[PATCH v4] arm64: dts: qcom: agatti: Add memory-region for audio PD

[PATCH v4] arm64: dts: qcom: agatti: Add memory-region for audio PD

[Vinayak Katoch]

Reserve memory region for audio PD dynamic loading and remote heap
requirements. Add the required VMID list for memory ownership
transfers.

Fixes: 851d5ae6003b ("arm64: dts: qcom: agatti: enable FastRPC on the ADSP")
Tested-by: Christopher Obbard <chris.obbard@oss.qualcomm.com>
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Vinayak Katoch <vinayak.katoch@oss.qualcomm.com>
---
Changes in v4:
- Added a Fixes tag.
- Link to v3: https://lore.kernel.org/r/20260820-agatti-audio-v3-1-47337097ee53@oss.qualcomm.com

Changes in v3:
- Changed alloc-ranges to <0x0 0x0 0x1 0x0> to cover the full 32-bit address space.
- Collected Reviewed-by/Tested-by tags.
- Link to v2: https://lore.kernel.org/r/20260807-agatti-audio-v2-1-3959b1ab8059@oss.qualcomm.com

Changes in v2:
- Fixed VMID list alignment.
- Link to v1: https://lore.kernel.org/r/20260806-agatti-audio-v1-1-cd6766cc9ccb@oss.qualcomm.com
---
 arch/arm64/boot/dts/qcom/agatti.dtsi | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/agatti.dtsi b/arch/arm64/boot/dts/qcom/agatti.dtsi
index e7fed60a59d9..8d557010d3c0 100644
--- a/arch/arm64/boot/dts/qcom/agatti.dtsi
+++ b/arch/arm64/boot/dts/qcom/agatti.dtsi
@@ -381,6 +381,14 @@ rmtfs_mem: memory@89b01000 {
 			qcom,client-id = <1>;
 			qcom,vmid = <QCOM_SCM_VMID_MSS_MSA QCOM_SCM_VMID_NAV>;
 		};
+
+		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x0 0x1 0x0>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x800000>;
+		};
 	};
 
 	smp2p-adsp {
@@ -2346,6 +2354,9 @@ fastrpc {
 					compatible = "qcom,fastrpc";
 					qcom,glink-channels = "fastrpcglink-apps-dsp";
 					label = "adsp";
+					memory-region = <&adsp_rpc_remote_heap_mem>;
+					qcom,vmids = <QCOM_SCM_VMID_LPASS
+						      QCOM_SCM_VMID_ADSP_HEAP>;
 
 					qcom,non-secure-domain;
 

---
base-commit: 944a035ecca915ae947905dcfb03f2b9dc6d032c
change-id: 20260806-agatti-audio-357bcd74ae9c

Best regards,
-- 
Vinayak Katoch <vinayak.katoch@oss.qualcomm.com>

Re: [PATCH v4] arm64: dts: qcom: agatti: Add memory-region for audio PD

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The fastrpc driver assigns CMA memory to the DSP via qcom_scm_assign_mem() but never restores HLOS permissions before freeing it back to the kernel, leading to a fatal XPU memory protection fault.
--

commit ec8640fac73b78cbfdda01ddc330dda934f6259f
Author: Vinayak Katoch <vinayak.katoch@oss.qualcomm.com>

arm64: dts: qcom: agatti: Add memory-region for audio PD

Reserve memory region for audio PD dynamic loading and remote heap
requirements. Add the required VMID list for memory ownership
transfers.

> diff --git a/arch/arm64/boot/dts/qcom/agatti.dtsi b/arch/arm64/boot/dts/qcom/agatti.dtsi
> index e7fed60a59d93..8d557010d3c0d 100644
> --- a/arch/arm64/boot/dts/qcom/agatti.dtsi
> +++ b/arch/arm64/boot/dts/qcom/agatti.dtsi
[ ... ]
> @@ -2346,6 +2354,9 @@ fastrpc {
>  					compatible = "qcom,fastrpc";
>  					qcom,glink-channels = "fastrpcglink-apps-dsp";
>  					label = "adsp";
> +					memory-region = <&adsp_rpc_remote_heap_mem>;
> +					qcom,vmids = <QCOM_SCM_VMID_LPASS
> +						      QCOM_SCM_VMID_ADSP_HEAP>;

[Severity: Critical]
This is a pre-existing issue, but does adding this configuration activate
buggy TrustZone memory assignment code paths in fastrpc on this platform?

The fastrpc driver assigns CMA memory to the DSP via qcom_scm_assign_mem()
but never restores HLOS permissions before freeing it back to the kernel,
which leads to a fatal XPU memory protection fault.

For example, when freeing user-mapped remote heap memory in
drivers/misc/fastrpc.c:fastrpc_req_munmap_impl():

	fastrpc_buf_free(buf);

Or when freeing the static process remote heap in
drivers/misc/fastrpc.c:fastrpc_rpmsg_remove():

	if (cctx->remote_heap)
		fastrpc_buf_free(cctx->remote_heap);

In both cases, the physical pages are returned to the generic CMA pool
without restoring HLOS permissions. Any subsequent kernel allocation from
this CMA pool will cause an immediate kernel panic (XPU violation).

Since a local userspace application can allocate remote heap memory via
FASTRPC_IOCTL_MMAP and then free it via FASTRPC_IOCTL_MUNMAP, could this
be trivially triggered as a local Denial of Service (DoS)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908-agatti-audio-v4-1-b3db91d3fdec@oss.qualcomm.com?part=1