Re: [PATCH v3 6/6] arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Adding the firewalled LPM metadata region to the R5 core's `memory-region` array causes the Linux remoteproc driver to unconditionally map it as Normal Non-Cacheable memory, creating a risk of speculative access violations.
- [Low] Typo in the device tree header comment: 'J42S2' instead of 'J742S2'.
--

commit c8beda67fe9ff009082210810a32125f13239503
Author: Richard Genoud (TI) <richard.genoud@bootlin.com>

arm64: dts: ti: k3-j742s2-ti-ipc-firmware: Reserve memory for LPM metadata

This commit declares a carveout memory region to store LPM metadata on
J742S2. The memory region is firewalled to be accessed only by TIFS, and
is used by U-Boot R5 SPL to save and restore context during suspend/resume.

> diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
> new file mode 100644
> index 0000000000000..d66bcd2f4e194
> --- /dev/null
> +++ b/arch/arm64/boot/dts/ti/k3-j742s2-ti-ipc-firmware.dtsi
> @@ -0,0 +1,24 @@
> +// SPDX-License-Identifier: GPL-2.0-only OR MIT
> +/**
> + * Device Tree Source for enabling IPC using TI SDK firmware on J42S2 SoCs

[Severity: Low]
This isn't a bug, but there's a typo in the SoC name.
Should this be J742S2 instead of J42S2?

> + *
> + * Copyright (C) 2026 Texas Instruments Incorporated - https://www.ti.com/
> + * Copyright (C) 2026 Bootlin
> + */

[ ... ]

> +&mcu_r5fss0_core0 {
> +	memory-region = <&mcu_r5fss0_core0_dma_memory_region>,
> +			<&mcu_r5fss0_core0_memory_region>,
> +			<&lpm_memory_region>;

[Severity: High]
Does adding the firewalled lpm_memory_region to the mcu_r5fss0_core0
memory-region list risk speculative access violations?

During probe in ti_k3_r5_remoteproc.c, k3_r5_cluster_rproc_init() iterates
over all memory-region entries past index 0 and unconditionally maps them
using devm_ioremap_resource_wc().

This establishes a Normal Non-Cacheable memory mapping, which allows the
architecture's prefetcher to issue speculative reads to the region.

Since the commit message notes this memory is firewalled to be accessed
only by TIFS, wouldn't a speculative read from Linux be blocked by the
hardware firewall and trigger a fatal abort?

> +	memory-region-names = "dma", "firmware", "lpm-metadata";
> +	bootph-pre-ram;
> +	status = "okay";
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=6