Arnd Bergmann [Wed, 21 Jan 2026 15:45:49 +0000 (16:45 +0100)]
Merge tag 'qcom-drivers-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Qualcomm driver updates for v6.20
Support multiple wait queues in the SCM firmware interface and provide
discovery of the wait queue interrupt to deal with the cases where
bootloader didn't patch the DeviceTree with the IRQ information.
Refactor the MDT loader and the SCM driver's peripheral authentication
service interface and introduce support for passing a remoteproc
resource table to the firmware. The remoteproc patches that uses this
and uses this to configure the IOMMU are included here due to
bidirectional dependencies. The end result is remoteproc support on the
Glymur platform.
Enable QSEECOM and thereby UEFI variable access, on the Surface Pro 11.
Make the QMI interface endianness aware, to support ath1Xk on big endian
machines.
Add the Glymur support in LLCC driver.
* tag 'qcom-drivers-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (33 commits)
soc: qcom: preserve CPU endianness for QMI_DATA_LEN
soc: qcom: fix QMI encoding/decoding for basic elements
soc: qcom: check QMI basic element error codes
soc: qcom: ubwc: add missing include
remoteproc: qcom: pas: Enable Secure PAS support with IOMMU managed by Linux
remoteproc: pas: Extend parse_fw callback to fetch resources via SMC call
firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table
firmware: qcom_scm: Add SHM bridge handling for PAS when running without QHEE
firmware: qcom_scm: Refactor qcom_scm_pas_init_image()
firmware: qcom_scm: Add a prep version of auth_and_reset function
soc: qcom: mdtloader: Remove qcom_mdt_pas_init() from exported symbols
soc: qcom: mdtloader: Add PAS context aware qcom_mdt_pas_load() function
remoteproc: pas: Replace metadata context with PAS context structure
firmware: qcom_scm: Introduce PAS context allocator helper function
firmware: qcom_scm: Rename peripheral as pas_id
firmware: qcom_scm: Remove redundant piece of code
dt-bindings: remoteproc: qcom,pas: Add iommus property
soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe
soc: qcom: pmic_glink_altmode: Consume TBT3/USB4 mode notifications
dt-bindings: qcom,pdc: document the Milos Power Domain Controller
...
Cleanups:
- knav_dma/knav_qmss: Remove redundant ENOMEM printks and simplify error messages
- knav_dma/knav: Simplify code with scoped for each OF child loops
- ti_sci.h: Fix all kernel-doc warnings
* tag 'ti-driver-soc-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux:
soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
soc: ti: k3-socinfo: Fix regmap leak on probe failure
soc: ti: k3-socinfo: Fix compile testing
soc: ti: knav_dma: Simplify with scoped for each OF child loop
soc: ti: knav: Simplify with scoped for each OF child loop
soc: ti: knav_dma: Simplify error messages in probe
soc: ti: knav_dma: Remove ENOMEM printks
soc: ti: knav_qmss: Remove ENOMEM printks
firmware: ti_sci.h: fix all kernel-doc warnings
Arnd Bergmann [Wed, 21 Jan 2026 15:39:29 +0000 (16:39 +0100)]
Merge tag 'imx-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/drivers
i.MX drivers changes for 6.20:
- A few changes from Peng Fan adding dump syslog support for i.MX
System Manager firmware driver, cleaning up soc-imx9 driver, fixing
error handling for soc-imx8m driver
* tag 'imx-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
soc: imx8m: Fix error handling for clk_prepare_enable()
soc: imx: Spport i.MX9[4,52]
soc: imx: Use dev_err_probe() for i.MX9
soc: imx: Use device-managed APIs for i.MX9
firmware: imx: sm-misc: Dump syslog info
firmware: arm_scmi: imx: Support getting syslog of MISC protocol
Arnd Bergmann [Wed, 21 Jan 2026 15:37:44 +0000 (16:37 +0100)]
Merge tag 'zynqmp-soc-for-6.20' of https://github.com/Xilinx/linux-xlnx into soc/drivers
arm64: Xilinx SOC changes for 6.20
- Fix Michal's email in cpuidle driver
- s/system_unbound_wq/system_dfl_wq/g in zynqmp_power
* tag 'zynqmp-soc-for-6.20' of https://github.com/Xilinx/linux-xlnx:
cpuidle: zynq: Switch Michal Simek's email to new one
soc/xilinx: replace use of system_unbound_wq with system_dfl_wq
Arnd Bergmann [Wed, 21 Jan 2026 15:34:00 +0000 (16:34 +0100)]
Merge tag 'tegra-for-6.20-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
soc/tegra: Changes for v6.20-rc1
This series primarily refactors the Tegra PMC driver to eliminate
reliance on a global variable, transitioning to passing the tegra_pmc
context explicitly across clocks, powergates, sysfs/debugfs interfaces,
and power management callbacks. Additionally, it resolves a warning
during system resume by deferring an unsafe generic_handle_irq() call to
a hard IRQ context using irq_work.
* tag 'tegra-for-6.20-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
soc/tegra: pmc: Add PMC contextual functions
soc/tegra: pmc: Do not rely on global variable
soc/tegra: pmc: Use driver-private data
soc/tegra: pmc: Use PMC context embedded in powergates
soc/tegra: pmc: Pass PMC context as debugfs data
soc/tegra: pmc: Pass PMC context via sys-off callback data
soc/tegra: pmc: Embed reboot notifier in PMC context
soc/tegra: pmc: Store PMC context in clocks
soc/tegra: pmc: Pass struct tegra_pmc to tegra_powergate_state()
soc/tegra: pmc: Use contextual data instead of global variable
soc/tegra: pmc: Fix unsafe generic_handle_irq() call
Arnd Bergmann [Wed, 21 Jan 2026 15:30:51 +0000 (16:30 +0100)]
Merge tag 'tee-sysfs-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
TEE sysfs for 6.20
- Add an optional generic sysfs attribute for TEE revision
- Implement revision reporting for OP-TEE using both SMC and FF-A ABIs
* tag 'tee-sysfs-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tee: optee: store OS revision for TEE core
tee: add revision sysfs attribute
Arnd Bergmann [Wed, 21 Jan 2026 15:28:23 +0000 (16:28 +0100)]
Merge tag 'tee-bus-callback-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
TEE bus callback for 6.20
- Move from generic device_driver to TEE bus-specific callbacks
- Add module_tee_client_driver() and registration helpers to reduce
boilerplate
- Convert several client drivers (TPM, KEYS, firmware, EFI, hwrng,
and RTC)
- Update documentation and fix kernel-doc warnings
* tag 'tee-bus-callback-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tpm/tpm_ftpm_tee: Fix kdoc after function renames
tpm/tpm_ftpm_tee: Make use of tee bus methods
tpm/tpm_ftpm_tee: Make use of tee specific driver registration
KEYS: trusted: Make use of tee bus methods
KEYS: trusted: Migrate to use tee specific driver registration function
firmware: tee_bnxt: Make use of tee bus methods
firmware: tee_bnxt: Make use of module_tee_client_driver()
firmware: arm_scmi: Make use of tee bus methods
firmware: arm_scmi: optee: Make use of module_tee_client_driver()
efi: stmm: Make use of tee bus methods
efi: stmm: Make use of module_tee_client_driver()
hwrng: optee - Make use of tee bus methods
hwrng: optee - Make use of module_tee_client_driver()
rtc: optee: Make use of tee bus methods
rtc: optee: Migrate to use tee specific driver registration function
tee: Adapt documentation to cover recent additions
tee: Add probe, remove and shutdown bus callbacks to tee_client_driver
tee: Add some helpers to reduce boilerplate for tee client drivers
Arnd Bergmann [Wed, 21 Jan 2026 15:27:26 +0000 (16:27 +0100)]
Merge tag 'optee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
OP-TEE update for 6.20
- A micro optimization by making a local array static const
- Update OP-TEE mailing list as moderated
- Update an outdated comment for cmd_alloc_suppl()
* tag 'optee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
optee: make read-only array attr static const
MAINTAINERS: Mark the OP-TEE mailing list moderated
optee: update outdated comment
Arnd Bergmann [Wed, 21 Jan 2026 15:25:01 +0000 (16:25 +0100)]
Merge tag 'renesas-drivers-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Renesas driver updates for v6.20 (take two)
- Add and use for_each_of_imap_item() iterator,
- Add support for the RZ/N1 GPIO Interrupt Multiplexer.
* tag 'renesas-drivers-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
soc: renesas: Add support for RZ/N1 GPIO Interrupt Multiplexer
irqchip/renesas-rza1: Use for_each_of_imap_item iterator
irqchip/ls-extirq: Use for_each_of_imap_item iterator
of: unittest: Add a test case for for_each_of_imap_item iterator
of/irq: Introduce for_each_of_imap_item
Arnd Bergmann [Wed, 21 Jan 2026 15:22:21 +0000 (16:22 +0100)]
Merge tag 'scmi-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm SCMI updates for v7.0
A set of cleanups, refactoring, and fixes to the Arm SCMI stack:
1. Rework protocol version negotiation by moving version discovery and
downgrade handling into the SCMI core and performing negotiation early,
before protocol initialization. Remove legacy per-protocol versioning
logic now made redundant by centralized SCMI handling.
2. Increase the internal MAX_OPPS limit in the SCMI performance protocol
to 64, allowing platforms with larger OPP tables to be fully supported.
3. Reduce duplicated boilerplate in pinctrl and related protocols by
consolidating validation and lookup logic in protocol get info helpers.
4. Refactor reset protocol domain handling by introducing a shared lookup
helper, ensuring consistent validation and error reporting.
5. Fix potential undefined behaviour by properly initializing pointers
annotated with the __free attribute.
* tag 'scmi-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_scmi: Remove legacy protocol versioning logic
firmware: arm_scmi: Rework protocol version negotiation logic
firmware: arm_scmi: Increase performance MAX_OPPS limit to 64
firmware: arm_scmi: Move boiler plate code into the get info functions
firmware: arm_scmi: Refactor reset domain handling
firmware: arm_scmi: Fix uninitialized pointers with __free attr
Arnd Bergmann [Wed, 21 Jan 2026 15:19:24 +0000 (16:19 +0100)]
Merge tag 'ffa-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm FF-A updates for v7.0
A small set of updates to the Arm FF-A driver:
1. Fix a correctness issue in NOTIFICATION_INFO_GET handling of 32-bit
firmware responses, avoiding reads from undefined register bits.
2. Improve clarity and robustness of FF-A feature checks by tying them
to explicit version requirements.
3. Ensure Rx/Tx buffers are unmapped on FF-A initialization failure to
prevent resource leaks.
* tag 'ffa-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET
firmware: arm_ffa: Tie FF-A version checks to specific features
firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
Arnd Bergmann [Wed, 21 Jan 2026 14:48:41 +0000 (15:48 +0100)]
Merge tag 'renesas-drivers-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Renesas driver updates for v6.20
- Enable Interrupt Controller (ICU) support on the RZ/N2H SoC.
* tag 'renesas-drivers-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
soc: renesas: Enable ICU support on RZ/N2H
Sven Peter [Sat, 17 Jan 2026 17:59:10 +0000 (18:59 +0100)]
soc: apple: rtkit: Add function to poweroff
Add a function to put a co-processor into the lowest possible power
state from which recovery usually isn't possible without a full SoC
reset. This is required for the USB4/Thunderbolt co-processors which
can be restarted since the entire USB4 root complex can be completely
reset independently of the rest of the SoC.
Thierry Reding [Mon, 3 Feb 2025 15:22:58 +0000 (16:22 +0100)]
soc/tegra: pmc: Add PMC contextual functions
Add implementations that take as argument a struct tegra_pmc * for most
public APIs, as well as a function to obtain the PMC for any given
device. This will allow transitioning away users from relying on a
global variable storing the PMC context.
Thierry Reding [Mon, 3 Feb 2025 13:55:03 +0000 (14:55 +0100)]
soc/tegra: pmc: Do not rely on global variable
The reset action for changing the suspend mode back on failure can take
a context-specific data argument that can be set to the PMC context in
order to avoid relying on a global variable.
Thierry Reding [Mon, 3 Feb 2025 13:38:24 +0000 (14:38 +0100)]
soc/tegra: pmc: Embed reboot notifier in PMC context
Instead of relying on a global variable to track the PMC context, embed
the reboot notifier into the PMC context so that the latter can be
resolved using container_of().
Thierry Reding [Mon, 3 Feb 2025 13:33:09 +0000 (14:33 +0100)]
soc/tegra: pmc: Store PMC context in clocks
Clocks exposed by the PMC need to reference the PMC context for register
programming. Store a reference to the context in the data structure for
each clock to avoid the need for a global variable.
Thierry Reding [Mon, 3 Feb 2025 13:27:21 +0000 (14:27 +0100)]
soc/tegra: pmc: Pass struct tegra_pmc to tegra_powergate_state()
By using the generic read_poll_timeout() instead of readx_poll_timeout()
we can pass additional parameters, which allows us to pass an additional
PMC context structure and avoid relying on a global variable for this.
The warning occurs because generic_handle_irq() is being called from
a non-interrupt context which is considered as unsafe.
Fix this warning by deferring generic_handle_irq() call to an IRQ work
which gets executed in hard IRQ context where generic_handle_irq()
can be called safely.
When PREEMPT_RT kernels are used, regular IRQ work (initialized with
init_irq_work) is deferred to run in per-CPU kthreads in preemptible
context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD
variant so that with PREEMPT_RT kernels, the IRQ work is processed in
hardirq context instead of being deferred to a thread which is required
for calling generic_handle_irq().
On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD()
execute in IRQ context, so this change has no functional impact for
standard kernel configurations.
Peng Fan [Tue, 13 Jan 2026 22:12:41 +0000 (06:12 +0800)]
soc: imx8m: Fix error handling for clk_prepare_enable()
imx8m_soc_prepare() directly returns the result of clk_prepare_enable(),
which skips proper cleanup if the clock enable fails. Check the return
value of clk_prepare_enable() and release resources if failure.
Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/ Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Peng Fan [Wed, 29 Oct 2025 12:07:01 +0000 (20:07 +0800)]
firmware: arm_scmi: imx: Support getting syslog of MISC protocol
MISC protocol supports getting system log regarding system sleep latency,
wakeup interrupt and etc. Add the API for user to retrieve the information
from SM.
soc: qcom: preserve CPU endianness for QMI_DATA_LEN
To ensure correct handling of endianness in the QMI subsystem, the
QMI_DATA_LEN field used in host-side drivers remains in CPU-native byte
order. Remove unnecessary endianness conversions, considering that
QMI_DATA_LEN is always of type `u32` on the host. On the QMI wire
interface, however, its representation is variable and may use either 1 or
2 bytes.
soc: qcom: fix QMI encoding/decoding for basic elements
Extend the QMI byte encoding and decoding logic to support multiple basic
data type sizes (u8, u16, u32, u64) using differnet macros for each type.
Ensure correct handling of data sizes and proper byte order conversion on
big-endian platforms by consistently applying these macros during encoding
and decoding of basic elements.
Extend handling of QMI basic element types to also capture error codes.
This is required for big-endian platforms where a simple memcpy is not
sufficient and exact data type knowledge is necessary.
Colin Ian King [Fri, 9 Jan 2026 15:44:42 +0000 (15:44 +0000)]
optee: make read-only array attr static const
Don't populate the read-only array attr on the stack at run
time, instead make it static const.
Signed-off-by: Colin Ian King <coking@nvidia.com> Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
soc: renesas: Add support for RZ/N1 GPIO Interrupt Multiplexer
On the Renesas RZ/N1 SoC, GPIOs can generate interruptions. Those
interruption lines are multiplexed by the GPIO Interrupt Multiplexer in
order to map 32 * 3 GPIO interrupt lines to 8 GIC interrupt lines.
The GPIO interrupt multiplexer IP does nothing but select 8 GPIO
IRQ lines out of the 96 available to wire them to the GIC input lines.
Aristo Chen [Mon, 12 Jan 2026 15:48:30 +0000 (23:48 +0800)]
tee: optee: store OS revision for TEE core
Collect OP-TEE OS revision from secure world for both SMC and FF-A
ABIs, store it in the OP-TEE driver, and expose it through the
generic get_tee_revision() callback.
Uwe Kleine-König [Tue, 13 Jan 2026 14:38:15 +0000 (15:38 +0100)]
tpm/tpm_ftpm_tee: Fix kdoc after function renames
Recently ftpm_tee_probe() and ftpm_tee_remove() grew a suffix in their
function name but I failed to adapt the kernel doc when doing so. This
change aligns the kernel doc to the actual function name (again).
Fixes: 92fad96aea24 ("tpm/tpm_ftpm_tee: Make use of tee bus methods") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601132105.9lgSsC4U-lkp@intel.com/ Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Wentao Liang [Tue, 13 Jan 2026 01:47:16 +0000 (01:47 +0000)]
soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly
calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)
on the error path. However, after the devm_add_action_or_reset()
returns, the of_node_put(clk_mux_np) is called again, causing a double
free.
Fix by returning directly, to avoid the duplicate of_node_put().
Johan Hovold [Thu, 27 Nov 2025 13:49:42 +0000 (14:49 +0100)]
soc: ti: k3-socinfo: Fix regmap leak on probe failure
The mmio regmap allocated during probe is never freed.
Switch to using the device managed allocator so that the regmap is
released on probe failures (e.g. probe deferral) and on driver unbind.
Fixes: a5caf03188e4 ("soc: ti: k3-socinfo: Do not use syscon helper to build regmap") Cc: stable@vger.kernel.org # 6.15 Cc: Andrew Davis <afd@ti.com> Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Andrew Davis <afd@ti.com> Link: https://patch.msgid.link/20251127134942.2121-1-johan@kernel.org Signed-off-by: Nishanth Menon <nm@ti.com>
Aristo Chen [Mon, 12 Jan 2026 15:48:29 +0000 (23:48 +0800)]
tee: add revision sysfs attribute
Add a generic TEE revision sysfs attribute backed by a new
optional get_tee_revision() callback. The revision string is
diagnostic-only and must not be used to infer feature support.
ARM: s3c: remove a leftover hwmon-s3c.h header file
The last user of defined structures s3c_hwmon_pdata and s3c_hwmon_chcfg
was removed in commit 0d297df03890 ("ARM: s3c: simplify platform code"),
thus the platform data header file itself can be removed also.
Bjorn Andersson [Wed, 14 Jan 2026 03:31:31 +0000 (21:31 -0600)]
Merge branch '20260105-kvmrprocv10-v10-0-022e96815380@oss.qualcomm.com' into drivers-for-6.20
Merge the support for loading and managing the TrustZone-based remote
processors found in the Glymur platform through a topic branch, as it's
a mix of qcom-soc and remoteproc patches.
Mukesh Ojha [Mon, 5 Jan 2026 13:23:01 +0000 (18:53 +0530)]
remoteproc: qcom: pas: Enable Secure PAS support with IOMMU managed by Linux
Most Qualcomm platforms feature Gunyah hypervisor, which typically
handles IOMMU configuration. This includes mapping memory regions and
device memory resources for remote processors by intercepting
qcom_scm_pas_auth_and_reset() calls. These mappings are later removed
during teardown. Additionally, SHM bridge setup is required to enable
memory protection for both remoteproc metadata and its memory regions.
When the aforementioned hypervisor is absent, the operating system must
perform these configurations instead.
When Linux runs as the hypervisor (@ EL2) on a SoC, it will have its
own device tree overlay file that specifies the firmware stream ID now
managed by Linux for a particular remote processor. If the iommus
property is specified in the remoteproc device tree node, it indicates
that IOMMU configuration must be handled by Linux. In this case, the
has_iommu flag is set for the remote processor, which ensures that the
resource table, carveouts, and SHM bridge are properly configured before
memory is passed to TrustZone for authentication. Otherwise, the
has_iommu flag remains unset, which indicates default behavior.
Enables Secure PAS support for remote processors when IOMMU configuration
is managed by Linux.
Mukesh Ojha [Mon, 5 Jan 2026 13:23:00 +0000 (18:53 +0530)]
remoteproc: pas: Extend parse_fw callback to fetch resources via SMC call
Qualcomm remote processor may rely on static and dynamic resources for
it to be functional. For most of the Qualcomm SoCs, when run with Gunyah
or older QHEE hypervisor, all the resources whether it is static or
dynamic, is managed by the hypervisor. Dynamic resources if it is
present for a remote processor will always be coming from secure world
via SMC call while static resources may be present in remote processor
firmware binary or it may be coming from SMC call along with dynamic
resources.
Remoteproc already has method like rproc_elf_load_rsc_table() to check
firmware binary has resources or not and if it is not having then we
pass NULL and zero as input resource table and its size argument
respectively to qcom_scm_pas_get_rsc_table() and while it has resource
present then it should pass the present resources to Trustzone(TZ) so that
it could authenticate the present resources and append dynamic resource
to return in output_rt argument along with authenticated resources.
Extend parse_fw callback to include SMC call to get resources from
Trustzone and to leverage resource table parsing and mapping and
unmapping code from the remoteproc framework.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:59 +0000 (18:52 +0530)]
firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table
Qualcomm remote processor may rely on Static and Dynamic resources for
it to be functional. Static resources are fixed like for example,
memory-mapped addresses required by the subsystem and dynamic
resources, such as shared memory in DDR etc., are determined at
runtime during the boot process.
For most of the Qualcomm SoCs, when run with Gunyah or older QHEE
hypervisor, all the resources whether it is static or dynamic, is
managed by the hypervisor. Dynamic resources if it is present for a
remote processor will always be coming from secure world via SMC call
while static resources may be present in remote processor firmware
binary or it may be coming qcom_scm_pas_get_rsc_table() SMC call along
with dynamic resources.
Some of the remote processor drivers, such as video, GPU, IPA, etc., do
not check whether resources are present in their remote processor
firmware binary. In such cases, the caller of this function should set
input_rt and input_rt_size as NULL and zero respectively. Remoteproc
framework has method to check whether firmware binary contain resources
or not and they should be pass resource table pointer to input_rt and
resource table size to input_rt_size and this will be forwarded to
TrustZone for authentication. TrustZone will then append the dynamic
resources and return the complete resource table in the passed output
buffer.
More about documentation on resource table format can be found in
include/linux/remoteproc.h
Mukesh Ojha [Mon, 5 Jan 2026 13:22:58 +0000 (18:52 +0530)]
firmware: qcom_scm: Add SHM bridge handling for PAS when running without QHEE
On SoCs running with a non-Gunyah-based hypervisor, Linux must take
responsibility for creating the SHM bridge both for metadata (before
calling qcom_scm_pas_init_image()) and for remoteproc memory (before
calling qcom_scm_pas_auth_and_reset()). We have taken care the things
required for qcom_scm_pas_auth_and_reset(). Lets put these awareness
of above conditions into qcom_scm_pas_init_image() and
qcom_scm_pas_metadata_release().
Refactor qcom_scm_pas_init_image() by moving the memory allocation,
copy, and free operations to a higher-level function, and isolate the
actual SMC call in a separate function. The main intention is to allow
flexibility for different allocators and to respect any constraints that
the allocator API may impose before invoking the actual SCM function.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:56 +0000 (18:52 +0530)]
firmware: qcom_scm: Add a prep version of auth_and_reset function
For memory passed to TrustZone (TZ), it must either be part of a pool
registered with TZ or explicitly registered via SHMbridge SMC calls.
When Gunyah hypervisor is present, PAS SMC calls from Linux running at
EL1 are trapped by Gunyah running @ EL2, which handles SHMbridge
creation for both metadata and remoteproc carveout memory before
invoking the calls to TZ.
On SoCs running with a non-Gunyah-based hypervisor, Linux must take
responsibility for creating the SHM bridge before invoking PAS SMC
calls. For the auth_and_reset() call, the remoteproc carveout memory
must first be registered with TZ via a SHMbridge SMC call and once
authentication and reset are complete, the SHMbridge memory can be
deregistered.
Introduce qcom_scm_pas_prepare_and_auth_reset(), which sets up the SHM
bridge over the remoteproc carveout memory when Linux operates at EL2.
This behavior is indicated by a new field added to the PAS context data
structure. The function then invokes the auth_and_reset SMC call.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:55 +0000 (18:52 +0530)]
soc: qcom: mdtloader: Remove qcom_mdt_pas_init() from exported symbols
qcom_mdt_pas_init() was previously used only by the remoteproc driver
(drivers/remoteproc/qcom_q6v5_pas.c). Since that driver has now
transitioned to using PAS context-based qcom_mdt_pas_load() function,
making qcom_mdt_pas_init() obsolete for external use.
Removes qcom_mdt_pas_init() from the list of exported symbols and make
it static to limit its scope to internal use within mdtloader.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:54 +0000 (18:52 +0530)]
soc: qcom: mdtloader: Add PAS context aware qcom_mdt_pas_load() function
Introduce a new PAS context-aware function, qcom_mdt_pas_load(), for
remote processor drivers. This function utilizes the PAS context
pointer returned from qcom_scm_pas_ctx_init() to perform firmware
metadata verification and memory setup via SMC calls.
The qcom_mdt_pas_load() and qcom_mdt_load() functions are largely
similar, but the former is designed for clients using the PAS
context-based data structure. Over time, all users of qcom_mdt_load()
can be migrated to use qcom_mdt_pas_load() for consistency and
improved abstraction.
As the remoteproc PAS driver (qcom_q6v5_pas) has already adopted the
PAS context-based approach, update it to use qcom_mdt_pas_load().
Mukesh Ojha [Mon, 5 Jan 2026 13:22:53 +0000 (18:52 +0530)]
remoteproc: pas: Replace metadata context with PAS context structure
As a superset of the existing metadata context, the PAS context
structure enables both remoteproc and non-remoteproc subsystems to
better support scenarios where the SoC runs with or without the Gunyah
hypervisor. To reflect this, relevant SCM and metadata functions are
updated to incorporate PAS context awareness and remove metadata context
data structure completely.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:52 +0000 (18:52 +0530)]
firmware: qcom_scm: Introduce PAS context allocator helper function
When the Peripheral Authentication Service (PAS) method runs on a SoC
where Linux operates at EL2 (i.e., without the Gunyah hypervisor), the
reset sequences are handled by TrustZone. In such cases, Linux must
perform additional steps before invoking PAS SMC calls, such as creating
a SHM bridge. Therefore, PAS SMC calls require awareness and handling of
these additional steps when Linux runs at EL2.
To support this, there is a need for a data structure that can be
initialized prior to invoking any SMC or MDT functions. This structure
allows those functions to determine whether they are operating in the
presence or absence of the Gunyah hypervisor and behave accordingly.
Currently, remoteproc and non-remoteproc subsystems use different
variants of the MDT loader helper API, primarily due to differences in
metadata context handling. Remoteproc subsystems retain the metadata
context until authentication and reset are completed, while
non-remoteproc subsystems (e.g., video, graphics, IPA, etc.) do not
retain the metadata context and can free it within the
qcom_scm_pas_init() call by passing a NULL context parameter and due to
these differences, it is not possible to extend metadata context
handling to support remoteproc and non remoteproc subsystem use PAS
operations, when Linux operates at EL2.
Add PAS context data structure allocator helper function.
Mukesh Ojha [Mon, 5 Jan 2026 13:22:50 +0000 (18:52 +0530)]
firmware: qcom_scm: Remove redundant piece of code
The qcom_scm_pas_metadata_release() function already frees the allocated
memory and sets ctx->ptr to NULL. Resetting ctx->phys and ctx->size to
zero is unnecessary because the context is expected to be discarded
after release.
On most Qualcomm platforms, the Qualcomm Hypervisor Execution
Environment (QHEE) is either used as a standalone hypervisor or
co-exists as a module with the Gunyah hypervisor. When QHEE is
present, it configures firmware streams for remote processors.
If QHEE is not available, the operating system must perform
these configurations instead and for that remote processor
firmware stream should be presented to the operating system.
To support this, add the iommus property as an optional property
for PAS-supported devices.
Haotian Zhang [Tue, 16 Dec 2025 01:39:32 +0000 (09:39 +0800)]
soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe
If cmd_db_magic_matches() fails after memremap() succeeds, the function
returns -EINVAL without unmapping the memory region, causing a
potential resource leak.
Switch to devm_memremap to automatically manage the map resource.
Some compute SoCs support additional operation modes, extending the
existing set of USB3/safe/DP-alt-mode.
The firmware performs all the necessary handshakes for
us and there is no room for error on that level (i.e. the sequences
will match what happens on Windows).
The trade-off with that approach is that the received notifications
trim some of the PDO/EUDO data (particularly the cable/plug parts),
offering a set of similar-in-nature-but-not-the-same indicators.
In an attempt to remedy this, I reconstructed some of it, so that the
connected mux/retimer drivers can continue to behave as expected.
Add support for parsing the aforementioned data coming from PMIC_GLINK
and passing it on to the various Type-C components.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:47 +0000 (15:16 +0100)]
tpm/tpm_ftpm_tee: Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:45 +0000 (15:16 +0100)]
KEYS: trusted: Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:44 +0000 (15:16 +0100)]
KEYS: trusted: Migrate to use tee specific driver registration function
The tee subsystem recently got a set of dedicated functions to register
(and unregister) a tee driver. Make use of them. These care for setting the
driver's bus (so the explicit assignment can be dropped) and the driver
owner (which is an improvement this driver benefits from).
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:43 +0000 (15:16 +0100)]
firmware: tee_bnxt: Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:42 +0000 (15:16 +0100)]
firmware: tee_bnxt: Make use of module_tee_client_driver()
Reduce boilerplate by using the newly introduced module_tee_client_driver().
That takes care of assigning the driver's bus, so the explicit assigning
in this driver can be dropped.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:41 +0000 (15:16 +0100)]
firmware: arm_scmi: Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods. Note that the return value of .remove()
was already ignored before, so there is no problem introduced by dropping
the error returns.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:40 +0000 (15:16 +0100)]
firmware: arm_scmi: optee: Make use of module_tee_client_driver()
Reduce boilerplate by using the newly introduced module_tee_client_driver().
That takes care of assigning the driver's bus, so the explicit assigning
in this driver can be dropped.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:39 +0000 (15:16 +0100)]
efi: stmm: Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:38 +0000 (15:16 +0100)]
efi: stmm: Make use of module_tee_client_driver()
Reduce boilerplate by using the newly introduced module_tee_client_driver().
That takes care of assigning the driver's bus, so the explicit assigning
in this driver can be dropped.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:35 +0000 (15:16 +0100)]
hwrng: optee - Make use of tee bus methods
The tee bus got dedicated callbacks for probe and remove.
Make use of these. This fixes a runtime warning about the driver needing
to be converted to the bus methods.
Uwe Kleine-König [Mon, 15 Dec 2025 14:16:34 +0000 (15:16 +0100)]
hwrng: optee - Make use of module_tee_client_driver()
Reduce boilerplate by using the newly introduced module_tee_client_driver().
That takes care of assigning the driver's bus, so the explicit assigning
in this driver can be dropped.
Printing messages on ENOMEM errors is redundant and discouraged, because
core already prints detailed report. Simplify the code by dropping
such dev_err().
Printing messages on ENOMEM errors is redundant and discouraged, because
core already prints detailed report. Simplify the code by dropping
such dev_err().
Julia Lawall [Sun, 4 Jan 2026 17:01:19 +0000 (18:01 +0100)]
optee: update outdated comment
The function cmd_alloc_suppl() was renamed as
optee_rpc_cmd_alloc_suppl() in commit c51a564a5b48
("optee: isolate smc abi"). Update the comment
accordingly.
Initializing automatic __free variables to NULL without need (e.g.
branches with different allocations), followed by actual allocation is
in contrary to explicit coding rules guiding cleanup.h:
"Given that the "__free(...) = NULL" pattern for variables defined at
the top of the function poses this potential interdependency problem the
recommendation is to always define and assign variables in one statement
and not group variable definitions at the top of the function when
__free() is used."
Code does not have a bug, but is less readable and uses discouraged
coding practice, so fix that by moving declaration to the place of
assignment.
Initializing automatic __free variables to NULL without need (e.g.
branches with different allocations), followed by actual allocation is
in contrary to explicit coding rules guiding cleanup.h:
"Given that the "__free(...) = NULL" pattern for variables defined at
the top of the function poses this potential interdependency problem the
recommendation is to always define and assign variables in one statement
and not group variable definitions at the top of the function when
__free() is used."
Code does not have a bug, but is less readable and uses discouraged
coding practice, so fix that by moving declaration to the place of
assignment.
Initializing automatic __free variables to NULL without need (e.g.
branches with different allocations), followed by actual allocation is
in contrary to explicit coding rules guiding cleanup.h:
"Given that the "__free(...) = NULL" pattern for variables defined at
the top of the function poses this potential interdependency problem the
recommendation is to always define and assign variables in one statement
and not group variable definitions at the top of the function when
__free() is used."
Code does not have a bug, but is less readable and uses discouraged
coding practice, so fix that by moving declaration to the place of
assignment.
Haotian Zhang [Wed, 17 Dec 2025 04:13:38 +0000 (12:13 +0800)]
clk: qcom: Return correct error code in qcom_cc_probe_by_index()
When devm_platform_ioremap_resource() fails, it returns various
error codes. Returning a hardcoded -ENOMEM masks the actual
failure reason.
Use PTR_ERR() to propagate the actual error code returned by
devm_platform_ioremap_resource() instead of -ENOMEM.
Fixes: 75e0a1e30191 ("clk: qcom: define probe by index API as common API") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251217041338.2432-1-vulab@iscas.ac.cn Signed-off-by: Bjorn Andersson <andersson@kernel.org>
firmware: qcom_scm: Use TASK_IDLE state in wait_for_wq_completion()
When the kernel issues an SMC (Secure Monitor Call) and the firmware
requests the kernel to wait, the waiting thread enters an
uninterruptible (D) state. In case of an extended wait request by the
firmware, any device suspend request, cannot proceed because of the
thread stuck in D state. This blocks the device suspend.
Replace wait_for_completion() with wait_for_completion_state(...,
TASK_IDLE), so that the waiting thread, show up in TASK_IDLE state,
instead of TASK_UNINTERRUPTIBLE (D state). This allows the thread to
block until completion, without blocking the device suspend.
firmware: qcom_scm: Support multiple waitq contexts
Currently, only a single waitqueue context exists in the driver.
Multi-waitqueue mechanism is added in firmware to support the case,
when multiple VMs make SMC calls or single VM making multiple calls on
same CPU. Enhance the driver to support multiple waitqueue when
support is present in the firmware.
When VMs make a SMC call, firmware allocates a waitqueue context,
assuming the SMC call to be a blocking call. The SMC calls that cannot
acquire resources, while execution in firmware, are returned to sleep
in the calling VM. When the resource becomes available in the
firmware, the VM gets notified to wake the sleeping thread and resume
SMC call. The current qcom_scm driver supports single waitqueue as the
old firmwares support only single waitqueue with waitqueue id zero.
Multi-waitqueue mechanism is added in firmware starting SM8650 to
support the case when multiple VMs make SMC calls or single VM making
multiple calls on same CPU. To enable this support in qcom_scm driver,
add support for handling multiple waitqueues. For instance, SM8650
firmware can allocate two such waitq contexts, so the driver needs to
implement two waitqueue contexts. For a generalized approach, the
number of supported waitqueues can be queried from the firmware using
a SMC call.
Introduce qcom_scm_query_waitq_count to get the number of waitqueue
contexts supported by the firmware and allocate “N” unique waitqueue
contexts with a dynamic sized array where each unique wq_ctx is
associated with a struct completion variable for easy lookup. Older
targets which support only a single waitqueue, may return an error for
qcom_scm_query_waitq_count, set the wq_cnt to one for such failures.
firmware: qcom_scm: Add API to get waitqueue IRQ info
Bootloader and firmware for SM8650 and older chipsets expect node
name as "qcom_scm", in order to patch the wait queue IRQ information.
However, DeviceTree uses node name "scm" and this mismatch prevents
firmware from correctly identifying waitqueue IRQ information. Waitqueue
IRQ is used for signaling between secure and non-secure worlds.
To resolve this, introduce qcom_scm_get_waitq_irq() that'll get the
hardware IRQ number to be used from firmware instead of relying on data
provided by devicetree, thereby bypassing the DeviceTree node name
mismatch.
This hardware IRQ number is converted to a Linux IRQ number using newly
qcom_scm_fill_irq_fwspec_params(). This Linux IRQ number is then
supplied to the threaded_irq call.
projects / thirdparty / kernel / linux.git / log
