linux-kernel - Re: [RFC PATCH] remoteproc: imx_dsp_rproc: Fix multiple start/stop commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <091a4f29-5435-428a-9a1c-ef82465211cb@nxp.com>
Date: Wed, 10 Dec 2025 02:24:37 +0200
From: Iuliana Prodan <iuliana.prodan@....com>
To: Daniel Baluta <daniel.baluta@....com>, andersson@...nel.org,
 mathieu.poirier@...aro.org
Cc: m.szyprowski@...sung.com, shawnguo@...nel.org, kernel@...gutronix.de,
 festevam@...il.com, arnaud.pouliquen@...s.st.com, robh@...nel.org,
 geert+renesas@...der.be, linux-remoteproc@...r.kernel.org,
 imx@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org,
 linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] remoteproc: imx_dsp_rproc: Fix multiple start/stop
 commands

On 12/9/2025 4:04 PM, Daniel Baluta wrote:
> After commit 67a7bc7f0358 ("remoteproc: Use of reserved_mem_region_*
> functions for "memory-region"") following commands with
> imx-dsp-rproc started to fail:
> 
> $ echo zephyr.elf > /sys/class/remoteproc/remoteproc0/firmware
> $ echo start > /sys/class/remoteproc/remoteproc0/state
> $ echo stop > /sys/class/remoteproc/remoteproc0/state
> $ echo start > /sys/class/remoteproc/remoteproc0/state #! This fails
> -sh: echo: write error: Device or resource busy
> 
> This happens because aforementioned commit replaced devm_ioremap_wc with
> devm_ioremap_resource_wc which will "reserve" the memory region with the
> first start and then will fail at the second start if the memory
> region is already reserved.
> 
> So prefer using devm_ioremap_wc as there is no easy way to undo
> devm_iormep_resource_wc manually.
> 
> Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"")
> Signed-off-by: Daniel Baluta <daniel.baluta@....com>
> ---
>   drivers/remoteproc/imx_dsp_rproc.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
> index 5130a35214c9..79d5c15319f3 100644
> --- a/drivers/remoteproc/imx_dsp_rproc.c
> +++ b/drivers/remoteproc/imx_dsp_rproc.c
> @@ -709,10 +709,10 @@ static int imx_dsp_rproc_add_carveout(struct imx_dsp_rproc *priv)
>   		if (imx_dsp_rproc_sys_to_da(priv, res.start, resource_size(&res), &da))
>   			return -EINVAL;
>   
> -		cpu_addr = devm_ioremap_resource_wc(dev, &res);
> -		if (IS_ERR(cpu_addr)) {
> +		cpu_addr = devm_ioremap_wc(dev, res.start, resource_size(&res));

While this patch technically "works", it’s more of a workaround because:
- it removes important resource protection;
- it doesn’t address the root cause.

The real issue is likely that:
- resources should be released on stop but aren’t;
- or the mapping should happen once during probe, not on every start.

Better alterntives:
1. move the devm_ioremap_resource_wc() to probe() and keep it mapped for 
the device lifetime. This is the typical pattern for remoteproc drivers.
2. use non-devm versions in start/stop callbacks:
/* In start callback */
cpu_addr = ioremap_wc(res.start, resource_size(&res));
/* In stop callback */
iounmap(cpu_addr);

My vote goes for option 1.

> +		if (!cpu_addr) {
>   			dev_err(dev, "failed to map memory %pR\n", &res);
> -			return PTR_ERR(cpu_addr);
> +			return -ENOMEM;
>   		}
>   
>   		/* Register memory region */