Re: [PATCHv3] remoteproc: imx_rproc: add missing DRAM ranges for i.MX93

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Address translation fails for requests matching exactly the end boundary of a memory region due to a strict inequality check.
--

commit 32acb41558a7e1f55f57c27cddcfe528e4522a38
Author: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>

remoteproc: imx_rproc: add missing DRAM ranges for i.MX93

This commit adds missing M33 DRAM address mappings (secure and non-secure
ranges) to the i.MX93 remoteproc address translation table. These additions
complete the DRAM coverage and prevent invalid address translations for
firmware accessing these regions.

> diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
> index 7f54322244aca..175c2d3099794 100644
> --- a/drivers/remoteproc/imx_rproc.c
> +++ b/drivers/remoteproc/imx_rproc.c
> @@ -198,6 +198,9 @@ static const struct imx_rproc_att imx_rproc_att_imx93[] = {
>  	{ 0x80000000, 0x80000000, 0x10000000, 0 },
>  	{ 0x90000000, 0x80000000, 0x10000000, 0 },
>  
> +	{ 0xA0000000, 0xA0000000, 0x10000000, 0 },
> +	{ 0xB0000000, 0xA0000000, 0x10000000, 0 },
> +

[Severity: High]
This is a pre-existing issue, but I noticed the boundaries of these translation
regions are checked using a strict inequality in imx_rproc_da_to_sys() and
imx_rproc_da_to_va().

In imx_rproc_da_to_sys(), the translation request is checked like this:

drivers/remoteproc/imx_rproc.c:imx_rproc_da_to_sys() {
	...
	if (da >= att->da && da + len < att->da + att->size) {
		unsigned int offset = da - att->da;
	...
}

And similarly in imx_rproc_da_to_va():

drivers/remoteproc/imx_rproc.c:imx_rproc_da_to_va() {
	...
	if (sys >= priv->mem[i].sys_addr && sys + len <
	    priv->mem[i].sys_addr +  priv->mem[i].size) {
		unsigned int offset = sys - priv->mem[i].sys_addr;
	...
}

Does this mean that if a translation request extends exactly to the end of a
memory region (da + len == att->da + att->size), it will be incorrectly
rejected?

Could this cause firmware loading or communication to fail if a resource
table, memory segment, or vring is placed exactly at the end of a memory
region?

>  	{ 0xC0000000, 0xC0000000, 0x10000000, 0 },
>  	{ 0xD0000000, 0xC0000000, 0x10000000, 0 },
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525062031.24725-1-Zhiqiang.Hou@nxp.com?part=1