Re: [PATCH v1 4/4] arm64: dts: qcom: sm8750: Make the ADSP remote heap no-map

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] fastrpc: missing HLOS permission restore causes dma_alloc_coherent crash
--

commit 7b6c7a04a288b135d8a9c50d62b4084748ab88f0
Author: Jianping Li <jianping.li@oss.qualcomm.com>

arm64: dts: qcom: sm8750: Make the ADSP remote heap no-map

This commit changes the ADSP remote heap declaration from a reusable shared
DMA pool to a no-map region. This is intended to prevent the kernel from
accessing pages that have been handed over to the DSP.

Link: https://lore.kernel.org/all/20251209-sm8750-fastrpc-adsp-v3-1-ccfff49a8af9@linaro.org/

> diff --git a/arch/arm64/boot/dts/qcom/sm8750.dtsi b/arch/arm64/boot/dts/qcom/sm8750.dtsi
> index dd738d13df8e0..ad71d30377c70 100644
> --- a/arch/arm64/boot/dts/qcom/sm8750.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sm8750.dtsi
> @@ -560,7 +560,7 @@ adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
>  			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
>  			alignment = <0x0 0x400000>;
>  			size = <0x0 0xc00000>;
> -			reusable;
> +			no-map;

[Severity: High]
Does changing this region to no-map expose a missing permission restore issue
in the fastrpc driver that could lead to a synchronous external abort?

In fastrpc_req_mmap(), the memory is assigned to the DSP, which removes HLOS
permissions:

drivers/misc/fastrpc.c:fastrpc_req_mmap() {
    ...
    err = qcom_scm_assign_mem(buf->dma_addr, (u64)buf->size,
        &src_perms, fl->cctx->vmperms, fl->cctx->vmcount);
    ...
}

When the memory is freed via fastrpc_req_munmap_impl(), it calls
fastrpc_buf_free() without restoring the HLOS permissions first:

drivers/misc/fastrpc.c:fastrpc_buf_free() {
    ...
    dma_free_coherent(buf->dev, buf->size, buf->virt,
              fastrpc_ipa_to_dma_addr(buf->fl->cctx, buf->dma_addr));
    ...
}

Because this patch changes the memory to no-map, the allocation is moved
to the DMA coherent pool. When the freed block is returned to the pool,
the next allocation from that pool will execute a memset():

kernel/dma/coherent.c:__dma_alloc_from_coherent() {
    ...
    memset(ret, 0, size);
    ...
}

Could this memset() trigger a kernel panic due to the missing HLOS
permissions on the re-issued memory block?

>  		};
>  	};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015071511.977-1-jianping.li@oss.qualcomm.com?part=4