Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

docs: kernel handoff (gitea blueline FF to f56b1ae, one build path), QCE-off note, shell-tree unify task

Browse source
This commit is contained in:
Fimeg 2026-07-21 15:49:15 -04:00
commit 931e794701
4 changed files with 249 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/STORAGE-ENCRYPTION.md
View file

@ -165,6 +165,25 @@ driver `drivers/soc/qcom/ice.c` feeding a `blk_crypto_profile` via
the same engine Android uses for FBE here. Root is ext4, which supports fscrypt
natively.
**Do not confuse ICE with QCE — and keep QCE off.** The Inline Crypto Engine
(`QCOM_INLINE_CRYPTO_ENGINE`, `drivers/soc/qcom/ice.c`) is our hardware at-rest
path and is a *separate* driver from the Qualcomm Crypto Engine async-offload
driver (`CRYPTO_DEV_QCE`, `drivers/crypto/qce/`). The blueline config currently
has the QCE family flipped fully on (`CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL=y`), but
QCE is unused here — it isn't even loaded (`/proc/crypto` shows only
`qcom-rng`) because its `cra_priority` is too low to ever be selected over the
CPU. Upstream is marking QCE **BROKEN** and dropping it from default ARM/ARM64
builds in Linux 7.3: it is slower than the CPU, has a history of bugs, and —
most relevant to us — *"does not have exclusive access to the hardware, causing
races with the secure world"* (Phoronix, 2026-07-20,
<https://www.phoronix.com/news/Linux-QCE-Disabling>; cryptodev commit marking it
BROKEN). That last point is the same secure-world-contention hazard this doc
flags for the Titan M path, and it is the reason our design uses **ICE + the
userspace AES-256-GCM secrets store**, never QCE. **Action: when we do the
in-scope kernel rebuild (below), leave `CRYPTO_DEV_QCE` and its `*_ENABLE_*`
sub-options OFF.** We lose nothing (it was never selected) and avoid shipping a
driver about to be BROKEN upstream.
**Provisioning (Pixel3Arch):** the rootfs is baked by `mkfs.ext4 -d` populating
a tree (`provision-rootfs.sh:220`). fscrypt needs `-O encrypt` on the fs and a
policy set on the target dirs *before* population — a change at that line plus a
@ -292,6 +311,7 @@ built once; the gating design is its own doc.
| Piece | State |
| --- | --- |
| Kernel crypto primitives (ext4 fscrypt, ICE inline) | Present, verified, unused |
| Qualcomm QCE async-offload driver (`CRYPTO_DEV_QCE`) | On in config but never loaded/selected; **keep OFF** — BROKEN upstream in 7.3, races with secure world. Not our path (we use ICE + userspace AEAD) |
| `TRUSTED_KEYS`/`ENCRYPTED_KEYS`/`PERSISTENT_KEYRINGS`/`BINDERFS` | Off — kernel rebuild in scope |
| fscrypt userspace + provisioning hook | Not built; hook points identified |
| Three-class model | Designed here; nothing built |