[PATCH v3 0/6] dts: ti: k3-j7: Reserve memory for LPM metadata

[PATCH v3 0/6] dts: ti: k3-j7: Reserve memory for LPM metadata

[Richard Genoud (TI)]

For TI Jacinto SoCs (J7200, J721S2, J784S4, J722S, J742S2) which support
low power modes, a chunk of memory is reserved for LPM metadata, needed
for saving ATF context and the certificate information of ATF and OPTEE
and the DM image. This LPM metadata area is firewalled to be accessed
only by TIFS.

At boot time, U-Boot R5 SPL copies the DM image into this memory region
so that it doesn't have to be reloaded from storage at resume, speeding
up the resume time.

U-Boot R5 SPL/TIFS use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

NB: Unlike for Sitara, this memory region is not part of the DM memory,
which is not retained across suspend, so the Sitara binding can't be
re-used here.

Patch 1 adds a new binding for this layout.
The other patches add the memory region for the TI Jacinto SoCs (J7200,
J721S2, J784S4, J722S, J742S2)

Changes since v2:
- Split the DTS changes per ipc-firmware.dtsi
- Reference the LPM carveout through a phandle
- Add a dt-bindings patch documenting the "lpm-metadata" memory-region
  name for the Jacinto layout.
- Use the generic @memory node naming instead of @lpm-memory.
- Clarify how the DM image is handled
Link to v2: https://lore.kernel.org/lkml/20260427160326.370415-1-richard.genoud@bootlin.com/

Changes since v1:
- add specific lpm region for j742s2 and j784s4 instead of the common
  one since the addresses are not the same.
- add j721s2 lpm_memory_region
- change j722s addresse to prevent holes
Link to v1: https://lore.kernel.org/lkml/20260312113446.1857592-1-p-mantena@ti.com/

Richard Genoud (TI) (6):
  dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region
  arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM
    metadata
  arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM
    metadata
  arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM
    metadata
  arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM
    metadata
  arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM
    metadata

 .../bindings/remoteproc/ti,k3-r5f-rproc.yaml  | 18 +++++++++++---
 .../boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi | 12 ++++++++--
 .../dts/ti/k3-j721s2-ti-ipc-firmware.dtsi     | 12 ++++++++--
 .../boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi | 12 ++++++++--
 arch/arm64/boot/dts/ti/k3-j742s2-evm.dts      |  2 ++
 .../dts/ti/k3-j742s2-ti-ipc-firmware.dtsi     | 24 +++++++++++++++++++
 .../dts/ti/k3-j784s4-ti-ipc-firmware.dtsi     | 15 ++++++++++++
 7 files changed, 86 insertions(+), 9 deletions(-)
 create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi

-- 
2.47.3

[PATCH v3 1/6] dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on Jacinto
devices.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 .../bindings/remoteproc/ti,k3-r5f-rproc.yaml   | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
index 14e6b2f817b3..af2acd429974 100644
--- a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
+++ b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
@@ -155,9 +155,10 @@ patternProperties:
         description: |
           phandle to the reserved memory nodes to be associated with the
           remoteproc device. There should be two reserved memory nodes defined
-          for the basic layout or 6 partitions for a detailed layout. The
-          reserved memory nodes should be carveout nodes, and should be defined
-          with a "no-map" property as per the bindings in
+          for the basic layout, three for the Jacinto layout or 6 partitions
+          for a detailed layout. The reserved memory nodes should be carveout
+          nodes, and should be defined with a "no-map" property as per the
+          bindings in
           Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
         oneOf:
           - description: Basic layout
@@ -174,6 +175,12 @@ patternProperties:
               - description: LPM metadata
               - description: LPM FS context data and reserved sections
               - description: DM RM/PM trace and firmware code/data
+          - description: Jacinto layout
+            items:
+              - description: region used for dynamic DMA allocations like vrings and
+                             vring buffers
+              - description: region reserved for firmware image sections
+              - description: LPM metadata
 
       memory-region-names:
         description: |
@@ -192,6 +199,11 @@ patternProperties:
               - const: lpm-metadata
               - const: lpm-context
               - const: dm-firmware
+          - description: Jacinto layout
+            items:
+              - const: dma
+              - const: firmware
+              - const: lpm-metadata
 
 # Optional properties:
 # --------------------
-- 
2.47.3

Re: [PATCH v3 1/6] dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Mapping the firewalled `lpm-metadata` region risks speculative access crashes (SError) in Linux.
--

commit 592574f765038d968e34daf0cc1a09b19f1b5e05
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region

This commit defines a new carveout memory region layout for Jacinto devices
to store LPM metadata. It introduces the lpm-metadata reserved memory node
to save and restore ATF and OPTEE contexts during suspend and resume.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
> index 775e9b3a19387..fd6e087997e4f 100644
> --- a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
> +++ b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml

[ ... ]

> @@ -174,6 +175,12 @@ patternProperties:
>                - description: LPM metadata
>                - description: LPM FS context data and reserved sections
>                - description: DM RM/PM trace and firmware code/data
> +          - description: Jacinto layout
> +            items:
> +              - description: region used for dynamic DMA allocations like vrings and
> +                             vring buffers
> +              - description: region reserved for firmware image sections
> +              - description: LPM metadata

[Severity: High]
The commit message notes that the LPM metadata area is firewalled to be
accessed only by TIFS. If it is added to the memory-region list here, won't
the remoteproc driver map it and risk a system crash?

In drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init(), the code
iterates over these memory regions and maps them using
devm_ioremap_resource_wc(). On ARM64 architectures, this creates a Normal
Non-Cacheable mapping that allows speculative CPU reads.

If the kernel maps this firewalled region, couldn't a speculative read from
the CPU trigger an asynchronous SError exception and crash the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=1

[PATCH v3 2/6] arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM metadata

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on J7200.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
  R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

As this is used by U-Boot SPL, bootph-pre-ram is added.

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
index d65f68c7d432..a6043970715a 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
@@ -47,6 +47,12 @@ rtos_ipc_memory_region: memory@a4000000 {
 		alignment = <0x1000>;
 		no-map;
 	};
+
+	lpm_memory_region: memory@a4800000 {
+		reg = <0x00 0xa4800000 0x00 0x00300000>;
+		no-map;
+		bootph-pre-ram;
+	};
 };
 
 &mailbox0_cluster0 {
@@ -99,8 +105,10 @@ &mcu_r5fss0 {
 &mcu_r5fss0_core0 {
 	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
 	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
-			<&mcu_r5fss0_core0_memory_region>;
-	memory-region-names = "dma", "firmware";
+			<&mcu_r5fss0_core0_memory_region>,
+			<&lpm_memory_region>;
+	memory-region-names = "dma", "firmware", "lpm-metadata";
+	bootph-pre-ram;
 	status = "okay";
 };
 
-- 
2.47.3

Re: [PATCH v3 2/6] arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Adding a firewalled memory region to the K3 remoteproc's memory-region array causes Linux to inadvertently map it as Normal Write-Combining memory, leading to fatal asynchronous SErrors due to speculative reads, and exposing it to the remoteproc ELF loader.
- [High] Retaining `mcu_r5fss0_core0` in the SPL device tree without its referenced memory regions will result in dangling phandles.
--

commit 6ba9ae95cd26c22916ced48472c89d3b231e698a
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM metadata

Declare a carveout memory region to store LPM metadata on J7200. For
Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
> index d65f68c7d4321..a6043970715ac 100644
> --- a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi

[ ... ]

> @@ -99,8 +105,10 @@ &mcu_r5fss0 {
>  &mcu_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
>  	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> -			<&mcu_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: Critical]
Will appending this firewalled memory region to the memory-region array cause
fatal asynchronous SErrors due to speculative reads?

Looking at k3_reserved_mem_init() in drivers/remoteproc/ti_k3_common.c,
the remoteproc driver unconditionally maps all memory-region entries starting
from index 1:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Since the lpm_memory_region is hardware-firewalled and only accessible by
TIFS, mapping it as Write-Combining (Normal Non-Cacheable) memory permits the
ARM64 CPU to perform speculative instruction and data fetches against it.

Could these speculative accesses trigger bus errors from the interconnect,
resulting in fatal asynchronous SErrors that panic the kernel during device
probe?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;

[Severity: High]
Will adding bootph-pre-ram here result in dangling phandles in the SPL
device tree?

Because bootph-pre-ram was added to mcu_r5fss0_core0 and lpm_memory_region,
but not to the existing mcu_r5fss0_core0_dma_memory_region and
mcu_r5fss0_core0_memory_region nodes, the SPL build tool (fdtgrep) will
strip the unannotated dma and firmware memory nodes.

Might this cause the U-Boot remoteproc driver to fail during parsing or
crash when attempting to resume the R5F core from retention due to the
missing references?

>  	status = "okay";
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=2

[PATCH v3 3/6] arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on J721S2.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
  R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

As this is used by U-Boot SPL, bootph-pre-ram is added.

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 .../arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
index 5253d028da09..010d20d56927 100644
--- a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
@@ -95,6 +95,12 @@ rtos_ipc_memory_region: memory@a8000000 {
 		alignment = <0x1000>;
 		no-map;
 	};
+
+	lpm_memory_region: memory@a9c00000 {
+		reg = <0x00 0xa9c00000 0x00 0x00300000>;
+		no-map;
+		bootph-pre-ram;
+	};
 };
 
 &mailbox0_cluster0 {
@@ -189,8 +195,10 @@ &mcu_r5fss0 {
 &mcu_r5fss0_core0 {
 	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
 	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
-			<&mcu_r5fss0_core0_memory_region>;
-	memory-region-names = "dma", "firmware";
+			<&mcu_r5fss0_core0_memory_region>,
+			<&lpm_memory_region>;
+	memory-region-names = "dma", "firmware", "lpm-metadata";
+	bootph-pre-ram;
 	status = "okay";
 };
 
-- 
2.47.3

Re: [PATCH v3 3/6] arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added firewalled LPM metadata region is unconditionally mapped as Normal Non-Cacheable memory by the Linux remoteproc driver, allowing speculative CPU reads to trigger a firewall violation (SError kernel panic).
--

commit ef1894ecf6dc370114f8c92e828b6141293dd4f0
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on
J721S2. It adds the lpm_memory_region to the mcu_r5fss0_core0 memory-region
array so U-Boot R5 SPL can access it to save and restore context across
suspend and resume.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
> index 5253d028da094..010d20d56927c 100644
> --- a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi

[ ... ]

> @@ -189,8 +195,10 @@ &mcu_r5fss0 {
>  &mcu_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
>  	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> -			<&mcu_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;
> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
>  	status = "okay";
>  };

[Severity: High]
Will adding this firewalled region to the memory-region list cause an
SError kernel panic due to speculative CPU accesses?

During kernel boot, the Linux remoteproc driver unconditionally iterates
over the memory regions to create mappings:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    if (IS_ERR(kproc->rmem[i].cpu_addr)) {
    ...
}

On ARM64, devm_ioremap_resource_wc() creates a Write-Combine mapping
(PROT_NORMAL_NC). Because it is mapped as Normal memory, the architecture
permits the CPU to perform speculative data fetches.

Since this LPM metadata area is hardware-firewalled to be accessed only by
TIFS, won't any speculative access by the Cortex-A CPU hit the firewall
and trigger an asynchronous external abort (SError)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=3

[PATCH v3 4/6] arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM metadata

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on J784S4.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
  R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

As this is used by U-Boot SPL, bootph-pre-ram is added and the device is
enabled.

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 .../boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi    | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
index 81b508b9b05e..1c0c1533f0a3 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
@@ -17,6 +17,12 @@ c71_3_memory_region: memory@ab100000 {
 		reg = <0x00 0xab100000 0x00 0xf00000>;
 		no-map;
 	};
+
+	lpm_memory_region: memory@ac000000 {
+		reg = <0x00 0xac000000 0x00 0x00300000>;
+		no-map;
+		bootph-pre-ram;
+	};
 };
 
 &mailbox0_cluster5 {
@@ -27,6 +33,15 @@ mbox_c71_3: mbox-c71-3 {
 	};
 };
 
+&mcu_r5fss0_core0 {
+	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
+			<&mcu_r5fss0_core0_memory_region>,
+			<&lpm_memory_region>;
+	memory-region-names = "dma", "firmware", "lpm-metadata";
+	bootph-pre-ram;
+	status = "okay";
+};
+
 &c71_3 {
 	mboxes = <&mailbox0_cluster5 &mbox_c71_3>;
 	memory-region = <&c71_3_dma_memory_region>,
-- 
2.47.3

Re: [PATCH v3 4/6] arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Adding the firewalled `lpm_memory_region` to the `memory-region` array forces the remoteproc driver to map it, leading to a kernel panic from speculative CPU fetches.
--

commit 8b3d051973c3ec2b39f876843cc836ccee8785ec
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on J784S4
devices. It appends this region to the memory-region array of the
mcu_r5fss0_core0 node for use during the resume process.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
> index 81b508b9b05ee..1c0c1533f0a35 100644
> --- a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi

[ ... ]

> @@ -27,6 +33,15 @@ mbox_c71_3: mbox-c71-3 {
>  	};
>  };
>  
> +&mcu_r5fss0_core0 {
> +	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;
> +	memory-region-names = "dma", "firmware", "lpm-metadata";

[Severity: High]
Will adding this firewalled region to the memory-region array cause a kernel
panic from speculative CPU fetches?

Looking at the remoteproc driver in
drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init(), it iterates over
the memory-region properties and maps them:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    ret = of_reserved_mem_region_to_resource(np, i + 1, &res);
    if (ret)
        return ret;
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Since the commit message notes the lpm_memory_region is firewalled and
only accessible by TIFS, mapping it via devm_ioremap_resource_wc() allows
the CPU to issue speculative fetches to it.

If a speculative fetch hits the firewall, won't the system interconnect
return a bus error and raise an SError that panics the kernel?

> +	bootph-pre-ram;
> +	status = "okay";
> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=4

[PATCH v3 5/6] arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM metadata

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on J722S.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
  R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

As this is used by U-Boot SPL, bootph-pre-ram is added.

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
index a59c3648d805..5d8499a33fcd 100644
--- a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
@@ -59,6 +59,12 @@ rtos_ipc_memory_region: memory@a5000000 {
 		alignment = <0x1000>;
 		no-map;
 	};
+
+	lpm_memory_region: memory@a6c00000 {
+		reg = <0x00 0xa6c00000 0x00 0x00300000>;
+		no-map;
+		bootph-pre-ram;
+	};
 };
 
 &mailbox0_cluster0 {
@@ -122,8 +128,10 @@ &wkup_r5fss0 {
 &wkup_r5fss0_core0 {
 	mboxes = <&mailbox0_cluster0 &mbox_wkup_r5_0>;
 	memory-region = <&wkup_r5fss0_core0_dma_memory_region>,
-			<&wkup_r5fss0_core0_memory_region>;
-	memory-region-names = "dma", "firmware";
+			<&wkup_r5fss0_core0_memory_region>,
+			<&lpm_memory_region>;
+	memory-region-names = "dma", "firmware", "lpm-metadata";
+	bootph-pre-ram;
 	status = "okay";
 };
 
-- 
2.47.3

Re: [PATCH v3 5/6] arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch exposes a firewalled memory region (`lpm_memory_region`) in the `memory-region` array of the `wkup_r5fss0_core0` node, which will cause the Linux remoteproc driver to blindly map it using `ioremap_wc()`. This triggers a firewall exception (SError) on the host CPU due to speculative memory accesses.
--

commit 8c35130aa389f76c596e95178c0c218fbc983b2b
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM metadata

Declare a carveout memory region to store LPM metadata on J722S.
For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image.

> diff --git a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
> --- a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi

[ ... ]

> @@ -122,8 +128,10 @@ &wkup_r5fss0 {
>  &wkup_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_wkup_r5_0>;
>  	memory-region = <&wkup_r5fss0_core0_dma_memory_region>,
> -			<&wkup_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&wkup_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: High]
Will adding this firewalled region to the memory-region list cause an SError
panic on the host CPU during driver probe?

Looking at the remoteproc driver, it unconditionally iterates through all
memory-region elements beyond index 0 and creates a Normal Non-Cacheable
mapping:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
		ret = of_reserved_mem_region_to_resource(np, i + 1, &res);
		if (ret)
			return ret;
    ...
		kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Because devm_ioremap_resource_wc() creates a Normal memory mapping, the
ARM64 architecture permits speculative instruction or data fetches to this
region. Since the commit message mentions this memory area is firewalled to
be accessed only by TIFS, speculative fetches by the Linux core could trigger
a hardware firewall violation and lead to an asynchronous SError.

Can this region either be hidden from the OS memory-region array, or should
the remoteproc driver be updated first to explicitly skip the "lpm-metadata"
region?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
>  	status = "okay";
>  };
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=5

[PATCH v3 6/6] arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM metadata

[Richard Genoud (TI)]

Declare a carveout memory region to store LPM metadata on J742S2.

For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image. This LPM
metadata area is firewalled to be accessed only by TIFS.

U-Boot R5 SPL/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image (which has been copied in memory at boot time by U-Boot
  R5-SPL)

At resume, U-Boot R5 SPL is executed and detects that the board is
resuming (with a flag set in the PMIC), then it:
- brings out of retention the DDR
- retrieves the LPM memory region from DTS
- authenticates certificates from LPM memory region and applies firewalls
- asks TIFS to restore TFA and its own minimal context
- starts TFA on remote proc
- loads back DM image from memory and jumps to DM

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

As this is used by U-Boot SPL, bootph-pre-ram is added and the device is
enabled.

NB: This memory region is not part of DM memory (which is not retained
at suspend)

Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
 arch/arm64/boot/dts/ti/k3-j742s2-evm.dts      |  2 ++
 .../dts/ti/k3-j742s2-ti-ipc-firmware.dtsi     | 24 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi

diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts b/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
index fcb7f05d7faf..583b672ef8e9 100644
--- a/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
@@ -24,3 +24,5 @@ memory@80000000 {
 		bootph-all;
 	};
 };
+
+#include "k3-j742s2-ti-ipc-firmware.dtsi"
diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
new file mode 100644
index 000000000000..d66bcd2f4e19
--- /dev/null
+++ b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+/**
+ * Device Tree Source for enabling IPC using TI SDK firmware on J42S2 SoCs
+ *
+ * Copyright (C) 2026 Texas Instruments Incorporated - https://www.ti.com/
+ * Copyright (C) 2026 Bootlin
+ */
+
+&reserved_memory {
+	lpm_memory_region: memory@ab000000 {
+		reg = <0x00 0xab000000 0x00 0x00300000>;
+		no-map;
+		bootph-pre-ram;
+	};
+};
+
+&mcu_r5fss0_core0 {
+	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
+			<&mcu_r5fss0_core0_memory_region>,
+			<&lpm_memory_region>;
+	memory-region-names = "dma", "firmware", "lpm-metadata";
+	bootph-pre-ram;
+	status = "okay";
+};
-- 
2.47.3

Re: [PATCH v3 6/6] arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Adding the firewalled LPM metadata region to the R5 core's `memory-region` array causes the Linux remoteproc driver to unconditionally map it as Normal Non-Cacheable memory, creating a risk of speculative access violations.
- [Low] Typo in the device tree header comment: 'J42S2' instead of 'J742S2'.
--

commit c8beda67fe9ff009082210810a32125f13239503
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on
J742S2. The memory region is firewalled to be accessed only by TIFS, and
is used by U-Boot R5 SPL to save and restore context during suspend/resume.

> diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
> new file mode 100644
> index 0000000000000..d66bcd2f4e194
> --- /dev/null
> +++ b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
> @@ -0,0 +1,24 @@
> +// SPDX-License-Identifier: GPL-2.0-only OR MIT
> +/**
> + * Device Tree Source for enabling IPC using TI SDK firmware on J42S2 SoCs

[Severity: Low]
This isn't a bug, but there's a typo in the SoC name.
Should this be J742S2 instead of J42S2?

> + *
> + * Copyright (C) 2026 Texas Instruments Incorporated - https://www.ti.com/
> + * Copyright (C) 2026 Bootlin
> + */

[ ... ]

> +&mcu_r5fss0_core0 {
> +	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: High]
Does adding the firewalled lpm_memory_region to the mcu_r5fss0_core0
memory-region list risk speculative access violations?

During probe in ti_k3_r5_remoteproc.c, k3_r5_cluster_rproc_init() iterates
over all memory-region entries past index 0 and unconditionally maps them
using devm_ioremap_resource_wc().

This establishes a Normal Non-Cacheable memory mapping, which allows the
architecture's prefetcher to issue speculative reads to the region.

Since the commit message notes this memory is firewalled to be accessed
only by TIFS, wouldn't a speculative read from Linux be blocked by the
hardware firewall and trigger a fatal abort?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
> +	status = "okay";
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=6