Re: [PATCH v3 3/6] arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata
From: sashiko-bot@kernel.org
Date: 2026-07-03 14:48:06
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] The newly added firewalled LPM metadata region is unconditionally mapped as Normal Non-Cacheable memory by the Linux remoteproc driver, allowing speculative CPU reads to trigger a firewall violation (SError kernel panic). -- commit ef1894ecf6dc370114f8c92e828b6141293dd4f0 Author: Richard Genoud (TI) [off-list ref] arm64: dts: ti: k3-j721s2-ti-ipc-firmware: Reserve memory for LPM metadata This commit declares a carveout memory region to store LPM metadata on J721S2. It adds the lpm_memory_region to the mcu_r5fss0_core0 memory-region array so U-Boot R5 SPL can access it to save and restore context across suspend and resume. Link: https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr
quoted hunk ↗ jump to hunk
diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi index 5253d028da094..010d20d56927c 100644 --- a/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j721s2-ti-ipc-firmware.dtsi
[ ... ]
quoted hunk ↗ jump to hunk
@@ -189,8 +195,10 @@ &mcu_r5fss0 { &mcu_r5fss0_core0 { mboxes = <&mailbox0_cluster0 &mbox_mcu_r5fss0_core0>; memory-region = <&mcu_r5fss0_core0_dma_memory_region>, - <&mcu_r5fss0_core0_memory_region>; - memory-region-names = "dma", "firmware"; + <&mcu_r5fss0_core0_memory_region>, + <&lpm_memory_region>; + memory-region-names = "dma", "firmware", "lpm-metadata"; + bootph-pre-ram; status = "okay"; };
[Severity: High]
Will adding this firewalled region to the memory-region list cause an
SError kernel panic due to speculative CPU accesses?
During kernel boot, the Linux remoteproc driver unconditionally iterates
over the memory regions to create mappings:
drivers/remoteproc/ti_k3_common.c:k3_reserved_mem_init() {
...
kproc->rmem[i].cpu_addr = devm_ioremap_resource_wc(dev, &res);
if (IS_ERR(kproc->rmem[i].cpu_addr)) {
...
}
On ARM64, devm_ioremap_resource_wc() creates a Write-Combine mapping
(PROT_NORMAL_NC). Because it is mapped as Normal memory, the architecture
permits the CPU to perform speculative data fetches.
Since this LPM metadata area is hardware-firewalled to be accessed only by
TIFS, won't any speculative access by the Cortex-A CPU hit the firewall
and trigger an asynchronous external abort (SError)?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260703143717.177362-1-richard.genoud@bootlin.com?part=3