soc: apple: Add registry-v2 PMP and safe DMA ownership

Documentation/devicetree/bindings/soc/apple/apple,pmp.yaml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) AND GPL-2.0-only
 %YAML 1.2
 ---
 $id: http://devicetree.org/schemas/soc/apple/apple,pmp.yaml#
@@ -19,6 +19,7 @@ properties:
   compatible:
     oneOf:
       - const: apple,t6000-pmp-v2
+      - const: apple,t6050-pmp-v2
       - items:
           - const: apple,t8140-pmp-v2
           - const: apple,t6000-pmp-v2
@@ -62,6 +63,22 @@ properties:
     minItems: 2
     description: Host physical address and size pairs mapped into firmware PIO space.
 
+  apple,dram-channel-disable:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description: Firmware DRAM channel disable mask
+  apple,pmc:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description: Boot-producer PMC configuration
+  apple,pmc-msg-disabled:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description: Firmware PMC messaging configuration
+  apple,soc-chip-variant:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description: Firmware chip variant value
+  apple,pmc-pmgr:
+    $ref: /schemas/types.yaml#/definitions/uint32
+    description: Packed firmware PMC power-manager boot configuration
+
 patternProperties:
   '^apple,tunable-':
     $ref: /schemas/types.yaml#/definitions/uint8-array
@@ -75,6 +92,17 @@ required:
   - mbox-names
   - iommus
 
+allOf:
+  - if:
+      properties:
+        compatible:
+          contains:
+            const: apple,t6050-pmp-v2
+    then:
+      required:
+        - apple,board-id
+        - apple,dram-vendor-id
+
 additionalProperties: false
 
 examples:

Documentation/driver-api/firmware/aurora-apif-pmp.rst

@@ -0,0 +1,35 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+Registry-v2 PMP guests
+======================
+
+The matched ``apple,t6050-pmp-v2`` firmware ABI uses 88-byte registry
+descriptors, firmware-assigned 16-bit IDs, negotiated value buffers, and
+update opcode ``0x36``. Linux validates descriptor sizes and names, rejects
+duplicate live IDs, and bounds every shared-buffer copy. Boot arguments are
+validated completely before any patch is written back. Board and calibration
+values come from the boot description; no machine-name policy is embedded.
+
+The existing T6000 protocol and T8140 42-bit DMA mask remain unchanged.
+Registry-v2 configures a 48-bit mailbox DMA address mask and requires an
+attached IOMMU domain before starting the processor. Its APIF DART description
+must retain the firmware streams, aperture and final-page guard reported by
+the producer. A missing provider must not permit direct-DMA fallback.
+
+Probe accepts only the known cold context marker with the CPU stopped and no
+retained DMA context. Unbind and reboot request RTKit idle, verify the matched
+context-save marker/version and save counter, then clear CPU_RUN and check
+its readback. Firmware allocations cannot be freed merely because RTKit
+acknowledged a power state. A failed stop drains callbacks but retains both
+shared RTKit backing and the PMP allocation owner until platform reset; it
+also leaves the cold-reprobe check unable to admit the retained context.
+
+The driver owns registry-v2 RTKit outside the callback context, avoiding an
+Arc ownership cycle. The notifier is removed and drained before the RTKit
+handle or context is released. Probe failure after firmware start follows
+the same stop-or-retain ownership path. Endpoint-7 auxiliary buffers are
+session-owned; identical requests reuse them rather than replacing live DMA.
+
+This is support for the inspected firmware ABI, not a generic promise that
+later PMP layouts use the same context registers. Hardware cold boot,
+registry exchange, idle/save, reboot and unbind qualification remain pending.

Documentation/driver-api/firmware/index.rst

@@ -7,6 +7,7 @@ Linux Firmware API
    aurora-apif
    aurora-apif-nvme
    aurora-apif-pcie
+   aurora-apif-pmp
    introduction
    core
    efi/index