From 7695d5e6e4827761b86beb3dde1f2a0409c5d3d2 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Mon, 6 Jul 2026 23:06:35 +0200
Subject: [PATCH 01/12] ASoC: qdsp6: q6apm: add voice-call blob-player
 prototype (FP6 bring-up)

Replay pre-generated APM command sequences (GRAPH_OPEN/SET_CFG/PREPARE/
START, mined from the stock FP6 ACDB by utilities/mkvoiceblobs.py)
through the q6apm GPR channel via
/sys/kernel/debug/q6apm-voice-proto/play.

Bring-up prototype for cellular voice-call audio: the replayed graphs
contain the VCPM voice config; the modem and the ADSP VCPM service
attach the vocoder to them once a call is active. Local carry only,
NOT for upstream (the upstreamable form will be topology-driven).

Assisted-by: Claude:claude-fable-5
---
 sound/soc/qcom/qdsp6/Makefile            |   2 +-
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 156 +++++++++++++++++++++++
 sound/soc/qcom/qdsp6/q6apm.c             |   3 +
 sound/soc/qcom/qdsp6/q6apm.h             |   4 +
 4 files changed, 164 insertions(+), 1 deletion(-)
 create mode 100644 sound/soc/qcom/qdsp6/q6apm-voice-proto.c

diff --git a/sound/soc/qcom/qdsp6/Makefile b/sound/soc/qcom/qdsp6/Makefile
index 67267304e7e9..d650e0b0ba5b 100644
--- a/sound/soc/qcom/qdsp6/Makefile
+++ b/sound/soc/qcom/qdsp6/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 snd-q6dsp-common-y := q6dsp-common.o q6dsp-lpass-ports.o q6dsp-lpass-clocks.o
-snd-q6apm-y := q6apm.o audioreach.o topology.o
+snd-q6apm-y := q6apm.o audioreach.o topology.o q6apm-voice-proto.o
 
 obj-$(CONFIG_SND_SOC_QDSP6_COMMON) += snd-q6dsp-common.o
 obj-$(CONFIG_SND_SOC_QDSP6_CORE) += q6core.o
diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
new file mode 100644
index 000000000000..e3c6587dde93
--- /dev/null
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Voice-call bring-up prototype for the Fairphone (Gen. 6): replay
+ * pre-generated APM command sequences through the q6apm GPR channel.
+ *
+ * The blobs reproduce, byte for byte, the GRAPH_OPEN/SET_CFG/PREPARE/START
+ * sequence the stock Android PAL/AGM/GSL stack sends to set up the
+ * handset voice-call graphs (mined from the device ACDB; generated by
+ * utilities/mkvoiceblobs.py in the bring-up repo). The modem's voice
+ * engine and the ADSP VCPM service wire up the vocoder themselves once
+ * these graphs are running.
+ *
+ * Local prototype only, NOT for upstream. Interface:
+ *   echo <fw-file> > /sys/kernel/debug/q6apm-voice-proto/play
+ * where <fw-file> is relative to /lib/firmware. Playback aborts on the
+ * first command the DSP rejects.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/firmware.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/soc/qcom/apr.h>
+#include <linux/uaccess.h>
+#include <sound/soc.h>
+#include "audioreach.h"
+#include "q6apm.h"
+
+#define Q6VP_MAGIC	0x50563651	/* "Q6VP" little-endian */
+#define Q6VP_VERSION	1
+
+struct q6vp_hdr {
+	__le32 magic;
+	__le32 version;
+	__le32 num_records;
+} __packed;
+
+struct q6vp_rec {
+	__le32 opcode;
+	__le32 size;
+} __packed;
+
+static struct q6apm *q6vp_apm;
+static struct dentry *q6vp_dir;
+
+static int q6vp_send(uint32_t opcode, const void *payload, uint32_t size)
+{
+	struct gpr_pkt *pkt;
+	int ret;
+
+	pkt = audioreach_alloc_apm_cmd_pkt(size, opcode, 0);
+	if (IS_ERR(pkt))
+		return PTR_ERR(pkt);
+
+	memcpy((void *)pkt + GPR_HDR_SIZE + APM_CMD_HDR_SIZE, payload, size);
+
+	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, 0);
+	kfree(pkt);
+
+	return ret;
+}
+
+static int q6vp_play(const char *name)
+{
+	const struct firmware *fw;
+	const struct q6vp_hdr *hdr;
+	const struct q6vp_rec *rec;
+	struct device *dev = q6vp_apm->dev;
+	size_t off;
+	uint32_t i, num, opcode, size;
+	int ret;
+
+	ret = request_firmware(&fw, name, dev);
+	if (ret) {
+		dev_err(dev, "voice-proto: cannot load %s (%d)\n", name, ret);
+		return ret;
+	}
+
+	hdr = (const struct q6vp_hdr *)fw->data;
+	if (fw->size < sizeof(*hdr) ||
+	    le32_to_cpu(hdr->magic) != Q6VP_MAGIC ||
+	    le32_to_cpu(hdr->version) != Q6VP_VERSION) {
+		dev_err(dev, "voice-proto: %s: bad header\n", name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	num = le32_to_cpu(hdr->num_records);
+	off = sizeof(*hdr);
+	for (i = 0; i < num; i++) {
+		if (off + sizeof(*rec) > fw->size) {
+			ret = -EINVAL;
+			goto out;
+		}
+		rec = (const struct q6vp_rec *)(fw->data + off);
+		opcode = le32_to_cpu(rec->opcode);
+		size = le32_to_cpu(rec->size);
+		off += sizeof(*rec);
+		if (off + size > fw->size) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ret = q6vp_send(opcode, fw->data + off, size);
+		dev_info(dev, "voice-proto: %s[%u] opcode 0x%08x size %u -> %d\n",
+			 name, i, opcode, size, ret);
+		if (ret)
+			goto out;
+
+		off += ALIGN(size, 4);
+	}
+
+out:
+	release_firmware(fw);
+	return ret;
+}
+
+static ssize_t q6vp_play_write(struct file *file, const char __user *ubuf,
+			       size_t count, loff_t *ppos)
+{
+	char name[128];
+	int ret;
+
+	if (!q6vp_apm)
+		return -ENODEV;
+	if (count >= sizeof(name))
+		return -EINVAL;
+	if (copy_from_user(name, ubuf, count))
+		return -EFAULT;
+	name[count] = '\0';
+	strim(name);
+
+	ret = q6vp_play(name);
+
+	return ret ? ret : count;
+}
+
+static const struct file_operations q6vp_play_fops = {
+	.open = simple_open,
+	.write = q6vp_play_write,
+	.llseek = default_llseek,
+};
+
+void q6apm_voice_proto_init(struct q6apm *apm)
+{
+	q6vp_apm = apm;
+	q6vp_dir = debugfs_create_dir("q6apm-voice-proto", NULL);
+	debugfs_create_file("play", 0200, q6vp_dir, NULL, &q6vp_play_fops);
+}
+
+void q6apm_voice_proto_exit(void)
+{
+	debugfs_remove_recursive(q6vp_dir);
+	q6vp_dir = NULL;
+	q6vp_apm = NULL;
+}
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 2ab378fb5032..cd7a9a1e0b9b 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -764,6 +764,8 @@ static int apm_probe(gpr_device_t *gdev)
 
 	g_apm = apm;
 
+	q6apm_voice_proto_init(apm);
+
 	q6apm_get_apm_state(apm);
 
 	ret = snd_soc_register_component(dev, &q6apm_audio_component, NULL, 0);
@@ -781,6 +783,7 @@ static int apm_probe(gpr_device_t *gdev)
 
 static void apm_remove(gpr_device_t *gdev)
 {
+	q6apm_voice_proto_exit();
 	of_platform_depopulate(&gdev->dev);
 	snd_soc_unregister_component(&gdev->dev);
 }
diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h
index 376a36700c53..736a2b53f303 100644
--- a/sound/soc/qcom/qdsp6/q6apm.h
+++ b/sound/soc/qcom/qdsp6/q6apm.h
@@ -157,4 +157,8 @@ int q6apm_remove_initial_silence(struct device *dev, struct q6apm_graph *graph,
 int q6apm_remove_trailing_silence(struct device *dev, struct q6apm_graph *graph, uint32_t samples);
 int q6apm_set_real_module_id(struct device *dev, struct q6apm_graph *graph, uint32_t codec_id);
 int q6apm_get_hw_pointer(struct q6apm_graph *graph, int dir);
+
+/* FP6 voice-call bring-up prototype (q6apm-voice-proto.c) */
+void q6apm_voice_proto_init(struct q6apm *apm);
+void q6apm_voice_proto_exit(void);
 #endif /* __APM_GRAPH_ */

From 2626032a50042275307cbb4c7f23c356697939f2 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Mon, 6 Jul 2026 23:17:04 +0200
Subject: [PATCH 02/12] voice-proto: continue on DSP rejections, log each
 record result

Assisted-by: Claude:claude-fable-5
---
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
index e3c6587dde93..744d9fc0c80b 100644
--- a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -68,7 +68,7 @@ static int q6vp_play(const char *name)
 	struct device *dev = q6vp_apm->dev;
 	size_t off;
 	uint32_t i, num, opcode, size;
-	int ret;
+	int ret, err = 0;
 
 	ret = request_firmware(&fw, name, dev);
 	if (ret) {
@@ -104,15 +104,16 @@ static int q6vp_play(const char *name)
 		ret = q6vp_send(opcode, fw->data + off, size);
 		dev_info(dev, "voice-proto: %s[%u] opcode 0x%08x size %u -> %d\n",
 			 name, i, opcode, size, ret);
+		/* keep going on DSP rejections; each result is logged */
 		if (ret)
-			goto out;
+			err = ret;
 
 		off += ALIGN(size, 4);
 	}
 
 out:
 	release_firmware(fw);
-	return ret;
+	return ret ? ret : err;
 }
 
 static ssize_t q6vp_play_write(struct file *file, const char __user *ubuf,

From 0c63174949e10000c7a18af637c7bd4b11e9323e Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Tue, 7 Jul 2026 20:07:01 +0200
Subject: [PATCH 03/12] net: qrtr: forward data packets between endpoints (FP6
 voice prototype)

The DSP subsystems are star-connected through the application
processor: each has a qrtr link to us but none to each other. Incoming
packets whose dst_node is neither the local node nor broadcast are
currently delivered to a *local* port matching dst_port (usually
nothing) and dropped, so two remote DSPs can never exchange QMI
messages.

On the FP6 (SM7635, AudioReach) the modem's voice stack needs exactly
that: it must reach the ADSP's service-registry notifier / audio
service to attach the vocoder to a VCPM voice session. Without
forwarding, every voice graph starts cleanly but the modem never
streams a single mailbox packet - calls stay silent both ways (see
journal/calls.md 2026-07-07/08).

Forward DATA and RESUME_TX packets destined to another known node onto
that node's endpoint, re-using qrtr_node_enqueue for per-hop flow
control. RESUME_TX additionally releases this hop's flow token on the
arrival link; per-hop counters stay in lockstep with end-to-end ones
because every packet of a forwarded flow transits this node. Control
packets keep flowing to the local ns, which already redistributes
service announcements mesh-wide.

Prototype for the milos carry; needs discussion (loop prevention,
broadcast handling, flow-control semantics) before any upstream
attempt.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 net/qrtr/af_qrtr.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index db823177e636..aae337572be7 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -520,6 +520,54 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 		qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
 	}
 
+	/* The DSPs are star-connected through this node: forward packets
+	 * destined to another node onto that node's endpoint (e.g. the
+	 * modem's voice stack talking to the ADSP's audio service). Only
+	 * DATA and RESUME_TX transit; control packets keep going to the
+	 * local ns, which does its own mesh-wide redistribution. RESUME_TX
+	 * additionally releases this hop's flow-control token on the
+	 * arrival link: per-hop counters advance in lockstep with the
+	 * end-to-end ones since every packet of the flow transits here.
+	 */
+	if (cb->dst_node != qrtr_local_nid &&
+	    cb->dst_node != QRTR_NODE_BCAST &&
+	    (cb->type == QRTR_TYPE_DATA || cb->type == QRTR_TYPE_RESUME_TX)) {
+		struct sockaddr_qrtr from = {AF_QIPCRTR,
+					     cb->src_node, cb->src_port};
+		struct sockaddr_qrtr to = {AF_QIPCRTR,
+					   cb->dst_node, cb->dst_port};
+		struct qrtr_node *dst;
+
+		dst = qrtr_node_lookup(cb->dst_node);
+		if (!dst || dst == node) {
+			if (dst)
+				qrtr_node_release(dst);
+			goto err;
+		}
+
+		if (cb->type == QRTR_TYPE_RESUME_TX) {
+			struct sk_buff *clone;
+
+			clone = skb_clone(skb, GFP_ATOMIC);
+			if (clone)
+				qrtr_tx_resume(node, clone);
+		}
+
+		pr_debug("qrtr: fwd %u:%u -> %u:%u type %d len %zu\n",
+			 cb->src_node, cb->src_port,
+			 cb->dst_node, cb->dst_port, cb->type, size);
+
+		if (skb_cow_head(skb, sizeof(struct qrtr_hdr_v1))) {
+			qrtr_node_release(dst);
+			goto err;
+		}
+
+		qrtr_node_enqueue(dst, skb, cb->type, &from, &to);
+		qrtr_node_release(dst);
+
+		return 0;
+	}
+
 	if (cb->type == QRTR_TYPE_RESUME_TX) {
 		qrtr_tx_resume(node, skb);
 	} else {

From 5f42f9a74a3a324a92dc803d30514811bd107497 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Wed, 8 Jul 2026 01:31:08 +0200
Subject: [PATCH 04/12] voice-proto: add out-of-band (shared memory) command
 support

Stock GSL delivers every voice GRAPH_OPEN out-of-band: the whole graph
(all subgraphs plus the cross-subgraph module connections and control
links, 4.3-4.7 KB) must be opened atomically in ONE command, which
exceeds the in-band GPR/GLINK intent limit. Splitting the open
per-subgraph to fit in-band makes the cross-referencing TX DevicePP
subgraph invalid - the root cause of every pp-subgraph open failure
since 2026-07-06 (byte-identical payloads open fine when sent whole;
verified against a gsl_log.bin packet capture of a working call on
stock Android).

Records with bit 31 set in the opcode are copied into a DMA buffer
allocated from the q6apm-dais device (it carries the ADSP SMMU
mapping), mapped once with the DSP via q6apm_map_memory_fixed_region
under a private graph id, and referenced by absolute DSP address in
the apm_cmd_header (mainline maps in absolute mode; GSL uses offset
mode - the DSP rejects offset references against our mapping).

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 158 ++++++++++++++++++++++-
 1 file changed, 156 insertions(+), 2 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
index 744d9fc0c80b..76817a881e8c 100644
--- a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -17,8 +17,11 @@
  */
 
 #include <linux/debugfs.h>
+#include <linux/dma-mapping.h>
 #include <linux/firmware.h>
 #include <linux/kernel.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/soc/qcom/apr.h>
 #include <linux/uaccess.h>
@@ -29,6 +32,22 @@
 #define Q6VP_MAGIC	0x50563651	/* "Q6VP" little-endian */
 #define Q6VP_VERSION	1
 
+/*
+ * A record opcode with this bit set is sent out-of-band: the payload is
+ * placed in an ADSP-mapped shared-memory region and the GPR command carries
+ * only an apm_cmd_header referencing it. Stock GSL sends every voice
+ * GRAPH_OPEN this way; it is mandatory because a voice graph must be opened
+ * atomically as one command (all subgraphs + cross-subgraph module
+ * connections and control links), and the whole payload (~4.3-4.7 KB)
+ * exceeds the ~4 KiB in-band GPR/GLINK intent limit. Splitting the open
+ * per-subgraph to fit in-band makes the cross-referencing TX DevicePP
+ * subgraph invalid (rejected at open) — see journal/calls.md 2026-07-08.
+ */
+#define Q6VP_OOB_FLAG		0x80000000
+#define Q6VP_GRAPH_ID		0xf000		/* private mem-map handle owner */
+#define Q6VP_BUF_SZ		0x40000		/* 256 KiB scratch region */
+#define Q6VP_SID_MASK		0xf
+
 struct q6vp_hdr {
 	__le32 magic;
 	__le32 version;
@@ -42,6 +61,11 @@ struct q6vp_rec {
 
 static struct q6apm *q6vp_apm;
 static struct dentry *q6vp_dir;
+static struct device *q6vp_dais_dev;
+static struct audioreach_graph_info *q6vp_info;
+static void *q6vp_buf;
+static dma_addr_t q6vp_buf_iova;
+static phys_addr_t q6vp_buf_dsp_addr;
 
 static int q6vp_send(uint32_t opcode, const void *payload, uint32_t size)
 {
@@ -60,6 +84,117 @@ static int q6vp_send(uint32_t opcode, const void *payload, uint32_t size)
 	return ret;
 }
 
+/*
+ * Lazily set up the shared-memory region used for OOB commands: allocate a
+ * DMA buffer against the q6apm-dais child device (it carries the iommus
+ * mapping the ADSP expects, same as the PCM data path), register a private
+ * graph_info so the APM_CMD_RSP_SHARED_MEM_MAP_REGIONS callback has a slot
+ * to store the handle in, and map the region with the DSP. The mapping is
+ * kept until the module goes away.
+ */
+static int q6vp_oob_init(void)
+{
+	struct device *dev = q6vp_apm->dev;
+	struct of_phandle_args args;
+	struct platform_device *pdev;
+	struct device_node *np;
+	u64 sid = 0;
+	u32 graph_id = Q6VP_GRAPH_ID;
+	int ret;
+
+	if (q6vp_info && q6vp_info->mem_map_handle)
+		return 0;
+
+	if (!q6vp_dais_dev) {
+		np = of_get_compatible_child(dev->of_node, "qcom,q6apm-dais");
+		if (!np) {
+			dev_err(dev, "voice-proto: no q6apm-dais node\n");
+			return -ENODEV;
+		}
+		if (!of_parse_phandle_with_fixed_args(np, "iommus", 1, 0,
+						      &args)) {
+			sid = args.args[0] & Q6VP_SID_MASK;
+			of_node_put(args.np);
+		}
+		pdev = of_find_device_by_node(np);
+		of_node_put(np);
+		if (!pdev) {
+			dev_err(dev, "voice-proto: no q6apm-dais device\n");
+			return -ENODEV;
+		}
+		q6vp_dais_dev = &pdev->dev;
+
+		q6vp_buf = dma_alloc_coherent(q6vp_dais_dev, Q6VP_BUF_SZ,
+					      &q6vp_buf_iova, GFP_KERNEL);
+		if (!q6vp_buf)
+			return -ENOMEM;
+		q6vp_buf_dsp_addr = q6vp_buf_iova | (sid << 32);
+	}
+
+	if (!q6vp_info) {
+		q6vp_info = kzalloc(sizeof(*q6vp_info), GFP_KERNEL);
+		if (!q6vp_info)
+			return -ENOMEM;
+		INIT_LIST_HEAD(&q6vp_info->sg_list);
+		q6vp_info->id = Q6VP_GRAPH_ID;
+		ret = idr_alloc_u32(&q6vp_apm->graph_info_idr, q6vp_info,
+				    &graph_id, graph_id, GFP_KERNEL);
+		if (ret < 0) {
+			kfree(q6vp_info);
+			q6vp_info = NULL;
+			return ret;
+		}
+	}
+
+	ret = q6apm_map_memory_fixed_region(q6vp_dais_dev, Q6VP_GRAPH_ID,
+					    q6vp_buf_dsp_addr, Q6VP_BUF_SZ);
+	if (ret) {
+		dev_err(dev, "voice-proto: mem map failed (%d)\n", ret);
+		return ret;
+	}
+
+	dev_info(dev, "voice-proto: OOB region mapped, handle 0x%x\n",
+		 q6vp_info->mem_map_handle);
+	return 0;
+}
+
+static int q6vp_send_oob(uint32_t opcode, const void *payload, uint32_t size)
+{
+	struct apm_cmd_header *cmd_header;
+	struct gpr_pkt *pkt;
+	int ret;
+
+	if (size > Q6VP_BUF_SZ)
+		return -EFBIG;
+
+	ret = q6vp_oob_init();
+	if (ret)
+		return ret;
+
+	memcpy(q6vp_buf, payload, size);
+
+	pkt = audioreach_alloc_apm_cmd_pkt(0, opcode, 0);
+	if (IS_ERR(pkt))
+		return PTR_ERR(pkt);
+
+	/*
+	 * The region is mapped in absolute-address mode (mainline's
+	 * q6apm_map_memory_fixed_region passes property_flag 0, unlike GSL
+	 * which maps with IS_OFFSET_MODE and then references offset 0), so
+	 * the header carries the full DSP-visible address of the buffer.
+	 */
+	cmd_header = (void *)pkt + GPR_HDR_SIZE;
+	cmd_header->payload_address_lsw = lower_32_bits(q6vp_buf_dsp_addr);
+	cmd_header->payload_address_msw = upper_32_bits(q6vp_buf_dsp_addr);
+	cmd_header->mem_map_handle = q6vp_info->mem_map_handle;
+	cmd_header->payload_size = size;
+
+	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, 0);
+	kfree(pkt);
+
+	return ret;
+}
+
 static int q6vp_play(const char *name)
 {
 	const struct firmware *fw;
@@ -101,9 +236,13 @@ static int q6vp_play(const char *name)
 			goto out;
 		}
 
-		ret = q6vp_send(opcode, fw->data + off, size);
+		if (opcode & Q6VP_OOB_FLAG)
+			ret = q6vp_send_oob(opcode & ~Q6VP_OOB_FLAG,
+					    fw->data + off, size);
+		else
+			ret = q6vp_send(opcode, fw->data + off, size);
 		dev_info(dev, "voice-proto: %s[%u] opcode 0x%08x size %u -> %d\n",
-			 name, i, opcode, size, ret);
+			 name, i, opcode & ~Q6VP_OOB_FLAG, size, ret);
 		/* keep going on DSP rejections; each result is logged */
 		if (ret)
 			err = ret;
@@ -153,5 +292,20 @@ void q6apm_voice_proto_exit(void)
 {
 	debugfs_remove_recursive(q6vp_dir);
 	q6vp_dir = NULL;
+
+	if (q6vp_info) {
+		if (q6vp_info->mem_map_handle)
+			q6apm_unmap_memory_fixed_region(q6vp_dais_dev,
+							Q6VP_GRAPH_ID);
+		idr_remove(&q6vp_apm->graph_info_idr, Q6VP_GRAPH_ID);
+		kfree(q6vp_info);
+		q6vp_info = NULL;
+	}
+	if (q6vp_buf) {
+		dma_free_coherent(q6vp_dais_dev, Q6VP_BUF_SZ, q6vp_buf,
+				  q6vp_buf_iova);
+		q6vp_buf = NULL;
+	}
+	q6vp_dais_dev = NULL;
 	q6vp_apm = NULL;
 }

From d36259f54be1246700ae171b7a1abcf40c5001a3 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Wed, 8 Jul 2026 01:31:08 +0200
Subject: [PATCH 05/12] arm64: dts: qcom: milos: add fastrpc remote heap for
 the ADSP audio PD

The ADSP audio PD loads its voice post-processing modules (Fluence
NN/EF/pro-vc etc.) as dynamic shared objects fetched from the apps
filesystem at GRAPH_OPEN time through FastRPC (adsprpcd attached with
createstaticpd:audiopd serves the files - /vendor/dsp/adsp on stock).
The static-PD attach allocates a remote heap that must be SCM-assigned
to the DSP: without qcom,vmids the heap stays HLOS-owned and the PD's
first touch kills the SoC instantly (xPU violation, no kernel output).

Add a 12 MiB CMA pool (mirroring downstream's adsp_mem_heap: 32-bit
addressable, 4 MiB aligned) and the LPASS/ADSP_HEAP vmids, following
the sc7280 (kodiak) precedent where upstream audiopd support landed.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 arch/arm64/boot/dts/qcom/milos.dtsi | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/milos.dtsi b/arch/arm64/boot/dts/qcom/milos.dtsi
index 288e0e658629..5394f51bdd31 100644
--- a/arch/arm64/boot/dts/qcom/milos.dtsi
+++ b/arch/arm64/boot/dts/qcom/milos.dtsi
@@ -548,6 +548,14 @@
 			no-map;
 		};
 
+		adsp_rpc_heap_mem: adsp-rpc-heap {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x0 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0xc00000>;
+		};
+
 		pvm_fw_mem: pvm-fw-region@824a0000 {
 			reg = <0x0 0x824a0000 0x0 0x100000>;
 			no-map;
@@ -1398,6 +1406,9 @@
 					qcom,glink-channels = "fastrpcglink-apps-dsp";
 					label = "adsp";
 					qcom,non-secure-domain;
+					memory-region = <&adsp_rpc_heap_mem>;
+					qcom,vmids = <QCOM_SCM_VMID_LPASS
+						      QCOM_SCM_VMID_ADSP_HEAP>;
 					#address-cells = <1>;
 					#size-cells = <0>;
 

From 3c381d76fc2ef576f97aa2e9f02fa2433b4dc43c Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Thu, 9 Jul 2026 00:44:51 +0200
Subject: [PATCH 06/12] voice-proto: make cal registration safe; handle
 REGISTER_CFG responses

- apm_callback: store results for APM_CMD_REGISTER_CFG (0x01001008) so
  registrations complete synchronously instead of always timing out
  (their success/failure was previously invisible and each cost 5 s).
- voice-proto: REGISTER_CFG payloads get permanent bump-allocated
  slices in the shared region instead of reusing the scratch slot -
  the DSP keeps reading registered config memory, and overwriting it
  with the next record's payload while registered wedged the SoC hard
  (two force-reboots on 2026-07-08).
- Grow the region to 8 MiB (the stock sequence registers a 6.4 MiB
  global cal blob) and raise the shared command timeout to 30 s: a
  voice GRAPH_OPEN can block >5 s while the ADSP dynamically loads the
  Fluence modules through FastRPC.

With this the full RX-side stock sequence (open, 139 KB cal register,
VSID/cal-keys, EP configs, prepare, start) completes with status 0 on
a live call; TX GRAPH_START is the one remaining DSP rejection.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 sound/soc/qcom/qdsp6/audioreach.c        |  4 +--
 sound/soc/qcom/qdsp6/audioreach.h        |  1 +
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 31 ++++++++++++++++++------
 sound/soc/qcom/qdsp6/q6apm.c             |  1 +
 4 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/audioreach.c b/sound/soc/qcom/qdsp6/audioreach.c
index a13f753eff98..7cb81ec586a2 100644
--- a/sound/soc/qcom/qdsp6/audioreach.c
+++ b/sound/soc/qcom/qdsp6/audioreach.c
@@ -601,9 +601,9 @@ int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev,
 
 	if (rsp_opcode)
 		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode) ||
-					(result->opcode == rsp_opcode),	5 * HZ);
+					(result->opcode == rsp_opcode),	30 * HZ);
 	else
-		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 5 * HZ);
+		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 30 * HZ);
 
 	if (!rc) {
 		dev_err(dev, "CMD timeout for [%x] opcode\n", hdr->opcode);
diff --git a/sound/soc/qcom/qdsp6/audioreach.h b/sound/soc/qcom/qdsp6/audioreach.h
index 6859770b38a6..19011c02572e 100644
--- a/sound/soc/qcom/qdsp6/audioreach.h
+++ b/sound/soc/qcom/qdsp6/audioreach.h
@@ -58,6 +58,7 @@ struct q6apm_graph;
 #define APM_CMD_GRAPH_FLUSH			0x01001005
 #define APM_CMD_SET_CFG				0x01001006
 #define APM_CMD_GET_CFG				0x01001007
+#define APM_CMD_REGISTER_CFG			0x01001008
 #define APM_CMD_SHARED_MEM_MAP_REGIONS		0x0100100C
 #define APM_CMD_SHARED_MEM_UNMAP_REGIONS	0x0100100D
 #define APM_CMD_RSP_SHARED_MEM_MAP_REGIONS	0x02001001
diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
index 76817a881e8c..b10e6e5214bd 100644
--- a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -45,7 +45,8 @@
  */
 #define Q6VP_OOB_FLAG		0x80000000
 #define Q6VP_GRAPH_ID		0xf000		/* private mem-map handle owner */
-#define Q6VP_BUF_SZ		0x40000		/* 256 KiB scratch region */
+#define Q6VP_BUF_SZ		0x800000	/* 8 MiB shared region */
+#define Q6VP_SCRATCH_SZ		0x10000		/* [0, 64K): transient commands */
 #define Q6VP_SID_MASK		0xf
 
 struct q6vp_hdr {
@@ -158,20 +159,36 @@ static int q6vp_oob_init(void)
 	return 0;
 }
 
+/*
+ * Persistent-slice bump offset: APM_CMD_REGISTER_CFG registers the payload
+ * with the DSP, which keeps reading that memory for as long as the config
+ * stays registered — those payloads must never be overwritten. They get
+ * bump-allocated slices above Q6VP_SCRATCH_SZ that live until reboot;
+ * transient commands (opens etc.) reuse the scratch slot at offset 0.
+ */
+static u32 q6vp_persist_off = Q6VP_SCRATCH_SZ;
+
 static int q6vp_send_oob(uint32_t opcode, const void *payload, uint32_t size)
 {
 	struct apm_cmd_header *cmd_header;
 	struct gpr_pkt *pkt;
+	u32 off = 0;
 	int ret;
 
-	if (size > Q6VP_BUF_SZ)
-		return -EFBIG;
-
 	ret = q6vp_oob_init();
 	if (ret)
 		return ret;
 
-	memcpy(q6vp_buf, payload, size);
+	if (opcode == APM_CMD_REGISTER_CFG) {
+		if (q6vp_persist_off + size > Q6VP_BUF_SZ)
+			return -EFBIG;
+		off = q6vp_persist_off;
+		q6vp_persist_off += ALIGN(size, SZ_4K);
+	} else if (size > Q6VP_SCRATCH_SZ) {
+		return -EFBIG;
+	}
+
+	memcpy(q6vp_buf + off, payload, size);
 
 	pkt = audioreach_alloc_apm_cmd_pkt(0, opcode, 0);
 	if (IS_ERR(pkt))
@@ -184,8 +201,8 @@ static int q6vp_send_oob(uint32_t opcode, const void *payload, uint32_t size)
 	 * the header carries the full DSP-visible address of the buffer.
 	 */
 	cmd_header = (void *)pkt + GPR_HDR_SIZE;
-	cmd_header->payload_address_lsw = lower_32_bits(q6vp_buf_dsp_addr);
-	cmd_header->payload_address_msw = upper_32_bits(q6vp_buf_dsp_addr);
+	cmd_header->payload_address_lsw = lower_32_bits(q6vp_buf_dsp_addr + off);
+	cmd_header->payload_address_msw = upper_32_bits(q6vp_buf_dsp_addr + off);
 	cmd_header->mem_map_handle = q6vp_info->mem_map_handle;
 	cmd_header->payload_size = size;
 
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index cd7a9a1e0b9b..95472e6984bb 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -820,6 +820,7 @@ static int apm_callback(const struct gpr_resp_pkt *data, void *priv, int op)
 	case GPR_BASIC_RSP_RESULT:
 		switch (result->opcode) {
 		case APM_CMD_SHARED_MEM_MAP_REGIONS:
+		case APM_CMD_REGISTER_CFG:
 		case APM_CMD_GRAPH_START:
 		case APM_CMD_GRAPH_OPEN:
 		case APM_CMD_GRAPH_PREPARE:

From cfc2b6a2765e43cad60f7fce9afe47faf4aa004d Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Fri, 10 Jul 2026 23:50:20 +0200
Subject: [PATCH 07/12] voice-proto: AMDB module pre-loading, longer cmd
 timeout

Three findings from the 2026-07-10 warm-capture session (journal/calls.md):
the stock voice sequence is byte-identical warm vs cold, so our replay
bytes were never the problem; VCPM rejects TX-side cal (EBADPARAM) while
accepting byte-identical RX cal through the same transport; and a voice
GRAPH_OPEN that has to FastRPC-load the Fluence pp modules takes >120 s
cold, so the client-side timeout/verify dance leaves failed opens in
VCPM's session history.

- apm_callback: handle AMDB_CMD_RSP_LOAD_MODULES (AMDB load responds
  with its own opcode, not an ibasic result); log per-module handles
  (handle 0 = not registered - e.g. 0x70010a3, which only appears after
  fluence_nn_module_fvxiii.so.1 is parsed).
- voice-proto: Q6VP_DSTPORT_FLAG record flag - first payload word
  carries the GPR destination port, so blobs can address static services
  other than APM (AMDB port 3 module pre-loading via mkamdbload.py).
- Raise the shared command timeout to 300 s so a cold TX voice
  GRAPH_OPEN (~125 s through the Fluence loads) completes inside ONE
  command with no retry dance.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 sound/soc/qcom/qdsp6/audioreach.c        |  4 +-
 sound/soc/qcom/qdsp6/audioreach.h        |  2 +
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 51 +++++++++++++++++++++---
 sound/soc/qcom/qdsp6/q6apm.c             | 17 ++++++++
 4 files changed, 67 insertions(+), 7 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/audioreach.c b/sound/soc/qcom/qdsp6/audioreach.c
index 7cb81ec586a2..12aa04e9504c 100644
--- a/sound/soc/qcom/qdsp6/audioreach.c
+++ b/sound/soc/qcom/qdsp6/audioreach.c
@@ -601,9 +601,9 @@ int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev,
 
 	if (rsp_opcode)
 		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode) ||
-					(result->opcode == rsp_opcode),	30 * HZ);
+					(result->opcode == rsp_opcode),	240 * HZ);
 	else
-		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 30 * HZ);
+		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 240 * HZ);
 
 	if (!rc) {
 		dev_err(dev, "CMD timeout for [%x] opcode\n", hdr->opcode);
diff --git a/sound/soc/qcom/qdsp6/audioreach.h b/sound/soc/qcom/qdsp6/audioreach.h
index 19011c02572e..fad5f700dc86 100644
--- a/sound/soc/qcom/qdsp6/audioreach.h
+++ b/sound/soc/qcom/qdsp6/audioreach.h
@@ -65,6 +65,8 @@ struct q6apm_graph;
 #define APM_CMD_RSP_GET_CFG			0x02001000
 #define APM_CMD_CLOSE_ALL			0x01001013
 #define APM_CMD_REGISTER_SHARED_CFG		0x0100100A
+#define AMDB_CMD_LOAD_MODULES			0x01001020
+#define AMDB_CMD_RSP_LOAD_MODULES		0x02001008
 
 #define APM_MEMORY_MAP_SHMEM8_4K_POOL		3
 
diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
index b10e6e5214bd..0ce26f5d8f0a 100644
--- a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -44,6 +44,17 @@
  * subgraph invalid (rejected at open) — see journal/calls.md 2026-07-08.
  */
 #define Q6VP_OOB_FLAG		0x80000000
+/*
+ * A record opcode with this bit set carries the GPR destination port in the
+ * first payload word (stripped before sending). Lets a blob address static
+ * services other than APM — e.g. AMDB (port 3) module pre-loading, so the
+ * dynamic Fluence pp modules can be made resident BEFORE the voice
+ * GRAPH_OPENs. A first open that has to FastRPC-load them can fail or block
+ * so long that the client-side retry dance corrupts VCPM's per-VSID voice
+ * session (TX cal EBADPARAM / TX START EFAILED, journal/calls.md
+ * 2026-07-10). In-band records only.
+ */
+#define Q6VP_DSTPORT_FLAG	0x40000000
 #define Q6VP_GRAPH_ID		0xf000		/* private mem-map handle owner */
 #define Q6VP_BUF_SZ		0x800000	/* 8 MiB shared region */
 #define Q6VP_SCRATCH_SZ		0x10000		/* [0, 64K): transient commands */
@@ -60,6 +71,7 @@ struct q6vp_rec {
 	__le32 size;
 } __packed;
 
+static DEFINE_MUTEX(q6vp_play_lock);
 static struct q6apm *q6vp_apm;
 static struct dentry *q6vp_dir;
 static struct device *q6vp_dais_dev;
@@ -70,16 +82,32 @@ static phys_addr_t q6vp_buf_dsp_addr;
 
 static int q6vp_send(uint32_t opcode, const void *payload, uint32_t size)
 {
+	uint32_t dest_port = APM_MODULE_INSTANCE_ID;
+	uint32_t rsp_opcode = 0;
 	struct gpr_pkt *pkt;
 	int ret;
 
-	pkt = audioreach_alloc_apm_cmd_pkt(size, opcode, 0);
+	if (opcode & Q6VP_DSTPORT_FLAG) {
+		if (size < sizeof(__le32))
+			return -EINVAL;
+		dest_port = le32_to_cpup(payload);
+		payload += sizeof(__le32);
+		size -= sizeof(__le32);
+		opcode &= ~Q6VP_DSTPORT_FLAG;
+	}
+
+	/* AMDB load responds with its own opcode, not an ibasic result */
+	if (opcode == AMDB_CMD_LOAD_MODULES)
+		rsp_opcode = AMDB_CMD_RSP_LOAD_MODULES;
+
+	pkt = audioreach_alloc_cmd_pkt(size, opcode, 0, GPR_APM_MODULE_IID,
+				       dest_port);
 	if (IS_ERR(pkt))
 		return PTR_ERR(pkt);
 
 	memcpy((void *)pkt + GPR_HDR_SIZE + APM_CMD_HDR_SIZE, payload, size);
 
-	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, 0);
+	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, rsp_opcode);
 	kfree(pkt);
 
 	return ret;
@@ -254,12 +282,15 @@ static int q6vp_play(const char *name)
 		}
 
 		if (opcode & Q6VP_OOB_FLAG)
-			ret = q6vp_send_oob(opcode & ~Q6VP_OOB_FLAG,
-					    fw->data + off, size);
+			ret = (opcode & Q6VP_DSTPORT_FLAG) ? -EINVAL :
+				q6vp_send_oob(opcode & ~Q6VP_OOB_FLAG,
+					      fw->data + off, size);
 		else
 			ret = q6vp_send(opcode, fw->data + off, size);
 		dev_info(dev, "voice-proto: %s[%u] opcode 0x%08x size %u -> %d\n",
-			 name, i, opcode & ~Q6VP_OOB_FLAG, size, ret);
+			 name, i,
+			 opcode & ~(Q6VP_OOB_FLAG | Q6VP_DSTPORT_FLAG),
+			 size, ret);
 		/* keep going on DSP rejections; each result is logged */
 		if (ret)
 			err = ret;
@@ -287,7 +318,17 @@ static ssize_t q6vp_play_write(struct file *file, const char __user *ubuf,
 	name[count] = '\0';
 	strim(name);
 
+	/*
+	 * Serialize blob playback: concurrent debugfs writers (e.g. a
+	 * dropped ssh session whose write is still stuck in a DSP wait)
+	 * would interleave their records on the GPR channel and corrupt
+	 * both sequences (seen 2026-07-10).
+	 */
+	ret = mutex_lock_interruptible(&q6vp_play_lock);
+	if (ret)
+		return ret;
 	ret = q6vp_play(name);
+	mutex_unlock(&q6vp_play_lock);
 
 	return ret ? ret : count;
 }
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 95472e6984bb..56c4c1d817e4 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -853,6 +853,23 @@ static int apm_callback(const struct gpr_resp_pkt *data, void *priv, int op)
 			break;
 		}
 		break;
+	case AMDB_CMD_RSP_LOAD_MODULES: {
+		/* amdb_module_load_unload_t: proc_domain, error_code,
+		 * num_modules, {module_id, handle_lsw, handle_msw}[].
+		 * A zero handle = module not registered with the AMDB.
+		 */
+		const u32 *amdb = data->payload;
+		u32 i, n = amdb[2];
+
+		for (i = 0; i < n; i++)
+			dev_info(dev, "AMDB load: module 0x%08x handle 0x%08x%08x\n",
+				 amdb[3 + 3 * i], amdb[5 + 3 * i],
+				 amdb[4 + 3 * i]);
+		apm->result.opcode = hdr->opcode;
+		apm->result.status = amdb[1];
+		wake_up(&apm->wait);
+		break;
+	}
 	case APM_CMD_RSP_SHARED_MEM_MAP_REGIONS:
 		apm->result.opcode = hdr->opcode;
 		apm->result.status = 0;

From f3eb810dfe89bab799a4a24325e569dc6b84b66b Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Sat, 11 Jul 2026 15:58:09 +0200
Subject: [PATCH 08/12] voice-proto: route audiopd to its dedicated context
 bank (pd-type)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The aDSP refuses to dlopen unsigned dynamic modules (fluence_nn) in an
audio static PD spawned on a generic context bank: it demands a
per-device testsig, which production-fused units cannot satisfy. Stock
(downstream adsprpc) binds audiopd to a dedicated CB — volcano-dsp.dtsi
cb12, SIDs 0x1005/0x1065, pd-type = <2> (AUDIO_STATICPD) — and there the
same unsigned fluence_nn loads fine on identical silicon.

Mirror that: tag compute-cb@5 (same SIDs) with pd-type = <2>, keep
pd-typed banks out of generic round-robin session allocation, and on
createstaticpd of "audiopd" re-route the client to the tagged session
before anything is allocated against it, so every IOVA the DSP sees for
this PD carries the audio bank's SID.

Local milos carry, not upstreamable as-is (upstream binding has no
pd-type model). See journal/calls.md 2026-07-11 session 10.

Assisted-by: Claude:claude-fable-5
---
 arch/arm64/boot/dts/qcom/milos.dtsi |  2 +
 drivers/misc/fastrpc.c              | 67 ++++++++++++++++++++++++++++-
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/milos.dtsi b/arch/arm64/boot/dts/qcom/milos.dtsi
index 5394f51bdd31..0f95a9976de7 100644
--- a/arch/arm64/boot/dts/qcom/milos.dtsi
+++ b/arch/arm64/boot/dts/qcom/milos.dtsi
@@ -1433,6 +1433,8 @@
 						reg = <5>;
 						iommus = <&apps_smmu 0x1005 0x0>,
 							 <&apps_smmu 0x1065 0x0>;
+						/* AUDIO_STATICPD bank, per downstream volcano-dsp.dtsi */
+						pd-type = <2>;
 						dma-coherent;
 					};
 
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f3a49384586d..2de896bfe921 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -103,6 +103,13 @@
 #define USER_PD		(1)
 #define SENSORS_PD	(2)
 
+/*
+ * Downstream DT "pd-type" context-bank designations (volcano-dsp.dtsi).
+ * A static PD must be spawned on its designated context bank / SMMU
+ * stream or the DSP treats it as a generic signed PD.
+ */
+#define FASTRPC_DT_PD_TYPE_AUDIO_STATICPD	2
+
 #define miscdev_to_fdevice(d) container_of(d, struct fastrpc_device, miscdev)
 
 struct fastrpc_phy_page {
@@ -255,6 +262,8 @@ struct fastrpc_session_ctx {
 	int sid;
 	bool used;
 	bool valid;
+	/* downstream DT pd-type this context bank is dedicated to (0 = generic) */
+	u32 pd_type;
 };
 
 struct fastrpc_soc_data {
@@ -314,6 +323,11 @@ struct fastrpc_user {
 	struct kref refcount;
 };
 
+static struct fastrpc_session_ctx *fastrpc_session_alloc_pd_type(
+					struct fastrpc_user *fl, u32 pd_type);
+static void fastrpc_session_free(struct fastrpc_channel_ctx *cctx,
+				 struct fastrpc_session_ctx *session);
+
 /* Extract SMMU PA from consolidated IOVA */
 static inline dma_addr_t fastrpc_ipa_to_dma_addr(struct fastrpc_channel_ctx *cctx, dma_addr_t iova)
 {
@@ -1371,6 +1385,29 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
 		goto err;
 	}
 
+	/*
+	 * The audio static PD must live on its designated context bank so the
+	 * DSP sees its memory on the audio SMMU stream; on a generic bank the
+	 * aDSP enforces module signing in the PD (dlopen of unsigned dynamic
+	 * modules fails demanding a testsig). Re-route before anything is
+	 * allocated against the session. Falls back to the already-held
+	 * generic session if no bank is tagged in DT.
+	 */
+	if (init.namelen >= strlen("audiopd") &&
+	    !memcmp(name, "audiopd", strlen("audiopd"))) {
+		struct fastrpc_session_ctx *audio_sess;
+
+		audio_sess = fastrpc_session_alloc_pd_type(fl,
+					FASTRPC_DT_PD_TYPE_AUDIO_STATICPD);
+		if (audio_sess) {
+			fastrpc_session_free(fl->cctx, fl->sctx);
+			fl->sctx = audio_sess;
+		}
+		dev_info(&fl->cctx->rpdev->dev,
+			 "audiopd: using session sid %d (%s)\n", fl->sctx->sid,
+			 audio_sess ? "dedicated audio CB" : "no audio CB in DT");
+	}
+
 	if (!fl->cctx->remote_heap) {
 		err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
 						&fl->cctx->remote_heap);
@@ -1582,7 +1619,9 @@ static struct fastrpc_session_ctx *fastrpc_session_alloc(
 
 	spin_lock_irqsave(&cctx->lock, flags);
 	for (i = 0; i < cctx->sesscount; i++) {
-		if (!cctx->session[i].used && cctx->session[i].valid) {
+		/* dedicated static-PD context banks are assigned by pd_type only */
+		if (!cctx->session[i].used && cctx->session[i].valid &&
+		    !cctx->session[i].pd_type) {
 			cctx->session[i].used = true;
 			session = &cctx->session[i];
 			/* any non-zero ID will work, session_idx + 1 is the simplest one */
@@ -1595,6 +1634,29 @@ static struct fastrpc_session_ctx *fastrpc_session_alloc(
 	return session;
 }
 
+static struct fastrpc_session_ctx *fastrpc_session_alloc_pd_type(
+					struct fastrpc_user *fl, u32 pd_type)
+{
+	struct fastrpc_channel_ctx *cctx = fl->cctx;
+	struct fastrpc_session_ctx *session = NULL;
+	unsigned long flags;
+	int i;
+
+	spin_lock_irqsave(&cctx->lock, flags);
+	for (i = 0; i < cctx->sesscount; i++) {
+		if (!cctx->session[i].used && cctx->session[i].valid &&
+		    cctx->session[i].pd_type == pd_type) {
+			cctx->session[i].used = true;
+			session = &cctx->session[i];
+			fl->client_id = i + 1;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&cctx->lock, flags);
+
+	return session;
+}
+
 static void fastrpc_session_free(struct fastrpc_channel_ctx *cctx,
 				 struct fastrpc_session_ctx *session)
 {
@@ -2251,6 +2313,9 @@ static int fastrpc_cb_probe(struct platform_device *pdev)
 	if (of_property_read_u32(dev->of_node, "reg", &sess->sid))
 		dev_info(dev, "FastRPC Session ID not specified in DT\n");
 
+	sess->pd_type = 0;
+	of_property_read_u32(dev->of_node, "pd-type", &sess->pd_type);
+
 	if (sessions > 0) {
 		struct fastrpc_session_ctx *dup_sess;
 

From 2d3c1ed4cf97214a193fc351ef1e9f37fc522d96 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Sat, 11 Jul 2026 16:45:23 +0200
Subject: [PATCH 09/12] voice-proto: don't free a reused static-PD heap on
 spawn failure

If a repeat audiopd spawn fails (e.g. remote invoke timeout), the error
path freed the persistent remote heap that a previous spawn had
SCM-assigned to the LPASS/ADSP VMIDs, without reclaiming it for HLOS.
The protected pages go back to the page allocator and the next 3 MB
dma_alloc dies with a synchronous external abort in dcache_clean_poc
(observed 2026-07-11 after an adsprpcd-audiopd restart). Free the heap
in the error path only when this spawn created it.

Pre-existing mainline bug, candidate for upstream once distilled.

Assisted-by: Claude:claude-fable-5
---
 drivers/misc/fastrpc.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 2de896bfe921..cb29a429af78 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1357,7 +1357,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
 	struct fastrpc_phy_page pages[1];
 	char *name;
 	int err;
-	bool scm_done = false;
+	bool scm_done = false, heap_created = false;
 	struct {
 		int client_id;
 		u32 namelen;
@@ -1413,6 +1413,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
 						&fl->cctx->remote_heap);
 		if (err)
 			goto err_name;
+		heap_created = true;
 
 		/* Map if we have any heap VMIDs associated with this ADSP Static Process. */
 		if (fl->cctx->vmcount) {
@@ -1483,8 +1484,16 @@ err_invoke:
 				&fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err);
 	}
 err_map:
-	fastrpc_buf_free(fl->cctx->remote_heap);
-	fl->cctx->remote_heap = NULL;
+	/*
+	 * A heap reused from an earlier spawn is still SCM-assigned to the
+	 * remote VMIDs; freeing it here would return protected pages to the
+	 * allocator and a later touch crashes with a synchronous external
+	 * abort. Keep it for the next spawn attempt.
+	 */
+	if (heap_created) {
+		fastrpc_buf_free(fl->cctx->remote_heap);
+		fl->cctx->remote_heap = NULL;
+	}
 err_name:
 	kfree(name);
 err:

From 806ec77a1fd1421c70949a33891fa616084698fb Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Sat, 11 Jul 2026 17:20:11 +0200
Subject: [PATCH 10/12] voice-proto: long command timeout only for voice blob
 sends

The blanket 240 s audioreach_send_cmd_sync timeout (cfc2b6a2765e) broke
boot audio: apm_probe's GET_SPF_STATE ready poll gets no answer when
sent before the DSP audio framework is up (the command is simply lost),
so probe held the shared command mutex for the full 240 s. That stalls
snd_q6apm's module init past udev's worker timeout, q6prm never gets
loaded, the LPI pinctrl never finds its 'core' clock and the sound card
never assembles (every boot since 2026-07-10 had no card). It also
queued every later voice-proto command behind the mutex for minutes,
which sessions 8-11 misread as slow DSP responses.

Restore the mainline 30 s default via audioreach_send_cmd_sync_timeout
and pass 240 s only from the voice-proto blob paths (a cold TX
GRAPH_OPEN through the Fluence FastRPC loads takes >120 s).

Assisted-by: Claude:claude-fable-5
---
 sound/soc/qcom/qdsp6/audioreach.c        | 19 +++++++++++++++----
 sound/soc/qcom/qdsp6/audioreach.h        |  5 +++++
 sound/soc/qcom/qdsp6/q6apm-voice-proto.c | 12 ++++++++++--
 sound/soc/qcom/qdsp6/q6apm.c             | 10 ++++++++++
 sound/soc/qcom/qdsp6/q6apm.h             |  2 ++
 5 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/audioreach.c b/sound/soc/qcom/qdsp6/audioreach.c
index 12aa04e9504c..4fea75b021e8 100644
--- a/sound/soc/qcom/qdsp6/audioreach.c
+++ b/sound/soc/qcom/qdsp6/audioreach.c
@@ -576,10 +576,11 @@ void *audioreach_alloc_graph_pkt(struct q6apm *apm,
 }
 EXPORT_SYMBOL_GPL(audioreach_alloc_graph_pkt);
 
-int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev,
+int audioreach_send_cmd_sync_timeout(struct device *dev, gpr_device_t *gdev,
 			     struct gpr_ibasic_rsp_result_t *result, struct mutex *cmd_lock,
 			     gpr_port_t *port, wait_queue_head_t *cmd_wait,
-			     const struct gpr_pkt *pkt, uint32_t rsp_opcode)
+			     const struct gpr_pkt *pkt, uint32_t rsp_opcode,
+			     unsigned long timeout_s)
 {
 
 	const struct gpr_hdr *hdr = &pkt->hdr;
@@ -601,9 +602,9 @@ int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev,
 
 	if (rsp_opcode)
 		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode) ||
-					(result->opcode == rsp_opcode),	240 * HZ);
+					(result->opcode == rsp_opcode),	timeout_s * HZ);
 	else
-		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), 240 * HZ);
+		rc = wait_event_timeout(*cmd_wait, (result->opcode == hdr->opcode), timeout_s * HZ);
 
 	if (!rc) {
 		dev_err(dev, "CMD timeout for [%x] opcode\n", hdr->opcode);
@@ -620,6 +621,16 @@ err:
 	mutex_unlock(cmd_lock);
 	return rc;
 }
+EXPORT_SYMBOL_GPL(audioreach_send_cmd_sync_timeout);
+
+int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev,
+			     struct gpr_ibasic_rsp_result_t *result, struct mutex *cmd_lock,
+			     gpr_port_t *port, wait_queue_head_t *cmd_wait,
+			     const struct gpr_pkt *pkt, uint32_t rsp_opcode)
+{
+	return audioreach_send_cmd_sync_timeout(dev, gdev, result, cmd_lock,
+						port, cmd_wait, pkt, rsp_opcode, 30);
+}
 EXPORT_SYMBOL_GPL(audioreach_send_cmd_sync);
 
 int audioreach_graph_send_cmd_sync(struct q6apm_graph *graph, const struct gpr_pkt *pkt,
diff --git a/sound/soc/qcom/qdsp6/audioreach.h b/sound/soc/qcom/qdsp6/audioreach.h
index fad5f700dc86..e52c4b564cbc 100644
--- a/sound/soc/qcom/qdsp6/audioreach.h
+++ b/sound/soc/qcom/qdsp6/audioreach.h
@@ -845,6 +845,11 @@ void audioreach_graph_free_buf(struct q6apm_graph *graph);
 int audioreach_send_cmd_sync(struct device *dev, gpr_device_t *gdev, struct gpr_ibasic_rsp_result_t *result,
 			     struct mutex *cmd_lock, gpr_port_t *port, wait_queue_head_t *cmd_wait,
 			     const struct gpr_pkt *pkt, uint32_t rsp_opcode);
+int audioreach_send_cmd_sync_timeout(struct device *dev, gpr_device_t *gdev,
+			     struct gpr_ibasic_rsp_result_t *result,
+			     struct mutex *cmd_lock, gpr_port_t *port, wait_queue_head_t *cmd_wait,
+			     const struct gpr_pkt *pkt, uint32_t rsp_opcode,
+			     unsigned long timeout_s);
 int audioreach_graph_send_cmd_sync(struct q6apm_graph *graph, const struct gpr_pkt *pkt,
 				   uint32_t rsp_opcode);
 int audioreach_set_media_format(struct q6apm_graph *graph,
diff --git a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
index 0ce26f5d8f0a..32a2dfdd623a 100644
--- a/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
+++ b/sound/soc/qcom/qdsp6/q6apm-voice-proto.c
@@ -107,7 +107,15 @@ static int q6vp_send(uint32_t opcode, const void *payload, uint32_t size)
 
 	memcpy((void *)pkt + GPR_HDR_SIZE + APM_CMD_HDR_SIZE, payload, size);
 
-	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, rsp_opcode);
+	/*
+	 * Voice blobs need the long wait: a cold TX GRAPH_OPEN that has to
+	 * FastRPC-load the Fluence pp modules takes >120 s. Regular audio
+	 * commands (and especially the probe-time GET_SPF_STATE ready poll)
+	 * must keep the short default or they hold the shared command mutex
+	 * hostage at boot: a 240 s stall in apm_probe delays module loading
+	 * past udev's worker timeout and the sound card never assembles.
+	 */
+	ret = q6apm_send_cmd_sync_timeout(q6vp_apm, pkt, rsp_opcode, 240);
 	kfree(pkt);
 
 	return ret;
@@ -234,7 +242,7 @@ static int q6vp_send_oob(uint32_t opcode, const void *payload, uint32_t size)
 	cmd_header->mem_map_handle = q6vp_info->mem_map_handle;
 	cmd_header->payload_size = size;
 
-	ret = q6apm_send_cmd_sync(q6vp_apm, pkt, 0);
+	ret = q6apm_send_cmd_sync_timeout(q6vp_apm, pkt, 0, 240);
 	kfree(pkt);
 
 	return ret;
diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 56c4c1d817e4..6e0562e600dd 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -38,6 +38,16 @@ int q6apm_send_cmd_sync(struct q6apm *apm, const struct gpr_pkt *pkt,
 					NULL, &apm->wait, pkt, rsp_opcode);
 }
 
+int q6apm_send_cmd_sync_timeout(struct q6apm *apm, const struct gpr_pkt *pkt,
+				uint32_t rsp_opcode, unsigned long timeout_s)
+{
+	gpr_device_t *gdev = apm->gdev;
+
+	return audioreach_send_cmd_sync_timeout(&gdev->dev, gdev, &apm->result,
+						&apm->lock, NULL, &apm->wait,
+						pkt, rsp_opcode, timeout_s);
+}
+
 static struct audioreach_graph *q6apm_get_audioreach_graph(struct q6apm *apm, uint32_t graph_id)
 {
 	struct audioreach_graph_info *info;
diff --git a/sound/soc/qcom/qdsp6/q6apm.h b/sound/soc/qcom/qdsp6/q6apm.h
index 736a2b53f303..f8a66ff5f29f 100644
--- a/sound/soc/qcom/qdsp6/q6apm.h
+++ b/sound/soc/qcom/qdsp6/q6apm.h
@@ -144,6 +144,8 @@ int q6apm_unmap_memory_fixed_region(struct device *dev, unsigned int graph_id);
 /* Helpers */
 int q6apm_send_cmd_sync(struct q6apm *apm, const struct gpr_pkt *pkt,
 			uint32_t rsp_opcode);
+int q6apm_send_cmd_sync_timeout(struct q6apm *apm, const struct gpr_pkt *pkt,
+				uint32_t rsp_opcode, unsigned long timeout_s);
 
 /* Callback for graph specific */
 struct audioreach_module *q6apm_find_module_by_mid(struct q6apm_graph *graph,

From 50cd4e823f9cedebac3e2a4e4bced88613e8466f Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Tue, 14 Jul 2026 19:26:13 +0200
Subject: [PATCH 11/12] iio: magnetometer: add support for QST QMC6308

The QST QMC6308 is a 3-axis AMR magnetometer on I2C, a single-supply
4-pin WLCSP part with no interrupt/DRDY pin, found e.g. in the
Fairphone 6. Its register map differs from the QMC5883L (chip ID at
0x00 instead of 0x0D, data at 0x01..0x06, and the range field living
in control register 2), so add a separate driver rather than extending
the QMC5883L driver.

Support raw X/Y/Z reads, output data rates 10/50/100/200 Hz, field
ranges +-30/12/8/2 Gauss, filter oversampling ratios (OSR1) 8/4/2/1,
the mount matrix, and runtime PM. The second-stage decimation filter
(OSR2) is left at its power-on default. The package has no DRDY pin,
so there is no trigger support.

Run measurements in the chip's periodic "normal" mode paced by the
DRDY flag rather than in its one-shot "single" mode: the datasheet
specifies no conversion time that could bound a one-shot wait, while
normal mode is paced by the specified output data rates, which also
keeps the sampling_frequency ABI meaningful.

Runtime PM puts the chip into its suspend mode after 500 ms without a
reading, dropping supply current from tens-to-hundreds of microamps to
2-3 uA (datasheet Table 2). The suspended chip retains its registers
and keeps responding on I2C, so resuming only rewrites the mode field
and discards one stale sample, and configuration changes can be
applied even while suspended. VDD is left enabled across runtime
suspend: the on-chip suspend draw is already negligible, and register
retention is what keeps the resume path trivial.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 drivers/iio/magnetometer/Kconfig   |  11 +
 drivers/iio/magnetometer/Makefile  |   2 +
 drivers/iio/magnetometer/qmc6308.c | 590 +++++++++++++++++++++++++++++
 3 files changed, 603 insertions(+)
 create mode 100644 drivers/iio/magnetometer/qmc6308.c

diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index fb313e591e85..7cd4d751e1d2 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -198,6 +198,17 @@ config INFINEON_TLV493D
 	  To compile this driver as a module, choose M here: the module
 	  will be called tlv493d.
 
+config QMC6308
+	tristate "QST QMC6308 3-Axis Magnetic Sensor"
+	depends on I2C
+	select REGMAP_I2C
+	help
+	  Say Y here to add support for the QST QMC6308 3-Axis
+	  Magnetic Sensor.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called qmc6308.
+
 config SENSORS_HMC5843
 	tristate
 	select IIO_BUFFER
diff --git a/drivers/iio/magnetometer/Makefile b/drivers/iio/magnetometer/Makefile
index 5bd227f8c120..59ea5cf17287 100644
--- a/drivers/iio/magnetometer/Makefile
+++ b/drivers/iio/magnetometer/Makefile
@@ -26,6 +26,8 @@ obj-$(CONFIG_IIO_ST_MAGN_SPI_3AXIS) += st_magn_spi.o
 
 obj-$(CONFIG_INFINEON_TLV493D)		+= tlv493d.o
 
+obj-$(CONFIG_QMC6308)			+= qmc6308.o
+
 obj-$(CONFIG_SENSORS_HMC5843)		+= hmc5843_core.o
 obj-$(CONFIG_SENSORS_HMC5843_I2C)	+= hmc5843_i2c.o
 obj-$(CONFIG_SENSORS_HMC5843_SPI)	+= hmc5843_spi.o
diff --git a/drivers/iio/magnetometer/qmc6308.c b/drivers/iio/magnetometer/qmc6308.c
new file mode 100644
index 000000000000..ceb4b98402bb
--- /dev/null
+++ b/drivers/iio/magnetometer/qmc6308.c
@@ -0,0 +1,590 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
+/*
+ * Support for QST QMC6308 3-Axis Magnetic Sensor on I2C bus.
+ *
+ * Copyright (C) 2026 Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
+ *
+ * Datasheet available at
+ * <https://qstcorp.com/upload/pdf/202202/13-52-15%20QMC6308%20Datasheet%20Rev.%20F(1).pdf>
+ */
+
+#include <linux/array_size.h>
+#include <linux/bitfield.h>
+#include <linux/bits.h>
+#include <linux/cleanup.h>
+#include <linux/delay.h>
+#include <linux/dev_printk.h>
+#include <linux/err.h>
+#include <linux/i2c.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/time.h>
+#include <linux/types.h>
+
+#include <asm/byteorder.h>
+
+#include <linux/iio/iio.h>
+
+#define QMC6308_REG_ID		0x00
+#define QMC6308_REG_X_LSB	0x01
+#define QMC6308_REG_STATUS	0x09
+#define QMC6308_REG_CTRL1	0x0A
+#define QMC6308_REG_CTRL2	0x0B
+#define QMC6308_REG_CTRL3	0x0D
+#define QMC6308_REG_CTRL4	0x29
+
+#define QMC6308_CHIP_ID		0x80
+
+/* Control register 1 */
+#define QMC6308_MODE_MASK	GENMASK(1, 0)
+#define QMC6308_ODR_MASK	GENMASK(3, 2)
+#define QMC6308_OSR1_MASK	GENMASK(5, 4)
+#define QMC6308_OSR2_MASK	GENMASK(7, 6)
+
+#define QMC6308_MODE_SUSPEND	0x00
+#define QMC6308_MODE_NORMAL	0x01
+
+#define QMC6308_ODR_10HZ	0x00
+#define QMC6308_ODR_50HZ	0x01
+#define QMC6308_ODR_100HZ	0x02
+#define QMC6308_ODR_200HZ	0x03
+
+#define QMC6308_OSR1_8		0x00
+#define QMC6308_OSR1_4		0x01
+#define QMC6308_OSR1_2		0x02
+#define QMC6308_OSR1_1		0x03
+
+/* Control register 2 */
+#define QMC6308_SET_RESET_MASK	GENMASK(1, 0)
+#define QMC6308_RNG_MASK	GENMASK(3, 2)
+#define QMC6308_SELF_TEST	BIT(6)
+#define QMC6308_SOFT_RST	BIT(7)
+
+#define QMC6308_SET_RESET_ON	0x00
+
+#define QMC6308_RNG_30G		0x00
+#define QMC6308_RNG_12G		0x01
+#define QMC6308_RNG_8G		0x02
+#define QMC6308_RNG_2G		0x03
+
+/* Status register */
+#define QMC6308_STATUS_DRDY	BIT(0)
+#define QMC6308_STATUS_OVFL	BIT(1)
+
+/*
+ * Power-on completion time (datasheet Table 7), also used as a
+ * conservative bound after soft reset, for which the datasheet
+ * gives no figure.
+ */
+#define QMC6308_POR_US		250
+
+#define QMC6308_AUTOSUSPEND_DELAY_MS	500
+
+struct qmc6308_data {
+	struct regmap *regmap;
+	/*
+	 * Protect data->range/odr/osr.
+	 * Protect poll and read during measurement (reading the status
+	 * register clears DRDY).
+	 */
+	struct mutex mutex;
+	struct iio_mount_matrix orientation;
+	u8 range;
+	u8 odr;
+	u8 osr;
+};
+
+enum qmc6308_axis {
+	QMC6308_AXIS_X,
+	QMC6308_AXIS_Y,
+	QMC6308_AXIS_Z,
+};
+
+static const int qmc6308_odr_avail[] = {
+	[QMC6308_ODR_10HZ] = 10,
+	[QMC6308_ODR_50HZ] = 50,
+	[QMC6308_ODR_100HZ] = 100,
+	[QMC6308_ODR_200HZ] = 200,
+};
+
+static const int qmc6308_osr1_avail[] = {
+	[QMC6308_OSR1_8] = 8,
+	[QMC6308_OSR1_4] = 4,
+	[QMC6308_OSR1_2] = 2,
+	[QMC6308_OSR1_1] = 1,
+};
+
+/*
+ * Sensitivity is 1000/2500/3750/15000 LSB/Gauss for the
+ * +-30/12/8/2 Gauss ranges respectively.
+ */
+static const int qmc6308_scales[][2] = {
+	[QMC6308_RNG_30G] = { 0, 1000000 },
+	[QMC6308_RNG_12G] = { 0, 400000 },
+	[QMC6308_RNG_8G] = { 0, 266667 },
+	[QMC6308_RNG_2G] = { 0, 66667 },
+};
+
+static int qmc6308_set_mode(struct qmc6308_data *data, unsigned int mode)
+{
+	return regmap_update_bits(data->regmap, QMC6308_REG_CTRL1,
+				  QMC6308_MODE_MASK,
+				  FIELD_PREP(QMC6308_MODE_MASK, mode));
+}
+
+static int qmc6308_take_measurement(struct iio_dev *indio_dev, int index,
+				    int *val)
+{
+	struct qmc6308_data *data = iio_priv(indio_dev);
+	struct regmap *map = data->regmap;
+	struct device *dev = regmap_get_device(map);
+	unsigned int status;
+	__le16 buf[3];
+	int ret;
+
+	ret = pm_runtime_resume_and_get(dev);
+	if (ret) {
+		/* EACCES means a read raced runtime PM disable on suspend */
+		if (ret != -EACCES)
+			dev_err(dev, "Failed to power on (%d)\n", ret);
+		return ret;
+	}
+
+	scoped_guard(mutex, &data->mutex) {
+		/* 50ms headroom over the slowest ODR (10Hz) */
+		ret = regmap_read_poll_timeout(map, QMC6308_REG_STATUS,
+					       status,
+					       (status & QMC6308_STATUS_DRDY),
+					       2 * USEC_PER_MSEC,
+					       150 * USEC_PER_MSEC);
+		if (ret)
+			goto out_rpm_put;
+
+		ret = regmap_bulk_read(map, QMC6308_REG_X_LSB, buf,
+				       sizeof(buf));
+		if (ret)
+			goto out_rpm_put;
+
+		if (status & QMC6308_STATUS_OVFL)
+			ret = -ERANGE;
+	}
+
+out_rpm_put:
+	pm_runtime_put_autosuspend(dev);
+	if (ret)
+		return ret;
+
+	*val = (s16)le16_to_cpu(buf[index]);
+
+	return 0;
+}
+
+static int qmc6308_read_raw(struct iio_dev *indio_dev,
+			    const struct iio_chan_spec *chan,
+			    int *val, int *val2, long mask)
+{
+	struct qmc6308_data *data = iio_priv(indio_dev);
+	int ret;
+
+	switch (mask) {
+	case IIO_CHAN_INFO_RAW:
+		ret = qmc6308_take_measurement(indio_dev, chan->address, val);
+		if (ret)
+			return ret;
+		return IIO_VAL_INT;
+	case IIO_CHAN_INFO_SCALE: {
+		guard(mutex)(&data->mutex);
+
+		*val = qmc6308_scales[data->range][0];
+		*val2 = qmc6308_scales[data->range][1];
+
+		return IIO_VAL_INT_PLUS_NANO;
+	}
+	case IIO_CHAN_INFO_SAMP_FREQ: {
+		guard(mutex)(&data->mutex);
+
+		*val = qmc6308_odr_avail[data->odr];
+
+		return IIO_VAL_INT;
+	}
+	case IIO_CHAN_INFO_OVERSAMPLING_RATIO: {
+		guard(mutex)(&data->mutex);
+
+		*val = qmc6308_osr1_avail[data->osr];
+
+		return IIO_VAL_INT;
+	}
+	default:
+		return -EINVAL;
+	}
+}
+
+static int qmc6308_write_raw(struct iio_dev *indio_dev,
+			     const struct iio_chan_spec *chan,
+			     int val, int val2, long mask)
+{
+	struct qmc6308_data *data = iio_priv(indio_dev);
+	unsigned int status;
+	unsigned int i;
+	int ret;
+
+	switch (mask) {
+	case IIO_CHAN_INFO_SCALE: {
+		if (val != 0)
+			return -EINVAL;
+
+		for (i = 0; i < ARRAY_SIZE(qmc6308_scales); i++) {
+			if (val2 == qmc6308_scales[i][1])
+				break;
+		}
+		if (i == ARRAY_SIZE(qmc6308_scales))
+			return -EINVAL;
+
+		guard(mutex)(&data->mutex);
+
+		ret = regmap_update_bits(data->regmap, QMC6308_REG_CTRL2,
+					 QMC6308_RNG_MASK,
+					 FIELD_PREP(QMC6308_RNG_MASK, i));
+		if (ret)
+			return ret;
+
+		data->range = i;
+
+		/*
+		 * The data registers still hold (and DRDY still
+		 * advertises) a sample converted at the previous range;
+		 * discard it so that the next read returns data matching
+		 * the new scale.
+		 */
+		return regmap_read(data->regmap, QMC6308_REG_STATUS,
+				   &status);
+	}
+	case IIO_CHAN_INFO_SAMP_FREQ: {
+		for (i = 0; i < ARRAY_SIZE(qmc6308_odr_avail); i++) {
+			if (val == qmc6308_odr_avail[i])
+				break;
+		}
+		if (i == ARRAY_SIZE(qmc6308_odr_avail))
+			return -EINVAL;
+
+		guard(mutex)(&data->mutex);
+
+		ret = regmap_update_bits(data->regmap, QMC6308_REG_CTRL1,
+					 QMC6308_ODR_MASK,
+					 FIELD_PREP(QMC6308_ODR_MASK, i));
+		if (ret)
+			return ret;
+
+		data->odr = i;
+
+		return 0;
+	}
+	case IIO_CHAN_INFO_OVERSAMPLING_RATIO: {
+		for (i = 0; i < ARRAY_SIZE(qmc6308_osr1_avail); i++) {
+			if (val == qmc6308_osr1_avail[i])
+				break;
+		}
+		if (i == ARRAY_SIZE(qmc6308_osr1_avail))
+			return -EINVAL;
+
+		guard(mutex)(&data->mutex);
+
+		ret = regmap_update_bits(data->regmap, QMC6308_REG_CTRL1,
+					 QMC6308_OSR1_MASK,
+					 FIELD_PREP(QMC6308_OSR1_MASK, i));
+		if (ret)
+			return ret;
+
+		data->osr = i;
+
+		return 0;
+	}
+	default:
+		return -EINVAL;
+	}
+}
+
+static int qmc6308_read_avail(struct iio_dev *indio_dev,
+			      struct iio_chan_spec const *chan,
+			      const int **vals, int *type, int *length,
+			      long mask)
+{
+	switch (mask) {
+	case IIO_CHAN_INFO_SAMP_FREQ:
+		*vals = qmc6308_odr_avail;
+		*type = IIO_VAL_INT;
+		*length = ARRAY_SIZE(qmc6308_odr_avail);
+		return IIO_AVAIL_LIST;
+	case IIO_CHAN_INFO_OVERSAMPLING_RATIO:
+		*vals = qmc6308_osr1_avail;
+		*type = IIO_VAL_INT;
+		*length = ARRAY_SIZE(qmc6308_osr1_avail);
+		return IIO_AVAIL_LIST;
+	case IIO_CHAN_INFO_SCALE:
+		*vals = (const int *)qmc6308_scales;
+		*type = IIO_VAL_INT_PLUS_NANO;
+		*length = ARRAY_SIZE(qmc6308_scales) * 2;
+		return IIO_AVAIL_LIST;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int qmc6308_write_raw_get_fmt(struct iio_dev *indio_dev,
+				     struct iio_chan_spec const *chan,
+				     long mask)
+{
+	switch (mask) {
+	case IIO_CHAN_INFO_SCALE:
+		return IIO_VAL_INT_PLUS_NANO;
+	default:
+		return IIO_VAL_INT;
+	}
+}
+
+static const struct iio_mount_matrix *
+qmc6308_get_mount_matrix(const struct iio_dev *indio_dev,
+			 const struct iio_chan_spec *chan)
+{
+	struct qmc6308_data *data = iio_priv(indio_dev);
+
+	return &data->orientation;
+}
+
+static const struct iio_chan_spec_ext_info qmc6308_ext_info[] = {
+	IIO_MOUNT_MATRIX(IIO_SHARED_BY_DIR, qmc6308_get_mount_matrix),
+	{ }
+};
+
+static const struct iio_info qmc6308_info = {
+	.read_raw = qmc6308_read_raw,
+	.write_raw = qmc6308_write_raw,
+	.read_avail = qmc6308_read_avail,
+	.write_raw_get_fmt = qmc6308_write_raw_get_fmt,
+};
+
+static int qmc6308_init(struct qmc6308_data *data)
+{
+	struct regmap *map = data->regmap;
+	unsigned int reg;
+	int ret;
+
+	ret = regmap_read(map, QMC6308_REG_ID, &reg);
+	if (ret)
+		return ret;
+
+	/* Allow unknown IDs so that fallback compatibles work */
+	if (reg != QMC6308_CHIP_ID)
+		dev_warn(regmap_get_device(map),
+			 "Unknown chip id: 0x%02x, continuing\n", reg);
+
+	/* The SOFT_RST bit is not auto-cleared and must be written back 0 */
+	ret = regmap_write(map, QMC6308_REG_CTRL2, QMC6308_SOFT_RST);
+	if (ret)
+		return ret;
+
+	fsleep(QMC6308_POR_US);
+
+	data->range = QMC6308_RNG_30G;
+
+	ret = regmap_write(map, QMC6308_REG_CTRL2,
+			   FIELD_PREP(QMC6308_SET_RESET_MASK,
+				      QMC6308_SET_RESET_ON) |
+			   FIELD_PREP(QMC6308_RNG_MASK, data->range));
+	if (ret)
+		return ret;
+
+	data->odr = QMC6308_ODR_50HZ;
+	data->osr = QMC6308_OSR1_8;
+
+	return regmap_write(map, QMC6308_REG_CTRL1,
+			    FIELD_PREP(QMC6308_MODE_MASK,
+				       QMC6308_MODE_NORMAL) |
+			    FIELD_PREP(QMC6308_ODR_MASK, data->odr) |
+			    FIELD_PREP(QMC6308_OSR1_MASK, data->osr));
+}
+
+static void qmc6308_power_down_action(void *priv)
+{
+	struct qmc6308_data *data = priv;
+
+	if (!pm_runtime_status_suspended(regmap_get_device(data->regmap)))
+		qmc6308_set_mode(data, QMC6308_MODE_SUSPEND);
+}
+
+static bool qmc6308_volatile_reg(struct device *dev, unsigned int reg)
+{
+	return reg >= QMC6308_REG_X_LSB && reg <= QMC6308_REG_STATUS;
+}
+
+static bool qmc6308_writable_reg(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case QMC6308_REG_CTRL1:
+	case QMC6308_REG_CTRL2:
+	case QMC6308_REG_CTRL3:
+	case QMC6308_REG_CTRL4:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static const struct regmap_config qmc6308_regmap_config = {
+	.reg_bits = 8,
+	.val_bits = 8,
+	.max_register = QMC6308_REG_CTRL4,
+	.cache_type = REGCACHE_MAPLE,
+	.volatile_reg = qmc6308_volatile_reg,
+	.writeable_reg = qmc6308_writable_reg,
+};
+
+#define QMC6308_CHANNEL(_axis)                                 \
+	{                                                      \
+		.type = IIO_MAGN,                              \
+		.modified = 1,                                 \
+		.channel2 = IIO_MOD_##_axis,                   \
+		.address = QMC6308_AXIS_##_axis,               \
+		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),  \
+		.info_mask_shared_by_type =                    \
+			BIT(IIO_CHAN_INFO_SCALE) |             \
+			BIT(IIO_CHAN_INFO_SAMP_FREQ) |         \
+			BIT(IIO_CHAN_INFO_OVERSAMPLING_RATIO), \
+		.info_mask_shared_by_type_available =          \
+			BIT(IIO_CHAN_INFO_SCALE) |             \
+			BIT(IIO_CHAN_INFO_SAMP_FREQ) |         \
+			BIT(IIO_CHAN_INFO_OVERSAMPLING_RATIO), \
+		.ext_info = qmc6308_ext_info,                  \
+	}
+
+static const struct iio_chan_spec qmc6308_channels[] = {
+	QMC6308_CHANNEL(X),
+	QMC6308_CHANNEL(Y),
+	QMC6308_CHANNEL(Z),
+};
+
+static int qmc6308_probe(struct i2c_client *client)
+{
+	struct device *dev = &client->dev;
+	struct qmc6308_data *data;
+	struct iio_dev *indio_dev;
+	struct regmap *map;
+	int ret;
+
+	indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
+	if (!indio_dev)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, indio_dev);
+
+	map = devm_regmap_init_i2c(client, &qmc6308_regmap_config);
+	if (IS_ERR(map))
+		return dev_err_probe(dev, PTR_ERR(map),
+				     "regmap initialization failed\n");
+
+	ret = devm_regulator_get_enable(dev, "vdd");
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to enable VDD regulator\n");
+
+	fsleep(QMC6308_POR_US);
+
+	data = iio_priv(indio_dev);
+	data->regmap = map;
+
+	ret = devm_mutex_init(dev, &data->mutex);
+	if (ret)
+		return ret;
+
+	ret = iio_read_mount_matrix(dev, &data->orientation);
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "Failed to read mount matrix\n");
+
+	indio_dev->name = "qmc6308";
+	indio_dev->info = &qmc6308_info;
+	indio_dev->channels = qmc6308_channels;
+	indio_dev->num_channels = ARRAY_SIZE(qmc6308_channels);
+	indio_dev->modes = INDIO_DIRECT_MODE;
+
+	ret = qmc6308_init(data);
+	if (ret)
+		return dev_err_probe(dev, ret, "qmc6308 init failed\n");
+
+	pm_runtime_set_active(dev);
+
+	ret = devm_add_action_or_reset(dev, qmc6308_power_down_action, data);
+	if (ret)
+		return ret;
+
+	pm_runtime_get_noresume(dev);
+	pm_runtime_use_autosuspend(dev);
+	pm_runtime_set_autosuspend_delay(dev, QMC6308_AUTOSUSPEND_DELAY_MS);
+	ret = devm_pm_runtime_enable(dev);
+	if (ret)
+		return ret;
+
+	pm_runtime_put_autosuspend(dev);
+
+	return devm_iio_device_register(dev, indio_dev);
+}
+
+static int qmc6308_runtime_suspend(struct device *dev)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct qmc6308_data *data = iio_priv(indio_dev);
+
+	return qmc6308_set_mode(data, QMC6308_MODE_SUSPEND);
+}
+
+static int qmc6308_runtime_resume(struct device *dev)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct qmc6308_data *data = iio_priv(indio_dev);
+	unsigned int status;
+	int ret;
+
+	ret = qmc6308_set_mode(data, QMC6308_MODE_NORMAL);
+	if (ret)
+		return ret;
+
+	/*
+	 * DRDY may still be set for a sample converted before the last
+	 * suspend; clear it so the next read waits for fresh data.
+	 */
+	return regmap_read(data->regmap, QMC6308_REG_STATUS, &status);
+}
+
+static DEFINE_RUNTIME_DEV_PM_OPS(qmc6308_pm_ops, qmc6308_runtime_suspend,
+				 qmc6308_runtime_resume, NULL);
+
+static const struct of_device_id qmc6308_match[] = {
+	{ .compatible = "qstcorp,qmc6308" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, qmc6308_match);
+
+static const struct i2c_device_id qmc6308_id[] = {
+	{ .name = "qmc6308" },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, qmc6308_id);
+
+static struct i2c_driver qmc6308_driver = {
+	.driver = {
+		.name = "qmc6308",
+		.of_match_table = qmc6308_match,
+		.pm = pm_ptr(&qmc6308_pm_ops),
+	},
+	.id_table = qmc6308_id,
+	.probe = qmc6308_probe,
+};
+module_i2c_driver(qmc6308_driver);
+
+MODULE_DESCRIPTION("QST QMC6308 3-Axis Magnetic Sensor driver");
+MODULE_AUTHOR("Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>");
+MODULE_LICENSE("Dual BSD/GPL");

From cf984064084f6911b7cf70f966fc478cc78d7dd7 Mon Sep 17 00:00:00 2001
From: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
Date: Tue, 14 Jul 2026 19:26:33 +0200
Subject: [PATCH 12/12] arm64: dts: qcom: milos-fairphone-fp6: add sensor i2c
 bus and magnetometer

The FP6 sensor suite (QMC6308 magnetometer @ 0x2c, SPL07 barometer
@ 0x76, STK3BCx ALS/proximity @ 0x48) sits on an I2C bus wired to
TLMM gpio153/gpio154. Those pads are eGPIOs with no AP serial-engine
function: on the stock OS the bus is driven by an island QUP owned by
the Snapdragon Sensor Core on the ADSP. From the AP they are only
usable as software GPIOs, so describe the bus as i2c-gpio, and add the
QMC6308 magnetometer node: powered from the always-on vreg_l10b (per
the schematics), mount matrix from the vendor SSC registry
(volcano_qmc630x_0.json .orient: sensor x -> device +y, sensor y ->
device -x, z -> z), validated against Earth's field with a four-point
cardinal rotation.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
---
 .../boot/dts/qcom/milos-fairphone-fp6.dts     | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
index e5944a1b255f..f81285d31247 100644
--- a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
+++ b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
@@ -27,6 +27,34 @@
 		serial1 = &uart11;
 	};
 
+	/*
+	 * The sensor I2C bus sits on TLMM eGPIO pads that have no AP QUP
+	 * function; on the stock OS it is driven by an island QUP of the
+	 * Snapdragon Sensor Core (ADSP). From the AP the pads are only
+	 * usable as software GPIOs, so bit-bang the bus.
+	 * Devices on the bus: QMC6308 magnetometer @ 0x2c, SPL07
+	 * barometer @ 0x76, STK3BCx ALS/proximity @ 0x48.
+	 */
+	i2c-sensors {
+		compatible = "i2c-gpio";
+		sda-gpios = <&tlmm 153 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&tlmm 154 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		pinctrl-0 = <&sensor_i2c_default>;
+		pinctrl-names = "default";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		magnetometer@2c {
+			compatible = "qstcorp,qmc6308";
+			reg = <0x2c>;
+			vdd-supply = <&vreg_l10b>;
+			mount-matrix = "0", "-1", "0",
+				       "1", "0", "0",
+				       "0", "0", "1";
+		};
+	};
+
 	gpio-keys {
 		compatible = "gpio-keys";
 
@@ -1091,6 +1119,14 @@
 			       <13 1>, /* NC */
 			       <63 2>; /* WLAN UART */
 
+	sensor_i2c_default: sensor-i2c-default-state {
+		/* SDA, SCL; external pull-ups to vreg_l10b */
+		pins = "gpio153", "gpio154";
+		function = "gpio";
+		drive-strength = <2>;
+		bias-disable;
+	};
+
 	ts_active: ts-irq-active-state {
 		pins = "gpio19";
 		function = "gpio";