypt/KeyStorage4.h
@@ -17,13 +17,17 @@
#ifndef ANDROID_TWRP_KEYSTORAGE_H
#define ANDROID_TWRP_KEYSTORAGE_H
+#include "Keymaster4.h"
#include "KeyBuffer.h"
+#include <ext4_utils/ext4_crypt.h>
#include <string>
namespace android {
namespace vold {
+namespace km = ::android::hardware::keymaster::V4_0;
+
// Represents the information needed to decrypt a disk encryption key.
// If "token" is nonempty, it is passed in as a required Gatekeeper auth token.
// If "token" and "secret" are nonempty, "secret" is appended to the application-specific
@@ -39,6 +43,12 @@
const std::string secret;
};
+enum class KeyType {
+ DE_SYS,
+ DE_USER,
+ CE_USER
+};
+
extern const KeyAuthentication kEmptyAuthentication;
// Checks if path "path" exists.
@@ -67,6 +77,9 @@
bool destroyKey(const std::string& dir);
bool runSecdiscardSingle(const std::string& file);
+
+bool generateWrappedKey(userid_t user_id, KeyType key_type, KeyBuffer* key);
+bool getEphemeralWrappedKey(km::KeyFormat format, KeyBuffer& kmKey, KeyBuffer* key);
} // namespace vold
} // namespace android