[PATCH] remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage

[Mostafa Saleh]

During adsp_map_carveout, the IOVA is computed by combining the
physical address and the SID:
    iova = adsp->mem_phys | (sid << 32);

However, adsp_unmap_carveout() uses the physical address and not
the IOVA in iommu_unmap(), causing the unmap to fail or leak
mappings because the address doesn't match the original IOVA.

Cache the constructed IOVA within the qcom_adsp device struct
during mapping and use it during unmapping.

Fixes: f22eedff28af ("remoteproc: qcom: Add support for memory sandbox")
Signed-off-by: Mostafa Saleh <smost...@google.com>
---
I found this using gemini while auditing the iommu API usage based on
unrelated bug report.
https://lore.kernel.org/all/20260827145855.1616223-1-xiang...@linux.alibaba.com/
---
 drivers/remoteproc/qcom_q6v5_adsp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c 
b/drivers/remoteproc/qcom_q6v5_adsp.c
index 39654206781d..2e5fb5954fa9 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -104,6 +104,7 @@ struct qcom_adsp {
        struct completion stop_done;
 
        phys_addr_t mem_phys;
+       unsigned long iova;
        phys_addr_t mem_reloc;
        void __iomem *mem_region;
        size_t mem_size;
@@ -333,7 +334,7 @@ static void adsp_unmap_carveout(struct rproc *rproc)
        struct qcom_adsp *adsp = rproc->priv;
 
        if (adsp->has_iommu)
-               iommu_unmap(rproc->domain, adsp->mem_phys, adsp->mem_size);
+               iommu_unmap(rproc->domain, adsp->iova, adsp->mem_size);
 }
 
 static int adsp_map_carveout(struct rproc *rproc)
@@ -341,7 +342,6 @@ static int adsp_map_carveout(struct rproc *rproc)
        struct qcom_adsp *adsp = rproc->priv;
        struct of_phandle_args args;
        long long sid;
-       unsigned long iova;
        int ret;
 
        if (!adsp->has_iommu)
@@ -358,9 +358,9 @@ static int adsp_map_carveout(struct rproc *rproc)
        of_node_put(args.np);
 
        /* Add SID configuration for ADSP Firmware to SMMU */
-       iova =  adsp->mem_phys | (sid << 32);
+       adsp->iova = adsp->mem_phys | (sid << 32);
 
-       ret = iommu_map(rproc->domain, iova, adsp->mem_phys,
+       ret = iommu_map(rproc->domain, adsp->iova, adsp->mem_phys,
                        adsp->mem_size, IOMMU_READ | IOMMU_WRITE,
                        GFP_KERNEL);
        if (ret) {
-- 
2.55.0.897.gb25b4bd76c-goog