Linux patches for the SM8750 (Pakala) MTP on the open boot stack

0001-WIP-arm64-dts-qcom-sm8750-add-the-EL2-overlay.patch

From 627f09fc3f9fbfb6c41952f582ae3cdbe0bbd102 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Thu, 8 Oct 2026 22:35:15 -0400
Subject: [PATCH 1/3] WIP: arm64: dts: qcom: sm8750: add the EL2 overlay

---
 arch/arm64/boot/dts/qcom/Makefile        |  4 +++
 arch/arm64/boot/dts/qcom/sm8750-el2.dtso | 33 ++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 arch/arm64/boot/dts/qcom/sm8750-el2.dtso

diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
index 88230c4e00ea9..6675d2d1db90b 100644
--- a/arch/arm64/boot/dts/qcom/Makefile
+++ b/arch/arm64/boot/dts/qcom/Makefile
@@ -454,6 +454,10 @@ dtb-$(CONFIG_ARCH_QCOM)	+= sm8650-mtp.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8650-qrd.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8650-valve-deckard.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8750-mtp.dtb
+
+sm8750-mtp-el2-dtbs	:= sm8750-mtp.dtb sm8750-el2.dtbo
+
+dtb-$(CONFIG_ARCH_QCOM)	+= sm8750-mtp-el2.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= sm8750-qrd.dtb
 dtb-$(CONFIG_ARCH_QCOM)	+= talos-evk.dtb
 
diff --git a/arch/arm64/boot/dts/qcom/sm8750-el2.dtso b/arch/arm64/boot/dts/qcom/sm8750-el2.dtso
new file mode 100644
index 0000000000000..0ca26a95e45f4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sm8750-el2.dtso
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ *
+ * SM8750 specific modifications required to boot in EL2.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+/* We can't and don't need to use zap shader in EL2 as linux can zap the gpu on it's own. */
+&gpu_zap_shader {
+	status = "disabled";
+};
+
+&iris {
+	/* TODO: Add video-firmware iommus to start IRIS from EL2 */
+	status = "disabled";
+};
+
+/*
+ * Linux at EL2 with VHE uses the EL2 virtual timer, PPI 12 (INTID 28), which
+ * Gunyah owns when Linux runs at EL1.
+ */
+&{/timer} {
+	interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>,
+		     <GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>,
+		     <GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>,
+		     <GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>,
+		     <GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>;
+};
-- 
2.47.3

0002-WIP-sm8750-el2-DSP-SMMU-streams-DARE-tag-reservation.patch

From 3aa27db08ada1635691b271d708c9b836176d4f3 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 9 Oct 2026 07:22:49 -0400
Subject: [PATCH 2/3] WIP: sm8750-el2: DSP SMMU streams, DARE tag reservations

The ADSP and CDSP boot streams (0x1000, 0x0c00) come from the
stock firmware IORT; the DARE tag regions from the XBL memory map. early
memtest without them: SError at 0x81400000.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/sm8750-el2.dtso | 25 ++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/sm8750-el2.dtso b/arch/arm64/boot/dts/qcom/sm8750-el2.dtso
index 0ca26a95e45f4..455d3b5e9d9d3 100644
--- a/arch/arm64/boot/dts/qcom/sm8750-el2.dtso
+++ b/arch/arm64/boot/dts/qcom/sm8750-el2.dtso
@@ -15,6 +15,31 @@ &gpu_zap_shader {
 	status = "disabled";
 };
 
+&remoteproc_adsp {
+	iommus = <&apps_smmu 0x1000 0x0>;
+};
+
+&remoteproc_cdsp {
+	iommus = <&apps_smmu 0x0c00 0x0>;
+};
+
+/*
+ * DARE tag storage that the firmware protects and that Gunyah keeps out of
+ * the HLOS VM: the hypervisor tags after the Gunyah carve-outs and the TZ
+ * tags after tz-merged. A Linux access takes an SError.
+ */
+&{/reserved-memory} {
+	dare-hyp-tags@81400000 {
+		reg = <0x0 0x81400000 0x0 0x560000>;
+		no-map;
+	};
+
+	dare-tz-tags@d8600000 {
+		reg = <0x0 0xd8600000 0x0 0xb340000>;
+		no-map;
+	};
+};
+
 &iris {
 	/* TODO: Add video-firmware iommus to start IRIS from EL2 */
 	status = "disabled";
-- 
2.47.3

0003-remoteproc-qcom-pas-pass-no-input-table-when-the-fir.patch

From 60a770323e93522cfb43900b33cf65d11655f7ab Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 9 Oct 2026 14:16:50 -0400
Subject: [PATCH 3/3] remoteproc: qcom: pas: pass no input table when the
 firmware has none

qcom_pas_parse_firmware() hands rproc->table_ptr and rproc->table_sz to
the PAS service as the firmware's own resource table even when
rproc_elf_load_rsc_table() found none. After a failed start the core
clears table_ptr but leaves table_sz, so the next start copies
table_sz bytes from NULL:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  pc : __pi_memcpy_generic+0x110/0x22c
  lr : qcom_pas_tee_get_rsc_table+0xf4/0x25c
  Call trace:
   __pi_memcpy_generic+0x110/0x22c (P)
   qcom_pas_get_rsc_table+0x38/0x60
   qcom_pas_parse_firmware+0xa0/0x100
   rproc_boot+0x2d4/0x380

Pass a NULL table of size zero when the firmware carries none, as the
comment below the call describes.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 drivers/remoteproc/qcom_q6v5_pas.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index 2e1e39826ffa0..2f6865c82654a 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -504,11 +504,13 @@ static int qcom_pas_parse_firmware(struct rproc *rproc, const struct firmware *f
 		return 0;
 
 	ret = rproc_elf_load_rsc_table(rproc, fw);
-	if (ret)
+	if (ret) {
 		dev_dbg(&rproc->dev, "Failed to load resource table from firmware\n");
-
-	table = rproc->table_ptr;
-	table_sz = rproc->table_sz;
+		table_sz = 0;
+	} else {
+		table = rproc->table_ptr;
+		table_sz = rproc->table_sz;
+	}
 
 	/*
 	 * The resources consumed by Qualcomm remote processors fall into two categories:
-- 
2.47.3

README.md

Linux patches for the SM8750 (Pakala) MTP on the open boot stack

Linux at EL2 on TF-A + OP-TEE + U-Boot. Base: linux-next next-20261008 (aac26bee2287 "Add linux-next specific files for 20261008"), branch pakala-el2 (60a770323e93).

Apply with git am *.patch on that base. Test run: https://lava.infra.foundries.io/scheduler/job/480644

WIP patches are marked WIP and are not intended for upstream as is.