8
33
Fork
You've already forked blackmagic
23

Fix STM32MP15x identification for Cortex-A7 cores post-Linux boot #2227

Merged
dragonmux merged 2 commits from ALTracer/blackmagic:fix/stm32mp15-ca7-ident into main 2026年04月09日 19:48:21 +02:00
Contributor
Copy link

Detailed description

  • No major new features, just small fixes to target support.
  • The existing problem is "ARM Cortex-A A7" detected, with memory map missing, in Production Boot, where "STM32MP15 A7" would be detected in Engineering Boot.
  • This PR solves it by redirecting back the DBGMCU IDCODE register read from System bus alias 0x50081000 (as observed by cortexar_mem_read) to Debug APB address 0xe0081000 on AP1.

Tested on STM32MP157C with STLINK/V3MINIE driven by BMDA.
I suppose this happens because Linux kernel unmaps peripherals via MMU, leaving only DRAM identity-mapped. Before it boots (e.g. in U-boot shell with stopped autoboot), the registers are still readable, because U-Boot only enables identity mapping in MMU. Linux device drivers rely on the kernel creating some secondary virtual mapping to used peripherals in kernel-private regions, and it should not stay predictable on every boot (ASLR etc.)
To be able to unwind kernel stacks, I register 512 MiB of DRAM at an address, which is conveniently both a physical DDR SoC base address (thanks ST) and VMSPLIT=PAGE_OFFSET=0xc0000000 3G/1G "entire DRAM is in low memory" address. Boards with 1024 MiB of DDR3 and this SoC are extremely rare and need a modified bootloader chain. I also add the 128 KiB BootROM at 0x0 for CA7 (CM4 sees 64 KiB RETRAM at 0x0), which you can dump ihex memory and compare-sections for a reliable benchmark.

Your checklist for this pull request

Closing issues

## Detailed description * No major new features, just small fixes to target support. * The existing problem is "ARM Cortex-A A7" detected, with memory map missing, in Production Boot, where "STM32MP15 A7" would be detected in Engineering Boot. * This PR solves it by redirecting back the DBGMCU IDCODE register read from System bus alias 0x50081000 (as observed by `cortexar_mem_read`) to Debug APB address 0xe0081000 on AP1. Tested on STM32MP157C with STLINK/V3MINIE driven by BMDA. I suppose this happens because Linux kernel unmaps peripherals via MMU, leaving only DRAM identity-mapped. Before it boots (e.g. in U-boot shell with stopped autoboot), the registers are still readable, because U-Boot only enables identity mapping in MMU. Linux device drivers rely on the kernel creating some secondary virtual mapping to used peripherals in kernel-private regions, and it should not stay predictable on every boot (ASLR etc.) To be able to unwind kernel stacks, I register 512 MiB of DRAM at an address, which is conveniently both a physical DDR SoC base address (thanks ST) and VMSPLIT=PAGE_OFFSET=0xc0000000 3G/1G "entire DRAM is in low memory" address. Boards with 1024 MiB of DDR3 and this SoC are extremely rare and need a modified bootloader chain. I also add the 128 KiB BootROM at 0x0 for CA7 (CM4 sees 64 KiB RETRAM at 0x0), which you can `dump ihex memory` and `compare-sections` for a reliable benchmark. ## Your checklist for this pull request * [x] I've read the [Code of Conduct](https://codeberg.org/blackmagic-debug/blackmagic/src/CODE_OF_CONDUCT.md) * [x] I've read the [guidelines for contributing](https://codeberg.org/blackmagic-debug/blackmagic/src/CONTRIBUTING.md) to this repository * [x] It builds for hardware native (see [Building the firmware](https://codeberg.org/blackmagic-debug/blackmagic?tab=readme-ov-file#building-the-firmware)) * [x] It builds as BMDA (see [Building the BMDA](https://codeberg.org/blackmagic-debug/blackmagic?tab=readme-ov-file#building-black-magic-debug-app)) * [x] I've tested it to the best of my ability * [x] My commit messages provide a useful short description of what the commits do ## Closing issues
stm32mp15: Add DRAM (512 MiB) and Boot ROM to CA7 memory map
Some checks failed
ci/woodpecker/pr/build-firmware/5 Pipeline was successful
ci/woodpecker/pr/build-firmware/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/8 Pipeline was successful
ci/woodpecker/pr/build-firmware/4 Pipeline was successful
ci/woodpecker/pr/build-firmware/6 Pipeline was successful
ci/woodpecker/pr/build-firmware/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/3 Pipeline was successful
ci/woodpecker/pr/build-firmware/7 Pipeline was successful
ci/woodpecker/pr/build-firmware/12 Pipeline was successful
ci/woodpecker/pr/build-firmware/15 Pipeline was successful
ci/woodpecker/pr/build-firmware/16 Pipeline was successful
ci/woodpecker/pr/build-firmware/14 Pipeline was successful
ci/woodpecker/pr/build-firmware/13 Pipeline was successful
ci/woodpecker/pr/build-firmware/10 Pipeline was successful
ci/woodpecker/pr/build-firmware/11 Pipeline was successful
ci/woodpecker/pr/build-firmware/9 Pipeline was successful
ci/woodpecker/pr/build-linux/1 Pipeline was successful
ci/woodpecker/pr/build-linux/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/18 Pipeline failed
ci/woodpecker/pr/build-firmware/17 Pipeline was successful
ci/woodpecker/pr/build-firmware/20 Pipeline was successful
ci/woodpecker/pr/build-firmware/19 Pipeline was successful
ci/woodpecker/pr/build-windows Pipeline was successful
7417b4b837
dragonmux requested changes 2026年04月07日 07:30:18 +02:00
Dismissed
dragonmux left a comment
Copy link

There's a couple of things could do with some cleanup/improvement and one query, but with them taken care of this is looking great and we'll be happy to merge it.

There's a couple of things could do with some cleanup/improvement and one query, but with them taken care of this is looking great and we'll be happy to merge it.
@ -109,6 +109,19 @@ static bool stm32mp15_ident(target_s *const target, const bool cortexm)
return false;
}
if (!cortexm) {

Can this ever fire if it's down below the check just above? You mentioned on Discord that the DBGMCU registers become unreadable via the normal AP and such, so we're trying to understand how this fits into the identification vs configuration aspects of this function.

Can this ever fire if it's down below the check just above? You mentioned on Discord that the DBGMCU registers become unreadable via the normal AP and such, so we're trying to understand how this fits into the identification vs configuration aspects of this function.
Author
Contributor
Copy link
  1. The check above is meant to pass for CM4 with partno 0x500 (true) / 0x450 (erratum). Later check is meant to fail for CM7 from H7 with true partno 0x450. CA7 always has partno 0x500 (true).
  2. I mentioned that after Linux boot this function breaks identification of CA7 as belonging to STM32MP15x, because it does not perform the read via the normal AP but instead defaults to processor manipulation, but 0x50081000 virtual address is not guaranteed to correspond to physical address of alias of DBGMCU. There's nothing to configure before _attach.
1. The check above is meant to pass for CM4 with partno 0x500 (true) / 0x450 (erratum). Later check is meant to fail for CM7 from H7 with true partno 0x450. CA7 always has partno 0x500 (true). 2. I mentioned that after Linux boot this function breaks identification of CA7 as belonging to STM32MP15x, because it does not perform the read via the normal AP but instead defaults to processor manipulation, but 0x50081000 virtual address is not guaranteed to correspond to physical address of alias of DBGMCU. There's nothing to configure before _attach.

That's fine then - we just wanted to make sure we understood the expected flow.

That's fine then - we just wanted to make sure we understood the expected flow.
dragonmux marked this conversation as resolved
@ -112,0 +115,4 @@
* becomes unreadable via cortexar_mem_read, so use debug APB on AP1
*/
uint32_t idcode = 0;
adiv5_mem_read(ap, &idcode, 0xe0081000U, 4);

U on the constant for the size of idcode please (although sizeof(idcode) would be better and more fool-proof in many ways). Please define a name for the 0xe... constant - perhaps STM32MP15_AP1_DBGMCU_IDCODE?

`U` on the constant for the size of `idcode` please (although `sizeof(idcode)` would be better and more fool-proof in many ways). Please define a name for the `0xe...` constant - perhaps `STM32MP15_AP1_DBGMCU_IDCODE`?
Author
Contributor
Copy link

Applied, thanks.

Applied, thanks.
dragonmux marked this conversation as resolved
@ -322,1 +335,4 @@
target_add_ram32(target, STM32MP15_CAN_SRAM_BASE, STM32MP15_CAN_SRAM_SIZE);
/* DRAM 512 MiB at identity mapping base */
target_add_ram32(target, 0xc0000000U, 0x20000000U);

Please define names for these RAM constants - STM32MP15_DRAM_BASE, etc perhaps? (same for BOOTROM in place of DRAM for the two below.

131072 would be better written as (128U * 1024U) if keeping the numbers in decimal, or being written as 0x00020000U if converted to hex for consistency.. please include all 8 hex digits of the base address for the ROM for consistency.

Please define names for these RAM constants - `STM32MP15_DRAM_BASE`, etc perhaps? (same for `BOOTROM` in place of `DRAM` for the two below. 131072 would be better written as `(128U * 1024U)` if keeping the numbers in decimal, or being written as `0x00020000U` if converted to hex for consistency.. please include all 8 hex digits of the base address for the ROM for consistency.
Author
Contributor
Copy link

Defined two new macros.
GDB supports ROM regions in memory-map.xml, but it's not exactly easy or useful to declare them from BMF,
<memory type="rom" start="0" length="131072"/>. So type="ram" it is.

Defined two new macros. GDB supports ROM regions in memory-map.xml, but it's not exactly easy or useful to declare them from BMF, `<memory type="rom" start="0" length="131072"/>`. So type="ram" it is.

That's fair - something for future improvement then to provide ROM regions that are distinct from Flash ones so we can define processor ROMs in the map to make the debugging experience that bit better when a user does not have inaccessible-by-default off and is trying to work with code that calls into those ROMs and such.

That's fair - something for future improvement then to provide ROM regions that are distinct from Flash ones so we can define processor ROMs in the map to make the debugging experience that bit better when a user does not have inaccessible-by-default off and is trying to work with code that calls into those ROMs and such.
dragonmux marked this conversation as resolved
ALTracer force-pushed fix/stm32mp15-ca7-ident from 7417b4b837
Some checks failed
ci/woodpecker/pr/build-firmware/5 Pipeline was successful
ci/woodpecker/pr/build-firmware/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/8 Pipeline was successful
ci/woodpecker/pr/build-firmware/4 Pipeline was successful
ci/woodpecker/pr/build-firmware/6 Pipeline was successful
ci/woodpecker/pr/build-firmware/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/3 Pipeline was successful
ci/woodpecker/pr/build-firmware/7 Pipeline was successful
ci/woodpecker/pr/build-firmware/12 Pipeline was successful
ci/woodpecker/pr/build-firmware/15 Pipeline was successful
ci/woodpecker/pr/build-firmware/16 Pipeline was successful
ci/woodpecker/pr/build-firmware/14 Pipeline was successful
ci/woodpecker/pr/build-firmware/13 Pipeline was successful
ci/woodpecker/pr/build-firmware/10 Pipeline was successful
ci/woodpecker/pr/build-firmware/11 Pipeline was successful
ci/woodpecker/pr/build-firmware/9 Pipeline was successful
ci/woodpecker/pr/build-linux/1 Pipeline was successful
ci/woodpecker/pr/build-linux/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/18 Pipeline failed
ci/woodpecker/pr/build-firmware/17 Pipeline was successful
ci/woodpecker/pr/build-firmware/20 Pipeline was successful
ci/woodpecker/pr/build-firmware/19 Pipeline was successful
ci/woodpecker/pr/build-windows Pipeline was successful
to 46056a7615
Some checks failed
ci/woodpecker/pr/build-firmware/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/3 Pipeline was successful
ci/woodpecker/pr/build-firmware/4 Pipeline was successful
ci/woodpecker/pr/build-firmware/5 Pipeline was successful
ci/woodpecker/pr/build-firmware/6 Pipeline was successful
ci/woodpecker/pr/build-firmware/7 Pipeline was successful
ci/woodpecker/pr/build-firmware/8 Pipeline was successful
ci/woodpecker/pr/build-firmware/9 Pipeline was successful
ci/woodpecker/pr/build-firmware/10 Pipeline was successful
ci/woodpecker/pr/build-firmware/11 Pipeline was successful
ci/woodpecker/pr/build-firmware/12 Pipeline was successful
ci/woodpecker/pr/build-firmware/13 Pipeline was successful
ci/woodpecker/pr/build-firmware/14 Pipeline was successful
ci/woodpecker/pr/build-firmware/15 Pipeline was successful
ci/woodpecker/pr/build-firmware/16 Pipeline was successful
ci/woodpecker/pr/build-firmware/17 Pipeline was successful
ci/woodpecker/pr/build-firmware/18 Pipeline failed
ci/woodpecker/pr/build-linux/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/19 Pipeline was successful
ci/woodpecker/pr/build-firmware/20 Pipeline was successful
ci/woodpecker/pr/build-linux/2 Pipeline was successful
ci/woodpecker/pr/build-windows Pipeline was successful
2026年04月09日 19:04:42 +02:00
Compare
@ -322,1 +340,4 @@
target_add_ram32(target, STM32MP15_CAN_SRAM_BASE, STM32MP15_CAN_SRAM_SIZE);
/* DRAM 512 MiB at identity mapping base */
target_add_ram32(target, STM32MP15_DRAM_BASE, 512U * 1048576U);

* 1024U * 1024U would be more ideal, if using this format.. or alternatively, for more consistency with the other target support, using a baked hex constant #defined'd as the _SIZE for the _BASE

`* 1024U * 1024U` would be more ideal, if using this format.. or alternatively, for more consistency with the other target support, using a baked hex constant `#defined`'d as the _SIZE for the _BASE
Author
Contributor
Copy link

as DRAM is external to the chip, I would like to avoid baking a hex constant, so that users in the future could find easier which number to patch for their fancy rare 1024 MiB setup. SoC supports DDR3/3L and LPDDR2/3. 0x2000_0000 means less to me than 512U * 1024U * 1024U.

as DRAM is external to the chip, I would like to avoid baking a hex constant, so that users in the future could find easier which number to patch for their fancy rare 1024 MiB setup. SoC supports DDR3/3L and LPDDR2/3. `0x2000_0000` means less to me than `512U * 1024U * 1024U`.
dragonmux marked this conversation as resolved
ALTracer force-pushed fix/stm32mp15-ca7-ident from 46056a7615
Some checks failed
ci/woodpecker/pr/build-firmware/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/2 Pipeline was successful
ci/woodpecker/pr/build-firmware/3 Pipeline was successful
ci/woodpecker/pr/build-firmware/4 Pipeline was successful
ci/woodpecker/pr/build-firmware/5 Pipeline was successful
ci/woodpecker/pr/build-firmware/6 Pipeline was successful
ci/woodpecker/pr/build-firmware/7 Pipeline was successful
ci/woodpecker/pr/build-firmware/8 Pipeline was successful
ci/woodpecker/pr/build-firmware/9 Pipeline was successful
ci/woodpecker/pr/build-firmware/10 Pipeline was successful
ci/woodpecker/pr/build-firmware/11 Pipeline was successful
ci/woodpecker/pr/build-firmware/12 Pipeline was successful
ci/woodpecker/pr/build-firmware/13 Pipeline was successful
ci/woodpecker/pr/build-firmware/14 Pipeline was successful
ci/woodpecker/pr/build-firmware/15 Pipeline was successful
ci/woodpecker/pr/build-firmware/16 Pipeline was successful
ci/woodpecker/pr/build-firmware/17 Pipeline was successful
ci/woodpecker/pr/build-firmware/18 Pipeline failed
ci/woodpecker/pr/build-linux/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/19 Pipeline was successful
ci/woodpecker/pr/build-firmware/20 Pipeline was successful
ci/woodpecker/pr/build-linux/2 Pipeline was successful
ci/woodpecker/pr/build-windows Pipeline was successful
to e6333cfc52
Some checks failed
ci/woodpecker/pr/build-firmware/15 Pipeline was successful
ci/woodpecker/pr/build-firmware/13 Pipeline was successful
ci/woodpecker/pr/build-linux/1 Pipeline was successful
ci/woodpecker/pr/build-firmware/19 Pipeline was successful
ci/woodpecker/pr/build-firmware/20 Pipeline was successful
ci/woodpecker/pr/build-linux/2 Pipeline was successful
ci/woodpecker/pr/build-windows Pipeline was successful
ci/woodpecker/push/build-firmware/1 Pipeline was successful
ci/woodpecker/push/build-firmware/2 Pipeline was successful
ci/woodpecker/push/build-firmware/3 Pipeline was successful
ci/woodpecker/push/build-firmware/4 Pipeline was successful
ci/woodpecker/push/build-firmware/5 Pipeline was successful
ci/woodpecker/push/build-firmware/6 Pipeline was successful
ci/woodpecker/push/build-firmware/8 Pipeline was successful
ci/woodpecker/push/build-firmware/7 Pipeline was successful
ci/woodpecker/push/build-firmware/9 Pipeline was successful
ci/woodpecker/push/build-firmware/11 Pipeline was successful
ci/woodpecker/push/build-firmware/12 Pipeline was successful
ci/woodpecker/push/build-firmware/10 Pipeline was successful
ci/woodpecker/push/build-firmware/13 Pipeline was successful
ci/woodpecker/push/build-firmware/16 Pipeline was successful
ci/woodpecker/push/build-firmware/14 Pipeline was successful
ci/woodpecker/push/build-firmware/15 Pipeline was successful
ci/woodpecker/push/build-firmware/17 Pipeline was successful
ci/woodpecker/push/build-firmware/20 Pipeline was successful
ci/woodpecker/push/build-firmware/18 Pipeline failed
ci/woodpecker/push/build-firmware/19 Pipeline was successful
ci/woodpecker/push/build-linux/1 Pipeline was successful
ci/woodpecker/push/build-linux/2 Pipeline was successful
ci/woodpecker/push/build-windows Pipeline was successful
2026年04月09日 19:33:50 +02:00
Compare
dragonmux left a comment
Copy link

LGTM, merging. Thank you for the contribution!

LGTM, merging. Thank you for the contribution!
Sign in to join this conversation.
No reviewers
Labels
Clear labels
BMD App
Black Magic Debug App (aka. PC hosted) (not firmware)
BMP Firmware
Black Magic Probe Firmware (not PC hosted software)
Bug
Confirmed bug
Build system
Build system
Can't reproduce
Maintainers can't reproduce this problem
CI
Continuous Integration System
Contribution wanted
User contributions welcome
Documentation
Project documentation
Draft
Work in progress draft
Duplicate
This issue or pull request already exists
Enhancement
General project improvement
Feedback wanted
Requires additional submitter feedback
Foreign Host Board
Non Native hardware to runing Black Magic firmware on
GDB
Issue/PR related to GDB
Good first issue
Good for newcommers
HwIssue Mitigation
Solving or mitigating a Hardware issue in Software
Information Needed
Maintainers need more information
NativeHardware
Official Black Magic Debug Hardware
New Host Board
New hardware to run Black Magic firmware on
New Target
New debug target
Off Topic
Something that does not involve the project in any way
Potential Bug
A potential, unconfirmed or very special circumstance bug
Regression
Bug caused by a regression
User Interest Needed
More user interest required before consideration
User Testing Needed
Looking for user testing reports
Won't fix
Outside of the project scope or works as intended
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
blackmagic-debug/blackmagic!2227
Reference in a new issue
blackmagic-debug/blackmagic
No description provided.
Delete branch "ALTracer/blackmagic:fix/stm32mp15-ca7-ident"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?