commit a48df51d23138388900995add2854cda4aa68e55 upstream.

The remote state is set to RPROC_DETACHED if the resource table is found
in the memory. However, this can be wrong if the remote is not started,
but firmware is still loaded in the memory. Use PM_GET_NODE_STATUS call
to the firmware to request the state of the RPU node. If the RPU is
actually out of reset and running, only then move the remote state to
RPROC_DETACHED, otherwise keep the remote state to RPROC_OFFLINE.

Signed-off-by: Tanmay Shah <tanmay.shah@amd.com>
Fixes: bca4b02ef92e ("remoteproc: xlnx: Add attach detach support")
Reviewed-by: Beleswar Padhi <b-padhi@ti.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20260428221855.313752-1-tanmay.shah@amd.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ecf9fc18e62c58eae1ceb65dab2bccb8a724de2d upstream.

Free allocated minidump_region 'name' in qcom_add_minidump_segments()
when failing before adding the region to 'dump_segments'. Otherwise,
the 'name' is not tracked and is never freed by qcom_minidump_cleanup().

Return error when adding to 'dump_segments' fails.

Cc: stable@vger.kernel.org # v5.11
Fixes: 8ed8485c4f05 ("remoteproc: qcom: Add capability to collect minidumps")
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Wasim Nazir <wasim.nazir@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260318-rproc-memleak-v2-1-ade70ab858f2@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[ Upstream commit 6ad61d0acd41044a949e84f96a5f8e02284d350f ]

The wcss_q6_bcr_reset used on QCS404, and wcss_q6_reset used on IPQ
are the same. "BCR reset" is redundant, and likely a mistake. Use the
documented "wcss_q6_reset" instead. Drop ".wcss_q6_reset_required"
from the descriptor, since all targets now need it.

This changes the bindings expectations, however, it actually fixes the
driver to consume the intended ones (qcom,q6v5.txt), which lists
"wcss_q6_reset" and *not* "wcss_q6_bcr_reset"

Fixes: 0af65b9b915e ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404")

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://lore.kernel.org/r/20251208223315.3540680-1-mr.nuke.me@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Pull rpmsg updates from Bjorn Andersson:
 "Mark 'data' argument in rpmsg_send() const, and perculate to related
  drivers. Replace deprecated class_destroy() with class_unregister()"

* tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg()
  ASoC: qcom: Constify GPR packet being send over GPR interface
  rpmsg: Constify buffer passed to send API
  remoteproc: mtk_scp: Constify buffer passed to scp_send_ipi()
  remoteproc: mtk_scp_ipi: Constify buffer passed to scp_ipi_send()
  drivers: rpmsg: class_destroy() is deprecated

Pull remoteproc updates from Bjorn Andersson:

 - Move requesting of IRQs in TI Keystone driver to probe time instead
   of remoteproc start, to allow better handling of errors.

 - Introduce support for more than 10 entries in the Qualcomm minidump
   implementation.

 - Add audio DSP remoteproc support for the Qualcomm Eliza platform. Add
   modem remoteproc support for the Qualcomm MDM9607, MSM8917, MSM8937,
   and MSM8940 platforms.

 - Add list of Qualcomm QMI service ids to the QMI header file, in order
   to avoid sprinkling them across the various drivers using them.
   Migrate sysmon to use this constant.

 - Fix several issues related to DeviceTree parsing and mailbox handling
   in the Xilinx R5F remote processor driver.

 - Fix incorrect error checks in reserved memory handling and polish the
   code across i.MX and TI drivers.

* tag 'rproc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (35 commits)
  remoteproc: qcom: pas: Add Eliza ADSP support
  dt-bindings: remoteproc: qcom,milos-pas: Document Eliza ADSP
  remoteproc: qcom: Add missing space before closing bracket
  dt-bindings: remoteproc: qcom: Drop types for firmware-name
  remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array
  dt-bindings: remoteproc: k3-r5f: Add memory-region-names
  dt-bindings: remoteproc: k3-r5f: Split up memory regions
  remoteproc: use SIZE_MAX in rproc_u64_fit_in_size_t()
  dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur CDSP
  dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur ADSP
  remoteproc: xlnx: Release mailbox channels on shutdown
  remoteproc: sysmon: Use the unified QMI service ID instead of defining it locally
  remoteproc: xlnx: Only access buffer information if IPI is buffered
  remoteproc: xlnx: Avoid mailbox setup
  remoteproc: keystone: Request IRQs in probe()
  remoteproc: pru: Remove empty remove callback
  remoteproc: pru: Use rproc_of_parse_firmware() to get firmware name
  remoteproc: da8xx: Reorder resource fetching in probe()
  remoteproc: da8xx: Remove unused local struct data
  remoteproc: da8xx: Use dev_err_probe()
  ...

The ADSP found on Eliza SoC is similar to the one found on SM8550.
So just add the dedicated compatible for Eliza ADSP and reuse the
SM8550 resource configuration.

Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260327-eliza-remoteproc-adsp-v1-2-1c46c5e5f809@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>

Add missing space before closing curly bracket for qcom_q6v5_mss and
qcom_q6v5_pas driver of_match[] lines, so that all qcom remoteproc
drivers are consistent on the common coding style.

Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260306145607.1394878-1-shengchao.guo@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>

MAX_NUM_OF_SS was hardcoded to 10 in the minidump_global_toc struct,
which is a direct overlay on an SMEM item allocated by the firmware.
Newer Qualcomm SoC firmware allocates space for more subsystems, while
older firmware only allocates space for 10. Bumping the constant would
cause Linux to read/write beyond the SMEM item boundary on older
platforms.

Fix this by converting subsystems[] to a flexible array member and
deriving the actual number of subsystems at runtime from the size
returned by qcom_smem_get(). Add a bounds check on minidump_id against
the derived count before indexing into the array.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260331171243.1962067-1-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>

scp_send_ipi() should only send the passed buffer, without modifying its
contents, so mark pointer 'buf' as pointer to const.

Acked-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-2-4d7fd27f037f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>

scp_ipi_send() should only send the passed buffer, without modifying its
contents, so mark pointer 'buf' as pointer to const.

Acked-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-1-4d7fd27f037f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>