[PATCH v5 0/4] mmc: Avoid reprogram all keys to Inline Crypto Engine for MMC runtime suspend resume

[PATCH v5 0/4] mmc: Avoid reprogram all keys to Inline Crypto Engine for MMC runtime suspend resume

[Neeraj Soni]

Crypto reprogram all keys is called for each MMC runtime suspend/resume in
current upstream design. If this is implemented as a non-interruptible
call to TEE for security, the cpu core is blocked for execution while this
call executes although the crypto engine already has the keys.
For example, glitches in audio/video streaming applications have been
observed due to this.

Fix this by allowing host driver to control when to re-program the
crypto keys along with some fix up around usage of CONFIG_MMC_CRYPTO.

---
- Split the v4 patch https://lore.kernel.org/linux-mmc/20260529092612.1749752-1-neeraj.soni@oss.qualcomm.com/
as suggested here https://lore.kernel.org/all/CAPx+jO8rUwYV6q1-RrA4aZ9XnomSf82fgf8Jh2fUC0fE03RFPw@mail.gmail.com/
into 2 logical patches [PATCH v5 1/4] and [PATCH v5 2/4].
- Introduced [PATCH v5 3/4] to specifically restore crypto keys during
hibernation exit.
- Introduced [PATCH v5 4/4] to fix crypto capability usage in mtk-sd as
suggested here https://lore.kernel.org/all/20260723230104.GA662946@google.com/.
- Dropped "Acked-by:" tag from v4 due to the split and introduction of
new changes.

Neeraj Soni (3):
  mmc: Allow host driver to control the re-programming of Crypto keys
  mmc: sdhci-msm: Reprogram crypto keys during host hardware
    initialization
  mmc: mtk-sd: Protect crypto capability with crypto config

Ram Prakash Gupta (1):
  mmc: sdhci-msm: Use pm ops instead of macro to restore crypto keys

 drivers/mmc/core/crypto.c    |  2 +-
 drivers/mmc/host/mtk-sd.c    |  4 ++++
 drivers/mmc/host/sdhci-msm.c | 22 +++++++++++++++++++++-
 include/linux/mmc/host.h     |  5 +----
 4 files changed, 27 insertions(+), 6 deletions(-)

--
2.34.1

[PATCH v5 1/4] mmc: Allow host driver to control the re-programming of Crypto keys

[Neeraj Soni]

The register context for the crypto profile belongs to the
sdhci/cqhci host and not the mmc card, hence re-programming should be
managed by the host driver itself.

Add the flag MMC_CAP2_CRYPTO_NO_REPROG as part of host->caps2 to control
reprogramming keys to crypto engine for SoCs which dont require this
feature.

Signed-off-by: Seshu Madhavi Puppala <quic_spuppala@quicinc.com>
Co-developed-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
Signed-off-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
Co-developed-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Signed-off-by: Debraj Mukhopadhyay <quic_dmukhopa@quicinc.com>
Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
---
 drivers/mmc/core/crypto.c | 2 +-
 include/linux/mmc/host.h  | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/mmc/core/crypto.c b/drivers/mmc/core/crypto.c
index fec4fbf16a5b..a5a90bfc634e 100644
--- a/drivers/mmc/core/crypto.c
+++ b/drivers/mmc/core/crypto.c
@@ -15,7 +15,7 @@
 void mmc_crypto_set_initial_state(struct mmc_host *host)
 {
 	/* Reset might clear all keys, so reprogram all the keys. */
-	if (host->caps2 & MMC_CAP2_CRYPTO)
+	if ((host->caps2 & MMC_CAP2_CRYPTO) && !(host->caps2 & MMC_CAP2_CRYPTO_NO_REPROG))
 		blk_crypto_reprogram_all_keys(&host->crypto_profile);
 }
 
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index ba84f02c2a10..83d92fb64417 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -457,12 +457,9 @@ struct mmc_host {
 #define MMC_CAP2_CQE_DCMD	(1 << 24)	/* CQE can issue a direct command */
 #define MMC_CAP2_AVOID_3_3V	(1 << 25)	/* Host must negotiate down from 3.3V */
 #define MMC_CAP2_MERGE_CAPABLE	(1 << 26)	/* Host can merge a segment over the segment size */
-#ifdef CONFIG_MMC_CRYPTO
 #define MMC_CAP2_CRYPTO		(1 << 27)	/* Host supports inline encryption */
-#else
-#define MMC_CAP2_CRYPTO		0
-#endif
 #define MMC_CAP2_ALT_GPT_TEGRA	(1 << 28)	/* Host with eMMC that has GPT entry at a non-standard location */
+#define MMC_CAP2_CRYPTO_NO_REPROG (1 << 29)	/* Host handles inline crypto key reprogramming */
 
 	bool			uhs2_sd_tran;	/* UHS-II flag for SD_TRAN state */
 	bool			uhs2_app_cmd;	/* UHS-II flag for APP command */
-- 
2.34.1

Re: [PATCH v5 1/4] mmc: Allow host driver to control the re-programming of Crypto keys

[Eric Biggers]

On Thu, Jul 30, 2026 at 07:38:19PM +0530, Neeraj Soni wrote:
> diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
> index ba84f02c2a10..83d92fb64417 100644
> --- a/include/linux/mmc/host.h
> +++ b/include/linux/mmc/host.h
> @@ -457,12 +457,9 @@ struct mmc_host {
>  #define MMC_CAP2_CQE_DCMD	(1 << 24)	/* CQE can issue a direct command */
>  #define MMC_CAP2_AVOID_3_3V	(1 << 25)	/* Host must negotiate down from 3.3V */
>  #define MMC_CAP2_MERGE_CAPABLE	(1 << 26)	/* Host can merge a segment over the segment size */
> -#ifdef CONFIG_MMC_CRYPTO
>  #define MMC_CAP2_CRYPTO		(1 << 27)	/* Host supports inline encryption */
> -#else
> -#define MMC_CAP2_CRYPTO		0
> -#endif

I'm still a bit confused why this unrelated change is included.  If
you'd like to make this unrelated change, it should be a separate patch,
and the mtk-sd patch would need to be before it (not after).

- Eric

[PATCH v5 2/4] mmc: sdhci-msm: Reprogram crypto keys during host hardware initialization

[Neeraj Soni]

Host looses the Inline Crypto Engine (ICE) keys during hardware reset.
Re-program the keys while intializing ICE to ensure that ICE is available
in the same state as before the hardware reset.

Also set MMC_CAP2_CRYPTO_NO_REPROG to indicate that re-program of ICE keys
is not needed during MMC runtime suspend/resume.

Signed-off-by: Seshu Madhavi Puppala <quic_spuppala@quicinc.com>
Co-developed-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
Signed-off-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
Co-developed-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Signed-off-by: Debraj Mukhopadhyay <quic_dmukhopa@quicinc.com>
Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
---
 drivers/mmc/host/sdhci-msm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 4aff965f0e2e..7d71dc6f388d 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -1958,7 +1958,10 @@ static int sdhci_msm_ice_init(struct sdhci_msm_host *msm_host,
 				cap.sdus_mask * 512;
 	}
 
+	blk_crypto_reprogram_all_keys(&mmc->crypto_profile);
+
 	mmc->caps2 |= MMC_CAP2_CRYPTO;
+	mmc->caps2 |= MMC_CAP2_CRYPTO_NO_REPROG;
 	return 0;
 }
 
-- 
2.34.1

Re: [PATCH v5 2/4] mmc: sdhci-msm: Reprogram crypto keys during host hardware initialization

[Eric Biggers]

On Thu, Jul 30, 2026 at 07:38:20PM +0530, Neeraj Soni wrote:
> Host looses the Inline Crypto Engine (ICE) keys during hardware reset.
> Re-program the keys while intializing ICE to ensure that ICE is available
> in the same state as before the hardware reset.
> 
> Also set MMC_CAP2_CRYPTO_NO_REPROG to indicate that re-program of ICE keys
> is not needed during MMC runtime suspend/resume.
> 
> Signed-off-by: Seshu Madhavi Puppala <quic_spuppala@quicinc.com>
> Co-developed-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
> Signed-off-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
> Co-developed-by: Sarthak Garg <quic_sartgarg@quicinc.com>
> Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
> Signed-off-by: Debraj Mukhopadhyay <quic_dmukhopa@quicinc.com>
> Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
> ---
>  drivers/mmc/host/sdhci-msm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
> index 4aff965f0e2e..7d71dc6f388d 100644
> --- a/drivers/mmc/host/sdhci-msm.c
> +++ b/drivers/mmc/host/sdhci-msm.c
> @@ -1958,7 +1958,10 @@ static int sdhci_msm_ice_init(struct sdhci_msm_host *msm_host,
>  				cap.sdus_mask * 512;
>  	}
>  
> +	blk_crypto_reprogram_all_keys(&mmc->crypto_profile);
> +

This still does nothing.  The crypto profile was just initialized, so no
keyslots are in-use and blk_crypto_reprogram_all_keys() does nothing.

>  	mmc->caps2 |= MMC_CAP2_CRYPTO;
> +	mmc->caps2 |= MMC_CAP2_CRYPTO_NO_REPROG;

This seems to be the actual point of the patch, so let's simplify it to
just this.  However, this is also broken because this is ordered before
patch 3 that introduces the actually functional key reprogramming.
Please drop the no-op call to blk_crypto_reprogram_all_keys(), then
merge patches 2 and 3 into a single one.

- Eric

[PATCH v5 3/4] mmc: sdhci-msm: Use pm ops instead of macro to restore crypto keys

[Neeraj Soni]

From: Ram Prakash Gupta <ram.gupta@oss.qualcomm.com>

Inline Crypto Engine (ICE) keys are lost after hibernation entry and this
needs to be restored when hibernation exits. ICE keys are re-programmed
during sdhci_msm_ice_init() but it may not cover cases where the
hibernation image is already restored.

Unwrap the pm ops and use directly in driver to add the call to restore
Inline Crypto Engine (ICE) keys. This ensures that ICE is brought into
same state as before hibernation.

Signed-off-by: Ram Prakash Gupta <ram.gupta@oss.qualcomm.com>
Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
---
 drivers/mmc/host/sdhci-msm.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 7d71dc6f388d..a4998e74a2bd 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -2986,9 +2986,26 @@ static int sdhci_msm_runtime_resume(struct device *dev)
 	return ret;
 }
 
+static int sdhci_msm_restore(struct device *dev)
+{
+	struct sdhci_host *host = dev_get_drvdata(dev);
+
+#ifdef CONFIG_MMC_CRYPTO
+	if (host->mmc->caps2 & MMC_CAP2_CRYPTO)
+		blk_crypto_reprogram_all_keys(&host->mmc->crypto_profile);
+#endif
+
+	return pm_runtime_force_resume(dev);
+}
+
 static const struct dev_pm_ops sdhci_msm_pm_ops = {
-	SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 	RUNTIME_PM_OPS(sdhci_msm_runtime_suspend, sdhci_msm_runtime_resume, NULL)
+	.suspend	= pm_runtime_force_suspend,
+	.resume		= pm_runtime_force_resume,
+	.freeze		= pm_runtime_force_suspend,
+	.restore	= sdhci_msm_restore,
+	.thaw		= pm_runtime_force_resume,
+	.poweroff	= pm_runtime_force_suspend,
 };
 
 static struct platform_driver sdhci_msm_driver = {
-- 
2.34.1

Re: [PATCH v5 3/4] mmc: sdhci-msm: Use pm ops instead of macro to restore crypto keys

[Eric Biggers]

On Thu, Jul 30, 2026 at 07:38:21PM +0530, Neeraj Soni wrote:
> From: Ram Prakash Gupta <ram.gupta@oss.qualcomm.com>
> 
> Inline Crypto Engine (ICE) keys are lost after hibernation entry and this
> needs to be restored when hibernation exits. ICE keys are re-programmed
> during sdhci_msm_ice_init() but it may not cover cases where the
> hibernation image is already restored.
> 
> Unwrap the pm ops and use directly in driver to add the call to restore
> Inline Crypto Engine (ICE) keys. This ensures that ICE is brought into
> same state as before hibernation.
> 
> Signed-off-by: Ram Prakash Gupta <ram.gupta@oss.qualcomm.com>
> Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
> ---
>  drivers/mmc/host/sdhci-msm.c | 19 ++++++++++++++++++-
>  1 file changed, 18 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
> index 7d71dc6f388d..a4998e74a2bd 100644
> --- a/drivers/mmc/host/sdhci-msm.c
> +++ b/drivers/mmc/host/sdhci-msm.c
> @@ -2986,9 +2986,26 @@ static int sdhci_msm_runtime_resume(struct device *dev)
>  	return ret;
>  }
>  
> +static int sdhci_msm_restore(struct device *dev)
> +{
> +	struct sdhci_host *host = dev_get_drvdata(dev);
> +
> +#ifdef CONFIG_MMC_CRYPTO
> +	if (host->mmc->caps2 & MMC_CAP2_CRYPTO)
> +		blk_crypto_reprogram_all_keys(&host->mmc->crypto_profile);
> +#endif
> +
> +	return pm_runtime_force_resume(dev);
> +}

Is it correct to access the ICE registers before
pm_runtime_force_resume() has run?  Aren't clocks and power still off?

Also, prefer IS_ENABLED() to '#ifdef'.  However, this suggests to me
that we actually should just keep MMC_CAP2_CRYPTO defined to 0 when
!IS_ENABLED(CONFIG_MMC_CRYPTO), as that solves this naturally without
any need for #ifdef or IS_ENABLED().

- Eric

[PATCH v5 4/4] mmc: mtk-sd: Protect crypto capability with crypto config

[Neeraj Soni]

Host crypto capability can not be used if CONFIG_MMC_CRYPTO=n.
So set MMC_CAP2_CRYPTO in mmc->caps2 only if CONFIG_MMC_CRYPTO=y.

Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
---
 drivers/mmc/host/mtk-sd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 01ea3adbdf3b..c415ed97e3c2 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -3031,7 +3031,11 @@ static int msdc_drv_probe(struct platform_device *pdev)
 		if (IS_ERR(host->crypto_clk))
 			return PTR_ERR(host->crypto_clk);
 		else if (host->crypto_clk)
+#ifdef CONFIG_MMC_CRYPTO
 			mmc->caps2 |= MMC_CAP2_CRYPTO;
+#else
+			dev_dbg(host->dev, "Enable necessary crypto config\n");
+#endif
 	}
 
 	host->irq = platform_get_irq(pdev, 0);
-- 
2.34.1

Re: [PATCH v5 4/4] mmc: mtk-sd: Protect crypto capability with crypto config

[Eric Biggers]

On Thu, Jul 30, 2026 at 07:38:22PM +0530, Neeraj Soni wrote:
> Host crypto capability can not be used if CONFIG_MMC_CRYPTO=n.
> So set MMC_CAP2_CRYPTO in mmc->caps2 only if CONFIG_MMC_CRYPTO=y.
> 
> Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com>
> ---
>  drivers/mmc/host/mtk-sd.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
> index 01ea3adbdf3b..c415ed97e3c2 100644
> --- a/drivers/mmc/host/mtk-sd.c
> +++ b/drivers/mmc/host/mtk-sd.c
> @@ -3031,7 +3031,11 @@ static int msdc_drv_probe(struct platform_device *pdev)
>  		if (IS_ERR(host->crypto_clk))
>  			return PTR_ERR(host->crypto_clk);
>  		else if (host->crypto_clk)
> +#ifdef CONFIG_MMC_CRYPTO
>  			mmc->caps2 |= MMC_CAP2_CRYPTO;
> +#else
> +			dev_dbg(host->dev, "Enable necessary crypto config\n");
> +#endif

host->dev is still NULL at this point.  So if the log message were to be
actually reached it would show '(NULL device *)'.

But the message doesn't seem very useful anyway, especially when it's
logged only at debug level.  So maybe just drop it.

Is there a reason to even enable the crypto clock when CONFIG_MMC_CRYPTO
is disabled?  If no, then the 'if' condition above could just be changed
to:

    if (IS_ENABLED(CONFIG_MMC_CRYPTO) && !(mmc->caps2 & MMC_CAP2_NO_MMC)) {

- Eric