[PATCH v2 0/2] arm64: dts: qcom: sm8350: Add the inline crypto engine

[PATCH v2 0/2] arm64: dts: qcom: sm8350: Add the inline crypto engine

[Demeter Barna via B4 Relay]

SM8350 has an inline crypto engine (ICE v3.2.0) next to its UFS host,
but sm8350.dtsi does not describe it, so ufs-qcom runs without inline
encryption. Add the compatible to the binding and the node to
sm8350.dtsi, as on SM8450.

The region covers the engine (0x1d88000, 0x8000) and its key manager
(0x1d90000, 0x9000), as in Qualcomm's SM8350 device tree; the clocks and
the power domain are those of SM8450. The TrustZone offers the raw-key
SCM calls but not GENERATE/PREPARE/IMPORT_ICE_KEY, so qcom-ice uses raw
keys.

Tested on a Razer Edge 5G with fscrypt v2 on ext4: "AES-256-XTS using
blk-crypto (native)", and files written with and without inlinecrypt
read back correctly either way. dtbs_check is clean for all SM8350
boards.

Signed-off-by: Demeter Barna <me@fromdisposition.org>
---
Changes in v2:
- dt-bindings: drop SM8350 from the legacy single-clock list. It was
  added there by mistake; SM8350 does not need the exemption, its node
  has both clocks and the power domain.
- Link to v1: https://patch.msgid.link/20261105-b4-sm8350-ice-v1-0-f55e6ea8e1ca@fromdisposition.org

---
Demeter Barna (2):
      dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350
      arm64: dts: qcom: sm8350: Add the inline crypto engine

 .../bindings/crypto/qcom,inline-crypto-engine.yaml          |  1 +
 arch/arm64/boot/dts/qcom/sm8350.dtsi                        | 13 +++++++++++++
 2 files changed, 14 insertions(+)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261105-b4-sm8350-ice-efad45e93262

Best regards,
--  
Demeter Barna <me@fromdisposition.org>

[PATCH v2 1/2] dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

[Demeter Barna via B4 Relay]

From: Demeter Barna <me@fromdisposition.org>

SM8350's UFS host has an inline crypto engine, version 3.2.0, with a
hardware key manager behind it, clocked by the UFS ICE core and AHB
clocks and powered by the UFS PHY GDSC. Document the compatible. Being a
new SoC, it stays off the legacy single-clock list, so both clocks and
the power domain are required.

Signed-off-by: Demeter Barna <me@fromdisposition.org>
---
 Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml b/Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml
index 23bf98c2b..2423fd846 100644
--- a/Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml
+++ b/Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml
@@ -24,6 +24,7 @@ properties:
           - qcom,sc7180-inline-crypto-engine
           - qcom,sc7280-inline-crypto-engine
           - qcom,shikra-inline-crypto-engine
+          - qcom,sm8350-inline-crypto-engine
           - qcom,sm8450-inline-crypto-engine
           - qcom,sm8550-inline-crypto-engine
           - qcom,sm8650-inline-crypto-engine

-- 
2.53.0

Re: [PATCH v2 1/2] dt-bindings: crypto: qcom,inline-crypto-engine: Add SM8350

[Krzysztof Kozlowski]

On Mon, Nov 09, 2026 at 01:55:29PM +0000, Demeter Barna wrote:
> SM8350's UFS host has an inline crypto engine, version 3.2.0, with a
> hardware key manager behind it, clocked by the UFS ICE core and AHB
> clocks and powered by the UFS PHY GDSC. Document the compatible. Being a
> new SoC, it stays off the legacy single-clock list, so both clocks and
> the power domain are required.
> 
> Signed-off-by: Demeter Barna <me@fromdisposition.org>
> ---
>  Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml | 1 +
>  1 file changed, 1 insertion(+)

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

Best regards,
Krzysztof

[PATCH v2 2/2] arm64: dts: qcom: sm8350: Add the inline crypto engine

[Demeter Barna via B4 Relay]

From: Demeter Barna <me@fromdisposition.org>

Describe the UFS inline crypto engine at 0x1d88000 and hand it to the
UFS host controller with qcom,ice. The region covers the engine and its
hardware key manager (0x8000 + 0x9000), as in Qualcomm's SM8350 device
tree; it is clocked by the UFS ICE core and AHB clocks and powered by
the UFS PHY GDSC, as on SM8450. Without it the UFS driver logs
"Disabling inline encryption support" and fscrypt has no hardware path.

Signed-off-by: Demeter Barna <me@fromdisposition.org>
---
 arch/arm64/boot/dts/qcom/sm8350.dtsi | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index 55b32050c..2b258c4b4 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -1782,6 +1782,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
 				<0 0>,
 				<0 0>,
 				<0 0>;
+			qcom,ice = <&ice>;
+
 			status = "disabled";
 		};
 
@@ -1807,6 +1809,17 @@ ufs_mem_phy: phy@1d87000 {
 			status = "disabled";
 		};
 
+		ice: crypto@1d88000 {
+			compatible = "qcom,sm8350-inline-crypto-engine",
+				     "qcom,inline-crypto-engine";
+			reg = <0 0x01d88000 0 0x11000>;
+			clocks = <&gcc GCC_UFS_PHY_ICE_CORE_CLK>,
+				 <&gcc GCC_UFS_PHY_AHB_CLK>;
+			clock-names = "core",
+				      "iface";
+			power-domains = <&gcc UFS_PHY_GDSC>;
+		};
+
 		cryptobam: dma-controller@1dc4000 {
 			compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0";
 			reg = <0 0x01dc4000 0 0x24000>;

-- 
2.53.0

Re: [PATCH v2 2/2] arm64: dts: qcom: sm8350: Add the inline crypto engine

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] arm64: dts: qcom: sm8350: ICE reg size 0x11000 instead of
  0x18000
--

commit b6d71a017150b9b7aef8d2a54ca324fd569ec504
Author: Demeter Barna <me@fromdisposition.org>

arm64: dts: qcom: sm8350: Add the inline crypto engine

This commit adds the UFS inline crypto engine (ICE) device node to the
SM8350 device tree and links it from the UFS host controller node via
qcom,ice.

> diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
> index 55b32050ce9c8..2b258c4b4fa71 100644
> --- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi

[ ... ]

> @@ -1807,6 +1809,17 @@ ufs_mem_phy: phy@1d87000 {
>  			status = "disabled";
>  		};
>  
> +		ice: crypto@1d88000 {
> +			compatible = "qcom,sm8350-inline-crypto-engine",
> +				     "qcom,inline-crypto-engine";
> +			reg = <0 0x01d88000 0 0x11000>;

[Severity: Low]
Should the ICE register region size be 0x18000 (0x8000 for ICE + 0x10000
for HWKM) instead of 0x11000?

Other Qualcomm SoCs with ICE v3.2.0+ and HWKM at 0x01d88000 define this
aperture as 0x18000, including Kodiak in fa9c7403af64 ("arm64: dts: qcom:
kodiak: Fix ICE reg size") and SM8450 in 7fb3d0512dac ("arm64: dts: qcom:
sm8450: Fix ICE reg size").  While drivers/soc/qcom/ice.c currently
accesses up to offset 0xd010 (QCOM_ICE_REG_HWKM_BANK0_BBAC_4), mapping
only 0x11000 leaves the upper 0x7000 bytes of the HWKM register space
unmapped.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-b4-sm8350-ice-v2-0-fd5e84985e90@fromdisposition.org?part=2

Re: [PATCH v2 2/2] arm64: dts: qcom: sm8350: Add the inline crypto engine

[Abel Vesa]

On 26-11-09 13:55:30, Demeter Barna wrote:
> Describe the UFS inline crypto engine at 0x1d88000 and hand it to the
> UFS host controller with qcom,ice. The region covers the engine and its
> hardware key manager (0x8000 + 0x9000), as in Qualcomm's SM8350 device
> tree; it is clocked by the UFS ICE core and AHB clocks and powered by
> the UFS PHY GDSC, as on SM8450. Without it the UFS driver logs
> "Disabling inline encryption support" and fscrypt has no hardware path.
> 
> Signed-off-by: Demeter Barna <me@fromdisposition.org>

Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>