From 3fd6a04e5bf863a8c02c150d584f42c7b9ae5f8c Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Sun, 12 Jul 2026 18:22:13 +0200 Subject: [PATCH 01/15] dt-bindings: soc: qcom,wcnss: Drop redundant $ref of firmware-name property The DT schema core defines the type ($ref) of 'firmware-name' property as string-array, so individual schemas do not need to. They also should not redefine it to a single string, but instead just set number of expected firmware names. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260712162212.184592-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- Documentation/devicetree/bindings/soc/qcom/qcom,wcnss.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,wcnss.yaml b/Documentation/devicetree/bindings/soc/qcom/qcom,wcnss.yaml index 4fcae6bedfff..56a4152633e5 100644 --- a/Documentation/devicetree/bindings/soc/qcom/qcom,wcnss.yaml +++ b/Documentation/devicetree/bindings/soc/qcom/qcom,wcnss.yaml @@ -19,8 +19,8 @@ properties: const: qcom,wcnss firmware-name: - $ref: /schemas/types.yaml#/definitions/string - default: wlan/prima/WCNSS_qcom_wlan_nv.bin + maxItems: 1 + default: [ wlan/prima/WCNSS_qcom_wlan_nv.bin ] description: Relative firmware image path for the WLAN NV blob. From b255c6f4e6b48e09227cd68777a5d2ec1d36dc31 Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Fri, 17 Jul 2026 20:06:37 +0200 Subject: [PATCH 02/15] soc: qcom: pmic_glink_altmode: Define the TBT extradata properly Before the fixes-referenced commit, there was a trailing 'u32 reserved' after the payload array. That commit gobbled it up into the thunderbolt extradata. Push it back where it belongs. There's no functional change, since the outer struct size remains identical - struct usbc_sc8280x_tbt_data and therefore the union it's a part of made up for the difference and the res bytes were ignored anyway. Fixes: 0539c5a6fdef ("soc: qcom: pmic_glink_altmode: Consume TBT3/USB4 mode notifications") Reported-by: Fenglin Wu Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260717-topic-tbt_extradata_fixup-v1-1-5caa18f1c8d3@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/pmic_glink_altmode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/pmic_glink_altmode.c b/drivers/soc/qcom/pmic_glink_altmode.c index 619bad2c27ee..13c434f8d03a 100644 --- a/drivers/soc/qcom/pmic_glink_altmode.c +++ b/drivers/soc/qcom/pmic_glink_altmode.c @@ -53,7 +53,7 @@ struct usbc_sc8280x_tbt_data { /* This field is NOP on USB4, all cables support rounded rates by spec */ u8 rounded_cable : 1; u8 power_limited : 1; - u8 res[11]; + u8 res[7]; }; struct usbc_notify { @@ -74,6 +74,7 @@ struct usbc_notify { struct usbc_sc8280x_dp_data dp; struct usbc_sc8280x_tbt_data tbt; } extended_data; + u32 reserved; }; struct usbc_sc8180x_notify { From 522bfb4f33c0930b3d14d5c5ee80bc93a883b544 Mon Sep 17 00:00:00 2001 From: Viken Dadhaniya Date: Thu, 2 Jul 2026 11:12:23 +0530 Subject: [PATCH 03/15] soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size The hardcoded MAX_GENI_CFG_RAMn_CNT limit is not accurate for all SoCs: some targets have less CFG RAM than the constant implies, while others like QCS615 need more entries than the old limit of 455 allowed, causing valid firmware to be rejected at load time. Rather than hardcoding a constant, read PROG_RAM_DEPTH from SE_HW_PARAM_2 at runtime to get the actual CFG RAM depth of the hardware instance and use that as the upper bound for firmware size validation. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Viken Dadhaniya Link: https://lore.kernel.org/r/20260702-qup-se-increase-ram-cnt-v3-1-80b363373a5b@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom-geni-se.c | 24 +++++++++++++----------- include/linux/soc/qcom/geni-se.h | 4 ++++ 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 15636a8dc907..107fa2057654 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -154,8 +154,6 @@ struct se_fw_hdr { /*Magic numbers*/ #define SE_MAGIC_NUM 0x57464553 -#define MAX_GENI_CFG_RAMn_CNT 455 - #define MI_PBT_NON_PAGED_SEGMENT 0x0 #define MI_PBT_HASH_SEGMENT 0x2 #define MI_PBT_NOTUSED_SEGMENT 0x3 @@ -1224,24 +1222,27 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); /** * geni_find_protocol_fw() - Locate and validate SE firmware for a protocol. - * @dev: Pointer to the device structure. + * @se: Pointer to the serial engine structure. * @fw: Pointer to the firmware image. * @protocol: Expected serial engine protocol type. * * Identifies the appropriate firmware image or configuration required for a - * specific communication protocol instance running on a Qualcomm GENI - * controller. + * specific communication protocol instance running on a Qualcomm GENI + * controller. Validates the firmware size against the hardware PROG_RAM_DEPTH + * read from SE_HW_PARAM_2. * * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise. */ -static struct se_fw_hdr *geni_find_protocol_fw(struct device *dev, const struct firmware *fw, +static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, enum geni_se_protocol_type protocol) { + struct device *dev = se->dev; const struct elf32_hdr *ehdr; const struct elf32_phdr *phdrs; const struct elf32_phdr *phdr; struct se_fw_hdr *sefw; u32 fw_end, cfg_idx_end, cfg_val_end; + u32 prog_ram_depth; u16 fw_size; int i; @@ -1300,10 +1301,11 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct device *dev, const struct sefw->fw_size_in_items = cpu_to_le16(fw_size); } - if (fw_size >= MAX_GENI_CFG_RAMn_CNT) { - dev_err(dev, - "Firmware size (%u) exceeds max allowed RAMn count (%u)\n", - fw_size, MAX_GENI_CFG_RAMn_CNT); + prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK, + readl_relaxed(se->base + SE_HW_PARAM_2)); + if (fw_size >= prog_ram_depth) { + dev_err(dev, "Firmware size (%u) exceeds RAM size (%u)\n", + fw_size, prog_ram_depth); continue; } @@ -1427,7 +1429,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, int ret; struct se_fw_hdr *hdr; - hdr = geni_find_protocol_fw(se->dev, fw, protocol); + hdr = geni_find_protocol_fw(se, fw, protocol); if (!hdr) return -EINVAL; diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index c5e6ab85df09..0991ef7ec092 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -124,6 +124,7 @@ struct geni_se { #define SE_DMA_RX_FSM_RST 0xd58 #define SE_HW_PARAM_0 0xe24 #define SE_HW_PARAM_1 0xe28 +#define SE_HW_PARAM_2 0xe2c /* GENI_FORCE_DEFAULT_REG fields */ #define FORCE_DEFAULT BIT(0) @@ -291,6 +292,9 @@ struct geni_se { #define RX_FIFO_DEPTH_MSK GENMASK(21, 16) #define RX_FIFO_DEPTH_SHFT 16 +/* SE_HW_PARAM_2 fields */ +#define PROG_RAM_DEPTH_MSK GENMASK(10, 0) + #define HW_VER_MAJOR_MASK GENMASK(31, 28) #define HW_VER_MAJOR_SHFT 28 #define HW_VER_MINOR_MASK GENMASK(27, 16) From ca8c96d3187a11229b3bd44992a9bc3d22caf13a Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Tue, 21 Jul 2026 19:11:28 +0200 Subject: [PATCH 04/15] firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A16 (UX3607OA) In line with other Glymur-based machines, the Asus Zenbook A16 (UX3607OA) exposes EFI variables through the "uefisecapp". Add it to the QSEECOM allowlist to enable this access. Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260721-topic-a16_submission-v1-3-8ea213130d05@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index f35f2ee39130..9ec79b445481 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2304,6 +2304,7 @@ static const struct of_device_id qcom_scm_qseecom_allowlist[] __maybe_unused = { { .compatible = "asus,vivobook-s15-x1p4" }, { .compatible = "asus,zenbook-a14-ux3407qa" }, { .compatible = "asus,zenbook-a14-ux3407ra" }, + { .compatible = "asus,zenbook-a16-ux3607oa" }, { .compatible = "dell,inspiron-14-plus-7441" }, { .compatible = "dell,latitude-7455" }, { .compatible = "dell,xps13-9345" }, From 966d23c7e68ea32679275a7e3d2383181002c868 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 24 Jul 2026 15:19:37 +0530 Subject: [PATCH 05/15] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published In qcom_scm_probe(), devm_request_threaded_irq() is called before smp_store_release(&__scm, scm). Two paths can dereference __scm before it is published, both causing a NULL pointer dereference. The IRQ handler receives scm via its data argument but passes only wq_ctx to qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), which then dereference __scm directly. Thread scm through both functions so the IRQ handler path never touches __scm. Non-atomic SMC calls made during probe (e.g. from qcom_tzmem_init via qcom_scm_shm_bridge_enable) can return WAITQ_SLEEP, causing qcom_scm_wait_for_wq_completion() to run before __scm is published and dereference it. Add platform_set_drvdata(pdev, scm) early in probe and change qcom_scm_wait_for_wq_completion() to take the device pointer and use dev_get_drvdata() to reach scm, removing any dependency on __scm. Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260724094939.613844-2-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm-smc.c | 2 +- drivers/firmware/qcom/qcom_scm.c | 22 ++++++++++------------ drivers/firmware/qcom/qcom_scm.h | 2 +- 3 files changed, 12 insertions(+), 14 deletions(-) diff --git a/drivers/firmware/qcom/qcom_scm-smc.c b/drivers/firmware/qcom/qcom_scm-smc.c index 01999c22659c..127365ab11fc 100644 --- a/drivers/firmware/qcom/qcom_scm-smc.c +++ b/drivers/firmware/qcom/qcom_scm-smc.c @@ -111,7 +111,7 @@ static int __scm_smc_do_quirk_handle_waitq(struct device *dev, struct arm_smccc_ smc_call_ctx = res->a2; trace_scm_waitq_sleep(wq_ctx, smc_call_ctx); - ret = qcom_scm_wait_for_wq_completion(wq_ctx); + ret = qcom_scm_wait_for_wq_completion(dev, wq_ctx); if (ret) return ret; diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index 9ec79b445481..d11026c26cde 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2645,23 +2645,20 @@ static int qcom_scm_get_waitq_irq(struct qcom_scm *scm) return irq_create_fwspec_mapping(&fwspec); } -static struct completion *qcom_scm_get_completion(u32 wq_ctx) +static struct completion *qcom_scm_get_completion(struct qcom_scm *scm, u32 wq_ctx) { - struct completion *wq; - - if (WARN_ON_ONCE(wq_ctx >= __scm->wq_cnt)) + if (WARN_ON_ONCE(wq_ctx >= scm->wq_cnt)) return ERR_PTR(-EINVAL); - wq = &__scm->waitq_comps[wq_ctx]; - - return wq; + return &scm->waitq_comps[wq_ctx]; } -int qcom_scm_wait_for_wq_completion(u32 wq_ctx) +int qcom_scm_wait_for_wq_completion(struct device *dev, u32 wq_ctx) { + struct qcom_scm *scm = dev_get_drvdata(dev); struct completion *wq; - wq = qcom_scm_get_completion(wq_ctx); + wq = qcom_scm_get_completion(scm, wq_ctx); if (IS_ERR(wq)) return PTR_ERR(wq); @@ -2670,11 +2667,11 @@ int qcom_scm_wait_for_wq_completion(u32 wq_ctx) return 0; } -static int qcom_scm_waitq_wakeup(unsigned int wq_ctx) +static int qcom_scm_waitq_wakeup(struct qcom_scm *scm, unsigned int wq_ctx) { struct completion *wq; - wq = qcom_scm_get_completion(wq_ctx); + wq = qcom_scm_get_completion(scm, wq_ctx); if (IS_ERR(wq)) return PTR_ERR(wq); @@ -2701,7 +2698,7 @@ static irqreturn_t qcom_scm_irq_handler(int irq, void *data) goto out; } - ret = qcom_scm_waitq_wakeup(wq_ctx); + ret = qcom_scm_waitq_wakeup(scm, wq_ctx); if (ret) goto out; } while (more_pending); @@ -2805,6 +2802,7 @@ static int qcom_scm_probe(struct platform_device *pdev) return -ENOMEM; scm->dev = &pdev->dev; + platform_set_drvdata(pdev, scm); ret = qcom_scm_find_dload_address(&pdev->dev, &scm->dload_mode_addr); if (ret < 0) return dev_err_probe(&pdev->dev, ret, diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h index caab80a73e17..cf90a565fdfb 100644 --- a/drivers/firmware/qcom/qcom_scm.h +++ b/drivers/firmware/qcom/qcom_scm.h @@ -66,7 +66,7 @@ struct qcom_scm_res { u64 result[MAX_QCOM_SCM_RETS]; }; -int qcom_scm_wait_for_wq_completion(u32 wq_ctx); +int qcom_scm_wait_for_wq_completion(struct device *dev, u32 wq_ctx); int scm_get_wq_ctx(u32 *wq_ctx, u32 *flags, u32 *more_pending); #define SCM_SMC_FNID(s, c) ((((s) & 0xFF) << 8) | ((c) & 0xFF)) From b697b20cea4374d27e2134da4bb7b0ea39f36c8b Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 24 Jul 2026 15:19:38 +0530 Subject: [PATCH 06/15] firmware: qcom: scm: Fix reserved memory cleanup on probe failure of_reserved_mem_device_init() adds an entry to a global list with no devres counterpart. If qcom_scm_probe() fails after the call the assignment is never cleaned up. A probe retry would add a duplicate entry, leaking the original one permanently. Add an err_rmem label that calls of_reserved_mem_device_release() and route all error paths after of_reserved_mem_device_init() through it. of_reserved_mem_device_release() is safe to call unconditionally as it simply walks an empty list when nothing was assigned. Fixes: a33b2579c8d3 ("firmware: qcom: scm: add support for SHM bridge memory carveout") Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260724094939.613844-3-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_scm.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c index d11026c26cde..3eaa4c9ccf3c 100644 --- a/drivers/firmware/qcom/qcom_scm.c +++ b/drivers/firmware/qcom/qcom_scm.c @@ -2850,9 +2850,11 @@ static int qcom_scm_probe(struct platform_device *pdev) "Failed to setup the reserved memory region for TZ mem\n"); ret = qcom_tzmem_enable(scm->dev); - if (ret) - return dev_err_probe(scm->dev, ret, - "Failed to enable the TrustZone memory allocator\n"); + if (ret) { + ret = dev_err_probe(scm->dev, ret, + "Failed to enable the TrustZone memory allocator\n"); + goto err_rmem; + } memset(&pool_config, 0, sizeof(pool_config)); pool_config.initial_size = 0; @@ -2860,9 +2862,11 @@ static int qcom_scm_probe(struct platform_device *pdev) pool_config.max_size = SZ_256K; scm->mempool = devm_qcom_tzmem_pool_new(scm->dev, &pool_config); - if (IS_ERR(scm->mempool)) - return dev_err_probe(scm->dev, PTR_ERR(scm->mempool), - "Failed to create the SCM memory pool\n"); + if (IS_ERR(scm->mempool)) { + ret = dev_err_probe(scm->dev, PTR_ERR(scm->mempool), + "Failed to create the SCM memory pool\n"); + goto err_rmem; + } ret = qcom_scm_query_waitq_count(scm); scm->wq_cnt = ret < 0 ? QCOM_SCM_DEFAULT_WAITQ_COUNT : ret; @@ -2938,6 +2942,10 @@ static int qcom_scm_probe(struct platform_device *pdev) qcom_scm_gunyah_wdt_init(scm); return 0; + +err_rmem: + of_reserved_mem_device_release(scm->dev); + return ret; } static void qcom_scm_shutdown(struct platform_device *pdev) From 9941fe8a04f3d258e07eb5899db3027252a4190f Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 24 Jul 2026 15:19:39 +0530 Subject: [PATCH 07/15] firmware: qcom: scm: Fix tzmem state on probe retry qcom_tzmem_enable() returns -EBUSY if called a second time, but this causes probe retries to fail permanently if a later step in qcom_scm_probe() defers after qcom_tzmem_enable() has already succeeded. Use DO_ONCE() to ensure qcom_tzmem_init() runs exactly once across all calls in a thread-safe manner. qcom_tzmem_dev is set on every call since probe retries use the same device pointer. The result of the first initialisation is cached and returned to every subsequent caller. Fixes: 40289e35ca52 ("firmware: qcom: scm: enable the TZ mem allocator") Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260724094939.613844-4-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/firmware/qcom/qcom_tzmem.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/qcom/qcom_tzmem.c b/drivers/firmware/qcom/qcom_tzmem.c index 0635cbeacfc8..0fd9581275f1 100644 --- a/drivers/firmware/qcom/qcom_tzmem.c +++ b/drivers/firmware/qcom/qcom_tzmem.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include #include @@ -507,14 +508,18 @@ phys_addr_t qcom_tzmem_to_phys(void *vaddr) } EXPORT_SYMBOL_GPL(qcom_tzmem_to_phys); +static void qcom_tzmem_do_init(int *result) +{ + *result = qcom_tzmem_init(); +} + int qcom_tzmem_enable(struct device *dev) { - if (qcom_tzmem_dev) - return -EBUSY; + static int result; qcom_tzmem_dev = dev; - - return qcom_tzmem_init(); + DO_ONCE(qcom_tzmem_do_init, &result); + return result; } EXPORT_SYMBOL_GPL(qcom_tzmem_enable); From 80350cdc5f7e2ddc6739987a78f04b9b7788e593 Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Mon, 27 Jul 2026 11:59:27 +0200 Subject: [PATCH 08/15] soc: qcom: smem: Use 'unsigned int' instead of 'unsigned' checkpatch.pl reports: WARNING: Prefer 'unsigned int' to bare use of 'unsigned' Convert the SMEM driver to use the less ambiguous type instead. Signed-off-by: Konrad Dybcio Reviewed-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260727-topic-smem_dramc-v5-1-66188b3e338d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/smem.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index afb21a778fe7..43b66120fc64 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -281,7 +281,7 @@ struct qcom_smem { struct smem_partition global_partition; struct xarray partitions; - unsigned num_regions; + unsigned int num_regions; struct smem_region regions[] __counted_by(num_regions); }; @@ -399,7 +399,7 @@ EXPORT_SYMBOL_GPL(qcom_smem_is_available); static int qcom_smem_alloc_private(struct qcom_smem *smem, struct smem_partition *part, - unsigned item, + unsigned int item, size_t size) { struct smem_private_entry *hdr, *end; @@ -460,7 +460,7 @@ static int qcom_smem_alloc_private(struct qcom_smem *smem, } static int qcom_smem_alloc_global(struct qcom_smem *smem, - unsigned item, + unsigned int item, size_t size) { struct smem_global_entry *entry; @@ -503,7 +503,7 @@ static int qcom_smem_alloc_global(struct qcom_smem *smem, * * Return: 0 on success, negative errno on failure. */ -int qcom_smem_alloc(unsigned host, unsigned item, size_t size) +int qcom_smem_alloc(unsigned int host, unsigned int item, size_t size) { struct smem_partition *part; unsigned long flags; @@ -544,7 +544,7 @@ int qcom_smem_alloc(unsigned host, unsigned item, size_t size) EXPORT_SYMBOL_GPL(qcom_smem_alloc); static void *qcom_smem_get_global(struct qcom_smem *smem, - unsigned item, + unsigned int item, size_t *size) { struct smem_header *header; @@ -553,7 +553,6 @@ static void *qcom_smem_get_global(struct qcom_smem *smem, u64 entry_offset; u32 e_size; u32 aux_base; - unsigned i; header = smem->regions[0].virt_base; entry = &header->toc[item]; @@ -562,7 +561,7 @@ static void *qcom_smem_get_global(struct qcom_smem *smem, aux_base = le32_to_cpu(entry->aux_base) & AUX_BASE_MASK; - for (i = 0; i < smem->num_regions; i++) { + for (unsigned int i = 0; i < smem->num_regions; i++) { region = &smem->regions[i]; if ((u32)region->aux_base == aux_base || !aux_base) { @@ -584,7 +583,7 @@ static void *qcom_smem_get_global(struct qcom_smem *smem, static void *qcom_smem_get_private(struct qcom_smem *smem, struct smem_partition *part, - unsigned item, + unsigned int item, size_t *size) { struct smem_private_entry *e, *end; @@ -683,7 +682,7 @@ static void *qcom_smem_get_private(struct qcom_smem *smem, * * Return: a pointer to an SMEM item on success, ERR_PTR() on failure. */ -void *qcom_smem_get(unsigned host, unsigned item, size_t *size) +void *qcom_smem_get(unsigned int host, unsigned int item, size_t *size) { struct smem_partition *part; void *ptr; @@ -717,12 +716,12 @@ EXPORT_SYMBOL_GPL(qcom_smem_get); * * Return: number of available bytes on success, negative errno on failure. */ -int qcom_smem_get_free_space(unsigned host) +int qcom_smem_get_free_space(unsigned int host) { struct smem_partition *part; struct smem_partition_header *phdr; struct smem_header *header; - unsigned ret; + unsigned int ret; if (IS_ERR(__smem)) return PTR_ERR(__smem); From 1d234eeafc56af8c9af6eee857f41a4310615e78 Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Mon, 27 Jul 2026 11:59:28 +0200 Subject: [PATCH 09/15] soc: qcom: smem: Expose DDR data from SMEM Most modern Qualcomm platforms (>= SM8150) expose information about the DDR memory present on the system via SMEM. Details from this information is used in various scenarios, such as multimedia drivers configuring the hardware based on the "Highest Bank address Bit" (hbb), or the list of valid frequencies in validation scenarios... Add support for parsing v3-v7 version of the structs. Unforunately, they are not versioned, so some elbow grease is necessary to determine which one is present. See for reference: ver 3: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/1d11897d2cfcc7b85f28ff74c445018dbbecac7a ver 4: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/f6e9aa549260bbc0bdcb156c2b05f48dc5963203 ver 5: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/617d3297abe8b1b8dd3de3d1dd69c3961e6f343f ver 5 with 6regions: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/d770e009f9bae58d56d926f7490bbfb45af8341f ver 6: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/62659b557fdb1551b20fae8073d1d701dfa8a62e ver 7: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/734d95599c5ebb1ca0d4e1639142e65c590532b7 Reviewed-by: Bjorn Andersson Signed-off-by: Konrad Dybcio Link: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/1d11897d2cfcc7b85f28ff74c445018dbbecac7a Link: https://lore.kernel.org/r/20260727-topic-smem_dramc-v5-2-66188b3e338d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/Makefile | 3 +- drivers/soc/qcom/smem.c | 60 +++-- drivers/soc/qcom/smem.h | 12 + drivers/soc/qcom/smem_dramc.c | 430 ++++++++++++++++++++++++++++++++++ include/linux/soc/qcom/smem.h | 2 + 5 files changed, 485 insertions(+), 22 deletions(-) create mode 100644 drivers/soc/qcom/smem.h create mode 100644 drivers/soc/qcom/smem_dramc.c diff --git a/drivers/soc/qcom/Makefile b/drivers/soc/qcom/Makefile index b7f1d2a57367..798643be3590 100644 --- a/drivers/soc/qcom/Makefile +++ b/drivers/soc/qcom/Makefile @@ -23,7 +23,8 @@ obj-$(CONFIG_QCOM_RPMH) += qcom_rpmh.o qcom_rpmh-y += rpmh-rsc.o qcom_rpmh-y += rpmh.o obj-$(CONFIG_QCOM_SMD_RPM) += rpm-proc.o smd-rpm.o -obj-$(CONFIG_QCOM_SMEM) += smem.o +qcom_smem-y += smem.o smem_dramc.o +obj-$(CONFIG_QCOM_SMEM) += qcom_smem.o obj-$(CONFIG_QCOM_SMEM_STATE) += smem_state.o CFLAGS_smp2p.o := -I$(src) obj-$(CONFIG_QCOM_SMP2P) += smp2p.o diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 43b66120fc64..b5e7bd8c1512 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -4,6 +4,7 @@ * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved. */ +#include #include #include #include @@ -16,6 +17,8 @@ #include #include +#include "smem.h" + /* * The Qualcomm shared memory system is a allocate only heap structure that * consists of one of more memory areas that can be accessed by the processors @@ -267,6 +270,7 @@ struct smem_region { * @partitions: list of partitions of current processor/host * @item_count: max accepted item number * @socinfo: platform device pointer + * @debugfs_dir: directory for SMEM-related debugfs attributes * @num_regions: number of @regions * @regions: list of the memory regions defining the shared memory */ @@ -281,6 +285,8 @@ struct qcom_smem { struct smem_partition global_partition; struct xarray partitions; + struct dentry *debugfs_dir; + unsigned int num_regions; struct smem_region regions[] __counted_by(num_regions); }; @@ -671,6 +677,30 @@ static void *qcom_smem_get_private(struct qcom_smem *smem, return ERR_PTR(-EINVAL); } +void *__qcom_smem_get(struct qcom_smem *smem, unsigned int host, unsigned int item, size_t *size) +{ + struct smem_partition *part; + void *ptr; + + if (IS_ERR(smem)) + return smem; + + if (item >= smem->item_count) + return ERR_PTR(-EINVAL); + + part = xa_load(&smem->partitions, host); + if (part) { + ptr = qcom_smem_get_private(smem, part, item, size); + } else if (smem->global_partition.virt_base) { + part = &smem->global_partition; + ptr = qcom_smem_get_private(smem, part, item, size); + } else { + ptr = qcom_smem_get_global(smem, item, size); + } + + return ptr; +} + /** * qcom_smem_get() - resolve ptr of size of a smem item * @host: the remote processor, or -1 @@ -684,26 +714,7 @@ static void *qcom_smem_get_private(struct qcom_smem *smem, */ void *qcom_smem_get(unsigned int host, unsigned int item, size_t *size) { - struct smem_partition *part; - void *ptr; - - if (IS_ERR(__smem)) - return __smem; - - if (item >= __smem->item_count) - return ERR_PTR(-EINVAL); - - part = xa_load(&__smem->partitions, host); - if (part) { - ptr = qcom_smem_get_private(__smem, part, item, size); - } else if (__smem->global_partition.virt_base) { - part = &__smem->global_partition; - ptr = qcom_smem_get_private(__smem, part, item, size); - } else { - ptr = qcom_smem_get_global(__smem, item, size); - } - - return ptr; + return __qcom_smem_get(__smem, host, item, size); } EXPORT_SYMBOL_GPL(qcom_smem_get); @@ -1236,19 +1247,26 @@ static int qcom_smem_probe(struct platform_device *pdev) if (ret < 0 && ret != -ENOENT) return ret; + smem->debugfs_dir = smem_dram_parse(smem, smem->dev); + __smem = smem; smem->socinfo = platform_device_register_data(&pdev->dev, "qcom-socinfo", PLATFORM_DEVID_NONE, NULL, 0); - if (IS_ERR(smem->socinfo)) + if (IS_ERR(smem->socinfo)) { + debugfs_remove_recursive(smem->debugfs_dir); + dev_dbg(&pdev->dev, "failed to register socinfo device\n"); + } return 0; } static void qcom_smem_remove(struct platform_device *pdev) { + debugfs_remove_recursive(__smem->debugfs_dir); + platform_device_unregister(__smem->socinfo); xa_destroy(&__smem->partitions); diff --git a/drivers/soc/qcom/smem.h b/drivers/soc/qcom/smem.h new file mode 100644 index 000000000000..40523eb87231 --- /dev/null +++ b/drivers/soc/qcom/smem.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __QCOM_SMEM_INTERNAL__ +#define __QCOM_SMEM_INTERNAL__ + +#include + +struct qcom_smem; + +struct dentry *smem_dram_parse(struct qcom_smem *smem, struct device *dev); +void *__qcom_smem_get(struct qcom_smem *smem, unsigned int host, unsigned int item, size_t *size); + +#endif diff --git a/drivers/soc/qcom/smem_dramc.c b/drivers/soc/qcom/smem_dramc.c new file mode 100644 index 000000000000..63ebe7f6db59 --- /dev/null +++ b/drivers/soc/qcom/smem_dramc.c @@ -0,0 +1,430 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "smem.h" + +#define SMEM_DDR_INFO_ID 603 + +#define MAX_DDR_FREQ_NUM_V3 13 +#define MAX_DDR_FREQ_NUM_V5 14 + +#define MAX_CHAN_NUM 8 +#define MAX_RANK_NUM 2 + +#define DDR_HBB_MIN 13 +#define DDR_HBB_MAX 19 + +#define MAX_SHUB_ENTRIES 8 + +static struct smem_dram *__dram; + +enum ddr_info_version { + INFO_UNKNOWN, + INFO_V3, + INFO_V3_WITH_14_FREQS, + INFO_V4, + INFO_V5, + INFO_V5_WITH_6_REGIONS, + INFO_V6, /* INFO_V6 seems to only have shipped with 6 DDR regions, unlike V7 */ + INFO_V7, + INFO_V7_WITH_6_REGIONS, +}; + +struct smem_dram { + unsigned long frequencies[MAX_DDR_FREQ_NUM_V5]; + u32 num_frequencies; + u8 hbb; +}; + +enum ddr_type { + DDR_TYPE_NODDR = 0, + DDR_TYPE_LPDDR1 = 1, + DDR_TYPE_LPDDR2 = 2, + DDR_TYPE_PCDDR2 = 3, + DDR_TYPE_PCDDR3 = 4, + DDR_TYPE_LPDDR3 = 5, + DDR_TYPE_LPDDR4 = 6, + DDR_TYPE_LPDDR4X = 7, + DDR_TYPE_LPDDR5 = 8, + DDR_TYPE_LPDDR5X = 9, +}; + +/* The data structures below are NOT __packed on purpose! */ + +/* Structs used across multiple versions */ +struct ddr_part_details { + __le16 revision_id1; + __le16 revision_id2; + __le16 width; + __le16 density; +}; + +struct ddr_freq_table { + __le32 freq_khz; + u8 enabled; +}; + +/* V3 */ +struct ddr_freq_plan_v3 { + struct ddr_freq_table ddr_freq[MAX_DDR_FREQ_NUM_V3]; + u8 num_ddr_freqs; + phys_addr_t clk_period_address; +}; + +struct ddr_details_v3 { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM]; + struct ddr_freq_plan_v3 ddr_freq_tbl; + u8 num_channels; +}; + +/* Some V3 structs have an additional frequency level */ +struct ddr_freq_plan_v3_14freqs { + struct ddr_freq_table ddr_freq[MAX_DDR_FREQ_NUM_V3 + 1]; + u8 num_ddr_freqs; + phys_addr_t clk_period_address; +}; + +struct ddr_details_v3_14freqs { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM]; + struct ddr_freq_plan_v3_14freqs ddr_freq_tbl; + u8 num_channels; +}; + +/* V4 */ +struct ddr_details_v4 { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM]; + struct ddr_freq_plan_v3 ddr_freq_tbl; + u8 num_channels; + u8 num_ranks[MAX_CHAN_NUM]; + u8 highest_bank_addr_bit[MAX_CHAN_NUM][MAX_RANK_NUM]; +}; + +/* V5 */ +struct shub_freq_table { + u8 enable; + __le32 freq_khz; +}; + +struct shub_freq_plan_entry { + u8 num_shub_freqs; + struct shub_freq_table shub_freq[MAX_SHUB_ENTRIES]; +}; + +struct ddr_xbl2quantum_smem_data { + phys_addr_t ssr_cookie_addr; + __le32 reserved[10]; +}; + +struct ddr_freq_plan_v5 { + struct ddr_freq_table ddr_freq[MAX_DDR_FREQ_NUM_V5]; + u8 num_ddr_freqs; + phys_addr_t clk_period_address; + __le32 max_nom_ddr_freq; +}; + +struct ddr_region_v5 { + __le64 start_address; + __le64 size; + __le64 mem_controller_address; + __le32 granule_size; /* MiB */ + u8 ddr_rank; +#define DDR_RANK_0 BIT(0) +#define DDR_RANK_1 BIT(1) + u8 segments_start_index; + __le64 segments_start_offset; +}; + +struct ddr_regions_v5 { + __le32 ddr_region_num; /* We expect this to always be 4 or 6 */ + __le64 ddr_rank0_size; + __le64 ddr_rank1_size; + __le64 ddr_cs0_start_addr; + __le64 ddr_cs1_start_addr; + __le32 highest_bank_addr_bit; + struct ddr_region_v5 ddr_region[] __counted_by_le(ddr_region_num); +}; + +struct ddr_details_v5 { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM]; + struct ddr_freq_plan_v5 ddr_freq_tbl; + u8 num_channels; + u8 _padding; + struct ddr_regions_v5 ddr_regions; +}; + +/* V6 */ +struct ddr_misc_info_v6 { + __le32 dsf_version; + __le32 reserved[10]; +}; + +/* V7 */ +struct ddr_details_v7 { + u8 manufacturer_id; + u8 device_type; + struct ddr_part_details ddr_params[MAX_CHAN_NUM]; + struct ddr_freq_plan_v5 ddr_freq_tbl; + u8 num_channels; + u8 sct_config; + struct ddr_regions_v5 ddr_regions; +}; + +/** + * qcom_smem_dram_get_hbb(): Get the Highest bank address bit + * + * Context: Check qcom_smem_is_available() before calling this function. + * Because __dram * is initialized by smem_dram_parse(), which is in turn + * called from * qcom_smem_probe(), __dram will only be NULL if the data + * couldn't have been found/interpreted correctly. + * + * Return: highest bank bit on success, -ENODATA on failure. + */ +int qcom_smem_dram_get_hbb(void) +{ + if (!__dram || !__dram->hbb) + return -ENODATA; + + if (__dram->hbb < DDR_HBB_MIN || __dram->hbb > DDR_HBB_MAX) + return -ENODATA; + + return __dram->hbb; +} +EXPORT_SYMBOL_GPL(qcom_smem_dram_get_hbb); + +static void smem_dram_parse_v3_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v3 *details = data; + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V3; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + } + } +} + +static void smem_dram_parse_v3_14freqs_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v3_14freqs *details = data; + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V3 + 1; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) + dram->frequencies[dram->num_frequencies++] = 1000 * freq_entry->freq_khz; + } +} + +static void smem_dram_parse_v4_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v4 *details = data; + + /* Rank 0 channel 0 entry holds the correct value */ + dram->hbb = details->highest_bank_addr_bit[0][0]; + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V3; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + } + } +} + +static void smem_dram_parse_v5_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v5 *details = data; + struct ddr_regions_v5 *region = &details->ddr_regions; + + dram->hbb = le32_to_cpu(region[0].highest_bank_addr_bit); + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V5; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + } + } +} + +static void smem_dram_parse_v7_data(struct smem_dram *dram, void *data) +{ + struct ddr_details_v7 *details = data; + struct ddr_regions_v5 *region = &details->ddr_regions; + + dram->hbb = le32_to_cpu(region[0].highest_bank_addr_bit); + + for (int i = 0; i < MAX_DDR_FREQ_NUM_V5; i++) { + struct ddr_freq_table *freq_entry = &details->ddr_freq_tbl.ddr_freq[i]; + + if (freq_entry->freq_khz && freq_entry->enabled) { + u32 freq_khz = le32_to_cpu(freq_entry->freq_khz); + dram->frequencies[dram->num_frequencies++] = 1000 * freq_khz; + } + } +} + +/* The structure contains no version field, so we have to perform some guesswork.. */ +static int smem_dram_infer_struct_version(size_t size) +{ + /* Some early versions provided less bytes of less useful data */ + if (size < sizeof(struct ddr_details_v3)) + return -EINVAL; + + if (size == sizeof(struct ddr_details_v3)) + return INFO_V3; + + if (size == sizeof(struct ddr_details_v3_14freqs)) + return INFO_V3_WITH_14_FREQS; + + if (size == sizeof(struct ddr_details_v4)) + return INFO_V4; + + if (size == sizeof(struct ddr_details_v5) + + 4 * sizeof(struct ddr_region_v5)) + return INFO_V5; + + if (size == sizeof(struct ddr_details_v5) + + 4 * sizeof(struct ddr_region_v5) + + sizeof(struct ddr_xbl2quantum_smem_data) + + sizeof(struct shub_freq_plan_entry)) + return INFO_V5; + + if (size == sizeof(struct ddr_details_v5) + + 6 * sizeof(struct ddr_region_v5)) + return INFO_V5_WITH_6_REGIONS; + + if (size == sizeof(struct ddr_details_v5) + + 6 * sizeof(struct ddr_region_v5) + + sizeof(struct ddr_xbl2quantum_smem_data) + + sizeof(struct shub_freq_plan_entry)) + return INFO_V5_WITH_6_REGIONS; + + if (size == sizeof(struct ddr_details_v5) + + 6 * sizeof(struct ddr_region_v5) + + sizeof(struct ddr_misc_info_v6) + + sizeof(struct shub_freq_plan_entry)) + return INFO_V6; + + if (size == sizeof(struct ddr_details_v7) + + 4 * sizeof(struct ddr_region_v5) + + sizeof(struct ddr_misc_info_v6) + + sizeof(struct shub_freq_plan_entry)) + return INFO_V7; + + if (size == sizeof(struct ddr_details_v7) + + 6 * sizeof(struct ddr_region_v5) + + sizeof(struct ddr_misc_info_v6) + + sizeof(struct shub_freq_plan_entry)) + return INFO_V7_WITH_6_REGIONS; + + return INFO_UNKNOWN; +} + +static int smem_dram_frequencies_show(struct seq_file *s, void *unused) +{ + struct smem_dram *dram = s->private; + + for (int i = 0; i < dram->num_frequencies; i++) + seq_printf(s, "%lu\n", dram->frequencies[i]); + + return 0; +} +DEFINE_SHOW_ATTRIBUTE(smem_dram_frequencies); + +static int smem_hbb_show(struct seq_file *s, void *unused) +{ + struct smem_dram *dram = s->private; + + if (!dram->hbb) + return -EINVAL; + + seq_printf(s, "%d\n", dram->hbb); + + return 0; +} +DEFINE_SHOW_ATTRIBUTE(smem_hbb); + +struct dentry *smem_dram_parse(struct qcom_smem *smem, struct device *dev) +{ + struct dentry *debugfs_dir; + enum ddr_info_version ver; + struct smem_dram *dram; + size_t actual_size; + void *data; + + /* No need to check qcom_smem_is_available(), this func is called by the SMEM driver */ + data = __qcom_smem_get(smem, QCOM_SMEM_HOST_ANY, SMEM_DDR_INFO_ID, &actual_size); + if (IS_ERR_OR_NULL(data)) + return ERR_PTR(-ENODATA); + + ver = smem_dram_infer_struct_version(actual_size); + if (ver < 0) { + /* Some SoCs don't provide data that's useful for us */ + return ERR_PTR(-ENODATA); + } else if (ver == INFO_UNKNOWN) { + /* In other cases, we may not have added support for a newer struct revision */ + dev_err(dev, "Found an unknown type of DRAM info struct (size = %zu)\n", + actual_size); + return ERR_PTR(-EINVAL); + } + + dram = devm_kzalloc(dev, sizeof(*dram), GFP_KERNEL); + if (!dram) + return ERR_PTR(-ENOMEM); + + switch (ver) { + case INFO_V3: + smem_dram_parse_v3_data(dram, data); + break; + case INFO_V3_WITH_14_FREQS: + smem_dram_parse_v3_14freqs_data(dram, data); + break; + case INFO_V4: + smem_dram_parse_v4_data(dram, data); + break; + case INFO_V5: + case INFO_V5_WITH_6_REGIONS: + case INFO_V6: + smem_dram_parse_v5_data(dram, data); + break; + case INFO_V7: + case INFO_V7_WITH_6_REGIONS: + smem_dram_parse_v7_data(dram, data); + break; + default: + return ERR_PTR(-EINVAL); + } + + debugfs_dir = debugfs_create_dir("qcom_smem", NULL); + debugfs_create_file("dram_frequencies", 0444, debugfs_dir, dram, + &smem_dram_frequencies_fops); + debugfs_create_file("hbb", 0444, debugfs_dir, dram, &smem_hbb_fops); + + __dram = dram; + + return debugfs_dir; +} diff --git a/include/linux/soc/qcom/smem.h b/include/linux/soc/qcom/smem.h index f946e3beca21..3249cbd2016b 100644 --- a/include/linux/soc/qcom/smem.h +++ b/include/linux/soc/qcom/smem.h @@ -17,4 +17,6 @@ int qcom_smem_get_feature_code(u32 *code); int qcom_smem_bust_hwspin_lock_by_host(unsigned int host); +int qcom_smem_dram_get_hbb(void); + #endif From 1b445022d1d0ec7431b6f8fe0054ae8ccf33d60a Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Mon, 27 Jul 2026 11:59:29 +0200 Subject: [PATCH 10/15] soc: qcom: ubwc: Get HBB from SMEM To make sure the correct settings for a given DRAM configuration get applied, attempt to retrieve that data from SMEM (which happens to be what the BSP kernel does, albeit with through convoluted means of the bootloader altering the DT with this data). Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260727-topic-smem_dramc-v5-3-66188b3e338d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/ubwc_config.c | 40 +++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/ubwc_config.c b/drivers/soc/qcom/ubwc_config.c index 0209a02c390f..23901a4c51f7 100644 --- a/drivers/soc/qcom/ubwc_config.c +++ b/drivers/soc/qcom/ubwc_config.c @@ -11,6 +11,7 @@ #include #include +#include static const struct qcom_ubwc_cfg_data no_ubwc_data = { /* no UBWC, no HBB */ @@ -168,9 +169,25 @@ static const struct of_device_id qcom_ubwc_configs[] __maybe_unused = { { } }; +static struct qcom_ubwc_cfg_data *cfg; +static DEFINE_MUTEX(cfg_mutex); +/** + * qcom_ubwc_config_get_data() - Retrieve UBWC data for the platform. + * + * Return: Pointer to valid struct qcom_ubwc_cfg_data on success, negative + * errno on failure. Note that this may return EPROBE_DEFER. + */ const struct qcom_ubwc_cfg_data *qcom_ubwc_config_get_data(void) { const struct qcom_ubwc_cfg_data *data; + int hbb; + + guard(mutex)(&cfg_mutex); + if (cfg) + return cfg; + + if (!qcom_smem_is_available()) + return ERR_PTR(-EPROBE_DEFER); data = of_machine_get_match_data(qcom_ubwc_configs); if (!data) { @@ -178,9 +195,30 @@ const struct qcom_ubwc_cfg_data *qcom_ubwc_config_get_data(void) return ERR_PTR(-EINVAL); } - return data; + hbb = qcom_smem_dram_get_hbb(); + if (hbb == -ENODATA) { + /* Lack of HBB data is OK - it was only introduced later */ + return data; + } else if (hbb < 0) { + pr_err("Couldn't get HBB data from SMEM: %d\n", hbb); + return ERR_PTR(hbb); + } + + cfg = kmemdup(data, sizeof(*data), GFP_KERNEL); + if (!cfg) + return ERR_PTR(-ENOMEM); + + cfg->highest_bank_bit = hbb; + + return cfg; } EXPORT_SYMBOL_GPL(qcom_ubwc_config_get_data); +static void __exit ubwc_config_exit(void) +{ + kfree(cfg); +} +module_exit(ubwc_config_exit); + MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("UBWC config database for QTI SoCs"); From 2d361087e8f662c7846e34451ebe19b42bb86db6 Mon Sep 17 00:00:00 2001 From: Maulik Shah Date: Thu, 30 Jul 2026 14:16:23 +0530 Subject: [PATCH 11/15] soc: qcom: qcom_stats: Remove unused macro definitions Remove macros that are defined but never used, as identified by -Wunused-macros: STAT_TYPE_OFFSET, COUNT_OFFSET, LAST_ENTERED_AT_OFFSET, LAST_EXITED_AT_OFFSET, ACCUMULATED_OFFSET No functional impact. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260730-b4b4-removed-unused-macros-v1-1-2883fecb9e6e@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom_stats.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/soc/qcom/qcom_stats.c b/drivers/soc/qcom/qcom_stats.c index e7122444f12a..d9c811cb9ef6 100644 --- a/drivers/soc/qcom/qcom_stats.c +++ b/drivers/soc/qcom/qcom_stats.c @@ -20,11 +20,6 @@ #define RPM_DYNAMIC_ADDR 0x14 #define RPM_DYNAMIC_ADDR_MASK 0xFFFF -#define STAT_TYPE_OFFSET 0x0 -#define COUNT_OFFSET 0x4 -#define LAST_ENTERED_AT_OFFSET 0x8 -#define LAST_EXITED_AT_OFFSET 0x10 -#define ACCUMULATED_OFFSET 0x18 #define CLIENT_VOTES_OFFSET 0x20 #define DDR_STATS_MAGIC_KEY 0xA1157A75 From 8463421f20f67168132fb1b47571741266d872fb Mon Sep 17 00:00:00 2001 From: Maulik Shah Date: Thu, 30 Jul 2026 14:16:24 +0530 Subject: [PATCH 12/15] soc: qcom: qcom_stats: Replace CLIENT_VOTES_OFFSET macro with sizeof() CLIENT_VOTES_OFFSET (0x20) equals sizeof(struct sleep_stats), since appended_stats immediately follows sleep_stats in the memory layout. Replace the magic constant with sizeof(struct sleep_stats) to make the layout relationship self-documenting and drop the macro. No functional impact. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260730-b4b4-removed-unused-macros-v1-2-2883fecb9e6e@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- drivers/soc/qcom/qcom_stats.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/soc/qcom/qcom_stats.c b/drivers/soc/qcom/qcom_stats.c index d9c811cb9ef6..06923408bfce 100644 --- a/drivers/soc/qcom/qcom_stats.c +++ b/drivers/soc/qcom/qcom_stats.c @@ -20,8 +20,6 @@ #define RPM_DYNAMIC_ADDR 0x14 #define RPM_DYNAMIC_ADDR_MASK 0xFFFF -#define CLIENT_VOTES_OFFSET 0x20 - #define DDR_STATS_MAGIC_KEY 0xA1157A75 #define DDR_STATS_MAX_NUM_MODES 20 #define DDR_STATS_MAGIC_KEY_ADDR 0x0 @@ -135,7 +133,7 @@ static int qcom_soc_sleep_stats_show(struct seq_file *s, void *unused) if (d->appended_stats_avail) { struct appended_stats votes; - memcpy_fromio(&votes, reg + CLIENT_VOTES_OFFSET, sizeof(votes)); + memcpy_fromio(&votes, reg + sizeof(struct sleep_stats), sizeof(votes)); seq_printf(s, "Client Votes: %#x\n", votes.client_votes); } From a20f7b1fe71167b34b77b748eed6a2476d6206c0 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Thu, 25 Jun 2026 00:38:13 +0530 Subject: [PATCH 13/15] dt-bindings: sram: qcom,imem: Add minidump-sram pattern property The qcom,imem binding describes a single word in always-on SRAM shared between the operating system (OS) and boot firmware. Before DDR is initialized on the warm reset following a crash, firmware reads this word to decide where to deliver the minidump, and the OS is expected to select one of the destinations: either USB upload to a host PC or save to on-device storage. If nothing is selected by the OS, USB is the default. Signed-off-by: Mukesh Ojha Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260624190830.3131112-3-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- .../devicetree/bindings/sram/qcom,imem.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/Documentation/devicetree/bindings/sram/qcom,imem.yaml b/Documentation/devicetree/bindings/sram/qcom,imem.yaml index c63026904061..17adced6d3a4 100644 --- a/Documentation/devicetree/bindings/sram/qcom,imem.yaml +++ b/Documentation/devicetree/bindings/sram/qcom,imem.yaml @@ -67,6 +67,22 @@ properties: $ref: /schemas/power/reset/syscon-reboot-mode.yaml# patternProperties: + "^minidump-sram@[0-9a-f]+$": + type: object + description: + A word in always-on SRAM shared between the kernel and boot firmware. + Before DDR is initialised on the warm reset following a crash, firmware + reads this word to decide where to deliver the minidump (USB or storage). + + properties: + reg: + maxItems: 1 + + required: + - reg + + additionalProperties: false + "^modem-tables@[0-9a-f]+$": type: object description: From a60558ae6562edc95317eae60dc5e989493a278d Mon Sep 17 00:00:00 2001 From: Shawn Guo Date: Wed, 29 Jul 2026 10:35:06 +0800 Subject: [PATCH 14/15] dt-bindings: soc: qcom,aoss-qmp: Document Nord AOSS side channel Document Always-on Subsystem side channel on Qualcomm Nord SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo Link: https://lore.kernel.org/r/20260729023508.879752-2-shengchao.guo@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- Documentation/devicetree/bindings/soc/qcom/qcom,aoss-qmp.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,aoss-qmp.yaml b/Documentation/devicetree/bindings/soc/qcom/qcom,aoss-qmp.yaml index 9f9d9bcb66c4..d2ae2ae87a95 100644 --- a/Documentation/devicetree/bindings/soc/qcom/qcom,aoss-qmp.yaml +++ b/Documentation/devicetree/bindings/soc/qcom/qcom,aoss-qmp.yaml @@ -31,6 +31,7 @@ properties: - qcom,kaanapali-aoss-qmp - qcom,maili-aoss-qmp - qcom,milos-aoss-qmp + - qcom,nord-aoss-qmp - qcom,qcs615-aoss-qmp - qcom,qcs8300-aoss-qmp - qcom,qdu1000-aoss-qmp From 94d3305d990b055e1561e3b78275344b1f40c86e Mon Sep 17 00:00:00 2001 From: Sumit Garg Date: Thu, 2 Jul 2026 17:28:25 +0530 Subject: [PATCH 15/15] media: qcom: Switch to generic PAS TZ APIs Switch qcom media client drivers over to generic PAS TZ APIs. Generic PAS TZ service allows to support multiple TZ implementation backends like QTEE based SCM PAS service, OP-TEE based PAS service and any further future TZ backend service. Reviewed-by: Mukesh Ojha Tested-by: Mukesh Ojha # Lemans Reviewed-by: Konrad Dybcio Signed-off-by: Sumit Garg Link: https://lore.kernel.org/r/20260702115835.167602-10-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson --- drivers/media/platform/qcom/iris/Kconfig | 27 ++++++++++--------- .../media/platform/qcom/iris/iris_firmware.c | 9 ++++--- drivers/media/platform/qcom/venus/Kconfig | 1 + drivers/media/platform/qcom/venus/firmware.c | 11 ++++---- 4 files changed, 26 insertions(+), 22 deletions(-) diff --git a/drivers/media/platform/qcom/iris/Kconfig b/drivers/media/platform/qcom/iris/Kconfig index af78a1775937..388c9bbc8136 100644 --- a/drivers/media/platform/qcom/iris/Kconfig +++ b/drivers/media/platform/qcom/iris/Kconfig @@ -1,14 +1,15 @@ config VIDEO_QCOM_IRIS - tristate "Qualcomm iris V4L2 decoder driver" - depends on VIDEO_DEV - depends on ARCH_QCOM || COMPILE_TEST - select V4L2_MEM2MEM_DEV - select QCOM_MDT_LOADER - select QCOM_SCM - select QCOM_UBWC_CONFIG - select VIDEOBUF2_DMA_CONTIG - help - This is a V4L2 driver for Qualcomm iris video accelerator - hardware. It accelerates decoding operations on various - Qualcomm SoCs. - To compile this driver as a module choose m here. + tristate "Qualcomm iris V4L2 decoder driver" + depends on VIDEO_DEV + depends on ARCH_QCOM || COMPILE_TEST + select V4L2_MEM2MEM_DEV + select QCOM_MDT_LOADER + select QCOM_SCM + select QCOM_PAS + select QCOM_UBWC_CONFIG + select VIDEOBUF2_DMA_CONTIG + help + This is a V4L2 driver for Qualcomm iris video accelerator + hardware. It accelerates decoding operations on various + Qualcomm SoCs. + To compile this driver as a module choose m here. diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c index 1a476146d758..ea9654dd679e 100644 --- a/drivers/media/platform/qcom/iris/iris_firmware.c +++ b/drivers/media/platform/qcom/iris/iris_firmware.c @@ -4,6 +4,7 @@ */ #include +#include #include #include #include @@ -80,7 +81,7 @@ int iris_fw_load(struct iris_core *core) return -ENOMEM; } - ret = qcom_scm_pas_auth_and_reset(IRIS_PAS_ID); + ret = qcom_pas_auth_and_reset(IRIS_PAS_ID); if (ret) { dev_err(core->dev, "auth and reset failed: %d\n", ret); return ret; @@ -94,7 +95,7 @@ int iris_fw_load(struct iris_core *core) cp_config->cp_nonpixel_size); if (ret) { dev_err(core->dev, "qcom_scm_mem_protect_video_var failed: %d\n", ret); - qcom_scm_pas_shutdown(IRIS_PAS_ID); + qcom_pas_shutdown(IRIS_PAS_ID); return ret; } } @@ -104,10 +105,10 @@ int iris_fw_load(struct iris_core *core) int iris_fw_unload(struct iris_core *core) { - return qcom_scm_pas_shutdown(IRIS_PAS_ID); + return qcom_pas_shutdown(IRIS_PAS_ID); } int iris_set_hw_state(struct iris_core *core, bool resume) { - return qcom_scm_set_remote_state(resume, 0); + return qcom_pas_set_remote_state(resume, 0); } diff --git a/drivers/media/platform/qcom/venus/Kconfig b/drivers/media/platform/qcom/venus/Kconfig index 63ee8c78dc6d..7997b8aa427a 100644 --- a/drivers/media/platform/qcom/venus/Kconfig +++ b/drivers/media/platform/qcom/venus/Kconfig @@ -6,6 +6,7 @@ config VIDEO_QCOM_VENUS select OF_DYNAMIC if ARCH_QCOM select QCOM_MDT_LOADER select QCOM_SCM + select QCOM_PAS select VIDEOBUF2_DMA_CONTIG select V4L2_MEM2MEM_DEV help diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c index 1de7436713ed..3a38ff985822 100644 --- a/drivers/media/platform/qcom/venus/firmware.c +++ b/drivers/media/platform/qcom/venus/firmware.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -58,7 +59,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume) int ret; if (core->use_tz) { - ret = qcom_scm_set_remote_state(resume, 0); + ret = qcom_pas_set_remote_state(resume, 0); if (resume && ret == -EINVAL) ret = 0; return ret; @@ -218,7 +219,7 @@ int venus_boot(struct venus_core *core) int ret; if (!IS_ENABLED(CONFIG_QCOM_MDT_LOADER) || - (core->use_tz && !qcom_scm_is_available())) + (core->use_tz && !qcom_pas_is_available())) return -EPROBE_DEFER; ret = of_property_read_string_index(dev->of_node, "firmware-name", 0, @@ -236,7 +237,7 @@ int venus_boot(struct venus_core *core) core->fw.mem_phys = mem_phys; if (core->use_tz) - ret = qcom_scm_pas_auth_and_reset(VENUS_PAS_ID); + ret = qcom_pas_auth_and_reset(VENUS_PAS_ID); else ret = venus_boot_no_tz(core, mem_phys, mem_size); @@ -259,7 +260,7 @@ int venus_boot(struct venus_core *core) res->cp_nonpixel_start, res->cp_nonpixel_size); if (ret) { - qcom_scm_pas_shutdown(VENUS_PAS_ID); + qcom_pas_shutdown(VENUS_PAS_ID); dev_err(dev, "set virtual address ranges fail (%d)\n", ret); return ret; @@ -274,7 +275,7 @@ int venus_shutdown(struct venus_core *core) int ret; if (core->use_tz) - ret = qcom_scm_pas_shutdown(VENUS_PAS_ID); + ret = qcom_pas_shutdown(VENUS_PAS_ID); else ret = venus_shutdown_no_tz(core);