Re: [PATCH v1 09/11] soc: qcom: add ICE keyslot partitioning driver for guest VMs

[Krzysztof Kozlowski <krzk@kernel.org>]

On 27/08/2026 18:07, Linlin Zhang wrote:
> From: linlzhan <linlin.zhang@oss.qualcomm.com>
> 
> On Qualcomm platforms the ICE hardware has a fixed number of physical
> keyslots shared across the host and all guest VMs.  A userspace
> virtio-blk backend handling VIRTIO_BLK_T_CRYPTO_IN/OUT requests needs
> to translate a guest's virtual keyslot index to the corresponding
> physical ICE keyslot without letting one VM access another VM's slots.
> 
> Add QCOM_ICE_SLOTS, a platform driver that implements bcp_slot_virt_ops
> for the /dev/blk-crypto-proxy device.  It parses a
> qcom,ice-keyslot-map device-tree node describing the per-VM keyslot
> allocation table, where each child entry maps a guest_id to a
> contiguous physical slot range [slot_offset .. slot_offset +
> max_ice_slots).  Entry 0 is reserved for the host; guest entries start
> at index 1 and are excluded from the guest-facing translation so that
> blk-crypto-proxy cannot accidentally route a guest request into the
> host's physical keyslots.
> 
> The driver exposes two callbacks:
> 
>   get_guest_slots()  — return the number of ICE keyslots allocated to
>                        a given guest_id; used by BCP_GET_CRYPTO_CAPS to
>                        populate the max_slots field in the virtio config
>                        space.
>   vslot_to_pslot()   — translate a (guest_id, virtual-slot) pair to the
>                        corresponding physical ICE keyslot index; used by
>                        BCP_SUBMIT_IO_BY_VSLOT before calling
>                        bio_crypt_set_ctx_by_slot().
> 
> The singleton pointer to the parsed table is RCU-protected; the hot
> path reads it lock-free.  Probe validates that no two VM entries share
> a guest_id or overlapping physical slot ranges.
> 
> Note: This patch is submitted for visibility. The keyslot partitioning
> is based on the current DT-based keyslot allocation with vm_id known.
> We are aware this may be revised to use a TZ SCM query interface in a
> future version of this series, submit it RFC for design discussion.
> 
> Signed-off-by: linlzhan <linlin.zhang@oss.qualcomm.com>
> ---
>  drivers/soc/qcom/Kconfig          |  18 +++
>  drivers/soc/qcom/Makefile         |   1 +
>  drivers/soc/qcom/qcom_ice_slots.c | 232 ++++++++++++++++++++++++++++++
>  3 files changed, 251 insertions(+)
>  create mode 100644 drivers/soc/qcom/qcom_ice_slots.c
> 
> diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig
> index 6c632d114d45..e1f383b4dc63 100644
> --- a/drivers/soc/qcom/Kconfig
> +++ b/drivers/soc/qcom/Kconfig
> @@ -294,6 +294,24 @@ endif
>  # Options selected by other drivers from different subsystems must be outside
>  # of the menuconfig if-block:
>  
> +config QCOM_ICE_SLOTS
> +	tristate "Qualcomm ICE keyslot partitioning for VM guests"
> +	depends on ARCH_QCOM || COMPILE_TEST
> +	depends on BLK_CRYPTO_PROXY
> +	depends on BLK_INLINE_ENCRYPTION
> +	help
> +	  Parses the qcom,ice-keyslot-map device-tree node and provides
> +	  per-VM ICE keyslot accounting and virtual-to-physical slot
> +	  translation for guest VMs sharing ICE hardware on Qualcomm
> +	  platforms.
> +
> +	  When enabled, guest virtual keyslot indices are mapped to the
> +	  physical ICE keyslot range allocated to each VM, preventing one
> +	  VM from accessing another VM's keyslots.
> +
> +	  Say M here when multiple VMs share ICE keyslots on a Qualcomm
> +	  platform.  If unsure, say N.
> +
>  config QCOM_INLINE_CRYPTO_ENGINE
>  	tristate
>  	select QCOM_SCM
> diff --git a/drivers/soc/qcom/Makefile b/drivers/soc/qcom/Makefile
> index 6d4b7546d1fb..952a57554f9d 100644
> --- a/drivers/soc/qcom/Makefile
> +++ b/drivers/soc/qcom/Makefile
> @@ -38,6 +38,7 @@ obj-$(CONFIG_QCOM_LLCC) += llcc-qcom.o
>  obj-$(CONFIG_QCOM_KRYO_L2_ACCESSORS) +=	kryo-l2-accessors.o
>  obj-$(CONFIG_QCOM_ICC_BWMON)	+= icc-bwmon.o
>  qcom_ice-objs			+= ice.o
> +obj-$(CONFIG_QCOM_ICE_SLOTS)	+= qcom_ice_slots.o
>  obj-$(CONFIG_QCOM_INLINE_CRYPTO_ENGINE)	+= qcom_ice.o
>  obj-$(CONFIG_QCOM_CRYPTO_VIRT)	+= crypto_virt.o
>  obj-$(CONFIG_QCOM_PBS) +=	qcom-pbs.o
> diff --git a/drivers/soc/qcom/qcom_ice_slots.c b/drivers/soc/qcom/qcom_ice_slots.c
> new file mode 100644
> index 000000000000..364ac93077c1
> --- /dev/null
> +++ b/drivers/soc/qcom/qcom_ice_slots.c
> @@ -0,0 +1,232 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * qcom_ice_slots.c - Qualcomm ICE keyslot partitioning for guest VMs
> + *
> + * Implements bcp_slot_virt_ops: translates a (guest_id, virtual-slot) pair to
> + * a physical ICE keyslot index using a per-VM allocation table parsed from
> + * the device-tree node with compatible = "qcom,ice-keyslot-map".
> + *
> + * Device-tree layout:
> + *
> + *   ice_keyslot_map: ice-keyslot-map {
> + *       compatible = "qcom,ice-keyslot-map";

NAK, there is no such stuff.

Drivers for undocumented downstream DTS are not allowed.

...

> +
> +	dev_info(dev, "registered: %u VMs, %u total ICE slots\n",
> +		 idx, total_slots);

This does not look like useful printk message. Drivers should be silent
on success:
https://elixir.bootlin.com/linux/v6.15-rc7/source/Documentation/process/coding-style.rst#L913
https://elixir.bootlin.com/linux/v6.15-rc7/source/Documentation/process/debugging/driver_development_debugging_guide.rst#L79


Best regards,
Krzysztof