Re: [PATCH v3 1/6] dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Mapping the firewalled `lpm-metadata` region risks speculative access crashes (SError) in Linux.
--

commit 592574f765038d968e34daf0cc1a09b19f1b5e05
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

dt-bindings: remoteproc: k3-r5f: Add Jacinto LPM memory region

This commit defines a new carveout memory region layout for Jacinto devices
to store LPM metadata. It introduces the lpm-metadata reserved memory node
to save and restore ATF and OPTEE contexts during suspend and resume.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
> index 775e9b3a19387..fd6e087997e4f 100644
> --- a/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml
> +++ b/Documentation/devicetree/bindings/remoteproc/ti,k3-r5f-rproc.yaml

[ ... ]

> @@ -174,6 +175,12 @@ patternProperties:
>                - description: LPM metadata
>                - description: LPM FS context data and reserved sections
>                - description: DM RM/PM trace and firmware code/data
> +          - description: Jacinto layout
> +            items:
> +              - description: region used for dynamic DMA allocations like vrings and
> +                             vring buffers
> +              - description: region reserved for firmware image sections
> +              - description: LPM metadata

[Severity: High]
The commit message notes that the LPM metadata area is firewalled to be
accessed only by TIFS. If it is added to the memory-region list here, won't
the remoteproc driver map it and risk a system crash?

In drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init(), the code
iterates over these memory regions and maps them using
devm_ioremap_resource_wc(). On ARM64 architectures, this creates a Normal
Non-Cacheable mapping that allows speculative CPU reads.

If the kernel maps this firewalled region, couldn't a speculative read from
the CPU trigger an asynchronous SError exception and crash the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=1