Re: [PATCH v3 4/6] arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Adding the firewalled `lpm_memory_region` to the `memory-region` array forces the remoteproc driver to map it, leading to a kernel panic from speculative CPU fetches.
--

commit 8b3d051973c3ec2b39f876843cc836ccee8785ec
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j784s4-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on J784S4
devices. It appends this region to the memory-region array of the
mcu_r5fss0_core0 node for use during the resume process.

Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr

> diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
> index 81b508b9b05ee..1c0c1533f0a35 100644
> --- a/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j784s4-ti-ipc-firmware.dtsi

[ ... ]

> @@ -27,6 +33,15 @@ mbox_c71_3: mbox-c71-3 {
>  	};
>  };
>  
> +&mcu_r5fss0_core0 {
> +	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;
> +	memory-region-names = "dma", "firmware", "lpm-metadata";

[Severity: High]
Will adding this firewalled region to the memory-region array cause a kernel
panic from speculative CPU fetches?

Looking at the remoteproc driver in
drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init(), it iterates over
the memory-region properties and maps them:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
    ret = of_reserved_mem_region_to_resource(np, i + 1, &res);
    if (ret)
        return ret;
    ...
    kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Since the commit message notes the lpm_memory_region is firewalled and
only accessible by TIFS, mapping it via devm_ioremap_resource_wc() allows
the CPU to issue speculative fetches to it.

If a speculative fetch hits the firewall, won't the system interconnect
return a bus error and raise an SError that panics the kernel?

> +	bootph-pre-ram;
> +	status = "okay";
> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=4