From: linlzhan On Qualcomm platforms the ICE hardware has a fixed number of physical keyslots shared across the host and all guest VMs. A userspace virtio-blk backend handling VIRTIO_BLK_T_CRYPTO_IN/OUT requests needs to translate a guest's virtual keyslot index to the corresponding physical ICE keyslot without letting one VM access another VM's slots. Add QCOM_ICE_SLOTS, a platform driver that implements bcp_slot_virt_ops for the /dev/blk-crypto-proxy device. It parses a qcom,ice-keyslot-map device-tree node describing the per-VM keyslot allocation table, where each child entry maps a guest_id to a contiguous physical slot range [slot_offset .. slot_offset + max_ice_slots). Entry 0 is reserved for the host; guest entries start at index 1 and are excluded from the guest-facing translation so that blk-crypto-proxy cannot accidentally route a guest request into the host's physical keyslots. The driver exposes two callbacks: get_guest_slots() — return the number of ICE keyslots allocated to a given guest_id; used by BCP_GET_CRYPTO_CAPS to populate the max_slots field in the virtio config space. vslot_to_pslot() — translate a (guest_id, virtual-slot) pair to the corresponding physical ICE keyslot index; used by BCP_SUBMIT_IO_BY_VSLOT before calling bio_crypt_set_ctx_by_slot(). The singleton pointer to the parsed table is RCU-protected; the hot path reads it lock-free. Probe validates that no two VM entries share a guest_id or overlapping physical slot ranges. Note: This patch is submitted for visibility. The keyslot partitioning is based on the current DT-based keyslot allocation with vm_id known. We are aware this may be revised to use a TZ SCM query interface in a future version of this series, submit it RFC for design discussion. Signed-off-by: linlzhan --- drivers/soc/qcom/Kconfig | 18 +++ drivers/soc/qcom/Makefile | 1 + drivers/soc/qcom/qcom_ice_slots.c | 232 ++++++++++++++++++++++++++++++ 3 files changed, 251 insertions(+) create mode 100644 drivers/soc/qcom/qcom_ice_slots.c diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig index 6c632d114d45..e1f383b4dc63 100644 --- a/drivers/soc/qcom/Kconfig +++ b/drivers/soc/qcom/Kconfig @@ -294,6 +294,24 @@ endif # Options selected by other drivers from different subsystems must be outside # of the menuconfig if-block: +config QCOM_ICE_SLOTS + tristate "Qualcomm ICE keyslot partitioning for VM guests" + depends on ARCH_QCOM || COMPILE_TEST + depends on BLK_CRYPTO_PROXY + depends on BLK_INLINE_ENCRYPTION + help + Parses the qcom,ice-keyslot-map device-tree node and provides + per-VM ICE keyslot accounting and virtual-to-physical slot + translation for guest VMs sharing ICE hardware on Qualcomm + platforms. + + When enabled, guest virtual keyslot indices are mapped to the + physical ICE keyslot range allocated to each VM, preventing one + VM from accessing another VM's keyslots. + + Say M here when multiple VMs share ICE keyslots on a Qualcomm + platform. If unsure, say N. + config QCOM_INLINE_CRYPTO_ENGINE tristate select QCOM_SCM diff --git a/drivers/soc/qcom/Makefile b/drivers/soc/qcom/Makefile index 6d4b7546d1fb..952a57554f9d 100644 --- a/drivers/soc/qcom/Makefile +++ b/drivers/soc/qcom/Makefile @@ -38,6 +38,7 @@ obj-$(CONFIG_QCOM_LLCC) += llcc-qcom.o obj-$(CONFIG_QCOM_KRYO_L2_ACCESSORS) += kryo-l2-accessors.o obj-$(CONFIG_QCOM_ICC_BWMON) += icc-bwmon.o qcom_ice-objs += ice.o +obj-$(CONFIG_QCOM_ICE_SLOTS) += qcom_ice_slots.o obj-$(CONFIG_QCOM_INLINE_CRYPTO_ENGINE) += qcom_ice.o obj-$(CONFIG_QCOM_CRYPTO_VIRT) += crypto_virt.o obj-$(CONFIG_QCOM_PBS) += qcom-pbs.o diff --git a/drivers/soc/qcom/qcom_ice_slots.c b/drivers/soc/qcom/qcom_ice_slots.c new file mode 100644 index 000000000000..364ac93077c1 --- /dev/null +++ b/drivers/soc/qcom/qcom_ice_slots.c @@ -0,0 +1,232 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * qcom_ice_slots.c - Qualcomm ICE keyslot partitioning for guest VMs + * + * Implements bcp_slot_virt_ops: translates a (guest_id, virtual-slot) pair to + * a physical ICE keyslot index using a per-VM allocation table parsed from + * the device-tree node with compatible = "qcom,ice-keyslot-map". + * + * Device-tree layout: + * + * ice_keyslot_map: ice-keyslot-map { + * compatible = "qcom,ice-keyslot-map"; + * #address-cells = <1>; + * #size-cells = <0>; + * + * vm@3 { reg = <3>; qcom,max-ice-slots = <16>; qcom,ice-slot-offset = <0>; }; + * vm@52 { reg = <52>; qcom,max-ice-slots = <32>; qcom,ice-slot-offset = <16>; }; + * }; + * + * Each child entry maps a guest (reg = guest_id) to a contiguous physical keyslot + * range [slot_offset .. slot_offset + max_ice_slots). + * + * Entry 0 is always the host's own reservation. Entries 1+ are guest + * reservations. The host's entry is used by ufs-qcom to size its + * blk_crypto_profile; it is excluded from the guest-facing translation table + * so that blk-crypto-proxy can never accidentally route a guest request into + * the host's physical keyslots. + * + * The ufs-qcom driver reads the host slot info and validates all entries + * against the hardware slot count directly via the OF API, with no symbol + * dependency on this module. + */ + +#include +#include +#include +#include +#include +#include +#include + +#define QCOM_ICE_SLOTS_MAX_ENTRIES 8 + +struct qcom_ice_slot_entry { + u32 guest_id; + u32 max_slots; + u32 slot_offset; +}; + +struct qcom_ice_slots { + struct qcom_ice_slot_entry entries[QCOM_ICE_SLOTS_MAX_ENTRIES]; + unsigned int num_entries; +}; + +/* + * There is at most one qcom,ice-keyslot-map platform node per SoC. A single + * global pointer is set at probe time and cleared at remove time. The + * hot-path read (from bcp_slot_virt_ops callbacks) is protected by RCU; + * probe/remove serialise via the platform driver guarantee. + */ +static struct qcom_ice_slots __rcu *g_ice_slots; + +static struct qcom_ice_slots *virt_lookup(struct blk_crypto_profile *profile) +{ + /* Single UFS controller: profile argument is not needed. */ + return rcu_dereference(g_ice_slots); +} + +static int qcom_ice_slots_get_guest_slots(struct blk_crypto_profile *profile, + u32 guest_id) +{ + struct qcom_ice_slots *virt = virt_lookup(profile); + unsigned int i; + + if (!virt) + return -ENOKEY; + + /* entries[0] is the host; guest entries start at index 1. */ + for (i = 1; i < virt->num_entries; i++) { + if (virt->entries[i].guest_id == guest_id) + return virt->entries[i].max_slots; + } + return -ENOKEY; +} + +static int qcom_ice_slots_vslot_to_pslot(struct blk_crypto_profile *profile, + u32 guest_id, u32 virt_slot, + unsigned int *phy_slot_out) +{ + struct qcom_ice_slots *virt = virt_lookup(profile); + unsigned int i; + + if (!virt) + return -ENOKEY; + + for (i = 1; i < virt->num_entries; i++) { + if (virt->entries[i].guest_id != guest_id) + continue; + if (virt_slot >= virt->entries[i].max_slots) + return -EINVAL; + *phy_slot_out = virt->entries[i].slot_offset + virt_slot; + return 0; + } + return -ENOKEY; +} + +static const struct bcp_slot_virt_ops qcom_slot_virt_ops = { + .get_guest_slots = qcom_ice_slots_get_guest_slots, + .vslot_to_pslot = qcom_ice_slots_vslot_to_pslot, +}; + +static int qcom_ice_slots_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct device_node *child; + struct qcom_ice_slots *virt; + unsigned int idx = 0, total_slots = 0; + int ret = 0; + + virt = devm_kzalloc(dev, sizeof(*virt), GFP_KERNEL); + if (!virt) + return -ENOMEM; + + for_each_child_of_node(dev->of_node, child) { + u32 guest_id, max_slots, slot_offset; + unsigned int j; + + if (idx >= QCOM_ICE_SLOTS_MAX_ENTRIES) { + dev_err(dev, "too many vm entries (> %u)\n", + QCOM_ICE_SLOTS_MAX_ENTRIES); + ret = -EINVAL; + of_node_put(child); + goto err_free; + } + + if (of_property_read_u32(child, "reg", &guest_id)) + continue; + if (of_property_read_u32(child, "qcom,max-ice-slots", &max_slots)) + continue; + if (of_property_read_u32(child, "qcom,ice-slot-offset", &slot_offset)) { + dev_err(dev, "missing qcom,ice-slot-offset for guest_id=%u\n", + guest_id); + ret = -EINVAL; + of_node_put(child); + goto err_free; + } + + if (idx > 0 && + slot_offset < + virt->entries[idx - 1].slot_offset + + virt->entries[idx - 1].max_slots) { + dev_err(dev, "slot overlap: guest_id=%u overlaps guest_id=%u\n", + guest_id, virt->entries[idx - 1].guest_id); + ret = -EINVAL; + of_node_put(child); + goto err_free; + } + + for (j = 0; j < idx; j++) { + if (virt->entries[j].guest_id == guest_id) { + dev_err(dev, "duplicate guest_id=%u\n", guest_id); + ret = -EINVAL; + of_node_put(child); + goto err_free; + } + } + + virt->entries[idx].guest_id = guest_id; + virt->entries[idx].max_slots = max_slots; + virt->entries[idx].slot_offset = slot_offset; + total_slots += max_slots; + idx++; + } + + if (idx == 0) { + dev_err(dev, "no VM entries found in qcom,ice-keyslot-map\n"); + ret = -EINVAL; + goto err_free; + } + + virt->num_entries = idx; + + /* + * Publish the singleton. From this point on, bcp_slot_virt_ops + * callbacks can resolve virt via rcu_dereference(g_ice_slots). + */ + rcu_assign_pointer(g_ice_slots, virt); + + ret = bcp_register_slot_virt_ops(&qcom_slot_virt_ops); + if (ret) { + dev_err(dev, "failed to register slot_virt_ops: %d\n", ret); + goto err_free; + } + + dev_info(dev, "registered: %u VMs, %u total ICE slots\n", + idx, total_slots); + return 0; + +err_free: + return ret; +} + +static void qcom_ice_slots_remove(struct platform_device *pdev) +{ + bcp_unregister_slot_virt_ops(&qcom_slot_virt_ops); + /* + * Clear the singleton under RCU so that any concurrent ioctl that + * already took the read lock and is mid-lookup sees either the old + * valid pointer or NULL, never a freed pointer. + */ + rcu_assign_pointer(g_ice_slots, NULL); + synchronize_rcu(); +} + +static const struct of_device_id qcom_ice_slots_of_match[] = { + { .compatible = "qcom,ice-keyslot-map" }, + {} +}; +MODULE_DEVICE_TABLE(of, qcom_ice_slots_of_match); + +static struct platform_driver qcom_ice_slots_driver = { + .probe = qcom_ice_slots_probe, + .remove = qcom_ice_slots_remove, + .driver = { + .name = "qcom-ice-slots", + .of_match_table = qcom_ice_slots_of_match, + }, +}; +module_platform_driver(qcom_ice_slots_driver); + +MODULE_DESCRIPTION("Qualcomm ICE keyslot partitioning for guest VMs"); +MODULE_LICENSE("GPL"); -- 2.34.1