[PATCH 1/2] rockchip: rk3576: Allow pmu sram access for non-secure masters

[Quentin Schulz]

Hi Jonas,

On 1/14/26 6:27 PM, Jonas Karlman wrote:
> Hi Quentin,
> 
> On 1/14/2026 5:27 PM, Quentin Schulz wrote:
>> Hi Jonas,
>>
>> On 1/8/26 2:32 PM, Jonas Karlman wrote:
>>> The firewall block access to pmu sram for non-secure masters by default
>>> after reset (0xffffbfff).
>>>
>>> Change the pmu lookup configuration to match the default lookup config
>>> for ddr and system sram (0xffff3fff) to allow loading TF-A using DMA.
>>>
>>
>> What is this "default" lookup config and where does it come from? You
>> say it's 0xffffbfff after reset and it's set to something different
>> after a TF-A has configured the firewall... Is it after a cold boot?
>> That somehow is different than a warm reset maybe?
> 
> 0xffffbfff was the value the PMU_SGRF_SLV_LOOKUP0 reg had out of cold
> boot, when read out at top of arch_cpu_init() in SPL using ramboot.
> 
> As implied by the cover letter any naming and technical details may be
> wrong and has only been deduced from firewall.c/h in TF-A source and
> printing out below content of a few FW regs.
> 
>    SGRF_MST_DOMAIN_CON0: 00000770
>    SGRF_MST_DOMAIN_CON1: 00007007
>    SGRF_MST_DOMAIN_CON2: 00000007
>    SGRF_MST_DOMAIN_CON3: 00000000
>    SGRF_MST_DOMAIN_CON4: 00000000
>    SGRF_MST_DOMAIN_CON5: 00000700
>    SGRF_MST_DOMAIN_CON6: 00007777
>    SGRF_MST_DOMAIN_CON7: 00000007
> 
>    SGRF_DDR_RGN0: 84000000
>    SGRF_DDR_RGN1: 00000000
>    [...]
>    SGRF_DDR_RGN15: 00000000
>    SGRF_DDR_LOOKUP0: ffff3fff
>    SGRF_DDR_LOOKUP1: ffffffff
>    [...]
>    SGRF_DDR_LOOKUP7: ffffffff
>    SGRF_DDR_CON: 00010001
> 
>    SGRF_SYSMEM_RGN0: 00007f00
>    SGRF_SYSMEM_RGN1: 00000000
>    SGRF_SYSMEM_RGN2: 00000000
>    SGRF_SYSMEM_RGN3: 00000000
>    SGRF_SYSMEM_LOOKUP0: ffff3fff
>    SGRF_SYSMEM_LOOKUP1: ffffffff
>    SGRF_SYSMEM_CON: 00000001
> 
>    PMU_SGRF_SLV_LOOKUP0: ffffbfff
>    PMU_SGRF_SLV_LOOKUP1: ffffffff
>    PMU_SGRF_SLV_LOOKUP2: ffffffff
>    PMU_SGRF_SLV_LOOKUP3: ffffffff
>    PMU_SGRF_DOMAIN_CON: 00000000
> 
> Looking at the above patterns and with some details from TF-A source I
> could deduce that PMU_SGRF_SLV_LOOKUP0 possible have something in common
> with SGRF_DDR_LOOKUP0 and SGRF_SYSMEM_LOOKUP0 regs, describing what
> domains can access DDR and SYSTEM SRAM regions, and after a quick test I
> could confirm that changing 'b' (10) to '3' (00) seemed to allow DMA
> write access from sdmmc, sdhci and fspi to PMU SRAM.
> 
>    Access rights between domains and groups are as follows:
> 
>    00: NS access,     S access
>    01: NS access,     S not access
>    10: NS not access, S access
>    11: NS not access, S not access
> 
> My deduced guess is that PMU_SGRF_SLV_LOOKUP0[15:14] describe access to
> PMU SRAM for domain 7, similar to SGRF_DDR/SYSMEM_LOOKUP0[15:14], and
> changing it from only secure access (10) to both non-secure and secure
> access (00) allows us to use DMA from the masters re-assign to domain 7.
> 

This is really the kind of information I like to have when reading 
commit logs, especially for future reference if it turns out the 
assumptions were incorrect, would you mind making this explanation part 
of the commit log in a v2 maybe?

I'm also wondering if it isn't something similar we need to do for the 
other Rockchip SoCs to be able to remove u-boot,spl-fifo-mode; on the 
various storage medium nodes?

Cheers,
Quentin