Skip to contentSkip to conversation

arm64: dts: qcom: sm8350: Add the inline crypto engine

PATCH Superseded Demeter Barna 3 participants 7 messages Nov 5 – Nov 9

Subsystems (5)

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

cover arm64: dts: qcom: sm8350: Add the inline crypto engine

SM8350 has an inline crypto engine (ICE v3.2.0) next to its UFS host, but sm8350.dtsi does not describe it, so ufs-qcom runs without inline encryption. Add the compatible to the binding and the node to sm8350.dtsi, as on SM8450.

The region covers the engine (0x1d88000, 0x8000) and its key manager (0x1d90000, 0x9000), as in Qualcomm's SM8350 device tree; the clocks and the power domain are those of SM8450. The TrustZone offers the raw-key SCM calls but not GENERATE/PREPARE/IMPORT_ICE_KEY, so qcom-ice uses raw keys.

Tested on a Razer Edge 5G with fscrypt v2 on ext4: "AES-256-XTS using blk-crypto (native)", and files written with and without inlinecrypt read back correctly either way. dtbs_check is clean for all SM8350 boards.

---
Demeter Barna (2):
dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350
arm64: dts: qcom: sm8350: Add the inline crypto engine

 .../bindings/crypto/qcom,inline-crypto-engine.yaml          |  2 ++
 arch/arm64/boot/dts/qcom/sm8350.dtsi                        | 13 +++++++++++++
 2 files changed, 15 insertions(+)

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261105-b4-sm8350-ice-efad45e93262

Best regards,

Signature · 1 line
Demeter Barna <[email protected]>
#1 lore raw

PATCH 1/2 dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

SM8350's UFS host has an inline crypto engine, version 3.2.0, with a hardware key manager behind it, clocked by the UFS ICE core and AHB clocks and powered by the UFS PHY GDSC. Document the compatible and require the power domain and clock names for it, as for SM8450.

---
 Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml | 2 ++
 1 file changed, 2 insertions(+)
Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml +2 -0
index 23bf98c2b..198002f58 100644
@@ -24,6 +24,7 @@ properties:
           - qcom,sc7180-inline-crypto-engine
           - qcom,sc7280-inline-crypto-engine
           - qcom,shikra-inline-crypto-engine
+          - qcom,sm8350-inline-crypto-engine
           - qcom,sm8450-inline-crypto-engine
           - qcom,sm8550-inline-crypto-engine
           - qcom,sm8650-inline-crypto-engine
@@ -74,6 +75,7 @@ allOf:
                 - qcom,sa8775p-inline-crypto-engine
                 - qcom,sc7180-inline-crypto-engine
                 - qcom,sc7280-inline-crypto-engine
+                - qcom,sm8350-inline-crypto-engine
                 - qcom,sm8450-inline-crypto-engine
                 - qcom,sm8550-inline-crypto-engine
                 - qcom,sm8650-inline-crypto-engine
Signature · 1 line
2.53.0
#4 lore raw

PATCH 2/2 arm64: dts: qcom: sm8350: Add the inline crypto engine

In reply to Demeter Barna

Describe the UFS inline crypto engine at 0x1d88000 and hand it to the UFS host controller with qcom,ice. The region covers the engine and its hardware key manager (0x8000 + 0x9000), as in Qualcomm's SM8350 device tree; it is clocked by the UFS ICE core and AHB clocks and powered by the UFS PHY GDSC, as on SM8450. Without it the UFS driver logs "Disabling inline encryption support" and fscrypt has no hardware path.

---
 arch/arm64/boot/dts/qcom/sm8350.dtsi | 13 +++++++++++++
 1 file changed, 13 insertions(+)
arch/arm64/boot/dts/qcom/sm8350.dtsi +13 -0
index 55b32050c..2b258c4b4 100644
@@ -1782,6 +1782,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
 				<0 0>,
 				<0 0>,
 				<0 0>;
+			qcom,ice = <&ice>;
+
 			status = "disabled";
 		};
 
@@ -1807,6 +1809,17 @@ ufs_mem_phy: phy@1d87000 {
 			status = "disabled";
 		};
 
+		ice: crypto@1d88000 {
+			compatible = "qcom,sm8350-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";
+			reg = <0 0x01d88000 0 0x11000>;
+			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+				 <&gcc GCC_UFS_PHY_AHB_CLK>;
+			clock-names = "core",
+				      "iface";
+			power-domains = <&gcc UFS_PHY_GDSC>;
+		};
+
 		cryptobam: dma-controller@1dc4000 {
 			compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0";
 			reg = <0 0x01dc4000 0 0x24000>;
Signature · 1 line
2.53.0
#2 lore raw

Re: [PATCH 1/2] dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

In reply to Demeter Barna
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] dt-bindings: crypto: qcom,inline-crypto-engine: wrong allOf rule for SM8350 --

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] dt-bindings: crypto: qcom,inline-crypto-engine: wrong allOf rule for SM8350 --

commit 6fe4d61044ad335d59b80ff5b3c25ea2445e069d
Author: Demeter Barna <[email protected]>

dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

This commit documents the qcom,sm8350-inline-crypto-engine compatible in the Qualcomm Inline Crypto Engine DT binding schema.

Quoted 4 lines
Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml +0 -0
index 23bf98c2b9fa0..198002f582484 100644

[ ... ]

Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml allOf: · line 78

Quoted 5 lines
Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml +1 -0
@@ -74,6 +75,7 @@ allOf:
                 - qcom,sa8775p-inline-crypto-engine
                 - qcom,sc7180-inline-crypto-engine
                 - qcom,sc7280-inline-crypto-engine
+                - qcom,sm8350-inline-crypto-engine

[Severity: Medium]
Should qcom,sm8350-inline-crypto-engine be omitted from this allOf list?

The commit message states that this patch requires the power domain and clock names for SM8350, However, the allOf block uses a negated condition to exempt legacy SoCs from requiring power-domains, clock-names, and two clocks:

# Do not extend the list.
# Legacy SoCs are allowed for single clock.
# New SoCs must provide both clocks and power domains. allOf:
- if:
not:
properties:
compatible:
contains:
enum:
...
- qcom,sm8350-inline-crypto-engine
...
then:
required:
- power-domains
- clock-names
properties:
clocks:
minItems: 2
clock-names:
minItems: 2

Adding qcom,sm8350-inline-crypto-engine under the negated if condition causes dtbs_check to skip the then clause, exempting SM8350 from those requirements instead of enforcing them.

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
#5 lore raw
In reply to Demeter Barna
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [Medium] dt-bindings: crypto: qcom,inline-crypto-engine: inverted if-not condition for SM8350 - [Low]…

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] dt-bindings: crypto: qcom,inline-crypto-engine: inverted if-not condition for SM8350
- [Low] arm64: dts: qcom: sm8350: ICE reg size 0x11000 instead of 0x18000
--

commit da3fc875e05c7271bcc6b15fe532d10c5104a0b1
Author: Demeter Barna <[email protected]>

arm64: dts: qcom: sm8350: Add the inline crypto engine

This commit adds the UFS inline crypto engine (ICE) device node at 0x1d88000 to the SM8350 device tree and links it to the UFS host controller via the qcom,ice property.

Quoted 4 lines
arch/arm64/boot/dts/qcom/sm8350.dtsi +0 -0
index 55b32050ce9c8..2b258c4b4fa71 100644

[ ... ]

arch/arm64/boot/dts/qcom/sm8350.dtsi ufs_mem_phy: phy@1d87000 { · line 1814

Quoted 7 lines
arch/arm64/boot/dts/qcom/sm8350.dtsi +3 -0
@@ -1807,6 +1809,17 @@ ufs_mem_phy: phy@1d87000 {
 			status = "disabled";
 		};
 
+		ice: crypto@1d88000 {
+			compatible = "qcom,sm8350-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";

[Severity: Medium]
In the accompanying binding commit 4bdcd3be438d ("dt-bindings: crypto:
qcom,inline-crypto-engine: Add SM8350"), the commit message states:

Document the compatible and require the power domain and clock names for it, as for SM8450.

However, in Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml, qcom,sm8350-inline-crypto-engine was added to the negated compatible enum under allOf:

# Do not extend the list.
# Legacy SoCs are allowed for single clock.
# New SoCs must provide both clocks and power domains. allOf:
- if:
not:
properties:
compatible:
contains:
enum:
...
- qcom,sc7280-inline-crypto-engine
- qcom,sm8350-inline-crypto-engine
- qcom,sm8450-inline-crypto-engine
...
then:
required:
- power-domains
- clock-names
properties:
clocks:
minItems: 2
clock-names:
minItems: 2

Because that condition uses if: not: (introduced in commit 3360fa760425 to exempt legacy SoCs), doesn't adding qcom,sm8350-inline-crypto-engine to that enum exempt SM8350 from requiring power-domains, clock-names, and two clocks during dtbs_check validation instead of requiring them?

arch/arm64/boot/dts/qcom/sm8350.dtsi ufs_mem_phy: phy@1d87000 { · line 1815

Quoted 1 line
arch/arm64/boot/dts/qcom/sm8350.dtsi +1 -0
+			reg = <0 0x01d88000 0 0x11000>;

[Severity: Low]
Should the reg size in ice: crypto@1d88000 be 0x18000 instead of 0x11000?

When qcom_ice_probe() in drivers/soc/qcom/ice.c maps this resource via devm_platform_ioremap_resource(), 0x11000 covers the 0x8000 ICE region plus only 0x9000 bytes of the HWKM region from the downstream vendor device tree, leaving the upper 0x7000 bytes of the 0x10000 HWKM block unmapped.

Other upstream Qualcomm SoCs with ICE v3.2.0+ and HWKM at 0x01d88000, such as SC7280 in arch/arm64/boot/dts/qcom/kodiak.dtsi and SM8450 in arch/arm64/boot/dts/qcom/sm8450.dtsi (as well as SM8550, SM8650, SM8750, SA8775P, and QCS8300), use:

  reg = <0 0x01d88000 0 0x18000>;
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
#3 lore raw

Re: [PATCH 1/2] dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

In reply to Demeter Barna
Quoted 8 lines · Demeter Barna

SM8350's UFS host has an inline crypto engine, version 3.2.0, with a hardware key manager behind it, clocked by the UFS ICE core and AHB clocks and powered by the UFS PHY GDSC. Document the compatible and require the power domain and clock names for it, as for SM8450.

---
 Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml | 2 ++

And a comment "do not extend that list" did not ring a bell? If you do something against clear guideline, at least document why.

Best regards,
Krzysztof

#6 lore raw
In reply to Demeter Barna
Quoted 27 lines · Demeter Barna

Describe the UFS inline crypto engine at 0x1d88000 and hand it to the UFS host controller with qcom,ice. The region covers the engine and its hardware key manager (0x8000 + 0x9000), as in Qualcomm's SM8350 device tree; it is clocked by the UFS ICE core and AHB clocks and powered by the UFS PHY GDSC, as on SM8450. Without it the UFS driver logs "Disabling inline encryption support" and fscrypt has no hardware path.

---
 arch/arm64/boot/dts/qcom/sm8350.dtsi | 13 +++++++++++++
 1 file changed, 13 insertions(+)
arch/arm64/boot/dts/qcom/sm8350.dtsi +2 -0
index 55b32050c..2b258c4b4 100644
@@ -1782,6 +1782,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
 				<0 0>,
 				<0 0>,
 				<0 0>;
+			qcom,ice = <&ice>;
+
 			status = "disabled";
 		};
 
@@ -1807,6 +1809,17 @@ ufs_mem_phy: phy@1d87000 {
 			status = "disabled";

arch/arm64/boot/dts/qcom/sm8350.dtsi ufs_mem_phy: phy@1d87000 { · line 1819

Quoted 10 lines
arch/arm64/boot/dts/qcom/sm8350.dtsi +8 -0
 		};
 
+		ice: crypto@1d88000 {
+			compatible = "qcom,sm8350-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";
+			reg = <0 0x01d88000 0 0x11000>;
+			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+				 <&gcc GCC_UFS_PHY_AHB_CLK>;
+			clock-names = "core",
+				      "iface";

Odd, your binding was hinting towards incomplete/legacy DTS, but I see complete - at least in clocks part.

Best regards,
Krzysztof