From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D15231326C for ; Thu, 2 Jul 2026 04:02:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782964974; cv=none; b=e3C9Xwj0B79gCyufptWM9i/oZ8BI00DSXJSntw/veTkpTQN+J6q5cW573QIwCMLX3tk02j1LodUgfl4w8BndNqj4MJ96bTJAibWCYpW8EdpLsbgbPwcqYwtZatChINYP1+Rd1D+rK9OFq6qGLG9Sdo0JCVMSuw07XO/btJvrACY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782964974; c=relaxed/simple; bh=jEKDy6Q4kJGBzL2hEYleqfwVGMBzwD4g7obTojQDJyM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=DB87ehTci7CpEpZl9zuOu9FesTmveBFYjLlR0OHoB5tFTsy6zPhFOdQRLVk2Tk6Vhr2X7qigNgCI2xRGV3JN66B3aHXJw7UFZH7T0LpTnQWkoQB28vTk1uarIQxusts747IAyqsxWsgjr1+cFaQoHVHrKHKijeCDJVAAn2cyrAw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=YI69gsla; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=fAoDix/a; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="YI69gsla"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="fAoDix/a" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6621KDC03053461 for ; Thu, 2 Jul 2026 04:02:52 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= S9W8w7OdjpJqkYQrVpqOTZBE1FMiUuBplaVPcMbciTs=; b=YI69gslaxtjP7WKe MRIXn+3RItS/zEL0oysywiVNP9S4K9vgFvrL4NejWbis6Vo4xUgOZU4drUxE+l98 d+LcunByJk6oK1zUYY+yWVVvA5RYD7w2BbNmHkla/u4f+lOnIxn7tkiOoBnloQPA /+LeSCPLNuv3l6V0vxUpEdjDs8BH6HrWPG7c54QrdLYIP1Va7B760LPzjxjCjn4w +JDdSRITeBfITMaRcwe3hSXAGQYtyc8ygPhrAxqPwDgcLpNihqoP72fTIP+nzEcd Mj4EbMjxQ0SXK/7d7fN48OnA6hYvTWVaVfA7WIbdxG6ynEGWoc6NPDr1lIuPqXSC mUyA3g== Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4f50sd3v88-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 02 Jul 2026 04:02:52 +0000 (GMT) Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-c88ad1558f4so1942433a12.2 for ; Wed, 01 Jul 2026 21:02:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1782964972; x=1783569772; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=S9W8w7OdjpJqkYQrVpqOTZBE1FMiUuBplaVPcMbciTs=; b=fAoDix/a+A11CFotNVrniiaH9H5MA86uQuXngbzaK9E34uo/Y0VbOxG9bVW/uyZrJ/ lDSdND0D9619+4sWESqJtLwpVAgR9IRAJQwJoPQRqkILBaerhNIkoCt/+sY+brg92L4R fh5cHMTiKZm9fU+QecyMvnPiXPnDU8KzK3BTzLpCG7q2x7j417y53ZDcBWt7xrH13FR9 aGsJRNdWzkzIBG3IqjEbnUtoWBhYLpUXHGcC47NasDozp7OPJXVTD43MoJQSEauJ3cjz fYCtz6zRy7VqFsBWJwdnpIcVRVAdRJYN8hyfBjlppSiwRKtqJbwpD9D7HGX0BIItCvyj +v6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782964972; x=1783569772; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=S9W8w7OdjpJqkYQrVpqOTZBE1FMiUuBplaVPcMbciTs=; b=sOZRRYNmPMZYFVyOKRyC9fQMtfQMULPWrC55JdQrK7Np6uz6Yau1ePSEERFPZD/46u m8IalBz7PyAFAdfIVsAKBkbBvWF9i8HH1tUPidoIBo6F8KJXKTqDnb5vJiq9wYoXTOwy NOFjdbto1PEIo3f4jfEZfC7GDMbam6aA/gzEIr4IXCvuQf84qDmTqi063LkTtuqydCkH 1R+3Q4hS2hbVv1dZMD9mFKybGGgTxL8DpZjlB+IT2tpIgz0BsHDEx8FocBDz2IAtXa1M xNhe2QSS2jTsV2wrXOMpFN/+3SKf7L3/vEe9CsQFwhf9gS1nP+WFHS3bBEvuzWPTfRPI J2rg== X-Forwarded-Encrypted: i=1; AFNElJ+UtQiDumg4LRhijsDfV8JIE7JD6N/6XvTpkn6dSf7m5NrFNsFlsnx+6LZSBtaCqCM4wy7qZ/I74JD0+Is=@vger.kernel.org X-Gm-Message-State: AOJu0YzMMbbUqWuKT0OAnrwWQn5Pj+QMy1y1908zaNVTsoSjCDsJASrm NMZcDuRBQACM9kDrdJdg+gWmqgxrbiRAL2lA+urHyGLYjUNHpkDpYyUzf5x5ZLPRBWts64CFRRB JbWva0s+BqbuySmOBdYqH7uDS0Tc/bWPrVrUAeJLmDJTzAYgUk9Y2/kpn3fZhE54q4xY= X-Gm-Gg: AfdE7cldm5c8Y22QepbFOeHPxkJ8sUOU8FP3zYLP4cSjwRGqxrApndFi0S94+Vbl6Ji +K0YJKBkLmqrKwQ3ldshPGvM1alkyLAvBnpd6mVFV8hdg3H7ZcIHuBlqZDWkoRmh7KibCgmKzRJ PNva0fpUrrHVYvA6E+vNQkTzwCRzxmTfsEWZGKYNcFrZ+LKKpLWQElAWdxHOZU1eH4kac2E9Mpv uz95FKy8/MKA7c+C+/hF+ZC97oyBkllP381RwTp5V/InDWFvzFYdj2hjhxZHqo5prCBbXz8gvOD vsmP2Vc3O7y/9z7BfMacDZDycF2OauGR+N7tDIH0LsonMi5k24EwFixB3EdKpam9USMkL9vm815 KK83vswue9G9Nl5FHwvDo7r9wEDbMFYoa0aoVwktR X-Received: by 2002:a05:6a21:48d:b0:3bf:9fe1:c27 with SMTP id adf61e73a8af0-3bfed5018efmr5032496637.40.1782964971712; Wed, 01 Jul 2026 21:02:51 -0700 (PDT) X-Received: by 2002:a05:6a21:48d:b0:3bf:9fe1:c27 with SMTP id adf61e73a8af0-3bfed5018efmr5032429637.40.1782964971004; Wed, 01 Jul 2026 21:02:51 -0700 (PDT) Received: from [10.204.78.220] ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30f0bbdc4eesm4446432eec.24.2026.07.01.21.02.46 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Jul 2026 21:02:50 -0700 (PDT) Message-ID: Date: Thu, 2 Jul 2026 09:32:45 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v8 3/4] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe To: Srinivas Kandagatla , Jianping Li , Amol Maheshwari Cc: Arnd Bergmann , Greg Kroah-Hartman , Abel Vesa , Jorge Ramirez-Ortiz , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, quic_chennak@quicinc.com, stable@kernel.org References: <20260609025938.457-1-jianping.li@oss.qualcomm.com> <20260609025938.457-4-jianping.li@oss.qualcomm.com> Content-Language: en-US From: Ekansh Gupta In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Authority-Analysis: v=2.4 cv=Z+3c2nRA c=1 sm=1 tr=0 ts=6a45e2ec cx=c_pps a=Oh5Dbbf/trHjhBongsHeRQ==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=EWVka2mvqR4YGq0-U2gA:9 a=QEXdDO2ut3YA:10 a=_Vgx9l1VpLgwpw_dHYaR:22 X-Proofpoint-ORIG-GUID: l2f6hhDW_vT_4-c0pTMFOS1xVSgHtjhc X-Proofpoint-Spam-Info: AW1haW4tMjYwNzAyMDAzNyBTYWx0ZWRfXyQaSe4hZyQ+p Mve0La/LB33GKzeiw/q2elRs2a2VX2r7ZjFseVx4nut2BttTL1Kxjt7KnzyDrTOO8k3squdsWT4 T0mmxSF1RcGQXTEqeCzqC5XO8jHxxFY= X-Proofpoint-GUID: l2f6hhDW_vT_4-c0pTMFOS1xVSgHtjhc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzAyMDAzNyBTYWx0ZWRfXwhVV8kzVBJGh sTdeHLQMN/gU+wsyV1lYWHxljHltrss9OfnChjAGZsfyLfKpx0eCAogJCk8FLZeSvuca7l+U1Rt Hzd3/os7novZ2EY86o94+ZcRzV1AUUteDMWmx9d5SBcqvs3szzLZUM1XGnfxiipxwqu49eu5xhh +ukFnhdhbUs5l0cwoTfCiSdCNYel7RR3ZA6XvjrSGC+hlBUWDvN9mXQ/K6NIG6aA6lIHeZz4R5S rdYsHC5WW1pfLfcdiMSOibKyovq+pU+YNpEBKMfbxVASbIigZerpPX6WZxL4/xE1F6ZXtc6263h K1qKMPsxZHo/YJjG94l4nQ5+A2wGqlwOmAfA9S4TbvKvflJoQJO6CRjKwr5/YYwobUt2ETXsr91 NMEmTTLgE5CLCMcn6U91w5BbfNllklUHOM5exRom0Myvka3DW+fbjteTfJV3A24y209lmCsMQJ0 vd9hSJzwcxpTVR6vRpw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-07-02_01,2026-06-26_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 suspectscore=0 adultscore=0 priorityscore=1501 spamscore=0 phishscore=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607020037 On 02-07-2026 02:07, Srinivas Kandagatla wrote: > > > On 6/9/26 3:59 AM, Jianping Li wrote: >> Allocating and freeing Audio PD memory from userspace is unsafe because >> the kernel cannot reliably determine when the DSP has finished using the >> memory. Userspace may free buffers while they are still in use by the DSP, >> and remote free requests cannot be safely trusted. >> >> Additionally, the current implementation allows userspace to repeatedly >> grow the Audio PD heap, but does not support shrinking it. This can lead >> to unbounded memory usage over time, effectively causing a memory leak. >> >> Fix this by allocating the entire Audio PD reserved-memory region during >> rpmsg probe and tying its lifetime to the rpmsg channel. This removes >> userspace-controlled alloc/free and ensures that memory is reclaimed only >> when the DSP process is torn down. >> >> Add explicit validation for remote_heap presence and size before sending >> the memory to DSP, and fail early if the reserved-memory region is >> missing or incomplete. >> >> Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") >> Cc: stable@kernel.org >> Signed-off-by: Jianping Li >> --- >> drivers/misc/fastrpc.c | 112 ++++++++++++++++++++++------------------- >> 1 file changed, 59 insertions(+), 53 deletions(-) >> >> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c >> index 517884000331..1942e74535e5 100644 >> --- a/drivers/misc/fastrpc.c >> +++ b/drivers/misc/fastrpc.c >> @@ -276,6 +276,8 @@ struct fastrpc_channel_ctx { >> struct kref refcount; >> /* Flag if dsp attributes are cached */ >> bool valid_attributes; >> + /* Flag if audio PD init mem was allocated */ >> + bool audio_init_mem; >> u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; >> struct fastrpc_device *secure_fdevice; >> struct fastrpc_device *fdevice; >> @@ -1341,15 +1343,24 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, >> struct fastrpc_init_create_static init; >> struct fastrpc_invoke_args *args; >> struct fastrpc_phy_page pages[1]; >> + struct fastrpc_channel_ctx *cctx = fl->cctx; >> char *name; >> int err; >> - bool scm_done = false; >> struct { >> int client_id; >> u32 namelen; >> u32 pageslen; >> } inbuf; >> u32 sc; >> + unsigned long flags; >> + >> + if (!cctx->remote_heap || !cctx->remote_heap->dma_addr || >> + !cctx->remote_heap->size) { >> + err = -ENOMEM; >> + dev_err(fl->sctx->dev, >> + "remote heap memory region is not added\n"); >> + return err; >> + } >> >> args = kzalloc_objs(*args, FASTRPC_CREATE_STATIC_PROCESS_NARGS); >> if (!args) >> @@ -1373,31 +1384,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, >> inbuf.client_id = fl->client_id; >> inbuf.namelen = init.namelen; >> inbuf.pageslen = 0; >> - if (!fl->cctx->remote_heap) { >> - err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, >> - &fl->cctx->remote_heap); >> - if (err) >> - goto err_name; >> - >> - /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ >> - if (fl->cctx->vmcount) { >> - u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); >> - >> - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, >> - (u64)fl->cctx->remote_heap->size, >> - &src_perms, >> - fl->cctx->vmperms, fl->cctx->vmcount); >> - if (err) { >> - dev_err(fl->sctx->dev, >> - "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n", >> - &fl->cctx->remote_heap->dma_addr, >> - fl->cctx->remote_heap->size, err); >> - goto err_map; >> - } >> - scm_done = true; >> - inbuf.pageslen = 1; >> - } >> - } >> >> fl->pd = USER_PD; >> >> @@ -1409,8 +1395,17 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, >> args[1].length = inbuf.namelen; >> args[1].fd = -1; >> >> - pages[0].addr = fl->cctx->remote_heap->dma_addr; >> - pages[0].size = fl->cctx->remote_heap->size; >> + spin_lock_irqsave(&cctx->lock, flags); >> + if (!cctx->audio_init_mem) { >> + pages[0].addr = cctx->remote_heap->dma_addr; >> + pages[0].size = cctx->remote_heap->size; >> + cctx->audio_init_mem = true; >> + inbuf.pageslen = 1; >> + } else { >> + pages[0].addr = 0; >> + pages[0].size = 0; > > What is the expected behavoiur in this case? Audio daemon is expected to take the memory information to DSP audio PD only the first time it goes and attaches there. This is the case where daemon was killed but audio PD session is still running. In such cases, daemon is not expected to take any memory information to audio PD as the earlier shared information is already there with audio PD which it is using irrespective of daemon state.> >> + } >> + spin_unlock_irqrestore(&cctx->lock, flags); >> >> args[2].ptr = (u64)(uintptr_t) pages; >> args[2].length = sizeof(*pages); >> @@ -1428,27 +1423,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, >> >> return 0; >> err_invoke: >> - if (fl->cctx->vmcount && scm_done) { >> - u64 src_perms = 0; >> - struct qcom_scm_vmperm dst_perms; >> - u32 i; >> - >> - for (i = 0; i < fl->cctx->vmcount; i++) >> - src_perms |= BIT(fl->cctx->vmperms[i].vmid); >> - >> - dst_perms.vmid = QCOM_SCM_VMID_HLOS; >> - dst_perms.perm = QCOM_SCM_PERM_RWX; >> - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, >> - (u64)fl->cctx->remote_heap->size, >> - &src_perms, &dst_perms, 1); >> - if (err) >> - dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%llx err %d\n", >> - &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err); >> - } >> -err_map: >> - fastrpc_buf_free(fl->cctx->remote_heap); >> - fl->cctx->remote_heap = NULL; >> -err_name: >> + cctx->audio_init_mem = false; > this can race. > >> kfree(name); >> err: >> kfree(args); >> @@ -2415,12 +2390,23 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) >> } >> } >> >> - if (domain_id == SDSP_DOMAIN_ID) { >> + if (domain_id == SDSP_DOMAIN_ID || domain_id == ADSP_DOMAIN_ID) { >> struct resource res; >> u64 src_perms; >> >> err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res); >> if (!err) { >> + if (domain_id == ADSP_DOMAIN_ID) { >> + data->remote_heap = >> + kzalloc_obj(*data->remote_heap, GFP_KERNEL); >> + if (!data->remote_heap) { >> + err = -ENOMEM; >> + goto err_free_data; >> + } >> + >> + data->remote_heap->dma_addr = res.start; >> + data->remote_heap->size = resource_size(&res); >> + } >> src_perms = BIT(QCOM_SCM_VMID_HLOS); >> >> err = qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms, >> @@ -2428,7 +2414,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) >> if (err) >> goto err_free_data; >> } >> - >> } >> >> secure_dsp = !(of_property_read_bool(rdev->of_node, "qcom,non-secure-domain")); >> @@ -2487,6 +2472,7 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) >> misc_deregister(&data->secure_fdevice->miscdev); >> >> err_free_data: >> + kfree(data->remote_heap); >> kfree(data); >> return err; >> } >> @@ -2509,6 +2495,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) >> struct fastrpc_buf *buf, *b; >> struct fastrpc_user *user; >> unsigned long flags; >> + int err; >> >> /* No invocations past this point */ >> spin_lock_irqsave(&cctx->lock, flags); >> @@ -2526,8 +2513,27 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) >> list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) >> list_del(&buf->node); >> >> - if (cctx->remote_heap) >> - fastrpc_buf_free(cctx->remote_heap); >> + if (cctx->remote_heap && cctx->vmcount) { >> + u64 src_perms = 0; >> + struct qcom_scm_vmperm dst_perms; >> + >> + for (u32 i = 0; i < cctx->vmcount; i++) >> + src_perms |= BIT(cctx->vmperms[i].vmid); >> + >> + dst_perms.vmid = QCOM_SCM_VMID_HLOS; >> + dst_perms.perm = QCOM_SCM_PERM_RWX; >> + >> + err = qcom_scm_assign_mem(cctx->remote_heap->dma_addr, >> + cctx->remote_heap->size, &src_perms, >> + &dst_perms, 1); >> + if (err) >> + dev_err(&rpdev->dev, >> + "Failed to assign memory back to HLOS: dma_addr %pad size %#llx err %d\n", >> + &cctx->remote_heap->dma_addr, cctx->remote_heap->size, err); >> + } >> + >> + kfree(cctx->remote_heap); >> + cctx->remote_heap = NULL; >> >> of_platform_depopulate(&rpdev->dev); >> >