From 665d237915193b06d3026da367040e4a4f3356ba Mon Sep 17 00:00:00 2001 From: Jason Pettit Date: Sat, 29 Aug 2026 12:08:10 -0700 Subject: [PATCH 01/34] firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI The HP EliteBook X G2q 14" Next Gen AI PC is a Snapdragon X2 Elite (Glymur) laptop whose firmware exposes EFI variables through QSEECOM. Add its board compatible to the QSEECOM allowlist so that EFI variable access (efivarfs) works on this machine. Without it the kernel reports "qseecom: untested machine, skipping" and efivarfs is empty. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jason Pettit Link: https://lore.kernel.org/r/20260829-glymur-send-v5-3-a11bdf6a4b66@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 3eaa4c9ccf3c..c44c63e1c20d 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2311,6 +2311,7 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = { { .compatible = "ecs,liva-qc710" }, { .compatible = "honor,magicbook-art-14-snapdragon" }, { .compatible = "hp,elitebook-ultra-g1q" }, + { .compatible = "hp,elitebook-x-g2q" }, { .compatible = "hp,omnibook-x14" }, { .compatible = "huawei,gaokun3" }, { .compatible = "lenovo,flex-5g" }, From 7bb5f186784074f2a91d83e191e305238be47103 Mon Sep 17 00:00:00 2001 From: Gopikrishna Garmidi Date: Thu, 27 Aug 2026 01:13:17 -0700 Subject: [PATCH 02/34] soc: qcom: smem: fix 32-bit overflow in DDR frequency calculation The DDR frequency in SMEM is reported in kHz and converted to Hz by multiplying it by 1000. Since the SMEM frequency value is a u32, using an unsuffixed integer constant causes the multiplication to be performed with 32-bit arithmetic. This overflows for DDR frequencies above 4294967 kHz, resulting in an incorrect frequency being reported through the SMEM DRAM interface. Use an unsigned long constant for the multiplication so the calculation is performed with 64-bit arithmetic on the supported Qualcomm platforms. Apply the fix consistently to the v3, v3.1, v4, v5, and v7 SMEM parsers. Fixes: 1d234eeafc56 ("soc: qcom: smem: Expose DDR data from SMEM") Signed-off-by: Gopikrishna Garmidi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260827-glymur_dramc-v1-1-eba358d504b8@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smem_dramc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/soc/qcom/smem_dramc.c b/drivers/soc/qcom/smem_dramc.c index 63ebe7f6db59..9612230a03be 100644 --- a/drivers/soc/qcom/smem_dramc.c +++ b/drivers/soc/qcom/smem_dramc.c @@ -219,7 +219,7 @@ static void smem_dram_parse_v3_data(struct smem_dram *dram, void *data) if (freq_entry->freq_khz && freq_entry->enabled) { u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); - dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_khz; } } } @@ -232,7 +232,7 @@ static void smem_dram_parse_v3_14freqs_data(struct smem_dram *dram, void *data) struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; if (freq_entry->freq_khz && freq_entry->enabled) - dram->frequencies[dram->num_frequencies++] = 1000 * freq_entry->freq_khz; + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_entry->freq_khz; } } @@ -248,7 +248,7 @@ static void smem_dram_parse_v4_data(struct smem_dram *dram, void *data) if (freq_entry->freq_khz && freq_entry->enabled) { u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); - dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_khz; } } } @@ -265,7 +265,7 @@ static void smem_dram_parse_v5_data(struct smem_dram *dram, void *data) if (freq_entry->freq_khz && freq_entry->enabled) { u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); - dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_khz; } } } @@ -282,7 +282,7 @@ static void smem_dram_parse_v7_data(struct smem_dram *dram, void *data) if (freq_entry->freq_khz && freq_entry->enabled) { u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); - dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_khz; } } } From 9f3136c0c5bcb26d5c864f8a5658c1a6f449d351 Mon Sep 17 00:00:00 2001 From: Linmao Li Date: Thu, 27 Aug 2026 10:04:47 +0800 Subject: [PATCH 03/34] soc: qcom: smem: Fix byte order in v3 14-frequency parser smem_dram_parse_v3_14freqs_data() uses the little-endian freq_khz field directly when scaling the frequency from kHz to Hz. This produces byte-swapped values on big-endian systems. Convert freq_khz to CPU byte order before using it, as the other DDR data parsers do. Fixes: 1d234eeafc56 ("soc: qcom: smem: Expose DDR data from SMEM") Signed-off-by: Linmao Li Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260827020447.2642830-1-lilinmao@kylinos.cn Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smem_dramc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/smem_dramc.c b/drivers/soc/qcom/smem_dramc.c index 9612230a03be..cba5376ec80d 100644 --- a/drivers/soc/qcom/smem_dramc.c +++ b/drivers/soc/qcom/smem_dramc.c @@ -231,8 +231,11 @@ static void smem_dram_parse_v3_14freqs_data(struct smem_dram *dram, void *data) for (int i = 0; i < MAX_DDR_FREQ_NUM_V3 + 1; i++) { struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; - if (freq_entry->freq_khz && freq_entry->enabled) - dram->frequencies[dram->num_frequencies++] = 1000UL * freq_entry->freq_khz; + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + + dram->frequencies[dram->num_frequencies++] = 1000UL * freq_khz; + } } } From 713f6b15f361c9218faf227e989d713632fcb2c5 Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Thu, 20 Aug 2026 18:30:08 +0200 Subject: [PATCH 04/34] soc: qcom: smem: support Glymur DRAM info Glymur firmware provides a version 7 DDR-info SMEM entry whose 872-byte layout is different from the one the driver supports today. The data contains 16 channel descriptors, 14 DDR frequency slots, four 4 DDR region slots, a 10-entry SHUB frequency plan, and v6 misc information. It accounts for 616 bytes; the captured SMEM entry has a further 256 zero bytes. Add a Glymur-specific version 7 layout and recognize that complete entry. Parse the DDR frequencies and highest-bank bit from the common fields. Assisted-by: LLM Signed-off-by: Konrad Dybcio Tested-by: Gopikrishna Garmidi Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260820-topic-glymur_dramc-v1-1-f714eef34e4d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smem_dramc.c | 66 +++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/drivers/soc/qcom/smem_dramc.c b/drivers/soc/qcom/smem_dramc.c index cba5376ec80d..24ccdfdc2b3d 100644 --- a/drivers/soc/qcom/smem_dramc.c +++ b/drivers/soc/qcom/smem_dramc.c @@ -20,12 +20,22 @@ #define MAX_DDR_FREQ_NUM_V5 14 #define MAX_CHAN_NUM 8 +#define MAX_CHAN_NUM_V7_GLYMUR 16 #define MAX_RANK_NUM 2 #define DDR_HBB_MIN 13 #define DDR_HBB_MAX 19 #define MAX_SHUB_ENTRIES 8 +#define MAX_SHUB_ENTRIES_V7_GLYMUR 10 +#define MAX_DDR_REGIONS_V7_GLYMUR 4 + +/* + * Glymur's DRAM information entry has 256 bytes of trailing zeroes + * after its DDR details, four region slots, 10-entry SHUB frequency + * plan, and v6 misc information. + */ +#define DDR_V7_GLYMUR_RESERVED_SIZE 256 static struct smem_dram *__dram; @@ -39,6 +49,7 @@ enum ddr_info_version { INFO_V6, /* INFO_V6 seems to only have shipped with 6 DDR regions, unlike V7 */ INFO_V7, INFO_V7_WITH_6_REGIONS, + INFO_V7_GLYMUR, }; struct smem_dram { @@ -188,6 +199,37 @@ struct ddr_details_v7 { struct ddr_regions_v5 ddr_regions; }; +struct ddr_regions_v7_glymur { + __le32 ddr_region_num; + __le64 ddr_rank0_size; + __le64 ddr_rank1_size; + __le64 ddr_cs0_start_addr; + __le64 ddr_cs1_start_addr; + __le32 highest_bank_addr_bit; + struct ddr_region_v5 ddr_region[MAX_DDR_REGIONS_V7_GLYMUR]; +}; + +struct ddr_details_v7_glymur { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM_V7_GLYMUR]; + struct ddr_freq_plan_v5 ddr_freq_tbl; + u8 num_channels; + u8 sct_config; + struct ddr_regions_v7_glymur ddr_regions; +}; + +struct shub_freq_plan_entry_v7_glymur { + u8 num_shub_freqs; + struct shub_freq_table shub_freq[MAX_SHUB_ENTRIES_V7_GLYMUR]; +}; + +struct ddr_v7_glymur_tail { + struct shub_freq_plan_entry_v7_glymur shub_freq_plan; + struct ddr_misc_info_v6 misc_info; + u8 reserved[DDR_V7_GLYMUR_RESERVED_SIZE]; +}; + /** * qcom_smem_dram_get_hbb(): Get the Highest bank address bit * @@ -290,6 +332,23 @@ static void smem_dram_parse_v7_data(struct smem_dram *dram, void *data) } } +static void smem_dram_parse_v7_glymur_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v7_glymur *details = data; + + dram->hbb = le32_to_cpu(details->ddr_regions.highest_bank_addr_bit); + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V5; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + + dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + } + } +} + /* The structure contains no version field, so we have to perform some guesswork.. */ static int smem_dram_infer_struct_version(size_t size) { @@ -344,6 +403,10 @@ static int smem_dram_infer_struct_version(size_t size) sizeof(struct shub_freq_plan_entry)) return INFO_V7_WITH_6_REGIONS; + if (size == sizeof(struct ddr_details_v7_glymur) + + sizeof(struct ddr_v7_glymur_tail)) + return INFO_V7_GLYMUR; + return INFO_UNKNOWN; } @@ -418,6 +481,9 @@ struct dentry *smem_dram_parse(struct qcom_smem *smem, struct device *dev) case INFO_V7_WITH_6_REGIONS: smem_dram_parse_v7_data(dram, data); break; + case INFO_V7_GLYMUR: + smem_dram_parse_v7_glymur_data(dram, data); + break; default: return ERR_PTR(-EINVAL); } From 57bf822e3c692e1f204d3d8674967344e7e05549 Mon Sep 17 00:00:00 2001 From: Kathiravan Thirumoorthy Date: Wed, 19 Aug 2026 21:53:27 +0530 Subject: [PATCH 05/34] soc: qcom: llcc: Update the SCT table for IPQ5424 Update the IPQ5424 LLCC slice configuration table to give the PPE and Wi-Fi datapaths dedicated slices. Assign slice IDs 1 and 5 to the PPE RX descriptor and RX fill use cases, slice IDs 6 and 7 to the Wi-Fi radios connected over PCIe, and slice ID 2 to the CPU subsystem. Adjust the corresponding capacities, priorities, and way masks for these consumers. These slice assignments are based on recommendations from the performance team, following throughput measurements on IPQ5424. Having the dedicated slice configuration for each of these use cases helps to improve the networking throughput by more than 1 Gbps. Rename the usecase IDs for slice IDs 1 and 2 because LLCC_CPUSS and LLCC_VIDSC0 do not describe the actual users of those slices. Assisted-by: LLM Reviewed-by: Dmitry Baryshkov Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260819-ipq5424_llcc_updates-v3-1-42b48451481d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/llcc-qcom.c | 56 +++++++++++++++++++++++++----- include/linux/soc/qcom/llcc-qcom.h | 4 +++ 2 files changed, 52 insertions(+), 8 deletions(-) diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c index 733999867bbf..d60431ace50f 100644 --- a/drivers/soc/qcom/llcc-qcom.c +++ b/drivers/soc/qcom/llcc-qcom.c @@ -626,11 +626,11 @@ static const struct llcc_slice_config glymur_data[] = { static const struct llcc_slice_config ipq5424_data[] = { { - .usecase_id = LLCC_CPUSS, + .usecase_id = LLCC_PPE_RXDESC, .slice_id = 1, - .max_cap = 768, - .priority = 1, - .bonus_ways = 0xFFFF, + .max_cap = 128, + .priority = 3, + .bonus_ways = 0x0FFF, .retain_on_pc = true, .activate_on_init = true, .write_scid_cacheable_en = true, @@ -642,12 +642,52 @@ static const struct llcc_slice_config ipq5424_data[] = { .vict_prio = true, }, { - .usecase_id = LLCC_VIDSC0, + .usecase_id = LLCC_CPUSS, .slice_id = 2, - .max_cap = 256, - .priority = 2, + .max_cap = 768, + .priority = 1, .fixed_size = true, - .bonus_ways = 0xF000, + .bonus_ways = 0x0FFF, + .retain_on_pc = true, + .activate_on_init = true, + .write_scid_cacheable_en = true, + .stale_en = true, + .stale_cap_en = true, + }, + { + .usecase_id = LLCC_PPE_RXFILL, + .slice_id = 5, + .max_cap = 128, + .priority = 3, + .bonus_ways = 0x0FFF, + .retain_on_pc = true, + .activate_on_init = true, + .write_scid_cacheable_en = true, + .stale_en = true, + .stale_cap_en = true, + .alloc_oneway_en = true, + .ovcap_en = true, + .ovcap_prio = true, + .vict_prio = true, + }, + { + .usecase_id = LLCC_WLAN_5G, + .slice_id = 6, + .max_cap = 128, + .priority = 3, + .bonus_ways = 0xC000, + .retain_on_pc = true, + .activate_on_init = true, + .write_scid_cacheable_en = true, + .stale_en = true, + .stale_cap_en = true, + }, + { + .usecase_id = LLCC_WLAN_6G, + .slice_id = 7, + .max_cap = 128, + .priority = 3, + .bonus_ways = 0x3000, .retain_on_pc = true, .activate_on_init = true, .write_scid_cacheable_en = true, diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h index f3ed63e475ab..1ccc429401e8 100644 --- a/include/linux/soc/qcom/llcc-qcom.h +++ b/include/linux/soc/qcom/llcc-qcom.h @@ -86,6 +86,10 @@ #define LLCC_CPUSS_HEU 94 #define LLCC_PCIE_TCU 97 #define LLCC_MDM_PNG_FIXED 100 +#define LLCC_PPE_RXDESC 101 +#define LLCC_PPE_RXFILL 102 +#define LLCC_WLAN_5G 103 +#define LLCC_WLAN_6G 104 /** * struct llcc_slice_desc - Cache slice descriptor From c84cdd308471d6ae4f8121660436a4fed8126709 Mon Sep 17 00:00:00 2001 From: Ben Dooks Date: Tue, 23 Jun 2026 10:09:54 +0100 Subject: [PATCH 06/34] soc: qcom: smsm: fix __iomem annotations There are a number of points in the driver which miss out on __iomem annotations, so add these to remove the following sparse warnings: drivers/soc/qcom/smsm.c:159:32: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:159:32: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:159:32: got unsigned int [usertype] *local_state drivers/soc/qcom/smsm.c:171:25: warning: incorrect type in argument 2 (different address spaces) drivers/soc/qcom/smsm.c:171:25: expected void volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:171:25: got unsigned int [usertype] *local_state drivers/soc/qcom/smsm.c:181:48: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:181:48: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:181:48: got unsigned int [usertype] * drivers/soc/qcom/smsm.c:219:26: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:219:26: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:219:26: got unsigned int [usertype] *remote_state drivers/soc/qcom/smsm.c:257:49: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:257:49: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:257:49: got unsigned int [usertype] * drivers/soc/qcom/smsm.c:259:49: warning: incorrect type in argument 2 (different address spaces) drivers/soc/qcom/smsm.c:259:49: expected void volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:259:49: got unsigned int [usertype] * drivers/soc/qcom/smsm.c:280:24: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:280:24: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:280:24: got unsigned int [usertype] *remote_state drivers/soc/qcom/smsm.c:288:49: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:288:49: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:288:49: got unsigned int [usertype] * drivers/soc/qcom/smsm.c:290:49: warning: incorrect type in argument 2 (different address spaces) drivers/soc/qcom/smsm.c:290:49: expected void volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:290:49: got unsigned int [usertype] * drivers/soc/qcom/smsm.c:330:26: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smsm.c:330:26: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:330:26: got unsigned int [usertype] *remote_state drivers/soc/qcom/smsm.c:635:47: warning: incorrect type in argument 2 (different address spaces) drivers/soc/qcom/smsm.c:635:47: expected void volatile [noderef] __iomem *addr drivers/soc/qcom/smsm.c:635:47: got unsigned int [usertype] * Note, we don't fixup the qcom_smem_get() to return an __iomem annotated pointer. Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20260623090954.620688-1-ben.dooks@codethink.co.uk Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smsm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c index 021e9d1f61dc..d54dfc36103e 100644 --- a/drivers/soc/qcom/smsm.c +++ b/drivers/soc/qcom/smsm.c @@ -82,8 +82,8 @@ struct qcom_smsm { u32 num_hosts; u32 num_entries; - u32 *local_state; - u32 *subscription; + u32 __iomem *local_state; + u32 __iomem *subscription; struct qcom_smem_state *state; spinlock_t lock; @@ -115,8 +115,8 @@ struct smsm_entry { DECLARE_BITMAP(irq_falling, 32); unsigned long last_value; - u32 *remote_state; - u32 *subscription; + u32 __iomem *remote_state; + u32 __iomem *subscription; }; /** @@ -513,9 +513,9 @@ static int qcom_smsm_probe(struct platform_device *pdev) struct device_node *node; struct smsm_entry *entry; struct qcom_smsm *smsm; - u32 *intr_mask; + u32 __iomem *intr_mask; size_t size; - u32 *states; + u32 __iomem *states; u32 id; int ret; @@ -579,7 +579,7 @@ static int qcom_smsm_probe(struct platform_device *pdev) goto out_put; } - states = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_SHARED_STATE, NULL); + states = (u32 __iomem *)qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_SHARED_STATE, NULL); if (IS_ERR(states)) { dev_err(&pdev->dev, "Unable to acquire shared state entry\n"); ret = PTR_ERR(states); @@ -594,7 +594,7 @@ static int qcom_smsm_probe(struct platform_device *pdev) goto out_put; } - intr_mask = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, NULL); + intr_mask = (u32 __iomem *)qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, NULL); if (IS_ERR(intr_mask)) { dev_err(&pdev->dev, "unable to acquire shared memory interrupt mask\n"); ret = PTR_ERR(intr_mask); From 06cb5c457dd57ad1960f7557c67976de4afa79e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Mon, 20 Jul 2026 15:33:46 +0200 Subject: [PATCH 07/34] soc: qcom: apr: Drop unused apr_device_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit apr_device_id was introduced in commit 6adba21eb434 ("soc: qcom: Add APR bus driver") in 2018, and since then not a single driver made use of it. So drop the unused id_table pointer from struct apr_driver and move APR_NAME_SIZE to the apr header which still has a usage of it. Note that with the id_table being NULL apr_device_match() degrades to just of_driver_match_device(), so replace this callback accordingly. Reviewed-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://lore.kernel.org/r/e8b352f33ae38df3616dc157c1cafd13d49c5e3e.1784554037.git.u.kleine-koenig@baylibre.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/apr.c | 25 +------------------------ include/linux/device-id/apr.h | 21 --------------------- include/linux/mod_devicetable.h | 1 - include/linux/soc/qcom/apr.h | 4 ++-- 4 files changed, 3 insertions(+), 48 deletions(-) delete mode 100644 include/linux/device-id/apr.h diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c index ea7f83916d8d..2073edb416a4 100644 --- a/drivers/soc/qcom/apr.c +++ b/drivers/soc/qcom/apr.c @@ -338,29 +338,6 @@ static void apr_rxwq(struct work_struct *work) } } -static int apr_device_match(struct device *dev, const struct device_driver *drv) -{ - struct apr_device *adev = to_apr_device(dev); - const struct apr_driver *adrv = to_apr_driver(drv); - const struct apr_device_id *id = adrv->id_table; - - /* Attempt an OF style match first */ - if (of_driver_match_device(dev, drv)) - return 1; - - if (!id) - return 0; - - while (id->domain_id != 0 || id->svc_id != 0) { - if (id->domain_id == adev->domain_id && - id->svc_id == adev->svc.id) - return 1; - id++; - } - - return 0; -} - static int apr_device_probe(struct device *dev) { struct apr_device *adev = to_apr_device(dev); @@ -401,7 +378,7 @@ static int apr_uevent(const struct device *dev, struct kobj_uevent_env *env) const struct bus_type aprbus = { .name = "aprbus", - .match = apr_device_match, + .match = of_driver_match_device, .probe = apr_device_probe, .uevent = apr_uevent, .remove = apr_device_remove, diff --git a/include/linux/device-id/apr.h b/include/linux/device-id/apr.h deleted file mode 100644 index f282608ea018..000000000000 --- a/include/linux/device-id/apr.h +++ /dev/null @@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef LINUX_DEVICE_ID_APR_H -#define LINUX_DEVICE_ID_APR_H - -#ifdef __KERNEL__ -#include -typedef unsigned long kernel_ulong_t; -#endif - -#define APR_NAME_SIZE 32 -#define APR_MODULE_PREFIX "apr:" - -struct apr_device_id { - char name[APR_NAME_SIZE]; - __u32 domain_id; - __u32 svc_id; - __u32 svc_version; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -#endif /* ifndef LINUX_DEVICE_ID_APR_H */ diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h index a397213bedac..4fe1cd64292f 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -15,7 +15,6 @@ #include "device-id/acpi.h" #include "device-id/amba.h" #include "device-id/ap.h" -#include "device-id/apr.h" #include "device-id/auxiliary.h" #include "device-id/bcma.h" #include "device-id/ccw.h" diff --git a/include/linux/soc/qcom/apr.h b/include/linux/soc/qcom/apr.h index 909e84f84e0c..2e4231092088 100644 --- a/include/linux/soc/qcom/apr.h +++ b/include/linux/soc/qcom/apr.h @@ -5,7 +5,6 @@ #include #include -#include #include #include @@ -135,6 +134,8 @@ struct pkt_router_svc { typedef struct pkt_router_svc gpr_port_t; +#define APR_NAME_SIZE 32 + struct apr_device { struct device dev; uint16_t svc_id; @@ -158,7 +159,6 @@ struct apr_driver { const struct apr_resp_pkt *d); gpr_port_cb gpr_callback; struct device_driver driver; - const struct apr_device_id *id_table; }; typedef struct apr_driver gpr_driver_t; From 63a0be9b801af9f357054226895d5a172632c7ee Mon Sep 17 00:00:00 2001 From: Luca Weiss Date: Fri, 17 Jul 2026 13:45:02 +0200 Subject: [PATCH 08/34] dt-bindings: interconnect: qcom-bwmon: Add Milos cpu-bwmon compatible Add the compatible string for the CPU-to-DDR bandwidth monitor on the Milos SoC, which is BWMONv5. Signed-off-by: Luca Weiss Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260717-milos-cpu-bwmon-v1-1-dfe0bac9898c@fairphone.com Signed-off-by: Bjorn Andersson --- .../devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml b/Documentation/devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml index 21b4e04727de..f6969910bded 100644 --- a/Documentation/devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml +++ b/Documentation/devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml @@ -50,6 +50,7 @@ properties: - enum: - qcom,eliza-llcc-bwmon - qcom,hawi-llcc-bwmon + - qcom,milos-cpu-bwmon - qcom,qcs615-llcc-bwmon - qcom,qcs8300-llcc-bwmon - qcom,sa8775p-llcc-bwmon From f0c7f46249b917668851f51c7f6e9297c44d42d4 Mon Sep 17 00:00:00 2001 From: Jie Gan Date: Wed, 15 Jul 2026 09:16:14 +0800 Subject: [PATCH 09/34] dt-bindings: arm: add CTCU device for shikra The CTCU device for shikra shares the same configurations as SA8775p. Add a fallback to enable the CTCU for shikra to utilize the compatible of the SA8775p. Signed-off-by: Jie Gan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260715-add-coresight-nodes-for-shikra-v2-1-ebd485e39a51@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- Documentation/devicetree/bindings/arm/qcom,coresight-ctcu.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/arm/qcom,coresight-ctcu.yaml b/Documentation/devicetree/bindings/arm/qcom,coresight-ctcu.yaml index f3f3feac4ce2..335a8e1a5a9e 100644 --- a/Documentation/devicetree/bindings/arm/qcom,coresight-ctcu.yaml +++ b/Documentation/devicetree/bindings/arm/qcom,coresight-ctcu.yaml @@ -32,6 +32,7 @@ properties: - qcom,glymur-ctcu - qcom,kaanapali-ctcu - qcom,qcs8300-ctcu + - qcom,shikra-ctcu - qcom,sm8750-ctcu - qcom,x1e80100-ctcu - const: qcom,sa8775p-ctcu From 29b96e2769def61531c19aa537f5a3cf3ef38e41 Mon Sep 17 00:00:00 2001 From: Pan Chuang Date: Thu, 23 Jul 2026 10:42:47 +0800 Subject: [PATCH 10/34] soc: qcom: Remove redundant dev_err() Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260723024248.17480-1-panchuang@vivo.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom_aoss.c | 4 +--- drivers/soc/qcom/smp2p.c | 4 +--- drivers/soc/qcom/smsm.c | 4 +--- 3 files changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c index 259c41f0c34e..a6b673cd7678 100644 --- a/drivers/soc/qcom/qcom_aoss.c +++ b/drivers/soc/qcom/qcom_aoss.c @@ -602,10 +602,8 @@ static int qmp_probe(struct platform_device *pdev) irq = platform_get_irq(pdev, 0); ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0, "aoss-qmp", qmp); - if (ret < 0) { - dev_err(&pdev->dev, "failed to request interrupt\n"); + if (ret < 0) goto err_free_mbox; - } ret = qmp_open(qmp); if (ret < 0) diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c index af0ceeaf6e07..6f07fef40ce8 100644 --- a/drivers/soc/qcom/smp2p.c +++ b/drivers/soc/qcom/smp2p.c @@ -720,10 +720,8 @@ static int qcom_smp2p_probe(struct platform_device *pdev) NULL, qcom_smp2p_intr, IRQF_ONESHOT, NULL, (void *)smp2p); - if (ret) { - dev_err(&pdev->dev, "failed to request interrupt\n"); + if (ret) goto unwind_interfaces; - } /* * Treat smp2p interrupt as wakeup source, but keep it disabled diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c index d54dfc36103e..ac3c85a2597a 100644 --- a/drivers/soc/qcom/smsm.c +++ b/drivers/soc/qcom/smsm.c @@ -451,10 +451,8 @@ static int smsm_inbound_entry(struct qcom_smsm *smsm, NULL, smsm_intr, IRQF_ONESHOT, "smsm", (void *)entry); - if (ret) { - dev_err(smsm->dev, "failed to request interrupt\n"); + if (ret) return ret; - } entry->domain = irq_domain_create_linear(of_fwnode_handle(node), 32, &smsm_irq_ops, entry); if (!entry->domain) { From 595951340089dbc6e532e15242df1855bc858d45 Mon Sep 17 00:00:00 2001 From: Hardeep Sharma Date: Thu, 27 Aug 2026 23:21:16 +0530 Subject: [PATCH 11/34] dt-bindings: firmware: qcom,scm: Document SCM on Kuno SoC Document the SCM firmware interface found on the Qualcomm Kuno SoC. Reviewed-by: Bartosz Golaszewski Signed-off-by: Hardeep Sharma Link: https://lore.kernel.org/r/20260827-kuno-soc-support-v5-13-6d47636a8f09@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- Documentation/devicetree/bindings/firmware/qcom,scm.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/firmware/qcom,scm.yaml b/Documentation/devicetree/bindings/firmware/qcom,scm.yaml index 037d4ad8f718..ecee5aef65a7 100644 --- a/Documentation/devicetree/bindings/firmware/qcom,scm.yaml +++ b/Documentation/devicetree/bindings/firmware/qcom,scm.yaml @@ -37,6 +37,7 @@ properties: - qcom,scm-ipq9574 - qcom,scm-ipq9650 - qcom,scm-kaanapali + - qcom,scm-kuno - qcom,scm-maili - qcom,scm-mdm9607 - qcom,scm-milos From 6ee19bbd8d14853874336294a9e9aba87f6eaea4 Mon Sep 17 00:00:00 2001 From: Hardeep Sharma Date: Thu, 27 Aug 2026 23:21:04 +0530 Subject: [PATCH 12/34] soc: qcom: geni-se: allow selection on 32-bit ARM Qualcomm SoCs Kuno, a 32-bit ARM Cortex-A7 Qualcomm SoC, uses the GENI-based QUP wrapper for its debug UART. Drop the explicit ARM64 dependency so the driver can be selected on 32-bit ARM as well; QCOM_GENI_SE already sits under the QCOM_SOC menuconfig, which is gated by ARCH_QCOM || COMPILE_TEST, so no replacement dependency is needed. Acked-by: Mukesh Savaliya Reviewed-by: Abel Vesa Signed-off-by: Hardeep Sharma Link: https://lore.kernel.org/r/20260827-kuno-soc-support-v5-1-6d47636a8f09@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig index 2b524154d9fb..9f703261d7ac 100644 --- a/drivers/soc/qcom/Kconfig +++ b/drivers/soc/qcom/Kconfig @@ -39,7 +39,6 @@ config QCOM_COMMAND_DB config QCOM_GENI_SE tristate "Qualcomm GENI Serial Engine Driver" - depends on ARM64 || COMPILE_TEST default ARCH_QCOM help This driver is used to manage Generic Interface (GENI) firmware based From b6fe0b2ca99c29d211cacffd17bcd0e2f69049c2 Mon Sep 17 00:00:00 2001 From: Sreeshankar K Date: Mon, 24 Aug 2026 15:01:44 +0000 Subject: [PATCH 13/34] dt-bindings: arm: qcom,ids: Add SoC ID for SM7250 Add the ID for the Qualcomm SM7250 SoC. Signed-off-by: Sreeshankar K Acked-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260824150156.1310-2-sreeshankar0910@gmail.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/arm/qcom,ids.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h index 2cf433f61d5e..b63e4a0b8e54 100644 --- a/include/dt-bindings/arm/qcom,ids.h +++ b/include/dt-bindings/arm/qcom,ids.h @@ -209,6 +209,7 @@ #define QCOM_ID_IPQ8172 397 #define QCOM_ID_IPQ8173 398 #define QCOM_ID_IPQ8174 399 +#define QCOM_ID_SM7250 400 #define QCOM_ID_IPQ6018 402 #define QCOM_ID_IPQ6028 403 #define QCOM_ID_SDM429W 416 From 4f7b5ac0c4d841d9356af9f9d2698ab6caecf529 Mon Sep 17 00:00:00 2001 From: Sreeshankar K Date: Mon, 24 Aug 2026 15:01:45 +0000 Subject: [PATCH 14/34] soc: qcom: socinfo: Add SM7250 SoC ID Add SoC ID for Qualcomm SM7250 SoC. Signed-off-by: Sreeshankar K Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260824150156.1310-3-sreeshankar0910@gmail.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/socinfo.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c index 1836e226a294..63ee5cd561a2 100644 --- a/drivers/soc/qcom/socinfo.c +++ b/drivers/soc/qcom/socinfo.c @@ -450,6 +450,7 @@ static const struct soc_id soc_id[] = { { qcom_board_id(IPQ8172) }, { qcom_board_id(IPQ8173) }, { qcom_board_id(IPQ8174) }, + { qcom_board_id(SM7250) }, { qcom_board_id(IPQ6018) }, { qcom_board_id(IPQ6028) }, { qcom_board_id(SDM429W) }, From 34da43344c042bf276abace745d7cf6af27699df Mon Sep 17 00:00:00 2001 From: Viken Dadhaniya Date: Fri, 21 Aug 2026 12:06:17 +0530 Subject: [PATCH 15/34] soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison serial_protocol is declared as __le16 in struct se_fw_hdr, but was decoded with le32_to_cpu(). On big-endian systems the extra byte swap causes the field to always compare unequal to the protocol argument, so no firmware segment is ever selected. Use le16_to_cpu() to match the field width. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-1-43e6a3abd651@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom-geni-se.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 873bfbd6b2b7..1d6e6611441d 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1298,7 +1298,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1) continue; - if (le32_to_cpu(sefw->serial_protocol) != protocol) + if (le16_to_cpu(sefw->serial_protocol) != protocol) continue; if (fw_size % 2 != 0) { From 570b3d23794bff9ba8dd99dbd5293dc158a7dbce Mon Sep 17 00:00:00 2001 From: Viken Dadhaniya Date: Fri, 21 Aug 2026 12:06:18 +0530 Subject: [PATCH 16/34] soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around fw_size is read from the 16-bit fw_size_in_items field and incremented when the count is odd. If fw_size_in_items == 0xffff the increment wraps to 0 as a u16, making the bounds check below pass for a firmware segment whose actual size was not validated. Widen fw_size to u32 so the increment never wraps. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-2-43e6a3abd651@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom-geni-se.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 1d6e6611441d..54c0a66d6dd6 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1248,7 +1248,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct struct se_fw_hdr *sefw; u32 fw_end, cfg_idx_end, cfg_val_end; u32 prog_ram_depth; - u16 fw_size; + u32 fw_size; int i; if (!fw || fw->size < sizeof(struct elf32_hdr)) From 091269da39eb0a52cca2549e9ba522ab7b841ff2 Mon Sep 17 00:00:00 2001 From: Viken Dadhaniya Date: Fri, 21 Aug 2026 12:06:19 +0530 Subject: [PATCH 17/34] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller fw_end was computed from the raw fw_size_in_items, before the odd-word round-up. A segment with an odd word count could pass the bounds check at the unrounded value but then be copied one word past the validated limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after the round-up so they always reflect the true copy extent. The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the memcpy_toio() length, bypassing the validated and rounded value established by geni_find_protocol_fw(). Add a fw_size_out output parameter and use it in the caller. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-3-43e6a3abd651@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom-geni-se.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 54c0a66d6dd6..11ca8223fbcd 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1230,6 +1230,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * @se: Pointer to the serial engine structure. * @fw: Pointer to the firmware image. * @protocol: Expected serial engine protocol type. + * @fw_size_out: Non-NULL output parameter; receives the rounded, validated + * firmware word count on success. * * Identifies the appropriate firmware image or configuration required for a * specific communication protocol instance running on a Qualcomm GENI @@ -1239,7 +1241,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise. */ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, - enum geni_se_protocol_type protocol) + enum geni_se_protocol_type protocol, + u32 *fw_size_out) { struct device *dev = se->dev; const struct elf32_hdr *ehdr; @@ -1289,11 +1292,6 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset); fw_size = le16_to_cpu(sefw->fw_size_in_items); - fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); - cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + - le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8); - cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) + - le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32); if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1) continue; @@ -1306,6 +1304,12 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct sefw->fw_size_in_items = cpu_to_le16(fw_size); } + fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); + cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + + le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8); + cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) + + le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32); + prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK, readl_relaxed(se->base + SE_HW_PARAM_2)); if (fw_size >= prog_ram_depth) { @@ -1320,6 +1324,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct continue; } + *fw_size_out = fw_size; return sefw; } @@ -1430,11 +1435,11 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, { const u32 *fw_data, *cfg_val_arr; const u8 *cfg_idx_arr; - u32 i, reg_value; + u32 i, reg_value, fw_size_in_items; int ret; struct se_fw_hdr *hdr; - hdr = geni_find_protocol_fw(se, fw, protocol); + hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items); if (!hdr) return -EINVAL; @@ -1511,7 +1516,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, /* Program RAM address space. */ memcpy_toio(se->base + SE_GENI_CFG_RAMN, fw_data, - le16_to_cpu(hdr->fw_size_in_items) * sizeof(u32)); + fw_size_in_items * sizeof(u32)); /* Put default values on GENI's output pads. */ writel_relaxed(0x1, se->base + GENI_FORCE_DEFAULT_REG); From f38399670d0701ede4f8da397807aa64d7dc98be Mon Sep 17 00:00:00 2001 From: Viken Dadhaniya Date: Fri, 21 Aug 2026 12:06:20 +0530 Subject: [PATCH 18/34] soc: qcom: geni-se: Fix write to read-only firmware buffer geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr pointer and writes back the rounded-up fw_size value: sefw->fw_size_in_items = cpu_to_le16(fw_size); The firmware subsystem maps the firmware blob read-only. Writing through the cast pointer causes a level-3 permission fault on AArch64 and crashes the kernel during driver probe. The write-back is no longer necessary: geni_find_protocol_fw() now propagates the rounded size to the caller via fw_size_out. Remove the write-back and make sefw (and the hdr pointer in the caller) const-correct. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20260821-fix-write-to-read-only-firmware-buffer-v3-4-43e6a3abd651@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom-geni-se.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 11ca8223fbcd..6ac2bdc16984 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1238,17 +1238,17 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * controller. Validates the firmware size against the hardware PROG_RAM_DEPTH * read from SE_HW_PARAM_2. * - * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise. + * Return: pointer to a valid 'const struct se_fw_hdr' if found, or NULL otherwise. */ -static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, - enum geni_se_protocol_type protocol, - u32 *fw_size_out) +static const struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, + enum geni_se_protocol_type protocol, + u32 *fw_size_out) { struct device *dev = se->dev; const struct elf32_hdr *ehdr; const struct elf32_phdr *phdrs; const struct elf32_phdr *phdr; - struct se_fw_hdr *sefw; + const struct se_fw_hdr *sefw; u32 fw_end, cfg_idx_end, cfg_val_end; u32 prog_ram_depth; u32 fw_size; @@ -1290,7 +1290,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct if (phdr->p_filesz < sizeof(struct se_fw_hdr)) continue; - sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset); + sefw = (const struct se_fw_hdr *)(fw->data + phdr->p_offset); fw_size = le16_to_cpu(sefw->fw_size_in_items); if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1) @@ -1299,10 +1299,8 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct if (le16_to_cpu(sefw->serial_protocol) != protocol) continue; - if (fw_size % 2 != 0) { + if (fw_size % 2 != 0) fw_size++; - sefw->fw_size_in_items = cpu_to_le16(fw_size); - } fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + @@ -1437,15 +1435,15 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, const u8 *cfg_idx_arr; u32 i, reg_value, fw_size_in_items; int ret; - struct se_fw_hdr *hdr; + const struct se_fw_hdr *hdr; hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items); if (!hdr) return -EINVAL; - fw_data = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->fw_offset)); + fw_data = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->fw_offset)); cfg_idx_arr = (const u8 *)hdr + le16_to_cpu(hdr->cfg_idx_offset); - cfg_val_arr = (const u32 *)((u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset)); + cfg_val_arr = (const u32 *)((const u8 *)hdr + le16_to_cpu(hdr->cfg_val_offset)); ret = geni_icc_set_bw(se); if (ret) From c708b7141c6a9fd9d20b827a4fefc24ed65327ce Mon Sep 17 00:00:00 2001 From: bui duc phuc Date: Wed, 19 Aug 2026 17:26:30 +0700 Subject: [PATCH 19/34] soc: qcom: llcc-qcom: Handle errors from optional IRQ lookup platform_get_irq_optional() returns a positive IRQ number on success or a negative error code on failure. For an optional IRQ, -ENXIO indicates that no optional IRQ is available. Other errors, such as -EPROBE_DEFER and -EINVAL, should be propagated so that the caller can handle them appropriately. Propagate negative errors other than -ENXIO. Signed-off-by: bui duc phuc Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260819102630.68991-1-phucduc.bui@gmail.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/llcc-qcom.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c index d60431ace50f..5e45a10663c4 100644 --- a/drivers/soc/qcom/llcc-qcom.c +++ b/drivers/soc/qcom/llcc-qcom.c @@ -5657,6 +5657,10 @@ static int qcom_llcc_probe(struct platform_device *pdev) } drv_data->ecc_irq = platform_get_irq_optional(pdev, 0); + if (drv_data->ecc_irq < 0 && drv_data->ecc_irq != -ENXIO) + return dev_err_probe(&pdev->dev, drv_data->ecc_irq, + "failed to get IRQ resource\n"); + drv_data->edac_reg_offset = cfg->edac_reg_offset; drv_data->ecc_irq_configured = cfg->irq_configured; drv_data->dev = dev; From c7c56b6ec077cb96657494b8c18c2c78625035b1 Mon Sep 17 00:00:00 2001 From: Abel Vesa Date: Wed, 19 Aug 2026 10:23:28 +0300 Subject: [PATCH 20/34] soc: qcom: pmic_glink: Fix device access from worker during suspend For historical reasons, the GLINK smem interrupt is registered with IRRQF_NO_SUSPEND flag set, which is the underlying problem here, since the incoming messages can be delivered during late suspend and early resume. In this specific case, the pmic_glink_altmode_worker() currently gets scheduled on the system_wq which can be scheduled to run while devices are still suspended. This proves to be a problem when a Type-C retimer, switch or mux that is controlled over a bus like I2C, because the I2C controller is suspended. This has been proven to be the case on the X Elite boards where such retimers (ParadeTech PS8830) are used in order to handle Type-C orientation and altmode configuration. The following warning is thrown: [ 35.134876] i2c i2c-4: Transfer while suspended [ 35.143865] WARNING: CPU: 0 PID: 99 at drivers/i2c/i2c-core.h:56 __i2c_transfer+0xb4/0x57c [i2c_core] [ 35.352879] Workqueue: events pmic_glink_altmode_worker [pmic_glink_altmode] [ 35.360179] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 35.455242] Call trace: [ 35.457826] __i2c_transfer+0xb4/0x57c [i2c_core] (P) [ 35.463086] i2c_transfer+0x98/0xf0 [i2c_core] [ 35.467713] i2c_transfer_buffer_flags+0x54/0x88 [i2c_core] [ 35.473502] regmap_i2c_write+0x20/0x48 [regmap_i2c] [ 35.478659] _regmap_raw_write_impl+0x780/0x944 [ 35.483401] _regmap_bus_raw_write+0x60/0x7c [ 35.487848] _regmap_write+0x134/0x184 [ 35.491773] regmap_write+0x54/0x78 [ 35.495418] ps883x_set+0x58/0xec [ps883x] [ 35.499688] ps883x_sw_set+0x60/0x84 [ps883x] [ 35.504223] typec_switch_set+0x48/0x74 [typec] [ 35.508952] pmic_glink_altmode_worker+0x44/0x1fc [pmic_glink_altmode] [ 35.515712] process_scheduled_works+0x1a0/0x2d0 [ 35.520525] worker_thread+0x2a8/0x3c8 [ 35.524449] kthread+0xfc/0x184 [ 35.527749] ret_from_fork+0x10/0x20 The proper solution here should be to not deliver these kind of messages during system suspend at all, or at least make it configurable per glink client. But simply dropping the IRQF_NO_SUSPEND flag entirely will break other clients. The final shape of the rework of the pmic glink driver in order to fulfill both the filtering of the messages that need to be able to wake-up the system and the queueing of these messages until the system has properly resumed is still being discussed and it is planned as a future effort. Meanwhile, the stop-gap fix here is to schedule the pmic glink altmode worker on the system_freezable_wq instead of the system_wq. This will result in the altmode worker not being scheduled to run until the devices are resumed first, which will give the controllers like I2C a chance to resume before the transfer is requested. Reported-by: Johan Hovold Closes: https://lore.kernel.org/lkml/Z1CCVjEZMQ6hJ-wK@hovoldconsulting.com/ Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support") Cc: stable@vger.kernel.org # 6.3 Reviewed-by: Caleb Connolly Reviewed-by: Bjorn Andersson Signed-off-by: Abel Vesa Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260819-b4-soc-qcom-pmic-glink-fix-device-access-on-worker-while-suspended-v3-1-169b00e0d9d4@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/pmic_glink_altmode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c index 13c434f8d03a..465e5d2316a0 100644 --- a/drivers/soc/qcom/pmic_glink_altmode.c +++ b/drivers/soc/qcom/pmic_glink_altmode.c @@ -451,7 +451,7 @@ static void pmic_glink_altmode_sc8180xp_notify(struct pmic_glink_altmode *altmod alt_port->mode = mode; alt_port->hpd_state = hpd_state; alt_port->hpd_irq = hpd_irq; - schedule_work(&alt_port->work); + queue_work(system_freezable_wq, &alt_port->work); } #define SC8280XP_DPAM_MASK 0x3f @@ -502,7 +502,7 @@ static void pmic_glink_altmode_sc8280xp_notify(struct pmic_glink_altmode *altmod alt_port->tbt_data = *tbt; } - schedule_work(&alt_port->work); + queue_work(system_freezable_wq, &alt_port->work); } static void pmic_glink_altmode_callback(const void *data, size_t len, void *priv) From b2370c0f8960dbe9bc0b5169944c58239964a738 Mon Sep 17 00:00:00 2001 From: Maulik Shah Date: Sun, 2 Aug 2026 18:58:53 +0530 Subject: [PATCH 21/34] soc: qcom: rpmh-internal: fix kernel-doc issues in rpmh-internal.h kernel-doc emits two warnings for rpmh-internal.h: Warning: drivers/soc/qcom/rpmh-internal.h:136 struct member 'ver' not described in 'rsc_drv' Warning: drivers/soc/qcom/rpmh-internal.h:136 struct member 'regs' not described in 'rsc_drv' Fix them by adding @ver and @regs entries to the struct rsc_drv documentation. While at it, add a missing kernel-doc block for struct rsc_ver, and update the remaining struct kernel-doc comments (struct tcs_group, struct rpmh_request, struct rpmh_ctrlr, struct rsc_drv) to use the 'struct name -' format documented in Documentation/doc-guide/kernel-doc.rst. No functional impact. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260802-b4b4-rpmh-kdoc-v1-1-0f5026293d9a@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/rpmh-internal.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/soc/qcom/rpmh-internal.h b/drivers/soc/qcom/rpmh-internal.h index e3cf1beff803..39441a25af9b 100644 --- a/drivers/soc/qcom/rpmh-internal.h +++ b/drivers/soc/qcom/rpmh-internal.h @@ -20,7 +20,7 @@ struct rsc_drv; /** - * struct tcs_group: group of Trigger Command Sets (TCS) to send state requests + * struct tcs_group - group of Trigger Command Sets (TCS) to send state requests * to the controller * * @drv: The controller. @@ -53,7 +53,7 @@ struct tcs_group { }; /** - * struct rpmh_request: the message to be sent to rpmh-rsc + * struct rpmh_request - the message to be sent to rpmh-rsc * * @msg: the request * @cmd: the payload that will be part of the @msg @@ -70,7 +70,7 @@ struct rpmh_request { }; /** - * struct rpmh_ctrlr: our representation of the controller + * struct rpmh_ctrlr - our representation of the controller * * @cache: the list of cached requests * @cache_lock: synchronize access to the cache data @@ -84,13 +84,19 @@ struct rpmh_ctrlr { struct list_head batch_cache; }; +/** + * struct rsc_ver - Hardware version of the RSC controller. + * + * @major: Major version number. + * @minor: Minor version number. + */ struct rsc_ver { u32 major; u32 minor; }; /** - * struct rsc_drv: the Direct Resource Voter (DRV) of the + * struct rsc_drv - the Direct Resource Voter (DRV) of the * Resource State Coordinator controller (RSC) * * @name: Controller identifier. @@ -116,6 +122,8 @@ struct rsc_ver { * slot * @client: Handle to the DRV's client. * @dev: RSC device. + * @ver: HW version of the RSC controller. + * @regs: Pointer to the register offset table for this version. */ struct rsc_drv { const char *name; From 5e1fccb482a9b92e465fe1fd689f4e8cefd15a08 Mon Sep 17 00:00:00 2001 From: Maulik Shah Date: Sun, 2 Aug 2026 18:58:54 +0530 Subject: [PATCH 22/34] soc: qcom: rpmh: fix kernel-doc issues in rpmh.c Six documentation issues in rpmh.c: - struct batch_cache_req has a typo in its title: 'batch catch' should be 'batch cache'. Fix it. - __rpmh_write(), rpmh_write_async(), rpmh_write(), rpmh_write_batch() and rpmh_invalidate() use 'name: title' format instead of the 'name() - title' format documented in Documentation/doc-guide/kernel-doc.rst. Fix all of them. - rpmh_tx_done() has no kernel-doc comment. Add one describing its purpose as the RSC driver callback for active-only transfer completion. - __rpmh_write(), rpmh_write_async(), rpmh_write() and rpmh_write_batch() are missing Return: tags. Add them. - struct cache_req uses 'struct name:' format instead of the 'struct name -' format documented in Documentation/doc-guide/kernel-doc.rst. Fix it. - rpmh_write_batch() has an inaccurate description: it says requests are sent 'without caching' and that SLEEP/WAKE_ONLY requests are sent as fire-and-forget. In reality, SLEEP/WAKE_ONLY requests are cached in batch_cache and returned immediately; they are only sent to the controller later by rpmh_flush(). Fix the description. No functional impact. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260802-b4b4-rpmh-kdoc-v1-2-0f5026293d9a@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/rpmh.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c index f881c4c757ec..360242a315e3 100644 --- a/drivers/soc/qcom/rpmh.c +++ b/drivers/soc/qcom/rpmh.c @@ -41,7 +41,7 @@ #define ctrlr_to_drv(ctrlr) container_of(ctrlr, struct rsc_drv, client) /** - * struct cache_req: the request object for caching + * struct cache_req - the request object for caching * * @addr: the address of the resource * @sleep_val: the sleep vote @@ -56,7 +56,7 @@ struct cache_req { }; /** - * struct batch_cache_req - An entry in our batch catch + * struct batch_cache_req - An entry in our batch cache * * @list: linked list obj * @count: number of messages @@ -76,6 +76,14 @@ static struct rpmh_ctrlr *get_rpmh_ctrlr(const struct device *dev) return &drv->client; } +/** + * rpmh_tx_done() - Signal the completion of a RPMH transfer. + * @msg: The request that was previously sent. + * + * Called by the RSC driver when an active-only transfer is complete. + * Signals any blocking waiter and frees the message if it was dynamically + * allocated. + */ void rpmh_tx_done(const struct tcs_request *msg) { struct rpmh_request *rpm_msg = container_of(msg, struct rpmh_request, @@ -157,7 +165,7 @@ static struct cache_req *cache_rpm_request(struct rpmh_ctrlr *ctrlr, } /** - * __rpmh_write: Cache and send the RPMH request + * __rpmh_write() - Cache and send the RPMH request. * * @dev: The device making the request * @state: Active/Sleep request type @@ -166,6 +174,8 @@ static struct cache_req *cache_rpm_request(struct rpmh_ctrlr *ctrlr, * Cache the RPMH request and send if the state is ACTIVE_ONLY. * SLEEP/WAKE_ONLY requests are not sent to the controller at * this time. Use rpmh_flush() to send them to the controller. + * + * Return: 0 on success, negative error code on failure. */ static int __rpmh_write(const struct device *dev, enum rpmh_state state, struct rpmh_request *rpm_msg) @@ -248,7 +258,7 @@ int rpmh_read(const struct device *dev, struct tcs_cmd *cmd) EXPORT_SYMBOL_GPL(rpmh_read); /** - * rpmh_write_async: Write a set of RPMH commands + * rpmh_write_async() - Write a set of RPMH commands. * * @dev: The device making the request * @state: Active/sleep set @@ -257,6 +267,8 @@ EXPORT_SYMBOL_GPL(rpmh_read); * * Write a set of RPMH commands, the order of commands is maintained * and will be sent as a single shot. + * + * Return: 0 on success, negative error code on failure. */ int rpmh_write_async(const struct device *dev, enum rpmh_state state, const struct tcs_cmd *cmd, u32 n) @@ -280,7 +292,7 @@ int rpmh_write_async(const struct device *dev, enum rpmh_state state, EXPORT_SYMBOL_GPL(rpmh_write_async); /** - * rpmh_write: Write a set of RPMH commands and block until response + * rpmh_write() - Write a set of RPMH commands and block until response * * @dev: The device making the request * @state: Active/sleep set @@ -288,6 +300,8 @@ EXPORT_SYMBOL_GPL(rpmh_write_async); * @n: The number of elements in @cmd * * May sleep. Do not call from atomic contexts. + * + * Return: 0 on success, negative error code on failure. */ int rpmh_write(const struct device *dev, enum rpmh_state state, const struct tcs_cmd *cmd, u32 n) @@ -342,7 +356,7 @@ static int flush_batch(struct rpmh_ctrlr *ctrlr) } /** - * rpmh_write_batch: Write multiple sets of RPMH commands and wait for the + * rpmh_write_batch() - Write multiple sets of RPMH commands and wait for the * batch to finish. * * @dev: the device making the request @@ -350,13 +364,15 @@ static int flush_batch(struct rpmh_ctrlr *ctrlr) * @cmd: The payload data * @n: The array of count of elements in each batch, 0 terminated. * - * Write a request to the RSC controller without caching. If the request - * state is ACTIVE, then the requests are treated as completion request - * and sent to the controller immediately. The function waits until all the - * commands are complete. If the request was to SLEEP or WAKE_ONLY, then the - * request is sent as fire-n-forget and no ack is expected. + * If the request state is ACTIVE_ONLY, the requests are sent to the + * controller immediately and the function waits until all commands are + * complete. If the state is SLEEP or WAKE_ONLY, the requests are cached + * and the function returns immediately; they are sent to the controller + * later by rpmh_flush(). * * May sleep. Do not call from atomic contexts for ACTIVE_ONLY requests. + * + * Return: 0 on success, negative error code on failure. */ int rpmh_write_batch(const struct device *dev, enum rpmh_state state, const struct tcs_cmd *cmd, u32 *n) @@ -519,7 +535,7 @@ int rpmh_flush(struct rpmh_ctrlr *ctrlr) } /** - * rpmh_invalidate: Invalidate sleep and wake sets in batch_cache + * rpmh_invalidate() - Invalidate sleep and wake sets in batch_cache * * @dev: The device making the request * From 8f206c85f3c383605a5bc3640f9e5aa1d9d8a51a Mon Sep 17 00:00:00 2001 From: Maulik Shah Date: Sun, 2 Aug 2026 18:58:55 +0530 Subject: [PATCH 23/34] soc: qcom: rpmh-rsc: fix kernel-doc issues in rpmh-rsc.c Two documentation issues in rpmh-rsc.c: - rpmh_rsc_pd_callback() has a copy-paste title 'Check if any of the AMCs are busy' which describes rpmh_rsc_ctrlr_is_busy() not this function. Fix the title to accurately describe what this callback does: flush sleep/wake TCS data on PM domain power-off. - rpmh_rsc_cpu_pm_callback() has the same copy-paste title 'Check if any of the AMCs are busy'. Fix the title to accurately describe what this callback does: flush sleep/wake TCS data when all CPUs enter power down. No functional impact. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260802-b4b4-rpmh-kdoc-v1-3-0f5026293d9a@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/rpmh-rsc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c index f881af35ecfc..c4542318eac4 100644 --- a/drivers/soc/qcom/rpmh-rsc.c +++ b/drivers/soc/qcom/rpmh-rsc.c @@ -842,7 +842,7 @@ void rpmh_rsc_write_next_wakeup(struct rsc_drv *drv) } /** - * rpmh_rsc_cpu_pm_callback() - Check if any of the AMCs are busy. + * rpmh_rsc_cpu_pm_callback() - CPU PM notifier to flush sleep/wake TCS data. * @nfb: Pointer to the notifier block in struct rsc_drv. * @action: CPU_PM_ENTER, CPU_PM_ENTER_FAILED, or CPU_PM_EXIT. * @v: Unused @@ -923,7 +923,7 @@ static int rpmh_rsc_cpu_pm_callback(struct notifier_block *nfb, } /** - * rpmh_rsc_pd_callback() - Check if any of the AMCs are busy. + * rpmh_rsc_pd_callback() - PM domain callback to flush sleep/wake TCS data. * @nfb: Pointer to the genpd notifier block in struct rsc_drv. * @action: GENPD_NOTIFY_PRE_OFF, GENPD_NOTIFY_OFF, GENPD_NOTIFY_PRE_ON or GENPD_NOTIFY_ON. * @v: Unused From 5909d98ef551f13efcd4e2a366eebffaf3c29d3b Mon Sep 17 00:00:00 2001 From: Wangao Wang Date: Wed, 12 Aug 2026 14:29:00 +0800 Subject: [PATCH 24/34] soc: qcom: ubwc: Add configuration for Hawi Add UBWC configuration data for the Hawi platform, which uses UBWC 7.0 and enables the required flags and highest bank bit settings. This allows drivers to query the correct UBWC capabilities on Hawi. Also add UBWC 7.0 support to the version tag helper so that qcom_ubwc_version_tag() returns the correct tag for UBWC 7.0. Signed-off-by: Wangao Wang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260812-ubwc_for_hawi_maili-v1-1-c29edecb3bd8@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/ubwc_config.c | 8 ++++++++ include/linux/soc/qcom/ubwc.h | 3 +++ 2 files changed, 11 insertions(+) diff --git a/drivers/soc/qcom/ubwc_config.c b/drivers/soc/qcom/ubwc_config.c index 23901a4c51f7..428a3d1038c8 100644 --- a/drivers/soc/qcom/ubwc_config.c +++ b/drivers/soc/qcom/ubwc_config.c @@ -105,6 +105,13 @@ static const struct qcom_ubwc_cfg_data milos_data = { .highest_bank_bit = 15, }; +static const struct qcom_ubwc_cfg_data ubwc_7_0_hbb16 = { + .ubwc_enc_version = UBWC_7_0, + .flags = UBWC_SWIZZLE_ENABLE_LVL2 | + UBWC_SWIZZLE_ENABLE_LVL3, + .highest_bank_bit = 16, +}; + static const struct of_device_id qcom_ubwc_configs[] __maybe_unused = { { .compatible = "qcom,apq8016", .data = &no_ubwc_data }, { .compatible = "qcom,apq8026", .data = &no_ubwc_data }, @@ -112,6 +119,7 @@ static const struct of_device_id qcom_ubwc_configs[] __maybe_unused = { { .compatible = "qcom,apq8096", .data = &ubwc_1_0_hbb15 }, { .compatible = "qcom,eliza", .data = &ubwc_5_0_hbb15 }, { .compatible = "qcom,glymur", .data = &glymur_data}, + { .compatible = "qcom,hawi", .data = &ubwc_7_0_hbb16 }, { .compatible = "qcom,kaanapali", .data = &ubwc_6_0_hbb16 }, { .compatible = "qcom,mahua", .data = &glymur_data }, { .compatible = "qcom,milos", .data = &milos_data }, diff --git a/include/linux/soc/qcom/ubwc.h b/include/linux/soc/qcom/ubwc.h index f3a70360b177..b09ae05cbeae 100644 --- a/include/linux/soc/qcom/ubwc.h +++ b/include/linux/soc/qcom/ubwc.h @@ -36,6 +36,7 @@ struct qcom_ubwc_cfg_data { #define UBWC_4_3 0x40030000 #define UBWC_5_0 0x50000000 #define UBWC_6_0 0x60000000 +#define UBWC_7_0 0x70000000 #if IS_ENABLED(CONFIG_QCOM_UBWC_CONFIG) const struct qcom_ubwc_cfg_data *qcom_ubwc_config_get_data(void); @@ -108,6 +109,8 @@ static inline u32 qcom_ubwc_swizzle(const struct qcom_ubwc_cfg_data *cfg) static inline u32 qcom_ubwc_version_tag(const struct qcom_ubwc_cfg_data *cfg) { + if (cfg->ubwc_enc_version >= UBWC_7_0) + return 6; if (cfg->ubwc_enc_version >= UBWC_6_0) return 5; if (cfg->ubwc_enc_version >= UBWC_5_0) From 77a717ae0e07303d4ece8382cbf203e0c0c5c25f Mon Sep 17 00:00:00 2001 From: Wangao Wang Date: Wed, 12 Aug 2026 14:29:01 +0800 Subject: [PATCH 25/34] soc: qcom: ubwc: Add configuration for Maili Describe the Universal Bandwidth Compression (UBWC) configuration for the Maili platform. Maili reuses the hawi UBWC configuration. Signed-off-by: Wangao Wang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260812-ubwc_for_hawi_maili-v1-2-c29edecb3bd8@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/ubwc_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soc/qcom/ubwc_config.c b/drivers/soc/qcom/ubwc_config.c index 428a3d1038c8..e593386920ed 100644 --- a/drivers/soc/qcom/ubwc_config.c +++ b/drivers/soc/qcom/ubwc_config.c @@ -122,6 +122,7 @@ static const struct of_device_id qcom_ubwc_configs[] __maybe_unused = { { .compatible = "qcom,hawi", .data = &ubwc_7_0_hbb16 }, { .compatible = "qcom,kaanapali", .data = &ubwc_6_0_hbb16 }, { .compatible = "qcom,mahua", .data = &glymur_data }, + { .compatible = "qcom,maili", .data = &ubwc_7_0_hbb16, }, { .compatible = "qcom,milos", .data = &milos_data }, { .compatible = "qcom,msm8226", .data = &no_ubwc_data }, { .compatible = "qcom,msm8916", .data = &no_ubwc_data }, From f3c95a76d2ee9c17034e9d96917b37d194dd9f91 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 13 Aug 2026 10:09:21 +0300 Subject: [PATCH 26/34] soc: qcom: smem: Fix signedness bug in smem_dram_parse() The "ver" variable is type "enum ddr_info_version". Enum types are dependent on the compiler but in practical terms here, "ver" is basically an unsigned int. It needs to be signed for the -EINVAL to be handled correctly. Fixes: 1d234eeafc56 ("soc: qcom: smem: Expose DDR data from SMEM") Signed-off-by: Dan Carpenter Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/an1toQ-acGR0kOWj@stanley.mountain Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smem_dramc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/qcom/smem_dramc.c b/drivers/soc/qcom/smem_dramc.c index 24ccdfdc2b3d..497513c95308 100644 --- a/drivers/soc/qcom/smem_dramc.c +++ b/drivers/soc/qcom/smem_dramc.c @@ -448,7 +448,7 @@ struct dentry *smem_dram_parse(struct qcom_smem *smem, struct device *dev) return ERR_PTR(-ENODATA); ver = smem_dram_infer_struct_version(actual_size); - if (ver < 0) { + if ((int)ver < 0) { /* Some SoCs don't provide data that's useful for us */ return ERR_PTR(-ENODATA); } else if (ver == INFO_UNKNOWN) { From bb5c846a74ca119679fdc3241888a3de179d02c2 Mon Sep 17 00:00:00 2001 From: Hongyan Xu Date: Thu, 6 Aug 2026 14:05:40 +0800 Subject: [PATCH 27/34] soc: qcom: apr: clean up failed service registrations apr_add_device() publishes a service in svcs_idr before parsing the optional protection domain and registering the device. If device registration fails, put_device() frees the apr_device while its service remains in the IDR. A received packet can then dereference that stale entry. The property error path also leaves the service and allocation behind. Split device_register() into device_initialize() and device_add() so every pre-registration error can safely drop the device reference. Remove the service from the IDR on all failures after publication, then drain the RX workqueue before dropping the device reference. This prevents an in-flight lookup from outliving the device. Fixes: 6adba21eb434 ("soc: qcom: Add APR bus driver") Signed-off-by: Hongyan Xu Link: https://lore.kernel.org/r/20260806060541.820-1-getshell@seu.edu.cn Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/apr.c | 50 ++++++++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c index 2073edb416a4..2d5645ff9919 100644 --- a/drivers/soc/qcom/apr.c +++ b/drivers/soc/qcom/apr.c @@ -411,31 +411,35 @@ static int apr_add_device(struct device *dev, struct device_node *np, if (np) snprintf(adev->name, APR_NAME_SIZE, "%pOFn", np); - switch (apr->type) { - case PR_TYPE_APR: - dev_set_name(&adev->dev, "aprsvc:%s:%x:%x", adev->name, - domain_id, svc_id); - break; - case PR_TYPE_GPR: - dev_set_name(&adev->dev, "gprsvc:%s:%x:%x", adev->name, - domain_id, svc_id); - break; - default: - break; - } - adev->dev.bus = &aprbus; adev->dev.parent = dev; adev->dev.of_node = np; adev->dev.release = apr_dev_release; adev->dev.driver = NULL; + device_initialize(&adev->dev); + + switch (apr->type) { + case PR_TYPE_APR: + ret = dev_set_name(&adev->dev, "aprsvc:%s:%x:%x", adev->name, + domain_id, svc_id); + break; + case PR_TYPE_GPR: + ret = dev_set_name(&adev->dev, "gprsvc:%s:%x:%x", adev->name, + domain_id, svc_id); + break; + default: + ret = -EINVAL; + break; + } + if (ret) + goto out_put_device; spin_lock(&apr->svcs_lock); ret = idr_alloc(&apr->svcs_idr, svc, svc_id, svc_id + 1, GFP_ATOMIC); spin_unlock(&apr->svcs_lock); if (ret < 0) { dev_err(dev, "idr_alloc failed: %d\n", ret); - goto out; + goto out_put_device; } /* Protection domain is optional, it does not exist on older platforms */ @@ -443,18 +447,26 @@ static int apr_add_device(struct device *dev, struct device_node *np, 1, &adev->service_path); if (ret < 0 && ret != -EINVAL) { dev_err(dev, "Failed to read second value of qcom,protection-domain\n"); - goto out; + goto out_remove_idr; } dev_info(dev, "Adding APR/GPR dev: %s\n", dev_name(&adev->dev)); - ret = device_register(&adev->dev); + ret = device_add(&adev->dev); if (ret) { - dev_err(dev, "device_register failed: %d\n", ret); - put_device(&adev->dev); + dev_err(dev, "device_add failed: %d\n", ret); + goto out_remove_idr; } -out: + return 0; + +out_remove_idr: + spin_lock(&apr->svcs_lock); + idr_remove(&apr->svcs_idr, svc_id); + spin_unlock(&apr->svcs_lock); + flush_workqueue(apr->rxwq); +out_put_device: + put_device(&adev->dev); return ret; } From 7cabc842d0f2540f1d7734e7bb41d740560a036f Mon Sep 17 00:00:00 2001 From: Ben Dooks Date: Tue, 23 Jun 2026 09:59:31 +0100 Subject: [PATCH 28/34] soc: qcom: smp2p: fix __iomem annotation on entry->value pointer The entry->value is passed to readl() so should be marked __iomem so remove these sparse warnings by marking it __iomem and do the relevant casting to ensure no further warnings: drivers/soc/qcom/smp2p.c:280:64: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smp2p.c:280:64: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smp2p.c:280:64: got unsigned int [usertype] *value drivers/soc/qcom/smp2p.c:318:34: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smp2p.c:318:34: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smp2p.c:318:34: got unsigned int [usertype] *value drivers/soc/qcom/smp2p.c:446:26: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smp2p.c:446:26: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smp2p.c:446:26: got unsigned int [usertype] *value drivers/soc/qcom/smp2p.c:501:33: warning: incorrect type in argument 1 (different address spaces) drivers/soc/qcom/smp2p.c:501:33: expected void const volatile [noderef] __iomem *addr drivers/soc/qcom/smp2p.c:501:33: got unsigned int [usertype] *value drivers/soc/qcom/smp2p.c:504:26: warning: incorrect type in argument 2 (different address spaces) drivers/soc/qcom/smp2p.c:504:26: expected void volatile [noderef] __iomem *addr drivers/soc/qcom/smp2p.c:504:26: got unsigned int [usertype] *value Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20260623085931.589735-1-ben.dooks@codethink.co.uk Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smp2p.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c index 6f07fef40ce8..3104e31f91c9 100644 --- a/drivers/soc/qcom/smp2p.c +++ b/drivers/soc/qcom/smp2p.c @@ -102,7 +102,7 @@ struct smp2p_entry { struct qcom_smp2p *smp2p; const char *name; - u32 *value; + u32 __iomem *value; u32 last_value; struct irq_domain *domain; @@ -276,7 +276,7 @@ static void qcom_smp2p_start_in(struct qcom_smp2p *smp2p) list_for_each_entry(entry, &smp2p->inbound, node) { memcpy(buf, in->entries[i].name, sizeof(buf)); if (!strcmp(buf, entry->name)) { - entry->value = &in->entries[i].value; + entry->value = (u32 __iomem *)&in->entries[i].value; entry->last_value = readl(entry->value); break; } @@ -302,7 +302,7 @@ static void qcom_smp2p_notify_in(struct qcom_smp2p *smp2p) list_for_each_entry(entry, &smp2p->inbound, node) { memcpy(buf, in->entries[i].name, sizeof(buf)); if (!strcmp(buf, entry->name)) { - entry->value = &in->entries[i].value; + entry->value = (u32 __iomem *)&in->entries[i].value; break; } } @@ -528,7 +528,7 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, memcpy(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME); /* Make the logical entry reference the physical value */ - entry->value = &out->entries[out->valid_entries].value; + entry->value = (u32 __iomem *)&out->entries[out->valid_entries].value; out->valid_entries++; From c373463f8c08d46dd6a0d3b385037da790e186e7 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Thu, 3 Sep 2026 01:09:48 +0530 Subject: [PATCH 29/34] firmware: qcom: scm: Use devm_of_reserved_mem_device_init() Switch from of_reserved_mem_device_init() to the new resource managed devm_of_reserved_mem_device_init() so that the reserved memory region is released automatically on probe failure or device unbind. This eliminates the err_rmem cleanup label and the need to call of_reserved_mem_device_release() explicitly on error paths. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260902193948.1999595-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index c44c63e1c20d..7085595582e8 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2845,17 +2845,15 @@ static int qcom_scm_probe(struct platform_device *pdev) if (ret) return ret; - ret = of_reserved_mem_device_init(scm->dev); + ret = devm_of_reserved_mem_device_init(scm->dev); if (ret && ret != -ENODEV) return dev_err_probe(scm->dev, ret, "Failed to setup the reserved memory region for TZ mem\n"); ret = qcom_tzmem_enable(scm->dev); - if (ret) { - ret = dev_err_probe(scm->dev, ret, - "Failed to enable the TrustZone memory allocator\n"); - goto err_rmem; - } + if (ret) + return dev_err_probe(scm->dev, ret, + "Failed to enable the TrustZone memory allocator\n"); memset(&pool_config, 0, sizeof(pool_config)); pool_config.initial_size = 0; @@ -2863,11 +2861,9 @@ static int qcom_scm_probe(struct platform_device *pdev) pool_config.max_size = SZ_256K; scm->mempool = devm_qcom_tzmem_pool_new(scm->dev, &pool_config); - if (IS_ERR(scm->mempool)) { - ret = dev_err_probe(scm->dev, PTR_ERR(scm->mempool), - "Failed to create the SCM memory pool\n"); - goto err_rmem; - } + if (IS_ERR(scm->mempool)) + return dev_err_probe(scm->dev, PTR_ERR(scm->mempool), + "Failed to create the SCM memory pool\n"); ret = qcom_scm_query_waitq_count(scm); scm->wq_cnt = ret < 0 ? QCOM_SCM_DEFAULT_WAITQ_COUNT : ret; @@ -2943,10 +2939,6 @@ static int qcom_scm_probe(struct platform_device *pdev) qcom_scm_gunyah_wdt_init(scm); return 0; - -err_rmem: - of_reserved_mem_device_release(scm->dev); - return ret; } static void qcom_scm_shutdown(struct platform_device *pdev) From 618aedff70fbecb502a3f312a8b292e8478a93c7 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Thu, 6 Aug 2026 12:35:15 +0200 Subject: [PATCH 30/34] firmware: QCOM interfaces should depend on ARCH_QCOM The various Qualcomm firmware interfaces are only present on Qualcomm systems. Hence add dependencies on ARCH_QCOM, to prevent asking the user about them when configuring a kernel without Qualcomm SoC support. Make QCOM_PAS invisible instead, as it is already selected by its users when needed. Signed-off-by: Geert Uytterhoeven Reviewed-by: Sumit Garg Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/888efe8e63b6a18fae4acd5a90a1e0e69dcdf2ca.1786012495.git.geert+renesas@glider.be Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/qcom/Kconfig b/drivers/firmware/qcom/Kconfig index c7f8413ab996..691db0ded8e8 100644 --- a/drivers/firmware/qcom/Kconfig +++ b/drivers/firmware/qcom/Kconfig @@ -7,7 +7,7 @@ menu "Qualcomm firmware drivers" config QCOM_PAS - tristate "Qualcomm generic PAS interface driver" + tristate "Qualcomm generic PAS interface driver" if COMPILE_TEST help Enable the generic Peripheral Authentication Service (PAS) provided by the firmware. It acts as the common layer with different TZ @@ -16,6 +16,7 @@ config QCOM_PAS config QCOM_PAS_TEE tristate "Qualcomm PAS TEE interface driver" + depends on ARCH_QCOM || COMPILE_TEST select QCOM_PAS depends on TEE depends on !CPU_BIG_ENDIAN @@ -26,6 +27,7 @@ config QCOM_PAS_TEE config QCOM_SCM tristate "Qualcomm PAS SCM interface driver" + depends on ARCH_QCOM || COMPILE_TEST select QCOM_PAS select QCOM_TZMEM default y if ARCH_QCOM From 3ae4bd9cdcd25bb8ac9b9951934bedd404935545 Mon Sep 17 00:00:00 2001 From: Gourav Kumar Date: Thu, 3 Sep 2026 09:43:09 +0800 Subject: [PATCH 31/34] soc: qcom: ubwcg: Add Nord UBWC config Map qcom,nord to glymur_data in qcom_ubwc_configs[], since Nord shares Glymur's UBWC capabilities. Signed-off-by: Gourav Kumar Signed-off-by: Shawn Guo Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260903014309.314962-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/ubwc_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soc/qcom/ubwc_config.c b/drivers/soc/qcom/ubwc_config.c index e593386920ed..36c90f72943f 100644 --- a/drivers/soc/qcom/ubwc_config.c +++ b/drivers/soc/qcom/ubwc_config.c @@ -136,6 +136,7 @@ static const struct of_device_id qcom_ubwc_configs[] __maybe_unused = { { .compatible = "qcom,msm8976", .data = &no_ubwc_data }, { .compatible = "qcom,msm8996", .data = &ubwc_1_0_hbb15 }, { .compatible = "qcom,msm8998", .data = &ubwc_1_0_hbb15 }, + { .compatible = "qcom,nord", .data = &glymur_data }, { .compatible = "qcom,qcm2290", .data = &ubwc_0_0_hbb15, }, { .compatible = "qcom,qcm6490", .data = &ubwc_3_1_hbb14, }, { .compatible = "qcom,qcs8300", .data = &ubwc_4_0_hbb16, }, From a5c8d6d13a0417e19bb0c771f28474d997c21d11 Mon Sep 17 00:00:00 2001 From: Abel Vesa Date: Wed, 2 Sep 2026 14:57:06 +0300 Subject: [PATCH 32/34] MAINTAINERS: add Abel as reviewer for linux-arm-msm As agreed with Bjorn and Konrad off-list, I'm stepping up as reviewer for Qualcomm SoCs support. Signed-off-by: Abel Vesa Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260902-maintainers-qcom-add-reviewer-v1-1-82d6126df520@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 3a19da74d00c..e51a130e33f0 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3432,6 +3432,7 @@ F: include/linux/soc/qcom/ ARM/QUALCOMM SUPPORT M: Bjorn Andersson M: Konrad Dybcio +R: Abel Vesa L: linux-arm-msm@vger.kernel.org S: Maintained C: irc://irc.oftc.net/linux-msm From 72961dcd01a295caf6fbf9d1cc5bd3482dd91b07 Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Fri, 31 Jul 2026 19:59:46 +0200 Subject: [PATCH 33/34] firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11 Allow the use of QSEECOM on the Glymur-based Lenovo Yoga Slim 7x Gen11, as there seem to be no issues with the firmware that would mandate disabling it. Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Tested-by: Oleg Keri Link: https://lore.kernel.org/r/20260731-topic-yoga_submission-v2-3-f1887031da4f@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 7085595582e8..40d3cb847f8d 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2320,6 +2320,7 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = { { .compatible = "lenovo,thinkpad-t14s" }, { .compatible = "lenovo,thinkpad-x13s", }, { .compatible = "lenovo,yoga-slim7x" }, + { .compatible = "lenovo,yoga-slim7x-gen11" }, { .compatible = "medion,sprchrgd14s1" }, { .compatible = "microsoft,arcata", }, { .compatible = "microsoft,surface-pro-12in", }, From 87802d4dc4850bf27b3955ee9162b1e52c99da1a Mon Sep 17 00:00:00 2001 From: Bjorn Andersson Date: Tue, 15 Sep 2026 20:54:24 -0500 Subject: [PATCH 34/34] firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA) In line with other Glymur-based machines, the Asus Zenbook A14 (UX3407NA) exposes EFI variables through the "uefisecapp". Add it to the QSEECOM allowlist to enable this access. Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260915-zenbook-dts-v2-3-41de8669a7a8@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 40d3cb847f8d..162444f8bc8b 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2302,6 +2302,7 @@ EXPORT_SYMBOL_GPL(qcom_scm_qseecom_app_send); static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = { { .compatible = "asus,vivobook-s15" }, { .compatible = "asus,vivobook-s15-x1p4" }, + { .compatible = "asus,zenbook-a14-ux3407na" }, { .compatible = "asus,zenbook-a14-ux3407qa" }, { .compatible = "asus,zenbook-a14-ux3407ra" }, { .compatible = "asus,zenbook-a16-ux3607oa" },