imx8mp: Linux crashes during boot when the M7 core was already started by U-Boot

[morix]

Hello everybody,

I am working at running both A53 and M7 on an i.MX8M Plus at the same time.

Yocto-compiled Linux runs on top of A53 cores, while at the moment I am simply running MCUXpresso's hello_world demo on M7 (compiled for using TCM only).

I have configured remoteproc on Linux, and now I am perfectly able to start/stop M7 from Linux console, deploying to M7 the ELF of hello_world demo. And both (A53 and M7) work perfectly fine.

Now I am managing to fire the execution of M7 from U-Boot.

Even in this case everything is fine and I am able to start the M7 from U-Boot (deploying to M7 the BIN of hello_world demo). The problem arises when then I attempt to start Linux on A53s. The operating system crashes during boot with the following message:

[    2.914112] remoteproc remoteproc0: imx-rproc is available
[    2.923854] remoteproc remoteproc0: attaching to imx-rproc
[    2.929418] Unable to handle kernel paging request at virtual address ffff80000a264fff
[    2.937347] Mem abort info:
[    2.940154]   ESR = 0x0000000096000007
[    2.943920]   EC = 0x25: DABT (current EL), IL = 32 bits
[    2.947769] mmc1: SDHCI controller on 30b50000.mmc [30b50000.mmc] using ADMA
[    2.949239]   SET = 0, FnV = 0
[    2.959338]   EA = 0, S1PTW = 0
[    2.962476]   FSC = 0x07: level 3 translation fault
[    2.967354] Data abort info:
[    2.970230]   ISV = 0, ISS = 0x00000007
[    2.974066]   CM = 0, WnR = 0
[    2.977035] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041d89000
[    2.983737] [ffff80000a264fff] pgd=1000000074eee003, p4d=1000000074eee003, pud=1000000074eed003, pmd=10000000444ef003, pte=0000000000000000
[    2.996274] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP
[    3.002539] Modules linked in:
[    3.005592] CPU: 2 PID: 8 Comm: kworker/u8:0 Not tainted 6.1.55+g97604c995a86 #1
[    3.012986] Hardware name: AESYS 2319A (DT)
[    3.016976] mmc1: host does not support reading read-only switch, assuming write-enable
[    3.017166] Workqueue: events_unbound deferred_probe_work_func
[    3.030991] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    3.037950] pc : rproc_handle_resources.constprop.0+0x8c/0x164
[    3.043786] lr : rproc_boot+0x304/0x580
[    3.047621] sp : ffff800009fab9f0
[    3.050931] x29: ffff800009fab9f0 x28: ffff000024d53a98 x27: ffff8000098bb780
[    3.050978] mmc1: new ultra high speed SDR104 SDHC card at address 0001
[    3.058068] x26: 0000000000000006 x25: ffffffffffffffff x24: ffff80000a265000
[    3.058074] x23: ffff000004a1c038
[    3.065096] mmcblk1: mmc1:0001 SD32G 28.9 GiB  
[    3.071809]  x22: 0000000000000000 x21: ffff800009e1a2f0
[    3.071814] x20: ffff000004a1c000 x19: 0000000000000000 x18: 0000000000000006
[    3.071820] x17: 000000040044ffff x16: ffff000024cfc7e0 x15: ffffffffffffffff
[    3.071827] x14: fff7ffffffefffff x13: ffffffffffffffff
[    3.076558]  mmcblk1: p1 p2 p3 p4
[    3.079574]  x12: fff7ffffffefffff
[    3.079577] x11: ffffffffffffffff x10: ffffffffffffffff x9 : ffffffffffffffff
[    3.079584] x8 : ffffffffffffffff x7 : ffffffffffffffff x6 : ffffffffffffffff
[    3.125331] x5 : ffff000004b33000 x4 : ffff80000a265400 x3 : 00000000000003fd
[    3.132466] x2 : 00000000ffffffff x1 : ffff80000a265003 x0 : ffff80000a265000
[    3.139602] Call trace:
[    3.142045]  rproc_handle_resources.constprop.0+0x8c/0x164
[    3.147532]  rproc_boot+0x304/0x580
[    3.151019]  rproc_add+0xd0/0x170
[    3.154332]  imx_rproc_probe+0x464/0x5b0
[    3.158254]  platform_probe+0x68/0xc0
[    3.161915]  really_probe+0xbc/0x2dc
[    3.165490]  __driver_probe_device+0x78/0x114
[    3.169847]  driver_probe_device+0xd8/0x15c
[    3.174030]  __device_attach_driver+0xb8/0x134
[    3.178473]  bus_for_each_drv+0x80/0xdc
[    3.182308]  __device_attach+0xa0/0x1a0
[    3.186144]  device_initial_probe+0x14/0x20
[    3.190327]  bus_probe_device+0x98/0xa0
[    3.194162]  deferred_probe_work_func+0x80/0xc0
[    3.198693]  process_one_work+0x1d4/0x330
[    3.202702]  worker_thread+0x224/0x42c
[    3.206450]  kthread+0x108/0x10c
[    3.209676]  ret_from_fork+0x10/0x20
[    3.213253] Code: 128002b3 913f6021 97ffb5f6 1400002f (b8796b00)  
[    3.219345] ---[ end trace 0000000000000000 ]---

I just suspect some troubles with memory reservation/mapping... but why does it happen only when M7 is started from U-Boot, and not if M7 is started from remoteproc?

The relevant portion of Linux DTS is the following:

&resmem {

  m7_reserved: m7@75000000 {

    no-map;

    reg = <0 0x75000000 0 0x1000000>;

  };

  m7_vdev0vring0: vdev0vring0@74ff8000 {

    reg = <0 0x74ff8000 0 0x8000>;

    no-map;

  };

  m7_vdev0vring1: vdev0vring1@74ff0000 {

    reg = <0 0x74ff0000 0 0x8000>;

    no-map;

  };

  m7_vdevbuffer: vdevbuffer@74ef0000 {

    compatible = "shared-dma-pool";

    reg = <0 0x74ef0000 0 0x100000>;

    no-map;

  };

  m7_rsc_table: rsc-table@74eef000 {

    reg = <0 0x74eef000 0 0x1000>;

    no-map;

  };

  m7_itcm: m7-itcm@0x7e0000 {

    reg = <0 0x7e0000 0 0x20000>;

    no-map;

  };

  m7_dtcm: m7-dtcm@0x800000 {

    reg = <0 0x800000 0 0x20000>;

    no-map;

  };

};

/ {

  imx8mp-cm7 {

    compatible = "fsl,imx8mp-cm7";

    rsc-da = <0x74ff8000>;

    clocks = <&clk IMX8MP_CLK_M7_DIV>;

    clock-names = "core";

    mbox-names = "tx", "rx", "rxdb";

    mboxes = <&mu 0 1

      &mu 1 1

      &mu 3 1>;

    memory-region = <&m7_vdevbuffer>, <&m7_vdev0vring0>, <&m7_vdev0vring1>, <&m7_rsc_table>, <&m7_itcm>, <&m7_dtcm>;

    status = "okay";

    fsl,startup-delay-ms = <500>;

    fsl,auto-boot;

  };

};

/*

* ATTENTION: M7 may use IPs like below

* UART4

*/

&uart4 {

  status = "disabled";

};

Any ideas?

Thanks + regards.

[Harvey021]

Hi,

Try to run #mw 0x550ff000 0 4 to clear the garbage resource table area before running bootaux.

Regards

Harvey

[morix · Accepted solution]

Hello Harvey021,

thanks for your feedback.

I just found a viable solution: it turned out that:

• vdev0vring0 and vdev0vring1 were swapped;
• rsc-da must point to the base of vdev0ring0;
• I had to modify M7's hello world source code in order to make sure that is exposes a resource table at the memory location pointed out by m7_rsc_table (so basically I replace the empty_rsc_table.c (and correspondent header) with the attached rsc_table.c (and correspondent header) and I also modified board.h (see attached file).