[PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[Jianping Li]

The ADSP remote heap is declared as a reusable CMA pool. FastRPC
assigns the entire region to the DSP through qcom_scm_assign_mem()
during probe without allocating the pages from CMA. Consequently,
the pages remain available for movable HLOS allocations even after
HLOS access to the region has been revoked.

On Talos, GPU stress testing triggers a synchronous external abort
when zram accesses pages within the ADSP remote heap.

Replace reusable with no-map to prevent the region from being reused
for normal kernel allocations and exclude it from the kernel's
standard memory mapping.

Fixes: b0b51a5f1911f ("arm64: dts: qcom: talos: Add memory-region for audio PD")
Link: https://lore.kernel.org/all/20260424-talosaudio-v3-1-9e2ad5d78a2e@oss.qualcomm.com/
Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/talos.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/talos.dtsi b/arch/arm64/boot/dts/qcom/talos.dtsi
index 8ed6f2755705..b14952b57d6a 100644
--- a/arch/arm64/boot/dts/qcom/talos.dtsi
+++ b/arch/arm64/boot/dts/qcom/talos.dtsi
@@ -682,7 +682,7 @@ pil_gpu_mem: pil-gpu@97715000 {
 		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
 			compatible = "shared-dma-pool";
 			alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
-			reusable;
+			no-map;
 			alignment = <0x0 0x400000>;
 			size = <0x0 0x800000>;
 		};
-- 
2.43.0

Re: [PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64: dts: qcom: talos: SEA crash shifted to FastRPC dma_alloc_coherent due to un-restored HLOS permissions
--

commit af4a6b835881c10ea8fa53c33cf956e604f98923
Author: Jianping Li <jianping.li@oss.qualcomm.com>

arm64: dts: qcom: talos: Make the ADSP remote heap no-map

This commit isolates the ADSP remote heap by changing its declaration
from reusable to no-map. This is intended to prevent normal kernel
allocations from triggering a Synchronous External Abort (SEA) when
accessing pages within the heap.

Link: https://lore.kernel.org/all/20260424-talosaudio-v3-1-9e2ad5d78a2e@oss.qualcomm.com/

> diff --git a/arch/arm64/boot/dts/qcom/talos.dtsi b/arch/arm64/boot/dts/qcom/talos.dtsi
> index eedfdce3c479e..163c14971374c 100644
> --- a/arch/arm64/boot/dts/qcom/talos.dtsi
> +++ b/arch/arm64/boot/dts/qcom/talos.dtsi
> @@ -683,7 +683,7 @@ pil_gpu_mem: pil-gpu@97715000 {
>  		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
>  			compatible = "shared-dma-pool";
>  			alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
> -			reusable;
> +			no-map;

[Severity: High]
Does changing this to no-map just shift the Synchronous External Abort
from ZRAM to the FastRPC driver's dma_alloc_coherent() path?

By marking this region no-map, it becomes a coherent DMA pool, shifting
its allocations to FastRPC's dma_alloc_coherent() path.

FastRPC dynamically assigns the allocated memory chunk to the DSP during
fastrpc_req_mmap(), which revokes HLOS access:

drivers/misc/fastrpc.c:fastrpc_req_mmap() {
        ...
        err = qcom_scm_assign_mem(buf->dma_addr, (u64)buf->size,
                &src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
        ...
}

When the user unmaps the memory, fastrpc_req_munmap_impl() calls
fastrpc_buf_free() and returns the memory to the DMA pool without
restoring HLOS permissions.

The next allocation from the DMA pool will trigger an SEA when
dma_alloc_coherent() attempts to memset() the still-DSP-owned pages:

drivers/misc/fastrpc.c:__fastrpc_buf_alloc() {
        ...
        buf->virt = dma_alloc_coherent(dev, buf->size, &buf->dma_addr,
                                       GFP_KERNEL);
        ...
}

>  			alignment = <0x0 0x400000>;
>  			size = <0x0 0x800000>;
>  		};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014083820.468-1-jianping.li@oss.qualcomm.com?part=1

Re: [PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[Konrad Dybcio]

On 10/14/26 10:38 AM, Jianping Li wrote:
> The ADSP remote heap is declared as a reusable CMA pool. FastRPC
> assigns the entire region to the DSP through qcom_scm_assign_mem()
> during probe without allocating the pages from CMA. Consequently,
> the pages remain available for movable HLOS allocations even after
> HLOS access to the region has been revoked.
> 
> On Talos, GPU stress testing triggers a synchronous external abort
> when zram accesses pages within the ADSP remote heap.
> 
> Replace reusable with no-map to prevent the region from being reused
> for normal kernel allocations and exclude it from the kernel's
> standard memory mapping.
> 
> Fixes: b0b51a5f1911f ("arm64: dts: qcom: talos: Add memory-region for audio PD")
> Link: https://lore.kernel.org/all/20260424-talosaudio-v3-1-9e2ad5d78a2e@oss.qualcomm.com/
> Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad

Re: [PATCH v1] arm64: dts: qcom: talos: Make the ADSP remote heap no-map

[Ekansh Gupta]

On 14-10-2026 14:08, Jianping Li wrote:
> The ADSP remote heap is declared as a reusable CMA pool. FastRPC
> assigns the entire region to the DSP through qcom_scm_assign_mem()
> during probe without allocating the pages from CMA. Consequently,
> the pages remain available for movable HLOS allocations even after
> HLOS access to the region has been revoked.
> 
> On Talos, GPU stress testing triggers a synchronous external abort
> when zram accesses pages within the ADSP remote heap.
> 
> Replace reusable with no-map to prevent the region from being reused
> for normal kernel allocations and exclude it from the kernel's
> standard memory mapping.
> 
> Fixes: b0b51a5f1911f ("arm64: dts: qcom: talos: Add memory-region for audio PD")
> Link: https://lore.kernel.org/all/20260424-talosaudio-v3-1-9e2ad5d78a2e@oss.qualcomm.com/
> Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
> ---
>  arch/arm64/boot/dts/qcom/talos.dtsi | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/boot/dts/qcom/talos.dtsi b/arch/arm64/boot/dts/qcom/talos.dtsi
> index 8ed6f2755705..b14952b57d6a 100644
> --- a/arch/arm64/boot/dts/qcom/talos.dtsi
> +++ b/arch/arm64/boot/dts/qcom/talos.dtsi
> @@ -682,7 +682,7 @@ pil_gpu_mem: pil-gpu@97715000 {
>  		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
>  			compatible = "shared-dma-pool";
>  			alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
> -			reusable;
> +			no-map;
>  			alignment = <0x0 0x400000>;
>  			size = <0x0 0x800000>;
>  		};

Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>