From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B46C2383C9D for ; Tue, 7 Jul 2026 06:17:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783405064; cv=none; b=L8KVyxMaBsXRkbs/4lyapWFUGTzjQmQ57IGjCdJvJkaNzPXG4hstlcm531wl44xqZUOZr4FDAWvSOXx8oGBIqS+EuJQ5h2Oz5nkpklvf7BkX0kBxHb/IV3FSNh4RF2nTIFqFEJIgjSraGPt9AomgIA7oWyM/e7vxoJ2NA4TsCvk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783405064; c=relaxed/simple; bh=wtQTVfzkezqQV0RnJrEn/m3KjSX8pxjorSBtSg/NEdo=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=bbk53EBQgLTt/HurcYkTaReCtziDb0Canm5KP3N5c+VzIoFTC1rK6ZtqEbtZgfWIFqnZITnb1YPZzDETBUMbtrd1JrS0FmupCXXbS2L+rVG6CqxG2ktZaas6aB2BDyqo7znrqFSCGh2xNT38DbQceU7WJDpKrK1sHN5YjvrkuHY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=OoIDc5xK; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=hcSqPr5d; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="OoIDc5xK"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="hcSqPr5d" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66749Mkc2658552 for ; Tue, 7 Jul 2026 06:17:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=qcppdkim1; bh=pl1sWeMBafq5dBYywth/L+4oTHWDQJ/jNNc 0mkSxTac=; b=OoIDc5xKTfO2RCmuaSgRisk3U91iIdyLsZxShpQ5Ug8oFX7kfEj WOQKn7ZtEVwPNQY2HEQPn9jmxfuMll+VBffdeRhbe8mOiiY9s6Zdirbfe+N+HJeJ 7CMwMCxXVWwxEHgJTXxWroIzrXhJZcNHmrcmOxyu2wsEzxcMHttiQeBwqhvKimt0 2VZTurA7U0ETULhaQmsdBmFxoR2nWPPQ9yS82dFwV+GXJM30gvaqYNyvecIU1T6V KHGOYwLTyMOHu28WILMuG6J8HC3ybluos7vQV8uNqpJST5BmRC0UjTD9ZWgOpTAM OtRtBm8qcWidh8NYd6s706nrGdjmkRhCMXQ== Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f8a3r4ctj-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 07 Jul 2026 06:17:41 +0000 (GMT) Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-8478e603285so509326b3a.0 for ; Mon, 06 Jul 2026 23:17:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1783405060; x=1784009860; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pl1sWeMBafq5dBYywth/L+4oTHWDQJ/jNNc0mkSxTac=; b=hcSqPr5d3TwnyZYJfj9jbZi0Db68ohc070T/3ubYfvR9Fin9/WTBK7+Q6B24hlLfJB wc0Cnp9jZBz4+isBtHsyZsmqoAnIoQinMlNb/1APc8nl3mTP3Hu7Cnk1Kf7Yfi7BKpAo upDfbp4Od24Koq/HmapAsoNMVKvTXH/GpKdgjix3YlOuSl3081fU1ekRjklYbecM2eRf I/fIW2wo19W2PKE9sbc2pfMXunl1UcQJDQPEhL+4NYT7sh0tL7w+VgTYtE3fSejmIwZU rWDG2dvXQsjWF4j2a0OiS7iRvJi6ScujHsyPgW1aGnOqwU+SA8FMI7eUc9Ht3mbwNfeF SyiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783405060; x=1784009860; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pl1sWeMBafq5dBYywth/L+4oTHWDQJ/jNNc0mkSxTac=; b=kLpxL5PptImoHKLgQ1occUhMAy04+FQqqH+R92OxLLjBDhY69SJJdsepQa17WHHnYl z5ZpaO5vcGfeAfpYL/BhRnkzUSZoJqZRvyRuOKn3ryND6sw4rbq6bHNyWC3lhHt6MQPa I/eGD3/saBBAh267u0AJVnEuYeWCLGHhNKz/kVfEJSkNOlH0ESpzvboClh6QQ4zDmWIe p5XbX8AB2EvheBfCBbfVl8ubXt8juRfBFC86xEAsQ5nnd9odd445JR4ocL0t5/SyQoBy HJk5t4DibuypEmdxMauIb0XPQ+qeRk1mCLOate8AjtLoM1mZlzQdvUfXkus/hsOxE/xh PKKg== X-Forwarded-Encrypted: i=1; AHgh+RoeczfNEfzyylnWFxfMpzoXPgH9ZD4A9ptx1JwYnZXAHme2lt2qypLSGz40iQ6rIm3cLuoFDQtmtMW9qEY=@vger.kernel.org X-Gm-Message-State: AOJu0YycM16CccuMNndI0m8e/2jRA0YYiGL0PLu2x2lSvAfO1rManG3w SQlVDOoJeGHDYCeTojLx+2naPCve515IjL4xDdKvsEEQM/H68ERe3J2hQaQfOd4jZ7GpsB4vtCO uXh3lodPImsgSdgOPkMZ/4zvHZ/fjDYJEk9awR2aTUnVSqFKEBjTH6vF++puktHHL+8g= X-Gm-Gg: AfdE7ckGjsJIjynPx9jldbJlB++pkhuj3VdGXRzh5slR3rb7Pitcmy6m/9k7jcprAEl aHPfTsvhCHgqxyWUSetPwPW/6Z1ffwsvmHDzpAxFI96TfG20rg2UHbg68TMEZ230SF9kJftz1qe wT5AV4GVJfQ1gdO9kLSrlPCwld3pZ8aZgHDMpGpPxsyiOe6UqAkf5X7Z5tcXS9YEXAcZwcrZXz7 YvNhTJJS9cquTkSLa9+O6nhZqqv+TJD7lcrZns5vR9Lsyv8dKvPMujJBMlilMUDNKFjbGOkVS0z rBzCdhQK/eWujvj+fuLRTw7Ek8MbeDHZEp4sSYbSssq96EcPyyvtRpl23do9NDr6aykvHgf0IFF SntOLd5wB56IBl9pAMtkLrRtwaDqQmlw+bv0CO55WOUulIGeHSesfcwk5LHidjJLXXEQlxqiu3V VYODti/OE= X-Received: by 2002:a05:6a00:3e1c:b0:842:3838:cb03 with SMTP id d2e1a72fcca58-8482f358cd6mr1181885b3a.11.1783405060441; Mon, 06 Jul 2026 23:17:40 -0700 (PDT) X-Received: by 2002:a05:6a00:3e1c:b0:842:3838:cb03 with SMTP id d2e1a72fcca58-8482f358cd6mr1181856b3a.11.1783405059795; Mon, 06 Jul 2026 23:17:39 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6b96c0fsm4816238b3a.20.2026.07.06.23.17.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 23:17:39 -0700 (PDT) From: Jianping Li To: Srinivas Kandagatla , Ekansh Gupta Cc: Jianping Li , Arnd Bergmann , Greg Kroah-Hartman , Abel Vesa , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org Subject: [PATCH v9] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Date: Tue, 7 Jul 2026 14:17:33 +0800 Message-Id: <20260707061733.495-1-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA1NyBTYWx0ZWRfX6YVTJ7VV943W RI5kRvL4C1Xu2iQXOJvu8Uxn7lU4M76u9VVYfwQoa/mKMszdoY/KRZJ8zPSpnxlhvPNPdY4rV33 gfh6uvVaSm2Da5FK+SZ1V8LPkRdz/hH32xY69zNVw34mkKqSI0l9b9Km8t5Xzq+NYc02kpKEgNX lYOJHlRYHezIb5gmS0bLfqr3MRESZei8gKjLksHzLH5pjGrHwi22NVdBkg4w5Ok88X9P7LZgtM7 mR8+K5yyl6QFh2jF7mc9qZSRVuQI74wKM+FyY/Hg8TIPnB89AijNlEAJWOMr5xSM47dGIsGj84Y 8zGNBd0gFbw7jfJ2iIGIP8bRS9h1qMJf2mFw/P/f9WUu8g5XfUdf0VCEXWV/IBi5z0s/UOIr86O w9rrSLnK5F7ks1ogTB02ayNL42dPYn3HzcW4viW0pjdUntTrAaI6ciopOE8vlXlWACygA7Dim7T EKZCkKhmoc4Pvo7EDLg== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA1NyBTYWx0ZWRfXzr2zx9y5+x3H tmYUqLRjQ/okmnubuJyPqwIYafkKf9GKqDQuJKr94gLJXznDAH/BqfUTvkCZ58DbgHNg+GXS1fH XEDe+P7mDYpoUteBcsLZdsCmWekkN10= X-Proofpoint-GUID: -LH5Bi-rpXpYzNfAfOHXz33eLocQkMpM X-Proofpoint-ORIG-GUID: -LH5Bi-rpXpYzNfAfOHXz33eLocQkMpM X-Authority-Analysis: v=2.4 cv=OKcXGyaB c=1 sm=1 tr=0 ts=6a4c9a05 cx=c_pps a=mDZGXZTwRPZaeRUbqKGCBw==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=c8cBMUidy7NAwe8AhH0A:9 a=zc0IvFSfCIW2DFIPzwfm:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 adultscore=0 malwarescore=0 clxscore=1015 suspectscore=0 spamscore=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070057 Allocating and freeing Audio PD memory from userspace is unsafe because the kernel cannot reliably determine when the DSP has finished using the memory. Userspace may free buffers while they are still in use by the DSP, and remote free requests cannot be safely trusted. Additionally, the current implementation allows userspace to repeatedly grow the Audio PD heap, but does not support shrinking it. This can lead to unbounded memory usage over time, effectively causing a memory leak. Fix this by allocating the entire Audio PD reserved-memory region during rpmsg probe and tying its lifetime to the rpmsg channel. This removes userspace-controlled alloc/free and ensures that memory is reclaimed only when the DSP process is torn down. Add explicit validation for remote_heap presence and size before sending the memory to DSP, and fail early if the reserved-memory region is missing or incomplete. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 119 +++++++++++++++++++++++------------------ 1 file changed, 66 insertions(+), 53 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index d86e79134c68..1ec37e6c68a2 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -276,6 +276,8 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; @@ -1344,15 +1346,24 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, struct fastrpc_init_create_static init; struct fastrpc_invoke_args *args; struct fastrpc_phy_page pages[1]; + struct fastrpc_channel_ctx *cctx = fl->cctx; char *name; int err; - bool scm_done = false; struct { int client_id; u32 namelen; u32 pageslen; } inbuf; u32 sc; + unsigned long flags; + + if (!cctx->remote_heap || !cctx->remote_heap->dma_addr || + !cctx->remote_heap->size) { + err = -ENOMEM; + dev_err(fl->sctx->dev, + "remote heap memory region is not added\n"); + return err; + } args = kzalloc_objs(*args, FASTRPC_CREATE_STATIC_PROCESS_NARGS); if (!args) @@ -1376,31 +1387,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, inbuf.client_id = fl->client_id; inbuf.namelen = init.namelen; inbuf.pageslen = 0; - if (!fl->cctx->remote_heap) { - err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); - if (err) - goto err_name; - - /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ - if (fl->cctx->vmcount) { - u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); - - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); - if (err) { - dev_err(fl->sctx->dev, - "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, - fl->cctx->remote_heap->size, err); - goto err_map; - } - scm_done = true; - inbuf.pageslen = 1; - } - } fl->pd = USER_PD; @@ -1412,8 +1398,24 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, args[1].length = inbuf.namelen; args[1].fd = -1; - pages[0].addr = fl->cctx->remote_heap->dma_addr; - pages[0].size = fl->cctx->remote_heap->size; + /* + * Audio PD is a static PD and retains the remote heap + * information across daemon restarts. Therefore only + * the first attach should provide heap information to + * DSP. Subsequent attaches reuse the previously + * initialized memory pool. + */ + spin_lock_irqsave(&cctx->lock, flags); + if (!cctx->audio_init_mem) { + pages[0].addr = cctx->remote_heap->dma_addr; + pages[0].size = cctx->remote_heap->size; + cctx->audio_init_mem = true; + inbuf.pageslen = 1; + } else { + pages[0].addr = 0; + pages[0].size = 0; + } + spin_unlock_irqrestore(&cctx->lock, flags); args[2].ptr = (u64)(uintptr_t) pages; args[2].length = sizeof(*pages); @@ -1431,27 +1433,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, return 0; err_invoke: - if (fl->cctx->vmcount && scm_done) { - u64 src_perms = 0; - struct qcom_scm_vmperm dst_perms; - u32 i; - - for (i = 0; i < fl->cctx->vmcount; i++) - src_perms |= BIT(fl->cctx->vmperms[i].vmid); - - dst_perms.vmid = QCOM_SCM_VMID_HLOS; - dst_perms.perm = QCOM_SCM_PERM_RWX; - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); - if (err) - dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err); - } -err_map: - fastrpc_buf_free(fl->cctx->remote_heap); - fl->cctx->remote_heap = NULL; -err_name: + cctx->audio_init_mem = false; kfree(name); err: kfree(args); @@ -2418,12 +2400,23 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) } } - if (domain_id == SDSP_DOMAIN_ID) { + if (domain_id == SDSP_DOMAIN_ID || domain_id == ADSP_DOMAIN_ID) { struct resource res; u64 src_perms; err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res); if (!err) { + if (domain_id == ADSP_DOMAIN_ID) { + data->remote_heap = + kzalloc_obj(*data->remote_heap, GFP_KERNEL); + if (!data->remote_heap) { + err = -ENOMEM; + goto err_free_data; + } + + data->remote_heap->dma_addr = res.start; + data->remote_heap->size = resource_size(&res); + } src_perms = BIT(QCOM_SCM_VMID_HLOS); err = qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms, @@ -2431,7 +2424,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) if (err) goto err_free_data; } - } secure_dsp = !(of_property_read_bool(rdev->of_node, "qcom,non-secure-domain")); @@ -2490,6 +2482,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) misc_deregister(&data->secure_fdevice->miscdev); err_free_data: + kfree(data->remote_heap); kfree(data); return err; } @@ -2512,6 +2505,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) struct fastrpc_buf *buf, *b; struct fastrpc_user *user; unsigned long flags; + int err; /* No invocations past this point */ spin_lock_irqsave(&cctx->lock, flags); @@ -2529,8 +2523,27 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + if (cctx->remote_heap && cctx->vmcount) { + u64 src_perms = 0; + struct qcom_scm_vmperm dst_perms; + + for (u32 i = 0; i < cctx->vmcount; i++) + src_perms |= BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid = QCOM_SCM_VMID_HLOS; + dst_perms.perm = QCOM_SCM_PERM_RWX; + + err = qcom_scm_assign_mem(cctx->remote_heap->dma_addr, + cctx->remote_heap->size, &src_perms, + &dst_perms, 1); + if (err) + dev_err(&rpdev->dev, + "Failed to assign memory back to HLOS: dma_addr %pad size %#llx err %d\n", + &cctx->remote_heap->dma_addr, cctx->remote_heap->size, err); + } + + kfree(cctx->remote_heap); + cctx->remote_heap = NULL; of_platform_depopulate(&rpdev->dev); -- 2.43.0