* [PATCH v13 1/6] firmware: qcom_scm: ipq5332: add support to pass metadata size
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL Varadarajan Narayanan
` (4 subsequent siblings)
5 siblings, 0 replies; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Konrad Dybcio, Gokul Sriram Palanisamy, Dmitry Baryshkov,
Vignesh Viswanathan, Varadarajan Narayanan
From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
IPQ5332 security software running under trustzone requires metadata size.
With new command support added in TrustZone that includes a size parameter,
pass metadata size as well.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
drivers/firmware/qcom/qcom_scm.c | 14 +++++++++++---
drivers/firmware/qcom/qcom_scm.h | 1 +
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 7933e55803dc..4a51d2a2b519 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -575,7 +575,7 @@ EXPORT_SYMBOL_GPL(devm_qcom_scm_pas_context_alloc);
static int __qcom_scm_pas_init_image(struct device *dev, u32 pas_id,
dma_addr_t mdata_phys,
- struct qcom_scm_res *res)
+ struct qcom_scm_res *res, size_t size)
{
struct qcom_scm_desc desc = {
.svc = QCOM_SCM_SVC_PIL,
@@ -596,6 +596,14 @@ static int __qcom_scm_pas_init_image(struct device *dev, u32 pas_id,
desc.args[1] = mdata_phys;
+ if (__qcom_scm_is_call_available(__scm->dev, QCOM_SCM_SVC_PIL,
+ QCOM_SCM_PIL_PAS_INIT_IMAGE_V2)) {
+ desc.cmd = QCOM_SCM_PIL_PAS_INIT_IMAGE_V2;
+ desc.arginfo = QCOM_SCM_ARGS(3, QCOM_SCM_VAL, QCOM_SCM_RW,
+ QCOM_SCM_VAL);
+ desc.args[2] = size;
+ }
+
ret = qcom_scm_call(dev, &desc, res);
qcom_scm_bw_disable();
@@ -621,7 +629,7 @@ static int qcom_scm_pas_prep_and_init_image(struct device *dev,
memcpy(mdata_buf, metadata, size);
mdata_phys = qcom_tzmem_to_phys(mdata_buf);
- ret = __qcom_scm_pas_init_image(dev, ctx->pas_id, mdata_phys, &res);
+ ret = __qcom_scm_pas_init_image(dev, ctx->pas_id, mdata_phys, &res, size);
if (ret < 0)
qcom_tzmem_free(mdata_buf);
else
@@ -660,7 +668,7 @@ static int __qcom_scm_pas_init_image2(struct device *dev, u32 pas_id,
memcpy(mdata_buf, metadata, size);
- ret = __qcom_scm_pas_init_image(dev, pas_id, mdata_phys, &res);
+ ret = __qcom_scm_pas_init_image(dev, pas_id, mdata_phys, &res, size);
if (ret < 0 || !ctx) {
dma_free_coherent(dev, size, mdata_buf, mdata_phys);
} else if (ctx) {
diff --git a/drivers/firmware/qcom/qcom_scm.h b/drivers/firmware/qcom/qcom_scm.h
index caab80a73e17..cb80e22a3d90 100644
--- a/drivers/firmware/qcom/qcom_scm.h
+++ b/drivers/firmware/qcom/qcom_scm.h
@@ -105,6 +105,7 @@ int qcom_scm_shm_bridge_enable(struct device *scm_dev);
#define QCOM_SCM_PIL_PAS_SHUTDOWN 0x06
#define QCOM_SCM_PIL_PAS_IS_SUPPORTED 0x07
#define QCOM_SCM_PIL_PAS_MSS_RESET 0x0a
+#define QCOM_SCM_PIL_PAS_INIT_IMAGE_V2 0x1a
#define QCOM_SCM_PIL_PAS_GET_RSCTABLE 0x21
#define QCOM_SCM_SVC_IO 0x05
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 1/6] firmware: qcom_scm: ipq5332: add support to pass metadata size Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
2026-07-13 7:35 ` Rob Herring (Arm)
` (2 more replies)
2026-07-13 6:32 ` [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver Varadarajan Narayanan
` (3 subsequent siblings)
5 siblings, 3 replies; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Gokul Sriram Palanisamy, George Moussalem, Krzysztof Kozlowski,
Vignesh Viswanathan, Varadarajan Narayanan
From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Add new binding document for hexagon based WCSS secure PIL remoteproc.
IPQ5018, IPQ5332 and IPQ9574 follow secure PIL remoteproc.
Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
[ Dropped ipq5424 support ]
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
.../remoteproc/qcom,ipq5018-wcss-sec-pil.yaml | 178 +++++++++++++++++++++
1 file changed, 178 insertions(+)
diff --git a/Documentation/devicetree/bindings/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml b/Documentation/devicetree/bindings/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml
new file mode 100644
index 000000000000..a6fc3a9db621
--- /dev/null
+++ b/Documentation/devicetree/bindings/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml
@@ -0,0 +1,178 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm WCSS Secure Peripheral Image Loader
+
+maintainers:
+ - Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
+
+description:
+ Wireless Connectivity Subsystem (WCSS) Secure Peripheral Image Loader loads
+ firmware and power up QDSP6 remoteproc on the Qualcomm IPQ series SoC.
+
+properties:
+ compatible:
+ enum:
+ - qcom,ipq5018-wcss-sec-pil
+ - qcom,ipq5332-wcss-sec-pil
+ - qcom,ipq9574-wcss-sec-pil
+
+ reg:
+ maxItems: 1
+
+ firmware-name:
+ maxItems: 1
+ description: Firmware name for the Hexagon core
+
+ interrupts:
+ items:
+ - description: Watchdog interrupt
+ - description: Fatal interrupt
+ - description: Ready interrupt
+ - description: Handover interrupt
+ - description: Stop acknowledge interrupt
+
+ interrupt-names:
+ items:
+ - const: wdog
+ - const: fatal
+ - const: ready
+ - const: handover
+ - const: stop-ack
+
+ clocks:
+ minItems: 1
+ items:
+ - description: sleep clock
+ - description: AHB interconnect clock
+
+ clock-names:
+ minItems: 1
+ items:
+ - const: sleep
+ - const: interconnect
+
+ mboxes:
+ items:
+ - description: TMECom mailbox driver
+
+ qcom,smem-states:
+ $ref: /schemas/types.yaml#/definitions/phandle-array
+ description: States used by the AP to signal the remote processor
+ items:
+ - description: Stop Q6
+ - description: Shutdown Q6
+
+ qcom,smem-state-names:
+ description:
+ Names of the states used by the AP to signal the remote processor
+ items:
+ - const: stop
+ - const: shutdown
+
+ memory-region:
+ items:
+ - description: Q6 reserved region
+
+ glink-edge:
+ $ref: /schemas/remoteproc/qcom,glink-edge.yaml#
+ description:
+ Qualcomm G-Link subnode which represents communication edge, channels
+ and devices related to the Modem.
+ unevaluatedProperties: false
+
+required:
+ - compatible
+ - reg
+ - firmware-name
+ - interrupts
+ - interrupt-names
+ - qcom,smem-states
+ - qcom,smem-state-names
+ - memory-region
+
+allOf:
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: qcom,ipq5018-wcss-sec-pil
+ then:
+ properties:
+ clocks:
+ items:
+ - description: sleep clock
+ - description: AHB interconnect clock
+ clock-names:
+ items:
+ - const: sleep
+ - const: interconnect
+ required:
+ - clocks
+ - clock-names
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: qcom,ipq5332-wcss-sec-pil
+ then:
+ properties:
+ clocks:
+ items:
+ - description: sleep clock
+ clock-names:
+ items:
+ - const: sleep
+ required:
+ - clocks
+ - clock-names
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - qcom,ipq9574-wcss-sec-pil
+ then:
+ properties:
+ clocks: false
+ clock-names: false
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+
+ q6v5_wcss: remoteproc@cd00000 {
+ compatible = "qcom,ipq9574-wcss-sec-pil";
+ reg = <0x0cd00000 0x10000>;
+ firmware-name = "ath11k/IPQ9574/hw1.0/q6_fw.mbn";
+ interrupts-extended = <&intc GIC_SPI 325 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_wcss_in 0 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 1 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 2 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 3 IRQ_TYPE_NONE>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ qcom,smem-states = <&smp2p_wcss_out 1>,
+ <&smp2p_wcss_out 0>;
+ qcom,smem-state-names = "stop",
+ "shutdown";
+ memory-region = <&q6_region>;
+
+ glink-edge {
+ interrupts = <GIC_SPI 321 IRQ_TYPE_EDGE_RISING>;
+ label = "rtr";
+ qcom,remote-pid = <1>;
+ mboxes = <&apcs_glb 8>;
+ };
+ };
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL
2026-07-13 6:32 ` [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL Varadarajan Narayanan
@ 2026-07-13 7:35 ` Rob Herring (Arm)
2026-07-13 7:56 ` Krzysztof Kozlowski
2026-07-13 8:00 ` Krzysztof Kozlowski
2 siblings, 0 replies; 11+ messages in thread
From: Rob Herring (Arm) @ 2026-07-13 7:35 UTC (permalink / raw)
To: Varadarajan Narayanan
Cc: Krzysztof Kozlowski, Vignesh Viswanathan, Manikanta Mylavarapu,
Krzysztof Kozlowski, Conor Dooley, Konrad Dybcio, devicetree,
Bjorn Andersson, Mathieu Poirier, linux-arm-msm, George Moussalem,
linux-kernel, linux-remoteproc, Gokul Sriram Palanisamy
On Mon, 13 Jul 2026 12:02:18 +0530, Varadarajan Narayanan wrote:
> From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
>
> Add new binding document for hexagon based WCSS secure PIL remoteproc.
> IPQ5018, IPQ5332 and IPQ9574 follow secure PIL remoteproc.
>
> Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
> Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
> Signed-off-by: George Moussalem <george.moussalem@outlook.com>
> [ Dropped ipq5424 support ]
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
> Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
> ---
> .../remoteproc/qcom,ipq5018-wcss-sec-pil.yaml | 178 +++++++++++++++++++++
> 1 file changed, 178 insertions(+)
>
My bot found errors running 'make dt_binding_check' on your patch:
yamllint warnings/errors:
dtschema/dtc warnings/errors:
/builds/robherring/dt-review-ci/linux/Documentation/devicetree/bindings/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml: properties:qcom,smem-states:items:0: 'anyOf' conditional failed, one must be fixed:
'items' is a required property
'minItems' is a required property
'maxItems' is a required property
from schema $id: http://devicetree.org/meta-schemas/items.yaml
/builds/robherring/dt-review-ci/linux/Documentation/devicetree/bindings/remoteproc/qcom,ipq5018-wcss-sec-pil.yaml: properties:qcom,smem-states:items:1: 'anyOf' conditional failed, one must be fixed:
'items' is a required property
'minItems' is a required property
'maxItems' is a required property
from schema $id: http://devicetree.org/meta-schemas/items.yaml
doc reference errors (make refcheckdocs):
See https://patchwork.kernel.org/project/devicetree/patch/20260713-rproc-v13-2-41011cbcda3e@oss.qualcomm.com
The base for the series is generally the latest rc1. A different dependency
should be noted in *this* patch.
If you already ran 'make dt_binding_check' and didn't see the above
error(s), then make sure 'yamllint' is installed and dt-schema is up to
date:
pip3 install dtschema --upgrade
Please check and re-submit after running the above command yourself. Note
that DT_SCHEMA_FILES can be set to your schema file to speed up checking
your schema. However, it must be unset to test all examples with your schema.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL
2026-07-13 6:32 ` [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL Varadarajan Narayanan
2026-07-13 7:35 ` Rob Herring (Arm)
@ 2026-07-13 7:56 ` Krzysztof Kozlowski
2026-07-13 8:00 ` Krzysztof Kozlowski
2 siblings, 0 replies; 11+ messages in thread
From: Krzysztof Kozlowski @ 2026-07-13 7:56 UTC (permalink / raw)
To: Varadarajan Narayanan, Bjorn Andersson, Konrad Dybcio,
Mathieu Poirier, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Gokul Sriram Palanisamy, George Moussalem, Vignesh Viswanathan
On 13/07/2026 08:32, Varadarajan Narayanan wrote:
> From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
>
> Add new binding document for hexagon based WCSS secure PIL remoteproc.
> IPQ5018, IPQ5332 and IPQ9574 follow secure PIL remoteproc.
>
> Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
> Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
> Signed-off-by: George Moussalem <george.moussalem@outlook.com>
> [ Dropped ipq5424 support ]
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
How did this appear here at v13? That's a v13 so all your tags are
expected to be given in public.
There is no such tag:
https://lore.kernel.org/linux-arm-msm/4a4e0e9c-8541-4fcc-8019-10a576840109@oss.qualcomm.com/
Not mentioning that YOU CANNOT test bindings in a meaning of tested-by.
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL
2026-07-13 6:32 ` [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL Varadarajan Narayanan
2026-07-13 7:35 ` Rob Herring (Arm)
2026-07-13 7:56 ` Krzysztof Kozlowski
@ 2026-07-13 8:00 ` Krzysztof Kozlowski
2 siblings, 0 replies; 11+ messages in thread
From: Krzysztof Kozlowski @ 2026-07-13 8:00 UTC (permalink / raw)
To: Varadarajan Narayanan, Bjorn Andersson, Konrad Dybcio,
Mathieu Poirier, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Gokul Sriram Palanisamy, George Moussalem, Krzysztof Kozlowski,
Vignesh Viswanathan
On 13/07/2026 08:32, Varadarajan Narayanan wrote:
> +
> + mboxes:
> + items:
> + - description: TMECom mailbox driver
Drop "driver", this is not a phandle to a driver.
> +
> + qcom,smem-states:
> + $ref: /schemas/types.yaml#/definitions/phandle-array
> + description: States used by the AP to signal the remote processor
> + items:
> + - description: Stop Q6
> + - description: Shutdown Q6
Code already changed, you need to adapt this.
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 1/6] firmware: qcom_scm: ipq5332: add support to pass metadata size Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 2/6] dt-bindings: remoteproc: qcom: document hexagon based WCSS secure PIL Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
2026-07-13 6:51 ` sashiko-bot
2026-07-13 6:32 ` [PATCH v13 4/6] arm64: dts: qcom: ipq5018: add nodes to bring up q6 Varadarajan Narayanan
` (2 subsequent siblings)
5 siblings, 1 reply; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Vignesh Viswanathan, Gokul Sriram Palanisamy, George Moussalem,
Dmitry Baryshkov, Varadarajan Narayanan
From: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Add support to bring up hexagon based WCSS using secure PIL. All IPQxxxx
SoCs support secure Peripheral Image Loading (PIL).
Secure PIL image is signed firmware image which only trusted software such
as TrustZone (TZ) can authenticate and load. Linux kernel will send a
Peripheral Authentication Service (PAS) request to TZ to authenticate and
load the PIL images.
In order to avoid overloading the existing WCSS driver or PAS driver, we
came up with this new PAS based IPQ WCSS driver.
Signed-off-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
[ Dropped ipq5424 support ]
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
drivers/remoteproc/Kconfig | 19 ++
drivers/remoteproc/Makefile | 1 +
drivers/remoteproc/qcom_q6v5_wcss_sec.c | 325 ++++++++++++++++++++++++++++++++
include/linux/remoteproc.h | 2 +
4 files changed, 347 insertions(+)
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index 65befdbfa5f7..38aa10c5ee2a 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -258,6 +258,25 @@ config QCOM_Q6V5_WCSS
Hexagon V5 based WCSS remote processors on e.g. IPQ8074. This is
a non-TrustZone wireless subsystem.
+config QCOM_Q6V5_WCSS_SEC
+ tristate "Qualcomm Hexagon based WCSS Secure Peripheral Image Loader"
+ depends on OF && ARCH_QCOM
+ depends on QCOM_SMEM
+ depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
+ depends on RPMSG_QCOM_GLINK || RPMSG_QCOM_GLINK=n
+ select QCOM_MDT_LOADER
+ select QCOM_PIL_INFO
+ select QCOM_Q6V5_COMMON
+ select QCOM_RPROC_COMMON
+ select QCOM_SCM
+ help
+ Say y here to support the Qualcomm Secure Peripheral Image Loader
+ for the Hexagon based remote processors on e.g. IPQ5332.
+
+ This is TrustZone wireless subsystem. The firmware is
+ verified and booted with the help of the Peripheral Authentication
+ System (PAS) in TrustZone.
+
config QCOM_SYSMON
tristate "Qualcomm sysmon driver"
depends on RPMSG
diff --git a/drivers/remoteproc/Makefile b/drivers/remoteproc/Makefile
index 1c7598b8475d..08705ef62bce 100644
--- a/drivers/remoteproc/Makefile
+++ b/drivers/remoteproc/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_QCOM_Q6V5_ADSP) += qcom_q6v5_adsp.o
obj-$(CONFIG_QCOM_Q6V5_MSS) += qcom_q6v5_mss.o
obj-$(CONFIG_QCOM_Q6V5_PAS) += qcom_q6v5_pas.o
obj-$(CONFIG_QCOM_Q6V5_WCSS) += qcom_q6v5_wcss.o
+obj-$(CONFIG_QCOM_Q6V5_WCSS_SEC) += qcom_q6v5_wcss_sec.o
obj-$(CONFIG_QCOM_SYSMON) += qcom_sysmon.o
obj-$(CONFIG_QCOM_WCNSS_PIL) += qcom_wcnss_pil.o
qcom_wcnss_pil-y += qcom_wcnss.o
diff --git a/drivers/remoteproc/qcom_q6v5_wcss_sec.c b/drivers/remoteproc/qcom_q6v5_wcss_sec.c
new file mode 100644
index 000000000000..10a69fcd20f0
--- /dev/null
+++ b/drivers/remoteproc/qcom_q6v5_wcss_sec.c
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ */
+#include <linux/clk.h>
+#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/io.h>
+#include <linux/mailbox_client.h>
+#include <linux/of_reserved_mem.h>
+#include <linux/platform_device.h>
+#include <linux/soc/qcom/mdt_loader.h>
+
+#include "qcom_common.h"
+#include "qcom_q6v5.h"
+#include "qcom_pil_info.h"
+
+#define WCSS_CRASH_REASON 421
+
+#define WCSS_PAS_ID 0x6
+#define MPD_WCSS_PAS_ID 0xd
+
+#define Q6_WAIT_TIMEOUT (5 * HZ)
+
+struct wcss_sec {
+ struct device *dev;
+ struct qcom_rproc_glink glink_subdev;
+ struct qcom_rproc_ssr ssr_subdev;
+ struct qcom_q6v5 q6;
+ phys_addr_t mem_phys;
+ phys_addr_t mem_reloc;
+ void *mem_region;
+ size_t mem_size;
+ const struct wcss_data *desc;
+};
+
+struct wcss_data {
+ u32 pasid;
+ const char *ss_name;
+ bool auto_boot;
+};
+
+static int wcss_sec_start(struct rproc *rproc)
+{
+ struct wcss_sec *wcss = rproc->priv;
+ struct device *dev = wcss->dev;
+ int ret;
+
+ ret = qcom_q6v5_prepare(&wcss->q6);
+ if (ret)
+ return ret;
+
+ ret = qcom_scm_pas_auth_and_reset(wcss->desc->pasid);
+ if (ret) {
+ dev_err(dev, "wcss_reset failed\n");
+ goto unprepare;
+ }
+
+ ret = qcom_q6v5_wait_for_start(&wcss->q6, Q6_WAIT_TIMEOUT);
+ if (ret == -ETIMEDOUT)
+ dev_err(dev, "start timed out\n");
+
+unprepare:
+ qcom_q6v5_unprepare(&wcss->q6);
+
+ return ret;
+}
+
+static int wcss_sec_stop(struct rproc *rproc)
+{
+ struct wcss_sec *wcss = rproc->priv;
+ struct device *dev = wcss->dev;
+ int ret;
+
+ ret = qcom_scm_pas_shutdown(wcss->desc->pasid);
+ if (ret) {
+ dev_err(dev, "not able to shutdown\n");
+ return ret;
+ }
+
+ qcom_q6v5_unprepare(&wcss->q6);
+
+ return 0;
+}
+
+static void *wcss_sec_da_to_va(struct rproc *rproc, u64 da, size_t len,
+ bool *is_iomem)
+{
+ struct wcss_sec *wcss = rproc->priv;
+ int offset;
+
+ offset = da - wcss->mem_reloc;
+ if (offset < 0 || offset + len > wcss->mem_size)
+ return NULL;
+
+ return wcss->mem_region + offset;
+}
+
+static int wcss_sec_load(struct rproc *rproc, const struct firmware *fw)
+{
+ struct wcss_sec *wcss = rproc->priv;
+ struct device *dev = wcss->dev;
+ int ret;
+
+ ret = qcom_mdt_load(dev, fw, rproc->firmware, wcss->desc->pasid, wcss->mem_region,
+ wcss->mem_phys, wcss->mem_size, &wcss->mem_reloc);
+ if (ret)
+ return ret;
+
+ qcom_pil_info_store("wcss", wcss->mem_phys, wcss->mem_size);
+
+ return 0;
+}
+
+static unsigned long wcss_sec_panic(struct rproc *rproc)
+{
+ struct wcss_sec *wcss = rproc->priv;
+
+ return qcom_q6v5_panic(&wcss->q6);
+}
+
+static void wcss_sec_copy_segment(struct rproc *rproc,
+ struct rproc_dump_segment *segment,
+ void *dest, size_t offset, size_t size)
+{
+ struct wcss_sec *wcss = rproc->priv;
+ struct device *dev = wcss->dev;
+
+ if (!segment->io_ptr)
+ segment->io_ptr = ioremap_wc(segment->da, segment->size);
+
+ if (!segment->io_ptr) {
+ dev_err(dev, "Failed to ioremap segment %pad size 0x%zx\n",
+ &segment->da, segment->size);
+ return;
+ }
+
+ if (offset + size < segment->size) {
+ memcpy(dest, segment->io_ptr + offset, size);
+ } else {
+ iounmap(segment->io_ptr);
+ segment->io_ptr = NULL;
+ }
+}
+
+static int wcss_sec_dump_segments(struct rproc *rproc,
+ const struct firmware *fw)
+{
+ struct device *dev = rproc->dev.parent;
+ struct reserved_mem *rmem = NULL;
+ struct device_node *node;
+ int num_segs, index;
+ int ret;
+
+ /*
+ * Parse through additional reserved memory regions for the rproc
+ * and add them to the coredump segments
+ */
+ num_segs = of_count_phandle_with_args(dev->of_node,
+ "memory-region", NULL);
+ for (index = 0; index < num_segs; index++) {
+ node = of_parse_phandle(dev->of_node,
+ "memory-region", index);
+ if (!node)
+ return -EINVAL;
+
+ rmem = of_reserved_mem_lookup(node);
+ of_node_put(node);
+ if (!rmem) {
+ dev_err(dev, "unable to acquire memory-region index %d num_segs %d\n",
+ index, num_segs);
+ return -EINVAL;
+ }
+
+ dev_dbg(dev, "Adding segment 0x%pa size 0x%pa",
+ &rmem->base, &rmem->size);
+ ret = rproc_coredump_add_custom_segment(rproc,
+ rmem->base,
+ rmem->size,
+ wcss_sec_copy_segment,
+ NULL);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+static const struct rproc_ops wcss_sec_ops = {
+ .start = wcss_sec_start,
+ .stop = wcss_sec_stop,
+ .da_to_va = wcss_sec_da_to_va,
+ .load = wcss_sec_load,
+ .get_boot_addr = rproc_elf_get_boot_addr,
+ .panic = wcss_sec_panic,
+ .parse_fw = wcss_sec_dump_segments,
+};
+
+static int wcss_sec_alloc_memory_region(struct wcss_sec *wcss)
+{
+ struct device *dev = wcss->dev;
+ struct resource res;
+ int ret;
+
+ ret = of_reserved_mem_region_to_resource(dev->of_node, 0, &res);
+ if (ret) {
+ dev_err(dev, "unable to acquire memory-region resource\n");
+ return ret;
+ }
+
+ wcss->mem_phys = res.start;
+ wcss->mem_reloc = res.start;
+ wcss->mem_size = resource_size(&res);
+ wcss->mem_region = devm_ioremap_resource_wc(dev, &res);
+ if (!wcss->mem_region) {
+ dev_err(dev, "unable to map memory region: %pR\n", &res);
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+static int wcss_sec_probe(struct platform_device *pdev)
+{
+ const struct wcss_data *desc = of_device_get_match_data(&pdev->dev);
+ const char *fw_name = NULL;
+ struct wcss_sec *wcss;
+ struct clk *sleep_clk;
+ struct clk *int_clk;
+ struct rproc *rproc;
+ int ret;
+
+ ret = of_property_read_string(pdev->dev.of_node, "firmware-name",
+ &fw_name);
+ if (ret < 0)
+ return ret;
+
+ rproc = devm_rproc_alloc(&pdev->dev, desc->ss_name, &wcss_sec_ops,
+ fw_name, sizeof(*wcss));
+ if (!rproc) {
+ dev_err(&pdev->dev, "failed to allocate rproc\n");
+ return -ENOMEM;
+ }
+
+ wcss = rproc->priv;
+ wcss->dev = &pdev->dev;
+ wcss->desc = desc;
+
+ ret = wcss_sec_alloc_memory_region(wcss);
+ if (ret)
+ return ret;
+
+ sleep_clk = devm_clk_get_optional_enabled(&pdev->dev, "sleep");
+ if (IS_ERR(sleep_clk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(sleep_clk),
+ "Failed to get sleep clock\n");
+
+ int_clk = devm_clk_get_optional_enabled(&pdev->dev, "interconnect");
+ if (IS_ERR(int_clk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(int_clk),
+ "Failed to get interconnect clock\n");
+
+ ret = qcom_q6v5_init(&wcss->q6, pdev, rproc,
+ WCSS_CRASH_REASON, NULL, NULL);
+ if (ret)
+ return ret;
+
+ qcom_add_glink_subdev(rproc, &wcss->glink_subdev, desc->ss_name);
+ qcom_add_ssr_subdev(rproc, &wcss->ssr_subdev, desc->ss_name);
+
+ rproc->auto_boot = false;
+ rproc->dump_conf = RPROC_COREDUMP_INLINE;
+ rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE);
+
+ ret = devm_rproc_add(&pdev->dev, rproc);
+ if (ret) {
+ qcom_remove_glink_subdev(rproc, &wcss->glink_subdev);
+ qcom_remove_ssr_subdev(rproc, &wcss->ssr_subdev);
+ return ret;
+ }
+
+ platform_set_drvdata(pdev, rproc);
+
+ return 0;
+}
+
+static void wcss_sec_remove(struct platform_device *pdev)
+{
+ struct rproc *rproc = platform_get_drvdata(pdev);
+ struct wcss_sec *wcss = rproc->priv;
+
+ qcom_remove_glink_subdev(rproc, &wcss->glink_subdev);
+ qcom_remove_ssr_subdev(rproc, &wcss->ssr_subdev);
+ qcom_q6v5_deinit(&wcss->q6);
+}
+
+static const struct wcss_data wcss_sec_ipq5332_res_init = {
+ .pasid = MPD_WCSS_PAS_ID,
+ .ss_name = "q6wcss",
+};
+
+static const struct wcss_data wcss_sec_ipq9574_res_init = {
+ .pasid = WCSS_PAS_ID,
+ .ss_name = "q6wcss",
+};
+
+static const struct of_device_id wcss_sec_of_match[] = {
+ { .compatible = "qcom,ipq5018-wcss-sec-pil", .data = &wcss_sec_ipq5332_res_init },
+ { .compatible = "qcom,ipq5332-wcss-sec-pil", .data = &wcss_sec_ipq5332_res_init },
+ { .compatible = "qcom,ipq9574-wcss-sec-pil", .data = &wcss_sec_ipq9574_res_init },
+ { },
+};
+MODULE_DEVICE_TABLE(of, wcss_sec_of_match);
+
+static struct platform_driver wcss_sec_driver = {
+ .probe = wcss_sec_probe,
+ .remove = wcss_sec_remove,
+ .driver = {
+ .name = "qcom-wcss-secure-pil",
+ .of_match_table = wcss_sec_of_match,
+ },
+};
+module_platform_driver(wcss_sec_driver);
+
+MODULE_DESCRIPTION("Hexagon WCSS Secure Peripheral Image Loader");
+MODULE_LICENSE("GPL");
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
index 7c1546d48008..d9bfe2023d15 100644
--- a/include/linux/remoteproc.h
+++ b/include/linux/remoteproc.h
@@ -205,6 +205,7 @@ enum rproc_dump_mechanism {
* @node: list node related to the rproc segment list
* @da: device address of the segment
* @size: size of the segment
+ * @io_ptr: ptr to store the ioremapped dump segment
* @priv: private data associated with the dump_segment
* @dump: custom dump function to fill device memory segment associated
* with coredump
@@ -216,6 +217,7 @@ struct rproc_dump_segment {
dma_addr_t da;
size_t size;
+ void *io_ptr;
void *priv;
void (*dump)(struct rproc *rproc, struct rproc_dump_segment *segment,
void *dest, size_t offset, size_t size);
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver
2026-07-13 6:32 ` [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver Varadarajan Narayanan
@ 2026-07-13 6:51 ` sashiko-bot
0 siblings, 0 replies; 11+ messages in thread
From: sashiko-bot @ 2026-07-13 6:51 UTC (permalink / raw)
To: Varadarajan Narayanan; +Cc: conor+dt, robh, devicetree
Thank you for your contribution! Sashiko AI review found 7 potential issue(s) to consider:
- [High] The coredump segment copy logic unmaps the I/O region without copying the final chunk of data, and leaks the mapping on partial reads.
- [High] Incorrect teardown sequence using `devm_rproc_add()` causes Use-After-Free and missed subdevice cleanup during removal.
- [High] Incorrect error checking for `devm_ioremap_resource_wc()` leads to unhandled error pointers and kernel panic.
- [High] `wcss_sec_start()` unconditionally falls through to the error cleanup path on success, unpreparing the successfully started processor.
- [Medium] Missing `qcom_q6v5_deinit()` call in the probe error path leaks the QMP device handle.
- [Medium] Failure to set `is_iomem` flag in `wcss_sec_da_to_va` implementation causes improper I/O access.
- [Low] Integer truncation in `wcss_sec_da_to_va()` allows bounds check bypass for out-of-bounds device addresses.
--
--- Patch [3]: [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver ---
commit bd0a3df0198fbc98aeb1c2a316d62a018ed12f78
Author: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Subject: remoteproc: qcom: add hexagon based WCSS secure PIL driver
Add support to bring up hexagon based WCSS using secure PIL. All IPQxxxx
SoCs support secure Peripheral Image Loading (PIL).
[ ... ]
> diff --git a/drivers/remoteproc/qcom_q6v5_wcss_sec.c b/drivers/remoteproc/qcom_q6v5_wcss_sec.c
> new file mode 100644
> index 0000000000000..10a69fcd20f04
> --- /dev/null
> +++ b/drivers/remoteproc/qcom_q6v5_wcss_sec.c
> @@ -0,0 +1,325 @@
[ ... ]
> +static int wcss_sec_start(struct rproc *rproc)
> +{
> + struct wcss_sec *wcss = rproc->priv;
> + struct device *dev = wcss->dev;
> + int ret;
> +
> + ret = qcom_q6v5_prepare(&wcss->q6);
> + if (ret)
> + return ret;
> +
> + ret = qcom_scm_pas_auth_and_reset(wcss->desc->pasid);
> + if (ret) {
> + dev_err(dev, "wcss_reset failed\n");
> + goto unprepare;
> + }
> +
> + ret = qcom_q6v5_wait_for_start(&wcss->q6, Q6_WAIT_TIMEOUT);
> + if (ret == -ETIMEDOUT)
> + dev_err(dev, "start timed out\n");
> +
> +unprepare:
> + qcom_q6v5_unprepare(&wcss->q6);
> +
> + return ret;
> +}
[Severity: High]
Does wcss_sec_start() unintentionally disable the processor on success?
If qcom_q6v5_wait_for_start() succeeds and returns 0, the execution falls
through directly to the unprepare label, which drops the interconnect
bandwidth vote and load state.
Also, if wait_for_start() times out, the code falls through without
calling qcom_scm_pas_shutdown(), leaving TrustZone's peripheral
authentication system in an inconsistent state. Should there be a return
before the unprepare label and a pas shutdown on timeout?
[ ... ]
> +static void *wcss_sec_da_to_va(struct rproc *rproc, u64 da, size_t len,
> + bool *is_iomem)
> +{
[Severity: Medium]
Should this function set *is_iomem to true?
Since wcss->mem_region is mapped using devm_ioremap_resource_wc(),
the returned address is I/O memory. If *is_iomem is not set, the
remoteproc core might use standard memory accessors instead of I/O
specific accessors, which could lead to unaligned access faults on some
architectures.
> + struct wcss_sec *wcss = rproc->priv;
> + int offset;
> +
> + offset = da - wcss->mem_reloc;
[Severity: Low]
Can this integer truncation bypass the subsequent bounds check?
The variable offset is declared as a 32-bit signed int, but da is a
64-bit u64 and mem_reloc is phys_addr_t. If an out-of-bounds device
address is evaluated, the large 64-bit difference could be truncated
into a small positive 32-bit integer, bypassing the offset + len >
wcss->mem_size check later in the function.
> + if (offset < 0 || offset + len > wcss->mem_size)
> + return NULL;
> +
> + return wcss->mem_region + offset;
> +}
[ ... ]
> +static void wcss_sec_copy_segment(struct rproc *rproc,
> + struct rproc_dump_segment *segment,
> + void *dest, size_t offset, size_t size)
> +{
> + struct wcss_sec *wcss = rproc->priv;
> + struct device *dev = wcss->dev;
> +
> + if (!segment->io_ptr)
> + segment->io_ptr = ioremap_wc(segment->da, segment->size);
> +
> + if (!segment->io_ptr) {
> + dev_err(dev, "Failed to ioremap segment %pad size 0x%zx\n",
> + &segment->da, segment->size);
> + return;
> + }
> +
> + if (offset + size < segment->size) {
> + memcpy(dest, segment->io_ptr + offset, size);
> + } else {
> + iounmap(segment->io_ptr);
> + segment->io_ptr = NULL;
> + }
> +}
[Severity: High]
Does this else block skip copying the final chunk of data?
When reading the final chunk of a segment where offset + size >=
segment->size, the code falls into the else block and unmaps the I/O
memory but completely misses the memcpy() call. This leaves the last
chunk of the coredump uninitialized in the destination buffer.
Additionally, if userspace performs a partial read or aborts the dump,
the else block is never executed. Since rproc_coredump_cleanup() does
not unmap private pointers like io_ptr, does this permanently leak the
I/O mapping?
[ ... ]
> +static int wcss_sec_alloc_memory_region(struct wcss_sec *wcss)
> +{
> + struct device *dev = wcss->dev;
> + struct resource res;
> + int ret;
> +
> + ret = of_reserved_mem_region_to_resource(dev->of_node, 0, &res);
> + if (ret) {
> + dev_err(dev, "unable to acquire memory-region resource\n");
> + return ret;
> + }
> +
> + wcss->mem_phys = res.start;
> + wcss->mem_reloc = res.start;
> + wcss->mem_size = resource_size(&res);
> + wcss->mem_region = devm_ioremap_resource_wc(dev, &res);
> + if (!wcss->mem_region) {
[Severity: High]
Is this error check sufficient for devm_ioremap_resource_wc()?
The function devm_ioremap_resource_wc() returns an ERR_PTR on failure,
not NULL. Evaluating !wcss->mem_region will pass if an error pointer
is returned, which could later lead to a kernel panic when
wcss->mem_region is dereferenced in wcss_sec_load().
> + dev_err(dev, "unable to map memory region: %pR\n", &res);
> + return -ENOMEM;
> + }
> +
> + return 0;
> +}
[ ... ]
> +static int wcss_sec_probe(struct platform_device *pdev)
> +{
[ ... ]
> + rproc->auto_boot = false;
> + rproc->dump_conf = RPROC_COREDUMP_INLINE;
> + rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE);
> +
> + ret = devm_rproc_add(&pdev->dev, rproc);
> + if (ret) {
> + qcom_remove_glink_subdev(rproc, &wcss->glink_subdev);
> + qcom_remove_ssr_subdev(rproc, &wcss->ssr_subdev);
> + return ret;
> + }
[Severity: Medium]
Is a call to qcom_q6v5_deinit() missing in this error path?
Earlier in probe, qcom_q6v5_init() acquires a reference to the QMP
device handle via qmp_get(). If devm_rproc_add() fails, returning
here without calling qcom_q6v5_deinit() will permanently leak the
QMP device handle.
> +
> + platform_set_drvdata(pdev, rproc);
> +
> + return 0;
> +}
> +
> +static void wcss_sec_remove(struct platform_device *pdev)
> +{
> + struct rproc *rproc = platform_get_drvdata(pdev);
> + struct wcss_sec *wcss = rproc->priv;
> +
> + qcom_remove_glink_subdev(rproc, &wcss->glink_subdev);
> + qcom_remove_ssr_subdev(rproc, &wcss->ssr_subdev);
> + qcom_q6v5_deinit(&wcss->q6);
> +}
[Severity: High]
Does this sequence create a Use-After-Free during device teardown?
Because the remoteproc was registered using devm_rproc_add() in probe,
the rproc_del() function is scheduled to execute automatically during
the devres teardown phase, which runs after wcss_sec_remove() returns.
If qcom_q6v5_deinit() drops the q6v5->qmp handle via qmp_put() here,
when rproc_del() later tries to stop the running remoteproc, it will
call wcss_sec_stop() -> qcom_q6v5_unprepare(). This will attempt to
toggle the load state using the already-freed q6v5->qmp pointer,
causing a kernel panic.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-rproc-v13-0-41011cbcda3e@oss.qualcomm.com?part=3
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v13 4/6] arm64: dts: qcom: ipq5018: add nodes to bring up q6
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
` (2 preceding siblings ...)
2026-07-13 6:32 ` [PATCH v13 3/6] remoteproc: qcom: add hexagon based WCSS secure PIL driver Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 5/6] arm64: dts: qcom: ipq5332: " Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 6/6] arm64: dts: qcom: ipq9574: " Varadarajan Narayanan
5 siblings, 0 replies; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
George Moussalem, Dmitry Baryshkov, Konrad Dybcio,
Vignesh Viswanathan, Varadarajan Narayanan
From: George Moussalem <george.moussalem@outlook.com>
Enable nodes required for q6 remoteproc bring up.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
[ Change 'qcom,smem-state-names' order to resolve dt-bindings-check error ]
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
arch/arm64/boot/dts/qcom/ipq5018.dtsi | 64 +++++++++++++++++++++++++++++++++++
1 file changed, 64 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/ipq5018.dtsi b/arch/arm64/boot/dts/qcom/ipq5018.dtsi
index edff89257468..86e8f837bb09 100644
--- a/arch/arm64/boot/dts/qcom/ipq5018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq5018.dtsi
@@ -158,6 +158,35 @@ tz_region: tz@4ac00000 {
reg = <0x0 0x4ac00000 0x0 0x200000>;
no-map;
};
+
+ q6_region: wcss@4b000000 {
+ no-map;
+ reg = <0x0 0x4b000000 0x0 0x1b00000>;
+ };
+ };
+
+ wcss: smp2p-wcss {
+ compatible = "qcom,smp2p";
+ qcom,smem = <435>, <428>;
+
+ interrupt-parent = <&intc>;
+ interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>;
+
+ mboxes = <&apcs_glb 9>;
+
+ qcom,local-pid = <0>;
+ qcom,remote-pid = <1>;
+
+ wcss_smp2p_out: master-kernel {
+ qcom,entry-name = "master-kernel";
+ #qcom,smem-state-cells = <1>;
+ };
+
+ wcss_smp2p_in: slave-kernel {
+ qcom,entry-name = "slave-kernel";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
};
soc: soc@0 {
@@ -731,6 +760,41 @@ frame@b128000 {
};
};
+ q6v5_wcss: remoteproc@cd00000 {
+ compatible = "qcom,ipq5018-wcss-sec-pil";
+ reg = <0x0cd00000 0x10000>;
+ firmware-name = "ath11k/IPQ5018/hw1.0/q6_fw.mbn";
+ interrupts-extended = <&intc GIC_SPI 291 IRQ_TYPE_EDGE_RISING>,
+ <&wcss_smp2p_in 0 IRQ_TYPE_NONE>,
+ <&wcss_smp2p_in 1 IRQ_TYPE_NONE>,
+ <&wcss_smp2p_in 2 IRQ_TYPE_NONE>,
+ <&wcss_smp2p_in 3 IRQ_TYPE_NONE>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ clocks = <&gcc GCC_SLEEP_CLK_SRC>,
+ <&gcc GCC_SYS_NOC_WCSS_AHB_CLK>;
+ clock-names = "sleep",
+ "interconnect";
+
+ qcom,smem-states = <&wcss_smp2p_out 1>,
+ <&wcss_smp2p_out 0>;
+ qcom,smem-state-names = "stop",
+ "shutdown";
+
+ memory-region = <&q6_region>;
+
+ glink-edge {
+ interrupts = <GIC_SPI 179 IRQ_TYPE_EDGE_RISING>;
+ label = "rtr";
+ qcom,remote-pid = <1>;
+ mboxes = <&apcs_glb 8>;
+ };
+ };
+
pcie1: pcie@80000000 {
compatible = "qcom,pcie-ipq5018";
reg = <0x80000000 0xf1d>,
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH v13 5/6] arm64: dts: qcom: ipq5332: add nodes to bring up q6
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
` (3 preceding siblings ...)
2026-07-13 6:32 ` [PATCH v13 4/6] arm64: dts: qcom: ipq5018: add nodes to bring up q6 Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
2026-07-13 6:32 ` [PATCH v13 6/6] arm64: dts: qcom: ipq9574: " Varadarajan Narayanan
5 siblings, 0 replies; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Gokul Sriram Palanisamy, George Moussalem, Konrad Dybcio,
Dmitry Baryshkov, Vignesh Viswanathan, Varadarajan Narayanan
From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Enable nodes required for q6 remoteproc bring up.
Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
arch/arm64/boot/dts/qcom/ipq5332.dtsi | 62 +++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/ipq5332.dtsi b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
index 74d9de8d7641..0ecca5a0e68f 100644
--- a/arch/arm64/boot/dts/qcom/ipq5332.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
@@ -159,6 +159,35 @@ smem@4a800000 {
hwlocks = <&tcsr_mutex 3>;
};
+
+ q6_region: wcss@4a900000 {
+ reg = <0x0 0x4a900000 0x0 0x2b00000>;
+ no-map;
+ };
+ };
+
+ wcss: smp2p-wcss {
+ compatible = "qcom,smp2p";
+ qcom,smem = <435>, <428>;
+
+ interrupt-parent = <&intc>;
+ interrupts = <GIC_SPI 418 IRQ_TYPE_EDGE_RISING>;
+
+ mboxes = <&apcs_glb 9>;
+
+ qcom,local-pid = <0>;
+ qcom,remote-pid = <1>;
+
+ smp2p_wcss_out: master-kernel {
+ qcom,entry-name = "master-kernel";
+ #qcom,smem-state-cells = <1>;
+ };
+
+ smp2p_wcss_in: slave-kernel {
+ qcom,entry-name = "slave-kernel";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
};
soc@0 {
@@ -656,6 +685,39 @@ frame@b128000 {
};
};
+ q6v5_wcss: remoteproc@d100000 {
+ compatible = "qcom,ipq5332-wcss-sec-pil";
+ reg = <0x0d100000 0x10000>;
+ firmware-name = "ath12k/IPQ5332/hw1.0/q6_fw0.mbn";
+ interrupts-extended = <&intc GIC_SPI 421 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_wcss_in 0 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 1 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 2 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 3 IRQ_TYPE_NONE>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ clocks = <&gcc GCC_IM_SLEEP_CLK>;
+ clock-names = "sleep";
+
+ qcom,smem-states = <&smp2p_wcss_out 1>,
+ <&smp2p_wcss_out 0>;
+ qcom,smem-state-names = "stop",
+ "shutdown";
+
+ memory-region = <&q6_region>;
+
+ glink-edge {
+ interrupts = <GIC_SPI 417 IRQ_TYPE_EDGE_RISING>;
+ label = "rtr";
+ qcom,remote-pid = <1>;
+ mboxes = <&apcs_glb 8>;
+ };
+ };
+
pcie1: pcie@18000000 {
compatible = "qcom,pcie-ipq5332", "qcom,pcie-ipq9574";
reg = <0x18000000 0xf1c>,
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH v13 6/6] arm64: dts: qcom: ipq9574: add nodes to bring up q6
2026-07-13 6:32 [PATCH v13 0/6] Add new driver for WCSS secure PIL loading Varadarajan Narayanan
` (4 preceding siblings ...)
2026-07-13 6:32 ` [PATCH v13 5/6] arm64: dts: qcom: ipq5332: " Varadarajan Narayanan
@ 2026-07-13 6:32 ` Varadarajan Narayanan
5 siblings, 0 replies; 11+ messages in thread
From: Varadarajan Narayanan @ 2026-07-13 6:32 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Manikanta Mylavarapu
Cc: linux-arm-msm, linux-kernel, linux-remoteproc, devicetree,
Gokul Sriram Palanisamy, George Moussalem, Konrad Dybcio,
Dmitry Baryshkov, Vignesh Viswanathan, Varadarajan Narayanan
From: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Enable nodes required for q6 remoteproc bring up.
Signed-off-by: Manikanta Mylavarapu <manikanta.mylavarapu@oss.qualcomm.com>
Signed-off-by: Gokul Sriram Palanisamy <gokul.sriram.p@oss.qualcomm.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com>
Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
---
arch/arm64/boot/dts/qcom/ipq9574.dtsi | 60 ++++++++++++++++++++++++++++++++++-
1 file changed, 59 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq9574.dtsi b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
index 451c2076f6a7..fd9fd801eb98 100644
--- a/arch/arm64/boot/dts/qcom/ipq9574.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq9574.dtsi
@@ -3,7 +3,7 @@
* IPQ9574 SoC device tree source
*
* Copyright (c) 2020-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2025, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <dt-bindings/clock/qcom,apss-ipq.h>
@@ -222,6 +222,35 @@ smem@4aa00000 {
hwlocks = <&tcsr_mutex 3>;
no-map;
};
+
+ q6_region: wcss@4ab00000 {
+ reg = <0x0 0x4ab00000 0x0 0x2b00000>;
+ no-map;
+ };
+ };
+
+ wcss: smp2p-wcss {
+ compatible = "qcom,smp2p";
+ qcom,smem = <435>, <428>;
+
+ interrupt-parent = <&intc>;
+ interrupts = <GIC_SPI 322 IRQ_TYPE_EDGE_RISING>;
+
+ mboxes = <&apcs_glb 9>;
+
+ qcom,local-pid = <0>;
+ qcom,remote-pid = <1>;
+
+ smp2p_wcss_out: master-kernel {
+ qcom,entry-name = "master-kernel";
+ #qcom,smem-state-cells = <1>;
+ };
+
+ smp2p_wcss_in: slave-kernel {
+ qcom,entry-name = "slave-kernel";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
};
soc: soc@0 {
@@ -924,6 +953,35 @@ frame@b128000 {
};
};
+ q6v5_wcss: remoteproc@cd00000 {
+ compatible = "qcom,ipq9574-wcss-sec-pil";
+ reg = <0x0cd00000 0x10000>;
+ firmware-name = "ath11k/IPQ9574/hw1.0/q6_fw.mbn";
+ interrupts-extended = <&intc GIC_SPI 325 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_wcss_in 0 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 1 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 2 IRQ_TYPE_NONE>,
+ <&smp2p_wcss_in 3 IRQ_TYPE_NONE>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ qcom,smem-states = <&smp2p_wcss_out 1>,
+ <&smp2p_wcss_out 0>;
+ qcom,smem-state-names = "stop",
+ "shutdown";
+ memory-region = <&q6_region>;
+
+ glink-edge {
+ interrupts = <GIC_SPI 321 IRQ_TYPE_EDGE_RISING>;
+ label = "rtr";
+ qcom,remote-pid = <1>;
+ mboxes = <&apcs_glb 8>;
+ };
+ };
+
pcie1: pcie@10000000 {
compatible = "qcom,pcie-ipq9574";
reg = <0x10000000 0xf1d>,
--
2.34.1
^ permalink raw reply related [flat|nested] 11+ messages in thread