Re: [PATCH v3 3/6] arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added firewalled LPM metadata region is unconditionally mapped as Normal Non-Cacheable memory by the Linux remoteproc driver, allowing speculative CPU reads to trigger a firewall violation (SError kernel panic).
--

commit ef1894ecf6dc370114f8c92e828b6141293dd4f0
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on
J721S2. It adds the lpm_memory_region to the mcu_r5fss0_core0 memory-region
array so U-Boot R5 SPL can access it to save and restore context across
suspend and resume.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
> index 5253d028da094..010d20d56927c 100644
> --- a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi

[ ... ]

> @@ -189,8 +195,10 @@ &mcu_r5fss0 {
>  &mcu_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
>  	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> -			<&mcu_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;
> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
>  	status = "okay";
>  };

[Severity: High]
Will adding this firewalled region to the memory-region list cause an
SError kernel panic due to speculative CPU accesses?

During kernel boot, the Linux remoteproc driver unconditionally iterates
over the memory regions to create mappings:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    if (IS_ERR(kproc->rmem[i].cpu_addr)) {
    ...
}

On ARM64, devm_ioremap_resource_wc() creates a Write-Combine mapping
(PROT_NORMAL_NC). Because it is mapped as Normal memory, the architecture
permits the CPU to perform speculative data fetches.

Since this LPM metadata area is hardware-firewalled to be accessed only by
TIFS, won't any speculative access by the Cortex-A CPU hit the firewall
and trigger an asynchronous external abort (SError)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=3