Re: [PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64: dts: qcom: talos: SEA crash shifted to FastRPC dma_alloc_coherent due to un-restored HLOS permissions
--

commit af4a6b835881c10ea8fa53c33cf956e604f98923
Author: Jianping Li <jianping.li@oss.qualcomm.com>

arm64: dts: qcom: talos: Make the ADSP remote heap no-map

This commit isolates the ADSP remote heap by changing its declaration
from reusable to no-map. This is intended to prevent normal kernel
allocations from triggering a Synchronous External Abort (SEA) when
accessing pages within the heap.

Link: https://lore.kernel.org/all/20260424-talosaudio-v3-1-9e2ad5d78a2e@oss.qualcomm.com/

> diff --git a/arch/arm64/boot/dts/qcom/talos.dtsi b/arch/arm64/boot/dts/qcom/talos.dtsi
> index eedfdce3c479e..163c14971374c 100644
> --- a/arch/arm64/boot/dts/qcom/talos.dtsi
> +++ b/arch/arm64/boot/dts/qcom/talos.dtsi
> @@ -683,7 +683,7 @@ pil_gpu_mem: pil-gpu@97715000 {
>  		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
>  			compatible = "shared-dma-pool";
>  			alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
> -			reusable;
> +			no-map;

[Severity: High]
Does changing this to no-map just shift the Synchronous External Abort
from ZRAM to the FastRPC driver's dma_alloc_coherent() path?

By marking this region no-map, it becomes a coherent DMA pool, shifting
its allocations to FastRPC's dma_alloc_coherent() path.

FastRPC dynamically assigns the allocated memory chunk to the DSP during
fastrpc_req_mmap(), which revokes HLOS access:

drivers/misc/fastrpc.c:fastrpc_req_mmap() {
        ...
        err = qcom_scm_assign_mem(buf->dma_addr, (u64)buf->size,
                &src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
        ...
}

When the user unmaps the memory, fastrpc_req_munmap_impl() calls
fastrpc_buf_free() and returns the memory to the DMA pool without
restoring HLOS permissions.

The next allocation from the DMA pool will trigger an SEA when
dma_alloc_coherent() attempts to memset() the still-DSP-owned pages:

drivers/misc/fastrpc.c:__fastrpc_buf_alloc() {
        ...
        buf->virt = dma_alloc_coherent(dev, buf->size, &buf->dma_addr,
                                       GFP_KERNEL);
        ...
}

>  			alignment = <0x0 0x400000>;
>  			size = <0x0 0x800000>;
>  		};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014083820.468-1-jianping.li@oss.qualcomm.com?part=1