Re: [PATCH v3 5/6] arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The patch exposes a firewalled memory region (`lpm_memory_region`) in the `memory-region` array of the `wkup_r5fss0_core0` node, which will cause the Linux remoteproc driver to blindly map it using `ioremap_wc()`. This triggers a firewall exception (SError) on the host CPU due to speculative memory accesses.
--

commit 8c35130aa389f76c596e95178c0c218fbc983b2b
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j722s-ti-ipc-firmware: Reserve memory for LPM metadata

Declare a carveout memory region to store LPM metadata on J722S.
For Jacinto devices, this memory region is needed for saving ATF context
and the certificate information of ATF and OPTEE and DM image.

> diff --git a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
> --- a/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi
> +++ b/arch/arm64/boot/dts/ti/k3-j722s-ti-ipc-firmware.dtsi

[ ... ]

> @@ -122,8 +128,10 @@ &wkup_r5fss0 {
>  &wkup_r5fss0_core0 {
>  	mboxes = <&mailbox0_cluster0 &mbox_wkup_r5_0>;
>  	memory-region = <&wkup_r5fss0_core0_dma_memory_region>,
> -			<&wkup_r5fss0_core0_memory_region>;
> -	memory-region-names = "dma", "firmware";
> +			<&wkup_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: High]
Will adding this firewalled region to the memory-region list cause an SError
panic on the host CPU during driver probe?

Looking at the remoteproc driver, it unconditionally iterates through all
memory-region elements beyond index 0 and creates a Normal Non-Cacheable
mapping:

drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
    ...
		ret = of_reserved_mem_region_to_resource(np, i + 1, &res);
		if (ret)
			return ret;
    ...
		kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
    ...
}

Because devm_ioremap_resource_wc() creates a Normal memory mapping, the
ARM64 architecture permits speculative instruction or data fetches to this
region. Since the commit message mentions this memory area is firewalled to
be accessed only by TIFS, speculative fetches by the Linux core could trigger
a hardware firewall violation and lead to an asynchronous SError.

Can this region either be hidden from the OS memory-region array, or should
the remoteproc driver be updated first to explicitly skip the "lpm-metadata"
region?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
>  	status = "okay";
>  };
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=5