Re: [PATCH 5/5] arm64: dts: qcom: shikra: Add ICE, TRNG and QCE nodes

[Konrad Dybcio]

On 6/8/26 12:09 PM, Kuldeep Singh wrote:
>>> +		cryptobam: dma-controller@1b04000 {
>>> +			compatible = "qcom,bam-v1.7.4", "qcom,bam-v1.7.0";
>>> +			reg = <0x0 0x01b04000 0x0 0x24000>;
>>> +			interrupts = <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH 0>;
>>> +			#dma-cells = <1>;
>>> +			iommus = <&apps_smmu 0x84 0x0011>,
>>> +				 <&apps_smmu 0x86 0x0011>,
>>> +				 <&apps_smmu 0x92 0x0>,
>>> +				 <&apps_smmu 0x94 0x0011>,
>>
>> 0x84 / 0x0011 is exactly the same as 0x94 / 0x0011. Likewise 0x96
>> duplicates 0x86. Drop the duplicate IOMMU specifiers or explain in the
>> commit message why they are required.
> 
> +Konrad too as there was same discussion in past too.
> 
> 0x84/0x94 and 0x86/0x96 pairs are actually different even though
> resulting sid is same.
> Let me explain more.
> 
> From sid sheet,
> Description	   SID (hex)	MASK	RESULT_SID	S1 CB
> CE descriptors     0x84, 0x85	0x11	0x0084		S1_CRYPTO_KERNEL
> (for data pipe 4/5)
> CE descriptors	   0x86, 0x87	0x11	0x0086		S1_CRYPTO_USER
> (for data pipe 6/7)
> CE data pipe 4/5   0x94, 0x95	0x11	0x84(same)	S1_CRYPTO_KERNEL
> CE data pipe 6/7   0x96, 0x97	0x11	0x86(same)	S1_CRYPTO_USER
> 
> Qualcomm BAM DMA engine driving QCE has 2 major components here:
> * Descriptor pipe (0x84/0x86): This carries BAM command descriptors i,e
> key, algorithm, length etc. which tell crypto engine what to do.
> * Data pipe (0x94/0x96): This carries the actual data payload — the
> plaintext/ciphertext buffers being read/written.
> 
> The descriptor(SID 0x84) basically contain IOVA address that points to
> the data buffer. That same IOVA address is then used by the data pipe
> (SID 0x94) to actually DMA the data.
> 
> Since, Crypto engine descriptor and crypto engine data are part of same
> crypto operation and with the limited number of context banks, smmu
> provides an optimization to logically group and resolve them to same
> context bank/page tables.
> 
> Pipe 4/5 contain 2 SID(0x84/0x94) for kernel and pipe 6/7 contain
> sid(0x86/0x96) for user. Pipe 4/5 doesn't touch pipe6/7 buffers so both
> are safe.

I understand they are different from the hardware perspective. Are they
different as far as the OS is concerned? Will we ever need to separate
their data flows? (I guess that would require iommu-maps anyway since
currently they are bound to the same domain anyway)

Alternatively, if you'd like to keep this level of description, it would
be good to describe the iommus:items: in dt-bindings, so that one can
make sense out of it

Konrad