Linux patches for the Glymur CRD on the open boot stack

0001-arm64-dts-qcom-glymur-reserve-the-TZ-carve-outs.patch

From 07ab4f2cac69f650b0d9506772f0eb08e43b9fca Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Thu, 15 Oct 2026 20:45:34 -0400
Subject: [PATCH 1/8] arm64: dts: qcom: glymur: reserve the TZ carve-outs

The secure world on Glymur owns the DDR from 0xd7019000 to 0xd9dc0000:
the XBL_SC region, a reserved region, the TZ (QTEE) image and heap, the
trusted application region and the DRAM tag area. None of it is
described in glymur.dtsi. With the stock UEFI this goes unnoticed because
UEFI leaves the range out of the memory map it hands to the OS, but a
boot firmware that takes the memory map from the device tree gives it to
Linux, which then uses memory the secure world runs from.

Describe the carve-outs as no-map reserved memory, as hamoa.dtsi does
for its own.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur.dtsi | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index 65a398c0a9920..22168ff8a81a3 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -680,6 +680,31 @@ video_mem: video@92900000 {
 			no-map;
 		};
 
+		xbl_sc_mem: xbl-sc@d7019000 {
+			reg = <0x0 0xd7019000 0x0 0x60000>;
+			no-map;
+		};
+
+		reserved-region@d7079000 {
+			reg = <0x0 0xd7079000 0x0 0x107000>;
+			no-map;
+		};
+
+		qtee_mem: qtee@d7180000 {
+			reg = <0x0 0xd7180000 0x0 0x680000>;
+			no-map;
+		};
+
+		ta_mem: ta@d7800000 {
+			reg = <0x0 0xd7800000 0x0 0x1c00000>;
+			no-map;
+		};
+
+		tags_mem: tags@d9400000 {
+			reg = <0x0 0xd9400000 0x0 0x9c0000>;
+			no-map;
+		};
+
 		smem_mem: smem@ffe00000 {
 			compatible = "qcom,smem";
 			reg = <0x0 0xffe00000 0x0 0x200000>;
-- 
2.47.3

0002-arm64-dts-qcom-glymur-reserve-the-boot-firmware-carv.patch

From 581bc47dfe0ef7d5c7c671c975851ee13415f383 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 00:41:43 -0400
Subject: [PATCH 2/8] arm64: dts: qcom: glymur: reserve the boot firmware
 carve-outs

Besides the TZ carve-outs, the boot firmware keeps several other DDR
regions on Glymur that glymur.dtsi does not describe: the LLCC LPI region,
the CPUCP firmware and its tags, the XBL RAM dump area, the AOP image,
configuration and logs, the shared secure data, the ACPI TA and SoCCP SDI
regions, TZ diagnostics, the SPU and ADSP RPC shared memory, the gaps of
the PIL region, BERT and the OOB GLINK area. The stock UEFI leaves them
all out of the memory map it gives the OS. A boot firmware that takes the
memory map from the device tree (U-Boot here) hands them to Linux, which
can then overwrite running firmware such as CPUCP.

Describe them as no-map reserved memory.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur.dtsi | 95 ++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index 22168ff8a81a3..e1feeb5799da5 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -579,22 +579,82 @@ reserved-memory {
 		#size-cells = <2>;
 		ranges;
 
+		llcc_lpi_mem: llcc-lpi@80000000 {
+			reg = <0x0 0x80000000 0x0 0x900000>;
+			no-map;
+		};
+
+		cpucp_mem: cpucp@80900000 {
+			reg = <0x0 0x80900000 0x0 0xb00000>;
+			no-map;
+		};
+
 		pdp_mem: pdp@81400000 {
 			reg = <0x0 0x81400000 0x0 0x100000>;
 			no-map;
 		};
 
+		cpucp_tags_mem: cpucp-tags@81500000 {
+			reg = <0x0 0x81500000 0x0 0x360000>;
+			no-map;
+		};
+
+		xbl_ramdump_mem: xbl-ramdump@81860000 {
+			reg = <0x0 0x81860000 0x0 0x200000>;
+			no-map;
+		};
+
+		aop_image_mem: aop-image@81c00000 {
+			reg = <0x0 0x81c00000 0x0 0x60000>;
+			no-map;
+		};
+
 		aop_cmd_db_mem: aop-cmd-db@81c60000 {
 			compatible = "qcom,cmd-db";
 			reg = <0x0 0x81c60000 0x0 0x20000>;
 			no-map;
 		};
 
+		reserved-region@81c80000 {
+			reg = <0x0 0x81c80000 0x0 0x80000>;
+			no-map;
+		};
+
+		reserved-region@81d60000 {
+			reg = <0x0 0x81d60000 0x0 0x7c000>;
+			no-map;
+		};
+
 		pdp_ns_shared_mem: pdp-ns-shared@81e00000 {
 			reg = <0x0 0x81e00000 0x0 0x200000>;
 			no-map;
 		};
 
+		acpi_ta_mem: acpi-ta@82000000 {
+			reg = <0x0 0x82000000 0x0 0x200000>;
+			no-map;
+		};
+
+		soccp_sdi_mem: soccp-sdi@823a0000 {
+			reg = <0x0 0x823a0000 0x0 0x140000>;
+			no-map;
+		};
+
+		tz_stat_mem: tz-stat@82700000 {
+			reg = <0x0 0x82700000 0x0 0x100000>;
+			no-map;
+		};
+
+		spu_shared_mem: spu-shared@84900000 {
+			reg = <0x0 0x84900000 0x0 0x100000>;
+			no-map;
+		};
+
+		adsp_rpc_heap_mem: adsp-rpc-heap@84a00000 {
+			reg = <0x0 0x84a00000 0x0 0x900000>;
+			no-map;
+		};
+
 		oobdaretag_mem: oobdaretag@86e10000 {
 			reg = <0x0 0x86e10000 0x0 0x360000>;
 			no-map;
@@ -615,6 +675,11 @@ oobdtboem_mem: oobdtboem@87d50000 {
 			no-map;
 		};
 
+		reserved-region@87d70000 {
+			reg = <0x0 0x87d70000 0x0 0x90000>;
+			no-map;
+		};
+
 		oob_nonsecure_mem: oob-nonsecure@87e00000 {
 			reg = <0x0 0x87e00000 0x0 0xc00000>;
 			no-map;
@@ -635,6 +700,11 @@ soccpdtb_mem: soccpdtb@89200000 {
 			no-map;
 		};
 
+		reserved-region@89220000 {
+			reg = <0x0 0x89220000 0x0 0x4e0000>;
+			no-map;
+		};
+
 		cvp_mem: cvp@89700000 {
 			reg = <0x0 0x89700000 0x0 0x700000>;
 			no-map;
@@ -650,6 +720,11 @@ q6_adsp_dtb_mem: q6-adsp-dtb@8d800000 {
 			no-map;
 		};
 
+		reserved-region@8d880000 {
+			reg = <0x0 0x8d880000 0x0 0x80000>;
+			no-map;
+		};
+
 		cdsp_mem: cdsp@8d900000 {
 			reg = <0x0 0x8d900000 0x0 0x4000000>;
 			no-map;
@@ -660,6 +735,11 @@ q6_cdsp_dtb_mem: q6-cdsp-dtb@91900000 {
 			no-map;
 		};
 
+		reserved-region@91980000 {
+			reg = <0x0 0x91980000 0x0 0x7e000>;
+			no-map;
+		};
+
 		gpu_microcode_mem: gpu-microcode@919fe000 {
 			reg = <0x0 0x919fe000 0x0 0x2000>;
 			no-map;
@@ -680,6 +760,16 @@ video_mem: video@92900000 {
 			no-map;
 		};
 
+		reserved-region@93500000 {
+			reg = <0x0 0x93500000 0x0 0xa00000>;
+			no-map;
+		};
+
+		bert_mem: bert@d6f00000 {
+			reg = <0x0 0xd6f00000 0x0 0x100000>;
+			no-map;
+		};
+
 		xbl_sc_mem: xbl-sc@d7019000 {
 			reg = <0x0 0xd7019000 0x0 0x60000>;
 			no-map;
@@ -705,6 +795,11 @@ tags_mem: tags@d9400000 {
 			no-map;
 		};
 
+		oob_glink_mem: oob-glink@fec00000 {
+			reg = <0x0 0xfec00000 0x0 0x180000>;
+			no-map;
+		};
+
 		smem_mem: smem@ffe00000 {
 			compatible = "qcom,smem";
 			reg = <0x0 0xffe00000 0x0 0x200000>;
-- 
2.47.3

0003-dt-bindings-interconnect-qcom-glymur-rpmh-add-aggre3.patch

From 42f64c7343d4fa95ade512ccfdf59641fb620451 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 06:24:51 -0400
Subject: [PATCH 3/8] dt-bindings: interconnect: qcom,glymur-rpmh: add aggre3
 NoC clocks

The QoS registers of the USB2 and USB3 MP ports of the Glymur aggre3
NoC are only accessible while the matching GCC aggre AXI clocks run.
The binding allows no clocks for the aggre3 NoC, so the driver cannot
enable them before it programs the QoS settings.

Describe the two clocks, as is already done for the aggre2 and aggre4
NoCs.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 .../bindings/interconnect/qcom,glymur-rpmh.yaml    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Documentation/devicetree/bindings/interconnect/qcom,glymur-rpmh.yaml b/Documentation/devicetree/bindings/interconnect/qcom,glymur-rpmh.yaml
index f69b2facb658e..1ab13d982bf9b 100644
--- a/Documentation/devicetree/bindings/interconnect/qcom,glymur-rpmh.yaml
+++ b/Documentation/devicetree/bindings/interconnect/qcom,glymur-rpmh.yaml
@@ -196,6 +196,19 @@ allOf:
             - description: aggre USB4_2 AXI clock
             - description: aggre UFS PHY AXI clock
 
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
+              - qcom,glymur-aggre3-noc
+    then:
+      properties:
+        clocks:
+          items:
+            - description: aggre USB2 PRIM AXI clock
+            - description: aggre USB3 MP AXI clock
+
   - if:
       properties:
         compatible:
@@ -217,6 +230,7 @@ allOf:
           contains:
             enum:
               - qcom,glymur-aggre2-noc
+              - qcom,glymur-aggre3-noc
               - qcom,glymur-aggre4-noc
               - qcom,glymur-pcie-east-anoc
               - qcom,glymur-pcie-west-anoc
-- 
2.47.3

0004-interconnect-qcom-glymur-require-clocks-for-the-aggr.patch

From 052214b6a83572b15a9a8ccc693c70adde6f2a97 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 06:25:00 -0400
Subject: [PATCH 4/8] interconnect: qcom: glymur: require clocks for the aggre3
 NoC QoS

The aggre3 NoC programs QoS settings for its USB2 and USB3 MP ports,
whose registers are only accessible while GCC_AGGRE_USB2_PRIM_AXI_CLK
and GCC_AGGRE_USB3_MP_AXI_CLK run. Unlike the aggre2 and aggre4 NoCs,
the aggre3 descriptor does not set qos_requires_clocks, and the aggre3
node has no clocks, so the probe writes those registers with the clocks
off and the access never completes. The whole system stops, with the
driver core trace ending in:

  platform 1700000.interconnect: bus: 'platform': really_probe:
  probing driver qnoc-glymur with device

The stock boot firmware leaves the USB clocks running, which hides the
problem; a boot firmware that does not use USB (U-Boot here) exposes
it. Reading the QOSGEN_MAINCTL_LO register of the USB2 port from
U-Boot hangs the same way with the clock off and returns normally once
the clock is enabled.

Set qos_requires_clocks for the aggre3 NoC, so that the QoS settings
are only programmed with the clocks enabled and skipped when the
device tree provides none.

Fixes: 5c5f2221821a ("interconnect: qcom: add glymur interconnect provider driver")
Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 drivers/interconnect/qcom/glymur.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/interconnect/qcom/glymur.c b/drivers/interconnect/qcom/glymur.c
index 9b9ed99ef242e..7465eb1edd7c2 100644
--- a/drivers/interconnect/qcom/glymur.c
+++ b/drivers/interconnect/qcom/glymur.c
@@ -1928,6 +1928,7 @@ static const struct qcom_icc_desc glymur_aggre3_noc = {
 	.config = &glymur_aggre3_noc_regmap_config,
 	.nodes = aggre3_noc_nodes,
 	.num_nodes = ARRAY_SIZE(aggre3_noc_nodes),
+	.qos_requires_clocks = true,
 };
 
 static struct qcom_icc_bcm * const aggre4_noc_bcms[] = {
-- 
2.47.3

0005-arm64-dts-qcom-glymur-add-the-aggre3-NoC-QoS-clocks.patch

From 9469ec4f408d7944ea216adf4f016a5cdc5858b2 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 06:25:07 -0400
Subject: [PATCH 5/8] arm64: dts: qcom: glymur: add the aggre3 NoC QoS clocks

The QoS registers of the USB2 and USB3 MP ports of the aggre3 NoC are
only accessible while their aggre AXI clocks run. Describe the clocks
so the interconnect driver can enable them while it programs the QoS
settings, instead of skipping them.

Fixes: 41b6e8db400c ("arm64: dts: qcom: Introduce Glymur base dtsi")
Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index e1feeb5799da5..e580d8d43cee0 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -2968,6 +2968,8 @@ aggre3_noc: interconnect@1700000 {
 			reg = <0x0 0x01700000 0x0 0x1d400>;
 			qcom,bcm-voters = <&apps_bcm_voter>;
 			#interconnect-cells = <2>;
+			clocks = <&gcc GCC_AGGRE_USB2_PRIM_AXI_CLK>,
+				 <&gcc GCC_AGGRE_USB3_MP_AXI_CLK>;
 		};
 
 		aggre4_noc: interconnect@1740000 {
-- 
2.47.3

0006-arm64-dts-qcom-glymur-add-the-GPU-zap-shader-node.patch

From 3e5962f7e496ed8022d8dea356d02ed0c8a489ee Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 15:06:51 -0400
Subject: [PATCH 6/8] arm64: dts: qcom: glymur: add the GPU zap shader node

The GPU node has no zap-shader child, so the driver never loads a zap
shader and takes the GPU out of secure mode by writing
RBBM_SECVID_TRUST_CNTL itself. The gpu_microcode_mem carve-out the zap
shader is meant to be loaded into is reserved but unreferenced.

Add the zap-shader node with the carve-out as its memory region, as on
the other Adreno platforms; boards name the signed image.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index e580d8d43cee0..fff365cd1bb89 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -4294,6 +4294,10 @@ gpu: gpu@3d00000 {
 					 &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
 			interconnect-names = "gfx-mem";
 
+			gpu_zap_shader: zap-shader {
+				memory-region = <&gpu_microcode_mem>;
+			};
+
 			gpu_opp_table: opp-table {
 				compatible = "operating-points-v2-adreno",
 					     "operating-points-v2";
-- 
2.47.3

0007-arm64-dts-qcom-glymur-crd-name-the-GPU-zap-shader-fi.patch

From 4f3adb5cf70e965c428c0cb730a23e66a208f9ed Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 15:06:51 -0400
Subject: [PATCH 7/8] arm64: dts: qcom: glymur-crd: name the GPU zap shader
 firmware

Point the zap shader at the CRD's signed image in linux-firmware.

Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur-crd.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/glymur-crd.dtsi b/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
index 58158b51fe295..e8fc6bd6bcca8 100644
--- a/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
@@ -589,6 +589,10 @@ vreg_l4h_e0_1p2: ldo4 {
 	};
 };
 
+&gpu_zap_shader {
+	firmware-name = "qcom/glymur/gen80100_zap.mbn";
+};
+
 &i2c9 {
 	clock-frequency = <400000>;
 
-- 
2.47.3

0008-drm-msm-dp-skip-link-teardown-when-the-link-was-neve.patch

From 4a28fe00ce741566a586220822481dd73b395d78 Mon Sep 17 00:00:00 2001
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
Date: Fri, 16 Oct 2026 12:05:43 -0400
Subject: [PATCH 8/8] drm/msm/dp: skip link teardown when the link was never
 enabled

On an eDP output whose panel does not respond, .atomic_enable() fails
in msm_dp_display_prepare_link() with -ENOTCONN before
msm_dp_ctrl_on_link() runs, so the link clocks are never enabled. At
shutdown .atomic_post_disable() still calls msm_dp_display_unprepare(),
which calls msm_dp_ctrl_off_link() unconditionally, and its first read
of REG_DP_MAINLINK_CTRL takes a synchronous external abort:

  [drm:msm_dp_display_atomic_enable] *ERROR* DP display prepare failed, rc=-107
  ...
  Internal error: synchronous external abort: 0000000096001610 [#1]  SMP
  pc : msm_dp_ctrl_off_link+0x48/0x88
  Call trace:
   msm_dp_ctrl_off_link+0x48/0x88 (P)
   msm_dp_display_atomic_post_disable+0x6c/0x174
   msm_edp_bridge_atomic_post_disable+0x60/0x70
   ...
   msm_kms_shutdown+0x30/0x40

Before the link teardown moved to msm_dp_display_unprepare() it ran
from msm_dp_display_disable(), which returns early when the stream was
never powered on, so this path was not reached.

Return from msm_dp_ctrl_off_link() when the link clocks are off: the
mainlink was then never enabled and there is nothing to tear down.

Fixes: 1bda647ce61b ("drm/msm/dp: move link-level teardown from display_disable to display_unprepare")
Change-Id: I7618707e838bebf94081e46ee6034d7e234898ed
Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index abd3dcdad03c2..ab360eeb41e59 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -2693,6 +2693,10 @@ void msm_dp_ctrl_off_link(struct msm_dp_ctrl *msm_dp_ctrl,
 	ctrl = container_of(msm_dp_ctrl, struct msm_dp_ctrl_private, msm_dp_ctrl);
 	phy = ctrl->phy;
 
+	/* The link registers fault while the link clocks are off */
+	if (!ctrl->link_clks_on)
+		return;
+
 	msm_dp_ctrl_mainlink_disable(ctrl);
 
 	msm_dp_ctrl_reset(&ctrl->msm_dp_ctrl, panel);
-- 
2.47.3

README.md

Linux patches for the Glymur CRD on the open boot stack

Linux at EL2 on TF-A + OP-TEE + U-Boot. Base: linux-next next-20261008 (aac26bee2287 "Add linux-next specific files for 20261008"), branch glymur-el2 (4a28fe00ce74).

Apply with git am *.patch on that base. Test run: https://lava.infra.foundries.io/scheduler/job/493444

WIP patches are marked WIP and are not intended for upstream as is.