Re: [PATCH v3 2/6] arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Adding a firewalled memory region to the K3 remoteproc's memory-region array causes Linux to inadvertently map it as Normal Write-Combining memory, leading to fatal asynchronous SErrors due to speculative reads, and exposing it to the remoteproc ELF loader.
- [High] Retaining `mcu_r5fss0_core0` in the SPL device tree without its referenced memory regions will result in dangling phandles.
--

commit 6ba9ae95cd26c22916ced48472c89d3b231e698a
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j7200-ti-ipc-firmware: Reserve memory for LPM metadata

Declare a carveout memory region to store LPM metadata on J7200. For
Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
> index d65f68c7d4321..a6043970715ac 100644
> --- a/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j7200-ti-ipc-firmware.dtsi

[ ... ]

> @@ -99,8 +105,10 @@ &mcu_r5fss0 {
>  &mcu_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>;
>  	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> -			<&mcu_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: Critical]
Will appending this firewalled memory region to the memory-region array cause
fatal asynchronous SErrors due to speculative reads?

Looking at k3_reserved_mem_init() in drivers/remoteproc/ti_k3_common.c,
the remoteproc driver unconditionally maps all memory-region entries starting
from index 1:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Since the lpm_memory_region is hardware-firewalled and only accessible by
TIFS, mapping it as Write-Combining (Normal Non-Cacheable) memory permits the
ARM64 CPU to perform speculative instruction and data fetches against it.

Could these speculative accesses trigger bus errors from the interconnect,
resulting in fatal asynchronous SErrors that panic the kernel during device
probe?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;

[Severity: High]
Will adding bootph-pre-ram here result in dangling phandles in the SPL
device tree?

Because bootph-pre-ram was added to mcu_r5fss0_core0 and lpm_memory_region,
but not to the existing mcu_r5fss0_core0_dma_memory_region and
mcu_r5fss0_core0_memory_region nodes, the SPL build tool (fdtgrep) will
strip the unannotated dma and firmware memory nodes.

Might this cause the U-Boot remoteproc driver to fail during parsing or
crash when attempting to resume the R5F core from retention due to the
missing references?

>  	status = "okay";
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=2