imx93 Linux crashes during boot when the M33 core was already started in Single Boot

Eddy1 · ‎10-21-2024

Currently, there are some issues with debugging imx93 single Boot. The test steps are as follows:

Compile MCIMX93-EVK-freertos_hello.zip to generate the BIN file.
Copy the BIN file to imx-boot/iMX9 and rename it to m33_image.bin.

Generate the imx-boot file with the command:

make SOC=${SOC_NAME} REV=A1 dtbs=myd_lmx9x-11x11.dtb flash_singleboot_m33

Flash the image to the board, boot it, and observe that both the A core and M33 start normally.

M33 core

After booting, the A core reports the following error and fails to start, but the M33 debug port can still perform normal input and output:

[    1.903590] imx-dwmac 428a0000.ethernet: Using 32/32 bits DMA host/device width
[    1.917166] ci_hdrc ci_hdrc.0: EHCI Host Controller
[    1.922069] ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
[    1.945089] ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
[    1.950952] hub 1-0:1.0: USB hub found
[    1.954730] hub 1-0:1.0: 1 port detected
[    1.962081] sdhci-esdhc-imx 42860000.mmc: Got CD GPIO
[    1.962745] isi-capture 4ae40000.isi:cap_device: deferring 4ae40000.isi:cap_device device registration
[    1.976589] mxc-isi 4ae40000.isi: mxc_isi.0 registered successfully
[    1.983781] mxc-md 42800000.bus:camera: deferring cap_device registration
[    1.992311] rproc ddr init test
[    1.995507] rproc addr inittest
[    1.998832] memory region test
[    2.001968] mmc1: SDHCI controller on 42860000.mmc [42860000.mmc] using ADMA
[    2.009108] rproc clk enabletest
[    2.012486] remoteproc remoteproc0: imx-rproc is available
[    2.018036] remoteproc remoteproc0: attaching to imx-rproc
[    2.023586] Unable to handle kernel paging request at virtual address ffff7fffcb2e3e00
[    2.031509] Mem abort info:
[    2.034309]   ESR = 0x0000000096000004
[    2.038060]   EC = 0x25: DABT (current EL), IL = 32 bits
[    2.043395]   SET = 0, FnV = 0
[    2.046458]   EA = 0, S1PTW = 0
[    2.049600]   FSC = 0x04: level 0 translation fault
[    2.054493] Data abort info:
[    2.057386]   ISV = 0, ISS = 0x00000004
[    2.061226]   CM = 0, WnR = 0
[    2.064193] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000008200b000
[    2.070890] [ffff7fffcb2e3e00] pgd=0000000000000000, p4d=0000000000000000
[    2.077677] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[    2.083928] Modules linked in:
[    2.086971] CPU: 1 PID: 39 Comm: kworker/u4:1 Not tainted 6.1.55-05988-ga5c552ce6210-dirty #3
[    2.095480] Hardware name: NXP i.MX93 11X11 EVK board (DT)
[    2.100951] Workqueue: events_unbound deferred_probe_work_func
[    2.106782] pstate: 00400009 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    2.113732] pc : rproc_handle_resources.constprop.0+0x8c/0x164
[    2.119556] lr : rproc_boot+0x2fc/0x57c
[    2.123386] sp : ffff80000a5539e0
[    2.126689] x29: ffff80000a5539e0 x28: 0000000000000018 x27: ffff000004e444d0
[    2.133812] x26: 0000000000000006 x25: ffffffffc0ffee00 x24: ffff80000a2e5000
[    2.140936] x23: ffff000004e44038 x22: 0000000000000000 x21: ffff80000a0ff4e0
[    2.148060] x20: ffff000004e44000 x19: 0000000000000000 x18: 0000000000000006
[    2.155184] x17: ffff80000a061f10 x16: 000000004e17f57d x15: c0ffee00c0ffee00
[    2.162308] x14: c0ffee00c0ffee00 x13: c0ffee00c0ffee00 x12: c0ffee00c0ffee00
[    2.169432] x11: c0ffee00c0ffee00 x10: c0ffee00c0ffee00 x9 : c0ffee00c0ffee00
[    2.176556] x8 : c0ffee00c0ffee00 x7 : c0ffee00c0ffee00 x6 : c0ffee00c0ffee00
[    2.183680] x5 : ffff000004a21400 x4 : ffff80000a2e5400 x3 : 000000003f0015fc
[    2.190804] x2 : 00000000c0ffee00 x1 : ffff7fffcb2e3e04 x0 : ffff80000a2e5000
[    2.197929] Call trace:
[    2.200365]  rproc_handle_resources.constprop.0+0x8c/0x164
[    2.205841]  rproc_boot+0x2fc/0x57c
[    2.209325]  rproc_add+0xcc/0x16c
[    2.212627]  imx_rproc_probe+0x590/0x5ec
[    2.216544]  platform_probe+0x68/0xc0
[    2.220193]  really_probe+0xbc/0x2dc
[    2.223755]  __driver_probe_device+0x78/0x114
[    2.228106]  driver_probe_device+0x3c/0x15c
[    2.232274]  __device_attach_driver+0xb8/0x134
[    2.236703]  bus_for_each_drv+0x7c/0xd4
[    2.240525]  __device_attach+0x9c/0x1a0
[    2.244356]  device_initial_probe+0x14/0x20
[    2.248524]  bus_probe_device+0x98/0xa0
[    2.252346]  deferred_probe_work_func+0x80/0xc0
[    2.256870]  process_one_work+0x1d4/0x330
[    2.260874]  worker_thread+0x220/0x430
[    2.264610]  kthread+0x108/0x10c
[    2.267825]  ret_from_fork+0x10/0x20
[    2.271399] Code: 128002b3 913f8021 97ffb5ab 1400002f (b8796b00)
[    2.277473] ---[ end trace 0000000000000000 ]---

Then, try modifying the device tree to remove rsc_table:

After deleting rsc_table, the A core can start normally, but the M33 core can no longer print “hello world.” What could be the issue?

Neha_V · ‎06-29-2025

Even i am facing the same issue for hello world binary . The
rpmsg_lite_pingpong_rtos_linux_remote.bin and rpmsg_lite_str_echo_rtos.bin are working fine but whenever i load the hello world binary in uboot the kernel is crashing.

1.869080] ESR = 0x0000000096000005
[ 1.872820] EC = 0x25: DABT (current EL), IL = 32 bits
[ 1.878123] SET = 0, FnV = 0
[ 1.881170] EA = 0, S1PTW = 0
[ 1.884302] FSC = 0x05: level 1 translation fault
[ 1.889173] Data abort info:
[ 1.892041] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 1.897519] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 1.902563] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 1.907872] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000082042000
[ 1.914558] [ffff800043403e00] pgd=10000000affff003, p4d=10000000affff003, pud=0000000000000000
[ 1.923252] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[ 1.929505] Modules linked in:
[ 1.932549] CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.6.52-lts-next-g74a54ba9509c #2
[ 1.940797] Hardware name: NXP i.MX93 IWG50M OSM (DT)
[ 1.945834] Workqueue: events_unbound deferred_probe_work_func
[ 1.951665] pstate: 00400009 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.958615] pc : rproc_handle_resources.constprop.0+0x64/0x18c
[ 1.964439] lr : rproc_boot+0x37c/0x57c
[ 1.968270] sp : ffff8000823fb9f0
[ 1.971572] x29: ffff8000823fb9f0 x28: ffff800082405000 x27: ffff800081b4f138
[ 1.978696] x26: ffff00002fde9fc8 x25: 0000000000000006 x24: ffff800043403e00
[ 1.985820] x23: 0000000000000000 x22: ffff000004bc1038 x21: ffff800082176e58
[ 1.992944] x20: 0000000000000000 x19: ffff000004bc1000 x18: 0000000000000006
[ 2.000068] x17: ffff000004657c00 x16: ffff000004657800 x15: c0ffee00c0ffee00
[ 2.007192] x14: c0ffee00c0ffee00 x13: c0ffee00c0ffee00 x12: c0ffee00c0ffee00
[ 2.014316] x11: c0ffee00c0ffee00 x10: c0ffee00c0ffee00 x9 : c0ffee00c0ffee00
[ 2.021440] x8 : c0ffee00c0ffee00 x7 : c0ffee00c0ffee00 x6 : c0ffee00c0ffee00
[ 2.028564] x5 : ffff00000443fc00 x4 : ffff800082405000 x3 : 000000003f0015fc
[ 2.035688] x2 : 00000000c0ffee00 x1 : ffff800043403e04 x0 : ffff800082405000
[ 2.042813] Call trace:
[ 2.045248] rproc_handle_resources.constprop.0+0x64/0x18c
[ 2.050725] rproc_boot+0x37c/0x57c
[ 2.054209] rproc_add+0x144/0x17c
[ 2.057597] imx_rproc_probe+0x4d0/0x5f0
[ 2.061506] platform_probe+0x68/0xc8
[ 2.065155] really_probe+0x148/0x2b0
[ 2.068804] __driver_probe_device+0x78/0x12c
[ 2.073145] driver_probe_device+0x3c/0x15c
[ 2.077314] __device_attach_driver+0xb8/0x134
[ 2.081743] bus_for_each_drv+0x88/0xe8
[ 2.085574] __device_attach+0xa0/0x190
[ 2.089396] device_initial_probe+0x14/0x20
[ 2.093564] bus_probe_device+0xac/0xb0
[ 2.097395] deferred_probe_work_func+0x80/0xb8
[ 2.101919] process_one_work+0x138/0x248
[ 2.105923] worker_thread+0x320/0x438
[ 2.109658] kthread+0x110/0x114
[ 2.112873] ret_from_fork+0x10/0x20
[ 2.116447] Code: 6b020063 8b22c098 91001301 540007c4 (b862c880)
[ 2.122521] ---[ end trace 0000000000000000 ]---

in the m33 core terminal hello world is printed but in the A core terminal the kernal is crashing

Zhiming_Liu · ‎10-22-2024

Hi @Eddy1

Are you using default imx93-11x11-evk-rpmsg.dts for kernel?

Best Regards
Zhiming

Eddy1 · ‎10-23-2024

Yes, the same error occurs with this device tree.

Zhiming_Liu · ‎10-23-2024

Hi

You are using freertos binary which not support rpmsg framework, which cause this error.

If you need to use rpmsg, please port freertos in rpmsg demo project.

Best Regards
Zhiming

Eddy1 · ‎10-23-2024

Additionally, it has been tested that when the M33 core is started through U-Boot and then the system is booted, the same error occurs. Currently, after testing, the M33 can only be tested in the file system using the echo command

Zhiming_Liu · ‎10-24-2024

Hi @Eddy1

Can you try to load imx93-11x11-evk_m33_TCM_rpmsg_lite_str_echo_rtos.bin from uboot?

Best Regards
Zhiming

Eddy1 · ‎10-28-2024

Hi:

This demo works the same way in u-boot: after entering the file system, sending a message to M33, M33 cannot print out the message:

u-boot=> fatload mmc 0:1 80000000 imx93-14x14-evk_m33_TCM_rpmsg_lite_str_echo_rtos.bin; cp.b 0x80000000 0x201e0000 ${filesize}

16736 bytes read in 1 ms (16 MiB/s)

u-boot=> bootaux 0x1ffe0000 0
## Starting auxiliary core addr = 0x1FFE0000...
u-boot=> run bootcmd

After entering the file system, use the following command to send data:

modprobe imx_rpmsg_tty
[   54.656950] imx_rpmsg_tty virtio1.rpmsg-virtual-tty-channel.-1.30: new channel: 0x400 -> 0x1e!
[   54.667365] Install rpmsg tty driver!
echo "hi m33!" > /dev/ttyRPMSG30

However, the M33 core does not print anything.

If used in the file system with the command ‘echo imx93-14x14-evk_m33_TCM_rpmsg_lite_str_echo_rtos.elf > /sys/class/remoteproc/remoteproc0/firmware’, it can send and receive data normally.

Zhiming_Liu · ‎11-12-2024

Hello,

Sorry for the late reply,

The solution is that you must use below command before using bootaux.

setenv mmcargs $mmcargs clk-imx93.mcore_booted
saveenv

Best Regards,
Zhiming

Eddy1 · ‎11-13-2024

Hi：

Thank you very much for your assistance. It is now working very well. However, there is another point I'd like to raise. You mentioned earlier that only with the rpmsg framework can the system boot up from singleboot or uboot. Is it possible to modify it so that the m33 firmware can boot up regardless of whether it has the rpmsg framework or not?

Zhiming_Liu · ‎11-13-2024

Hello,

The default device tree enable the shared memory and remotproc node for NPU firmware. These resources are for rpmsg framework, so the kernel will hang when initialize these resources as there is no such definitions in M33 firmware if you load firmware from uboot. If you don't need NPU function, you can delete them in dts. But if need NPU, there are only two solutions: 1. Use remoteproc to load elf firmware; 2. Port freertos codes in rpmsg demo.

...
ethosu_mem: ethosu_region@C0000000 {
			compatible = "shared-dma-pool";
			reusable;
			reg = <0x0 0xC0000000 0x0 0x10000000>;
		};

		vdev0vring0: vdev0vring0@a4000000 {
			reg = <0 0xa4000000 0 0x8000>;
			no-map;
		};

		vdev0vring1: vdev0vring1@a4008000 {
			reg = <0 0xa4008000 0 0x8000>;
			no-map;
		};

		vdev1vring0: vdev1vring0@a4010000 {
			reg = <0 0xa4010000 0 0x8000>;
			no-map;
		};

		vdev1vring1: vdev1vring1@a4018000 {
			reg = <0 0xa4018000 0 0x8000>;
			no-map;
		};

		rsc_table: rsc-table@2021e000 {
			reg = <0 0x2021e000 0 0x1000>;
			no-map;
		};

		vdevbuffer: vdevbuffer@a4020000 {
			compatible = "shared-dma-pool";
			reg = <0 0xa4020000 0 0x100000>;
			no-map;
		};
...
	ethosu {
		compatible = "arm,ethosu";
		fsl,cm33-proc = <&cm33>;
		memory-region = <&ethosu_mem>;
		power-domains = <&mlmix>;
	};
...
&cm33 {
	mbox-names = "tx", "rx", "rxdb";
	mboxes = <&mu1 0 1>,
		 <&mu1 1 1>,
		 <&mu1 3 1>;
	memory-region = <&vdevbuffer>, <&vdev0vring0>, <&vdev0vring1>,
			<&vdev1vring0>, <&vdev1vring1>, <&rsc_table>;
	fsl,startup-delay-ms = <500>;
	status = "okay";
};

Best Regards,
Zhiming

Eddy1 · ‎11-13-2024

Hi:

The default device tree used is “arch/arm64/boot/dts/freescale/imx93-11x11-evk-rpmsg.dts”, in which the NPU has been removed by default.

Zhiming_Liu · ‎11-13-2024

Hi

The default dts without modifing fdtfile is arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts