From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B2D244E047 for ; Fri, 15 May 2026 12:42:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778848975; cv=none; b=RiGio+2yC+BoF86sNDSAaZX18+YQUpGLQ4zQhYTDwXnfYuE/aa81pvckDuakoy0X2JyAi8kEYR1LS24UYUJsfsAIOnqpBIFd3UpXflfH6T2VNZIIWGLbrGj0TZ5QzJv0CTvPMVtARnzfN3BbdTqmE4NdRubWLZ+oyH5RYtZQVmA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778848975; c=relaxed/simple; bh=FPLE9T5TP21koJOUSS+HDVnGURL5C7htZLkDTy8lCJ0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Qhd4MMHuA0Yiel1Ra43c415CghOlmc/N6tRBllnLNvIzhSJr4/d+3Hj8PD4Wf87j8b0Z5rnLyA74BFIFDEPeV8lGDqn6CJOvc+e/2xl/EXgNFyUjCg/sQ8r2Rr5dUhBTvE/GZ75lVOmppqyBc0cRW0tu4tOH/LhV97gzwHzFdEw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=kfPEuxtb; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iYwgylqY; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="kfPEuxtb"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iYwgylqY" Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64FAoCcI3512955 for ; Fri, 15 May 2026 12:42:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=f+pEnlL/Dwk yKv8LqyGHXztzvJ/4aDMHJNFY2G154uM=; b=kfPEuxtbkcMaRh4yvf02rxab1IK y+4xxLhLCMVF/XownSzBhds5T8r8YxtR7oGVe0PKvvNWddNWteeLEysKG0/RQyGV EN9rnZvvZ/rFYUUAWW2Ve5FMTDF5jNW5ZBCEREbFAA3lkRU0JnsftR5OTkD7iGyN kAdNZImLzmSpTYe2JpJtxhvOue99ZRgGuR4LuPsePFON7J/o4+1C2m5zpz9o5x8Y WucIaNnqQzC82fHxt7sAcyVpeyeEHkJor3MLTUzeF7yDfJKyipwhCsvCjDFPZhvM pGQOXacTiy2EtXjKOF/zOFgNYRXG/gDhlEvFhbVO/QsPKGxL0roD0Ggv3rw== Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4e5m1vb8vv-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 15 May 2026 12:42:53 +0000 (GMT) Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2b9b8137828so98278635ad.0 for ; Fri, 15 May 2026 05:42:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1778848972; x=1779453772; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=f+pEnlL/DwkyKv8LqyGHXztzvJ/4aDMHJNFY2G154uM=; b=iYwgylqYDLw2bMQO2a06jPISRFcG2Re7GMQLOScYdj7FMdcRx3n5BolBHdiBe96AIS Sw/AJTM4kicfYn1T6Z5R3RxaU8gzzLaC6WTfb5cgsKQdJu0E6v36jkB3FKph9QQyWiwk 0+YB0T1CmLqhIONYQ4ukKoa6Db0nEinbmtAmTdkIWKLKsH4lTQHs3SfYbyhKEBECHnfu hLM32Ygrx4WP/ThsqYuXGkdqs7W7BSOTHaEiq+pSwK3xH+6IZUAYgRH9e0bZAK2/C8X5 jNI99yGD8nWAbEGORtW/z5iY/MHQXqhsyrBF54z0QhSGMaov7nJjm+snu7dkCyJkKNIP WQCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778848972; x=1779453772; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=f+pEnlL/DwkyKv8LqyGHXztzvJ/4aDMHJNFY2G154uM=; b=Jds3OwKqhmKsMNqVfT0kaozYARyvEcvIQ3Wuy0aQjz5UWluA/bni1CbdXQdKzzdHq9 WgFLtHaFSozQGXFFDBjLrnwZZgOUQ7sgSzT0Y83WTiG7ID3iNSL8rhLAJGA/KdiRTFmP K/cssyfrCrkJGmL5MDvT9XCV3mRT56QnShJN9VNRzFNKUU9ghCdmXD7AGs8P+p5FrCXn JfmpGZQ07mRyrD+t+SB9by8J+6luWzJgogb1JR0NmqdA7k5BzdBH9WvLi5lNqvbbBjAm +wym7iJwwOkYHXfMkymYp9Am8UEYd96N8ZyZlKMIxLJFzNk50l2oFKvnA3kRdJsmLAEf 4cBA== X-Forwarded-Encrypted: i=1; AFNElJ+kLOSSUlE/fEDmVb37ZNgycDk8IrCMDPi1pc2rOdU2nuENXoGUx1AzKHTc6mE7bLVs9gXGrvm4FWPf+bw=@vger.kernel.org X-Gm-Message-State: AOJu0YwB3gqtMOAxWbhnxL2kbcda8R+3CDDLz/VYpijeG2bbshy4GFKS kgoPPgERfY4uVv+dPdsPcdPy4Q7OL1wuErMsn8QStF8ERewfR9ghDJsudXRk5azapz12XltOPWJ dDJsncllaXp6Q1LDCMD7abj1lDJHYlbZkvUokOUiqN84wbs/Qfn+Hmt6QWTfdDmDdV2Y= X-Gm-Gg: Acq92OFrZv9uBY9WRITAoPpznn43Iy3wyh8JpR1WVGge60sR66irXFxYTysKqnD8t+U 3ewoN2GFxGJm5YpLN+nnAKnCwUVW7QPrjKUFqdeB+cbvaK8XOb4JYQ0nuBUT2Avfl+3o1E4e6BG TjUntWg28XEiILfG2J14uzJjzh/LfAvMQTCjrAl7yQozAHsXfjXkKqw1AXPiAa0VIIWMTrXX897 2g7GcHA1FV+6ry6cuo6ttlPjRRRYR4zd8mzDnGqyU0Y82KFB72OrMPERJ/rM6afwfKfhTww0bXY dn1i/8D3/eIJMDE62Vxlpz+n00FOXxYHWIZ1ktIvjHODVJUh8HLkKYoOZUNLB4xtW7aIJlkLm/h 5WqZ6LRoFoucYcBPHXweZzUAWC/rdMc+YYv6ird+1nj2Ju4ML8p+CmP/e5mcHmcGcXqXrSafaoS URi8Qcv7g/emUstH956zo= X-Received: by 2002:a17:903:240c:b0:2bd:2439:25e9 with SMTP id d9443c01a7336-2bd7e9e263emr43094585ad.40.1778848972245; Fri, 15 May 2026 05:42:52 -0700 (PDT) X-Received: by 2002:a17:903:240c:b0:2bd:2439:25e9 with SMTP id d9443c01a7336-2bd7e9e263emr43094215ad.40.1778848971640; Fri, 15 May 2026 05:42:51 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bd5c05f27csm56119395ad.25.2026.05.15.05.42.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 May 2026 05:42:51 -0700 (PDT) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, abelvesa@kernel.org, jorge.ramirez-ortiz@linaro.org Cc: Jianping Li , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, ekansh.gupta@oss.qualcomm.com, quic_chennak@quicinc.com Subject: [PATCH v5 4/5] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Date: Fri, 15 May 2026 20:42:16 +0800 Message-Id: <20260515124217.20723-5-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260515124217.20723-1-jianping.li@oss.qualcomm.com> References: <20260515124217.20723-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTE1MDEyOSBTYWx0ZWRfXy8pyDwkxNZVB wwHvEd+C9uohRQkXGPcA95JrUul+yraUuDSB3qfG8DMFyMttftCyt82Ic+Q4SXYhallle8vCfX6 opYyqva1R1/Z7jRP42eEqc4lJRiXgzzrqFeEl4m3t2aOxcRCXJuuumxoXGm8LDnAB93GvARNRR8 9MIXDTZ7m6tsgeJpvHQHAe/WhWHqiaQzeLGan753aNgmIcKfJCbTEhGqYVvmT683P8iJiVvpzTO Dk8+veXh0B+EoxLhTSGahBdI6Yc8jN1+O2gYSr2ImF3UENOVJjQUWDzFcllYLPnMKpVS60b+dwf XtSOfpLT3VQ1DM2oAeSmbjyKUrKlj55VsRz0N+tBMoZRGzmhN3TanXzz0vc1wLCGwr+S/HJVd2y cI67XRiWAgOJaJsXQchUhKsB2OLIKQ8rWAfYHFStiGvuCKUm4U/5wQyFXvYBFzzCIzuXh5L3RaI kXfDkSvhzH2Z9wET4qA== X-Proofpoint-GUID: dc43EYGTUJZOCdd99wLkQuzsGC8kVvp7 X-Proofpoint-ORIG-GUID: dc43EYGTUJZOCdd99wLkQuzsGC8kVvp7 X-Authority-Analysis: v=2.4 cv=BvqtB4X5 c=1 sm=1 tr=0 ts=6a0714cd cx=c_pps a=MTSHoo12Qbhz2p7MsH1ifg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=NGcC8JguVDcA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=EUspDBNiAAAA:8 a=vXPY0jRleWu_0xqwLycA:9 a=GvdueXVYPmCkWapjIL-Q:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-05-15_03,2026-05-13_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 phishscore=0 clxscore=1015 priorityscore=1501 spamscore=0 malwarescore=0 bulkscore=0 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605130000 definitions=main-2605150129 Allocating and freeing Audio PD memory from userspace is unsafe because the kernel cannot reliably determine when the DSP has finished using the memory. Userspace may free buffers while they are still in use by the DSP, and remote free requests cannot be safely trusted. Allocate the entire Audio PD reserved-memory region upfront during rpmsg probe and tie its lifetime to the rpmsg channel. This avoids userspace- controlled alloc/free and ensures memory is reclaimed only when the DSP shuts down. Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 107 +++++++++++++++++++---------------------- 1 file changed, 49 insertions(+), 58 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index a0337cce77f3..9c70788afa0f 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -276,6 +276,8 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; @@ -1295,15 +1297,16 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, struct fastrpc_init_create_static init; struct fastrpc_invoke_args *args; struct fastrpc_phy_page pages[1]; + struct fastrpc_channel_ctx *cctx = fl->cctx; char *name; int err; - bool scm_done = false; struct { int client_id; u32 namelen; u32 pageslen; } inbuf; u32 sc; + unsigned long flags; args = kzalloc_objs(*args, FASTRPC_CREATE_STATIC_PROCESS_NARGS); if (!args) @@ -1327,31 +1330,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, inbuf.client_id = fl->client_id; inbuf.namelen = init.namelen; inbuf.pageslen = 0; - if (!fl->cctx->remote_heap) { - err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); - if (err) - goto err_name; - - /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ - if (fl->cctx->vmcount) { - u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); - - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); - if (err) { - dev_err(fl->sctx->dev, - "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, - fl->cctx->remote_heap->size, err); - goto err_map; - } - scm_done = true; - inbuf.pageslen = 1; - } - } fl->pd = USER_PD; @@ -1363,14 +1341,24 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, args[1].length = inbuf.namelen; args[1].fd = -1; - if (!fl->cctx->remote_heap || - !fl->cctx->remote_heap->dma_addr || - !fl->cctx->remote_heap->size) { - err = -ENOMEM; - goto err; + spin_lock_irqsave(&cctx->lock, flags); + if (!fl->cctx->audio_init_mem) { + if (!fl->cctx->remote_heap || + !fl->cctx->remote_heap->dma_addr || + !fl->cctx->remote_heap->size) { + spin_unlock_irqrestore(&cctx->lock, flags); + err = -ENOMEM; + goto err; + } + pages[0].addr = fl->cctx->remote_heap->dma_addr; + pages[0].size = fl->cctx->remote_heap->size; + fl->cctx->audio_init_mem = true; + inbuf.pageslen = 1; + } else { + pages[0].addr = 0; + pages[0].size = 0; } - pages[0].addr = fl->cctx->remote_heap->dma_addr; - pages[0].size = fl->cctx->remote_heap->size; + spin_unlock_irqrestore(&cctx->lock, flags); args[2].ptr = (u64)(uintptr_t) pages; args[2].length = sizeof(*pages); @@ -1388,27 +1376,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, return 0; err_invoke: - if (fl->cctx->vmcount && scm_done) { - u64 src_perms = 0; - struct qcom_scm_vmperm dst_perms; - u32 i; - - for (i = 0; i < fl->cctx->vmcount; i++) - src_perms |= BIT(fl->cctx->vmperms[i].vmid); - - dst_perms.vmid = QCOM_SCM_VMID_HLOS; - dst_perms.perm = QCOM_SCM_PERM_RWX; - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); - if (err) - dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err); - } -err_map: - fastrpc_buf_free(fl->cctx->remote_heap); - fl->cctx->remote_heap = NULL; -err_name: + fl->cctx->audio_init_mem = false; kfree(name); err: kfree(args); @@ -2397,12 +2365,21 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) } } - if (domain_id == SDSP_DOMAIN_ID) { + if (domain_id == SDSP_DOMAIN_ID || domain_id == ADSP_DOMAIN_ID) { struct resource res; u64 src_perms; err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res); if (!err) { + if (domain_id == ADSP_DOMAIN_ID) { + data->remote_heap = + kzalloc_obj(*data->remote_heap, GFP_KERNEL); + if (!data->remote_heap) + return -ENOMEM; + + data->remote_heap->dma_addr = res.start; + data->remote_heap->size = resource_size(&res); + } src_perms = BIT(QCOM_SCM_VMID_HLOS); err = qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms, @@ -2410,7 +2387,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) if (err) goto err_free_data; } - } secure_dsp = !(of_property_read_bool(rdev->of_node, "qcom,non-secure-domain")); @@ -2491,6 +2467,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) struct fastrpc_buf *buf, *b; struct fastrpc_user *user; unsigned long flags; + int err; /* No invocations past this point */ spin_lock_irqsave(&cctx->lock, flags); @@ -2508,8 +2485,22 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + if (cctx->remote_heap && cctx->vmcount) { + u64 src_perms = 0; + struct qcom_scm_vmperm dst_perms; + + for (u32 i = 0; i < cctx->vmcount; i++) + src_perms |= BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid = QCOM_SCM_VMID_HLOS; + dst_perms.perm = QCOM_SCM_PERM_RWX; + + err = qcom_scm_assign_mem(cctx->remote_heap->dma_addr, + cctx->remote_heap->size, &src_perms, + &dst_perms, 1); + if (!err) + kfree(cctx->remote_heap); + } of_platform_depopulate(&rpdev->dev); -- 2.43.0