AM6442: Crash in uboot when trying to read or write memory zone

Part Number: AM6442

Hello,

I'm trying to access the GPMC0 peripheral in uboot (3B00 0000h to 3B00 037Ch) but the system crashes on read or writes. Is this caused by the firewall? if yes, how can I enable accessing this memory zone from the A53s?

Details are below:

SDK version is: 8.0.0.21

EVM used: SK-AM64

Modification to show the problem: in uboot file /borad/ti/am64x/evm.c:

#define GPMC_REVISION 0x3B000000

int board_init(void)
{
 u32 val;
 printf("MyDEBUG: Reading GPMC rev....\n");
 val = readl(GPMC_REVISION);
 printf("MyDEBUG: GPMC_REVISION = %X\n", val);
 return 0;
}

Log / Crash dump:

U-Boot SPL 2021.01 (Nov 15 2021 - 12:06:42 -0600)

EEPROM not available at 80, trying to read at 81

SYSFW ABI: 3.1 (firmware rev 0x0015 '21.5.0--v2021.05 (Terrific Llam')

SPL initial stack usage: 13392 bytes

Trying to boot from MMC2

Starting ATF on ARM64 core...

NOTICE: BL31: v2.5(release):08.00.00.004-dirty

NOTICE: BL31: Built : 14:39:59, Aug 9 2021

U-Boot SPL 2021.01 (Nov 15 2021 - 12:06:57 -0600)

SYSFW ABI: 3.1 (firmware rev 0x0015 '21.5.0--v2021.05 (Terrific Llam')

Trying to boot from MMC2

U-Boot 2021.01 (Nov 15 2021 - 12:06:57 -0600)

SoC: AM64X SR1.0

Model: Texas Instruments AM642 SK

Board: AM64-SKEVM rev E2

DRAM: 2 GiB

MyDEBUG: Reading GPMC rev....

Unhandled Exception in EL3.

x30 = 0x00000000701a0e6c

x0 = 0x000000003b000000

x1 = 0x0000000000000000

x2 = 0x000000000000000a

x3 = 0x0000000002800000

x4 = 0x0000000002800000

x5 = 0x0000000000008dd8

x6 = 0x000000000000046c

x7 = 0x0000000000000002

x8 = 0x00000000fdec0f78

x9 = 0x0000000000000008

x10 = 0x0000000000000468

x11 = 0x00000000fdec0edc

x12 = 0x000000000000046c

x13 = 0x00000000fdec0efc

x14 = 0x00000000fdec1000

x15 = 0x00000000fdec1000

x16 = 0x00000000fff45444

x17 = 0x0000000000000000

x18 = 0x00000000fdec9de0

x19 = 0x00000000fffc20c0

x20 = 0x000000007f6ea000

x21 = 0x00000000fffc2068

x22 = 0x00000000800c54f0

x23 = 0x00000000800bce3f

x24 = 0x00000000800bce27

x25 = 0x00000000deadbeef

x26 = 0x0000000000000005

x27 = 0x0000000000000000

x28 = 0x0000000000000000

x29 = 0x00000000fdec0fb0

scr_el3 = 0x000000000000073d

sctlr_el3 = 0x0000000030cd183f

cptr_el3 = 0x0000000000000000

tcr_el3 = 0x0000000080803520

daif = 0x00000000000002c0

mair_el3 = 0x00000000004404ff

spsr_el3 = 0x00000000000003c9

elr_el3 = 0x00000000ffeed380

ttbr0_el3 = 0x00000000701ad780

esr_el3 = 0x0000000092000010

far_el3 = 0x000000003b000000

spsr_el1 = 0x0000000000000000

elr_el1 = 0x0000000000000000

spsr_abt = 0x0000000000000000

spsr_und = 0x0000000000000000

spsr_irq = 0x0000000000000000

spsr_fiq = 0x0000000000000000

sctlr_el1 = 0x0000000030d00801

actlr_el1 = 0x0000000000000000

cpacr_el1 = 0x0000000000000000

csselr_el1 = 0x0000000000000000

sp_el1 = 0x0000000000000000

esr_el1 = 0x0000000000000000

ttbr0_el1 = 0x0000000000000000

ttbr1_el1 = 0x0000000000000000

mair_el1 = 0x0000000000000000

amair_el1 = 0x0000000000000000

tcr_el1 = 0x0000000000800080

tpidr_el1 = 0x0000000000000000

tpidr_el0 = 0x0000000000000000

tpidrro_el0 = 0x0000000000000000

par_el1 = 0x0000000000000000

mpidr_el1 = 0x0000000080000000

afsr0_el1 = 0x0000000000000000

afsr1_el1 = 0x0000000000000000

contextidr_el1 = 0x0000000000000000

vbar_el1 = 0x0000000000000000

cntp_ctl_el0 = 0x0000000000000000

cntp_cval_el0 = 0x0000000000000000

cntv_ctl_el0 = 0x0000000000000000

cntv_cval_el0 = 0x0000000000000000

cntkctl_el1 = 0x0000000000000000

sp_el0 = 0x0000000000000000

isr_el1 = 0x0000000000000000

dacr32_el2 = 0x0000000000000000

ifsr32_el2 = 0x0000000000000000

cpuectlr_el1 = 0x0000000000000040

cpumerrsr_el1 = 0x000000001810026c

l2merrsr_el1 = 0x0000000010083380

cpuactlr_el1 = 0x00001000090ca000

Any help will be appreciated.

Thank you

over 3 years ago

0 Hong Guan64 over 3 years ago

TI__Guru 68450 points

Hi Mehdi,
For the error message "Unhandled Exception in EL3" in your log, it may be due to GPMC clock is not enabled.
For your info, Linux kernel support for GPMC-NAND is scheduled for the next SDK release in mid-Dec.
Best,
-Hong

0 MH over 3 years ago in reply to Hong Guan64

Intellectual 290 points

Hello Hong,

Thank you for your reply, great to learn that finally TI is releasing this crucial driver.

I'm still trying to understand my problem here, from what I can see the clock is enabled on GPMC and is at 66.7MHz, registers' log is below:

Model: Texas Instruments AM642 SK

Board: AM64-SKEVM rev E2

DRAM: 2 GiB

MyDEBUG: CTRLMMR_GPMC_CLKSEL= 0x0

MyDEBUG: PLL0_HSDIV_CTRL3= 0x800E

MyDEBUG: PLL0_CTRL= 0x18011

MyDEBUG: PLL0_STAT= 0x1

MyDEBUG: PLL0_FREQ_CTRL0= 0x50

MyDEBUG: PLL0_FREQ_CTRL1= 0x0

MyDEBUG: PLL0_DIV_CTRL= 0x1020001

I'm not sure how I can check if the module is powered up?, I see in TRM's Table 5-1197 that GPMC is on LPSC index 9 "LPSC_GPMC" which is off by default, but I can't find anywhere in the TRM how to set LPSC on or off: do you know how we can do this?

In addition, looking in the SDK arch/arm/mach-k3/j721e_init.c I noticed that during init it is removing the firewall rule ('remove_fwl_configs" function) that was set by the ROM I suppose? this can be found here:

cbass_rc0_fwls[] = {
 { "GPMC0", 2310, 8 }

Does the am64x sets firewall rules besides the ones being removed during boot (listed below):

struct fwl_data main_cbass_fwls[] = {
 { "MMCSD1_CFG", 2057, 1 },
 { "MMCSD0_CFG", 2058, 1 },
 { "USB3SS0_SLV0", 2176, 2 },
 { "PCIE0_SLV", 2336, 8 },
 { "PCIE1_SLV", 2337, 8 },
 { "PCIE0_CFG", 2688, 1 },
 { "PCIE1_CFG", 2689, 1 },
}, mcu_cbass_fwls[] = {
 { "MCU_ARMSS0_CORE0_SLV", 1024, 1 },
 { "MCU_ARMSS0_CORE1_SLV", 1028, 1 },
 { "MCU_FSS0_S1", 1033, 8 },
 { "MCU_FSS0_S0", 1036, 8 },
 { "MCU_CPSW0", 1220, 1 },
};

What are the ROM fwl rules for GPMC (CFG & Data, ELM)? {"GPMC0_CFG"?, fwl_ig?, region?}, or where I can find the reference for these rules?

Thank you,

Mehdi

+1 Hong Guan64 over 3 years ago in reply to MH

TI__Guru 68450 points

Hi Mehdi,
One good reference on PSC is in "TRM Section 5.2 Power", specifically power domain for GPMC (LPSC index = 9) is "OFF" after POR as listed in "Table 5-1197. MAIN PSC Information".

Also in "Section 5.2.2.2.1.2 PSC Features", Note: PSC functions are controlled through the DMSC. For more information how to use DMSC, see the TISCI API. (https://software-dl.ti.com/tisci/esd/latest/1_intro/index.html).

So clock/power management flow is like: DTS -> clk/tisci driver -> TICSI(SYSFW running on DMSC core) -> clk/power configuration.
The Linux kernel support for GPMC/NAND is currently targeted for SDK 8.1 (Mid-Dec).

For testing purpose, I verified GPMC clk/power domain "ON" @u-boot for your reference, and also uploaded the u-boot log in attachment.

# pd_id=0, & pd_state=1
mw.l 0x00400300 0x1 1
# md_id=9, & md_state=3
mw.l 0x00400a24 0x3 1
# cmd "go" to turn on the pd/md
mw.l 0x00400120 0x1 1

Regarding the FW question you raised in your post.
On General Purpose (GP) device, FW for most of HW modules (i.e. GPMC) is "OFF" after POR.
For High Security (HG) device, FW for some of HW modules is "ON" by bootrom/SYSFW. It is sometimes necessary to turn "OFF" FW in SPL as listed in
"arch/arm/mach-k3/j721e_init.c", where HS support is available on J721e SoC.
Please note that the flag "CONFIG_TI_SECURE_DEVICE" apply to HS device only.

#ifdef CONFIG_TI_SECURE_DEVICE
	remove_fwl_configs(cbass_hc_cfg0_fwls, ARRAY_SIZE(cbass_hc_cfg0_fwls));
	remove_fwl_configs(cbass_hc0_fwls, ARRAY_SIZE(cbass_hc0_fwls));
	remove_fwl_configs(cbass_rc_cfg0_fwls, ARRAY_SIZE(cbass_rc_cfg0_fwls));
	remove_fwl_configs(cbass_rc0_fwls, ARRAY_SIZE(cbass_rc0_fwls));
	remove_fwl_configs(infra_cbass0_fwls, ARRAY_SIZE(infra_cbass0_fwls));
	remove_fwl_configs(mcu_cbass0_fwls, ARRAY_SIZE(mcu_cbass0_fwls));
	remove_fwl_configs(wkup_cbass0_fwls, ARRAY_SIZE(wkup_cbass0_fwls));
#endif

Best,

-Hong

Fullscreen am6_8.0.0_psc_gpmc.txt Download

U-Boot SPL 2021.01-00001-g911f54274e (Oct 04 2021 - 21:01:12 -0500)
SYSFW ABI: 3.1 (firmware rev 0x0015 '21.5.0--v2021.05 (Terrific Llam')
SPL initial stack usage: 13392 bytes
Trying to boot from MMC2
Starting ATF on ARM64 core...

NOTICE:  BL31: v2.5(release):08.00.00.004-dirty
NOTICE:  BL31: Built : 21:46:29, Aug 10 2021

U-Boot SPL 2021.01-00001-g911f54274e (Oct 04 2021 - 21:04:38 -0500)
SYSFW ABI: 3.1 (firmware rev 0x0015 '21.5.0--v2021.05 (Terrific Llam')
Trying to boot from MMC2


U-Boot 2021.01-00001-g911f54274e (Oct 04 2021 - 21:04:38 -0500)

SoC:   AM64X SR1.0
Model: Texas Instruments AM642 EVM
Board: AM64-GPEVM rev E2
DRAM:  2 GiB
MMC:   mmc@fa10000: 0, mmc@fa00000: 1
In:    serial@2800000
Out:   serial@2800000
Err:   serial@2800000
Net:   eth0: ethernet@8000000
Hit any key to stop autoboot:  2  0 
=> md.l 0x00400200 1
00400200: 00000301                               ....
=> md.l 0x00400824 1
00400824: 00000a00                               ....
=> mw.l 0x00400300 0x1 1
=> mw.l 0x00400a24 0x3 1
=> mw.l 0x00400120 0x1 1
=> md.l 0x3b000000 1
3b000000: 00000060                               `...
=> md.l 0x3b000040 1
3b000040: 00001ff0                               ....
=>

0 MH over 3 years ago in reply to Hong Guan64

Intellectual 290 points

Hello Hong,

I confirm this indeed solves the problem. Thank you very much for the detailed answer.

I think it may be very beneficial to add clarification in the TRM:

1- Registers PSC0_PDSTAT to PSC0_MDCTL are not just one register each but rather one for each LPSC index (the only hint to that today is the length column which shows 32 vs 36 LPSC index in table 5-1197)

2- The sequence required to turn a certain LPSC index on and off including flags to monitor to complete the sequence

Thank you for your help.

Mehdi

0 Hong Guan64 over 3 years ago in reply to MH

TI__Guru 68450 points

Hi Mehdi,
Thank you for confirming the issue was fixed, and providing us your valuable feedback for the TRM improvement.
In fact, few registers were not completely described in "Table 5-1293 " of the TRM.
For example, GPMC module (md_id=9) is under power domain pd_id=0.
=> PSC0_MDCTL[md_id]=0x00400a00 + 4*(md_id) = 0x00400a24 is used in my test to power "ON" the GPMC module.
I'll follow-up internally with TRM team.
Best,
-Hong

0 MH over 3 years ago in reply to Hong Guan64

Intellectual 290 points

Thank you Hong, much appreciated.

Processors

Processors forum

AM6442: Crash in uboot when trying to read or write memory zone