Hi Jonas,
On 1/14/26 6:27 PM, Jonas Karlman wrote:
Hi Quentin,
On 1/14/2026 5:27 PM, Quentin Schulz wrote:
Hi Jonas,
On 1/8/26 2:32 PM, Jonas Karlman wrote:
The firewall block access to pmu sram for non-secure masters by default
after reset (0xffffbfff).
Change the pmu lookup configuration to match the default lookup config
for ddr and system sram (0xffff3fff) to allow loading TF-A using DMA.
What is this "default" lookup config and where does it come from? You
say it's 0xffffbfff after reset and it's set to something different
after a TF-A has configured the firewall... Is it after a cold boot?
That somehow is different than a warm reset maybe?
0xffffbfff was the value the PMU_SGRF_SLV_LOOKUP0 reg had out of cold
boot, when read out at top of arch_cpu_init() in SPL using ramboot.
As implied by the cover letter any naming and technical details may be
wrong and has only been deduced from firewall.c/h in TF-A source and
printing out below content of a few FW regs.
SGRF_MST_DOMAIN_CON0: 00000770
SGRF_MST_DOMAIN_CON1: 00007007
SGRF_MST_DOMAIN_CON2: 00000007
SGRF_MST_DOMAIN_CON3: 00000000
SGRF_MST_DOMAIN_CON4: 00000000
SGRF_MST_DOMAIN_CON5: 00000700
SGRF_MST_DOMAIN_CON6: 00007777
SGRF_MST_DOMAIN_CON7: 00000007
SGRF_DDR_RGN0: 84000000
SGRF_DDR_RGN1: 00000000
[...]
SGRF_DDR_RGN15: 00000000
SGRF_DDR_LOOKUP0: ffff3fff
SGRF_DDR_LOOKUP1: ffffffff
[...]
SGRF_DDR_LOOKUP7: ffffffff
SGRF_DDR_CON: 00010001
SGRF_SYSMEM_RGN0: 00007f00
SGRF_SYSMEM_RGN1: 00000000
SGRF_SYSMEM_RGN2: 00000000
SGRF_SYSMEM_RGN3: 00000000
SGRF_SYSMEM_LOOKUP0: ffff3fff
SGRF_SYSMEM_LOOKUP1: ffffffff
SGRF_SYSMEM_CON: 00000001
PMU_SGRF_SLV_LOOKUP0: ffffbfff
PMU_SGRF_SLV_LOOKUP1: ffffffff
PMU_SGRF_SLV_LOOKUP2: ffffffff
PMU_SGRF_SLV_LOOKUP3: ffffffff
PMU_SGRF_DOMAIN_CON: 00000000
Looking at the above patterns and with some details from TF-A source I
could deduce that PMU_SGRF_SLV_LOOKUP0 possible have something in common
with SGRF_DDR_LOOKUP0 and SGRF_SYSMEM_LOOKUP0 regs, describing what
domains can access DDR and SYSTEM SRAM regions, and after a quick test I
could confirm that changing 'b' (10) to '3' (00) seemed to allow DMA
write access from sdmmc, sdhci and fspi to PMU SRAM.
Access rights between domains and groups are as follows:
00: NS access, S access
01: NS access, S not access
10: NS not access, S access
11: NS not access, S not access
My deduced guess is that PMU_SGRF_SLV_LOOKUP0[15:14] describe access to
PMU SRAM for domain 7, similar to SGRF_DDR/SYSMEM_LOOKUP0[15:14], and
changing it from only secure access (10) to both non-secure and secure
access (00) allows us to use DMA from the masters re-assign to domain 7.
This is really the kind of information I like to have when reading
commit logs, especially for future reference if it turns out the
assumptions were incorrect, would you mind making this explanation part
of the commit log in a v2 maybe?
I'm also wondering if it isn't something similar we need to do for the
other Rockchip SoCs to be able to remove u-boot,spl-fifo-mode; on the
various storage medium nodes?
Cheers,
Quentin
