On Tue, Oct 07, 2025 at 10:18:45PM +0530, Mukesh Ojha wrote: > A few months ago, we discussed the challenges at Linaro Connect 2025 [1] > related to Secure PAS remoteproc enablement when Linux is running at EL2. > > [1] https://resources.linaro.org/en/resource/sF8jXifdb9V1mUefdbfafa > > Below, is the summary of the discussion. > > Qualcomm is working to enable remote processors on the SA8775p SoC with > a Linux host running at EL2. In doing so, it has encountered several > challenges related to how the remoteproc framework is handled when Linux > runs at EL1. > > One of the main challenges arises from differences in how IOMMU > translation is currently managed on SoCs running the Qualcomm EL2 > hypervisor (QHEE), where IOMMU translation for any device is entirely > owned by the hypervisor. Additionally, the firmware for remote > processors does not contain a resource table, which would typically > include the necessary IOMMU configuration settings. > > Qualcomm SoCs running with QHEE (EL2) have been utilizing the Peripheral > Authentication Service (PAS) from TrustZone (TZ) firmware to securely > authenticate and reset remote processors via a single SMC call, > _auth_and_reset_. This call is first trapped by QHEE, which then invokes > TZ for authentication. Once authentication is complete, the call returns > to QHEE, which sets up the IOMMU translation scheme for the remote > processors and subsequently brings them out of reset. The design of the > Qualcomm EL2 hypervisor dictates that the Linux host OS running at EL1 > is not permitted to configure IOMMU translation for remote processors, > and only a single-stage translation is configured. > > To make the remote processor bring-up (PAS) sequence > hypervisor-independent, the auth_and_reset SMC call is now handled > entirely by TZ. However, the issue of IOMMU configuration remains > unresolved, for example a scenario, when KVM host at EL2 has no > knowledge of the remote processors’ IOMMU settings. This is being > addressed by overlaying the IOMMU properties when the SoC runs a Linux > host at EL2. SMC call is being provided from the TrustZone firmware to > retrieve the resource table for a given subsystem. > > There are also remote processors such as those for video, camera, and > graphics that do not use the remoteproc framework to manage their > lifecycle. Instead, they rely on the Qualcomm PAS service to > authenticate their firmware. These processors also need to be brought > out of reset when Linux is running at EL2. The client drivers for these > processors use the MDT loader function to load and authenticate > firmware. Similar to the Qualcomm remoteproc PAS driver, they also need > to retrieve the resource table, create a shared memory bridge > (shmbridge), and map the resources before bringing the processors out of > reset. > > It is based on next-20251007 and tested on SA8775p which is now called > Lemans IOT platform and does not addresses DMA problem discussed at > [1] which is future scope of the series. >
Could you please add a link to the modified TZ firmware for Lemans, required to make use this patchset? - Mani > Changes in v4: > https://lore.kernel.org/lkml/[email protected]/ > - Fixed kernel robot warning/errors. > - Reworded some of the commit log, code comment as per suggestion from Bryan. > - Added support of gpdsp0 and gpdsp1 and disabled iris node. > - Add R-b tag to some of the reviewed patches. > - Rename struct qcom_scm_pas_cxt to qcom_scm_pas_context. > > Changes in v3: > https://lore.kernel.org/lkml/[email protected]/ > - Dropped video subsystem enablement for now, could add it in future > or on a separate series. > - Addressed most of the suggestion from Stephen and Bryan like some > remoteproc code checking resource table presence or right error > code propagation above the layer. > - Added leman-el2 overlay file. > - Added missed iommus binding which was missed last series. > - Separated qcom_mdt_pas_load() patch and its usage. > - Patch numbering got changed compared to last version > > Changes in v2: > https://lore.kernel.org/lkml/[email protected]/ > - A lot has changed from the V1 and a fresh look would be preferred. > - Removed approach where device tree contain devmem resources in > remoteproc node. > - SHMbridge need to created for both carveout and metadata memory > shared to TZ in a new way. > - Now, resource table would be given by SMC call which need to mapped > along with carveout before triggering _auth_and_reset_. > - IOMMU properties need to be added to firmware devices tree node when Linux > control IOMMU. > > --- > Mukesh Ojha (12): > dt-bindings: remoteproc: qcom,pas: Add iommus property > firmware: qcom_scm: Rename peripheral as pas_id > firmware: qcom_scm: Introduce PAS context initialization and destroy > helper > soc: qcom: mdtloader: Add PAS context aware qcom_mdt_pas_load() function > remoteproc: pas: Replace metadata context with PAS context structure > firmware: qcom_scm: Add a prep version of auth_and_reset function > firmware: qcom_scm: Simplify qcom_scm_pas_init_image() > firmware: qcom_scm: Add SHM bridge handling for PAS when running > without QHEE > firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource > table > remoteproc: pas: Extend parse_fw callback to fetch resources via SMC > call > remoteproc: qcom: pas: Enable Secure PAS support with IOMMU managed by > Linux > arm64: dts: qcom: Add EL2 overlay for Lemans > > .../bindings/remoteproc/qcom,pas-common.yaml | 3 + > arch/arm64/boot/dts/qcom/Makefile | 7 +- > arch/arm64/boot/dts/qcom/lemans-el2.dtso | 41 ++ > drivers/firmware/qcom/qcom_scm.c | 415 > ++++++++++++++++++--- > drivers/firmware/qcom/qcom_scm.h | 1 + > drivers/remoteproc/qcom_q6v5_pas.c | 187 ++++++++-- > drivers/soc/qcom/mdt_loader.c | 32 +- > include/linux/firmware/qcom/qcom_scm.h | 36 +- > include/linux/soc/qcom/mdt_loader.h | 16 +- > 9 files changed, 635 insertions(+), 103 deletions(-) > --- > base-commit: 68842969e138d9ad3e3aa2bbd65d514df1581b5c > change-id: 20251007-kvm_rprocv4_next-20251007-5e4ea5a978da > > Best regards, > -- > -Mukesh Ojha > -- மணிவண்ணன் சதாசிவம்
