Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] remoteproc: qcom_wcnss: DMA memory leak of metadata in wcnss_load() - [High] remoteproc: qcom_wcnss: missing pas_ctx->use_tzmem = true prevents required shmbridge creation --
commit 77b1a378f038e55ff2a11032d9b6f243214fbb7f Author: Mukesh Ojha <[email protected]> Date: Fri Sep 25 15:57:30 2026 +0000 remoteproc: qcom_wcnss: migrate to qcom_mdt_pas_load() and qcom_pas_prepare_and_auth_reset() This commit migrates the Qualcomm WCNSS remoteproc driver to use qcom_mdt_pas_load() and qcom_pas_prepare_and_auth_reset(). It allocates a PAS context during probe to support TrustZone authentication with shmbridge preparation. > diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c > index c856a92af43ce..01f9076aa0b17 100644 > --- a/drivers/remoteproc/qcom_wcnss.c > +++ b/drivers/remoteproc/qcom_wcnss.c [ ... ] > @@ -157,9 +158,7 @@ static int wcnss_load(struct rproc *rproc, const struct > firmware *fw) > struct qcom_wcnss *wcnss = rproc->priv; > int ret; > > - ret = qcom_mdt_load(wcnss->dev, fw, rproc->firmware, WCNSS_PAS_ID, > - (__force void *)wcnss->mem_region, wcnss->mem_phys, > - wcnss->mem_size, &wcnss->mem_reloc); > + ret = qcom_mdt_pas_load(wcnss->pas_ctx, fw, rproc->firmware, > &wcnss->mem_reloc); [Severity: High] Does this introduce a DMA memory leak of the metadata buffer? By passing wcnss->pas_ctx to qcom_mdt_pas_load(), the allocated metadata buffer is retained in wcnss->pas_ctx->ptr. In the previous qcom_mdt_load() implementation, passing a NULL context signaled the backend to free the buffer immediately. Since the remoteproc operations structure (wcnss_ops) lacks an .unprepare hook, there doesn't seem to be a corresponding call to qcom_pas_metadata_release(wcnss->pas_ctx) when the device is shut down. Will this persistently leak DMA memory each time the remoteproc is started and stopped via sysfs? > if (ret) > return ret; [ ... ] > @@ -600,6 +599,11 @@ static int wcnss_probe(struct platform_device *pdev) > if (ret) > return ret; > > + wcnss->pas_ctx = devm_qcom_pas_context_alloc(wcnss->dev, WCNSS_PAS_ID, > + wcnss->mem_phys, > wcnss->mem_size); [Severity: High] The commit message explicitly states the goal is to include the shmbridge prepare step required before TrustZone authentication. However, does this actually enable the shmbridge? The newly allocated wcnss->pas_ctx is zero-initialized by devm_qcom_pas_context_alloc(), so pas_ctx->use_tzmem defaults to false. When use_tzmem is false, qcom_scm_pas_prepare_and_auth_reset() explicitly skips creating the shmbridge and falls back to the legacy behavior. Should wcnss->pas_ctx->use_tzmem be set to true here to fulfill the stated security objective? > + if (IS_ERR(wcnss->pas_ctx)) > + return PTR_ERR(wcnss->pas_ctx); > + > wcnss->pmu_cfg = mmio + data->pmu_offset; > wcnss->spare_out = mmio + data->spare_offset; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
