Re: [PATCH v1 1/4] arm64: dts: qcom: kodiak: Make the ADSP remote heap no-map

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64: dts: qcom: kodiak: speculative SError risk due to Normal mapping of revoked remote heap
--

commit eae94193b9990051404a938db5815d54041d1867
Author: Jianping Li <jianping.li@oss.qualcomm.com>

arm64: dts: qcom: kodiak: Make the ADSP remote heap no-map

This commit replaces the "reusable" property with "no-map" for the ADSP
remote heap to prevent the kernel from reusing the memory after it has
been assigned to the DSP. It addresses a synchronous external abort that
occurred when the kernel accessed the revoked memory.

Link: https://lore.kernel.org/all/20260423063502.484-1-jianping.li@oss.qualcomm.com/

> diff --git a/arch/arm64/boot/dts/qcom/kodiak.dtsi b/arch/arm64/boot/dts/qcom/kodiak.dtsi
> index f2da3706d5c88..d4a5b02965252 100644
> --- a/arch/arm64/boot/dts/qcom/kodiak.dtsi
> +++ b/arch/arm64/boot/dts/qcom/kodiak.dtsi
> @@ -194,7 +194,7 @@ rmtfs_mem: rmtfs@9c900000 {
>  		adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
>  			compatible = "shared-dma-pool";
>  			alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
> -			reusable;
> +			no-map;

[Severity: High]
Does combining no-map with shared-dma-pool leave a live Normal memory
mapping that can trigger speculative SErrors?

When the DMA framework processes these combined properties,
rmem_dma_device_init() calls dma_init_coherent_memory(), which
unconditionally maps the entire region into vmalloc space:

kernel/dma/coherent.c:dma_init_coherent_memory() {
    ...
    mem_base = memremap(phys_addr, size, MEMREMAP_WC);
    ...
}

Because MEMREMAP_WC creates a Normal Non-Cacheable (MT_NORMAL_NC) mapping,
the CPU can speculatively prefetch from this memory.

Later, when the FastRPC driver assigns the physical memory to the DSP via
qcom_scm_assign_mem(), it revokes HLOS (kernel) access via TrustZone. If the
CPU issues a speculative fetch against the live vmalloc mapping, hitting the
TrustZone protection boundary will cause the interconnect to return an
external abort, triggering an asynchronous SError and crashing the system.

While changing to no-map prevents the linear map from accessing the memory,
does the region need a different compatible string or alternative handling so
the DMA framework doesn't map it back in as Normal memory?

>  			alignment = <0x0 0x400000>;
>  			size = <0x0 0x800000>;
>  		};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015071511.977-1-jianping.li@oss.qualcomm.com?part=1