From c157294492c17a74394434f1fde7cfe03af59d39 Mon Sep 17 00:00:00 2001 From: Shivam Sanjay Date: Mon, 24 Aug 2026 12:05:26 +0530 Subject: [PATCH 1/2] drivers: qcom: rpmh: fix MSGID MSG_LENGTH field encoding The RPMh command MSGID encodes a MSG_LENGTH field describing the payload length, in bytes, of the command. This field was hardcoded to 1 which is leading to unpredictable behavior on the AOP side (including the command never being acknowledged, causing timeouts). Changing it to 8 (the correct length for the single 32-bit data word every RPMh command carries), introducing macros MSGID_MSG_LENGTH_VALUE, MSGID_WRITE, MSGID_READ so the expected encoding is explicit. Using MSGID_WRITE since it's a write command. Signed-off-by: Shivam Sanjay --- core/drivers/qcom/rpmh/rpmh_hal.c | 4 ++-- core/drivers/qcom/rpmh/rpmh_hal.h | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/core/drivers/qcom/rpmh/rpmh_hal.c b/core/drivers/qcom/rpmh/rpmh_hal.c index 90dbf6f51..7c95ea910 100644 --- a/core/drivers/qcom/rpmh/rpmh_hal.c +++ b/core/drivers/qcom/rpmh/rpmh_hal.c @@ -230,9 +230,9 @@ enum hal_status hal_rpmh_write_cmd(enum rsc_drv_id drv_id, cmd_base = tcs_base + TCS_CMD_BASE_OFFSET + (cmd_idx * TCS_CMD_STRIDE); msgid = 0; - msgid |= SHIFT_U32(0, MSGID_READ_OR_WRITE_SHIFT); + msgid |= SHIFT_U32(MSGID_WRITE, MSGID_READ_OR_WRITE_SHIFT); msgid |= SHIFT_U32((completion ? 1 : 0), MSGID_RES_REQ_SHIFT); - msgid |= SHIFT_U32(1, MSGID_MSG_LENGTH_SHIFT); + msgid |= SHIFT_U32(MSGID_MSG_LENGTH_VALUE, MSGID_MSG_LENGTH_SHIFT); slave_id = (addr >> 16) & 0x7; offset = addr & 0xFFFF; diff --git a/core/drivers/qcom/rpmh/rpmh_hal.h b/core/drivers/qcom/rpmh/rpmh_hal.h index 91bc090e6..5cbfb1f94 100644 --- a/core/drivers/qcom/rpmh/rpmh_hal.h +++ b/core/drivers/qcom/rpmh/rpmh_hal.h @@ -53,6 +53,12 @@ enum hal_status { #define MSGID_RES_REQ_SHIFT 0x8 #define MSGID_MSG_LENGTH_SHIFT 0x0 +#define MSGID_READ 0x0 +#define MSGID_WRITE 0x1 + +/* Each RPMh command transfers a single 32-bit word (encoded as 8 bytes). */ +#define MSGID_MSG_LENGTH_VALUE 0x8 + #define ADDR_SLV_ID_SHIFT 0x10 #define ADDR_OFFSET_SHIFT 0x0 From cbd89e708523a6f72dcc75328ef9307c086f7a5d Mon Sep 17 00:00:00 2001 From: Shivam Sanjay Date: Mon, 31 Aug 2026 20:40:13 +0530 Subject: [PATCH 2/2] plat-qcom: rpmh: use target-specific MSG_RAM_SECTION_SIZE MSG_RAM_SECTION_SIZE was hardcoded to 0x10000 for all targets, but nord's actual AOP section size is 0x1000 (MSG_RAM_DRV_SIZE 0x400 + MSG_RAM_GAP_SIZE 0xC00), causing the wrong offset to be computed. Move MSG_RAM_SECTION_SIZE into a per-flavor header: 0x10000 for kodiak/lemans (unchanged), 0x1000 for nord. Offset is now 15 * MSG_RAM_SECTION_SIZE. Verified on hardware for nord, build verified for all three targets. --- core/drivers/qcom/rpmh/kodiak/rpmh_msgram_config.h | 11 +++++++++++ core/drivers/qcom/rpmh/lemans/rpmh_msgram_config.h | 11 +++++++++++ core/drivers/qcom/rpmh/nord/rpmh_msgram_config.h | 12 ++++++++++++ core/drivers/qcom/rpmh/rpmh_client.c | 4 ++-- core/drivers/qcom/rpmh/sub.mk | 3 +++ 5 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 core/drivers/qcom/rpmh/kodiak/rpmh_msgram_config.h create mode 100644 core/drivers/qcom/rpmh/lemans/rpmh_msgram_config.h create mode 100644 core/drivers/qcom/rpmh/nord/rpmh_msgram_config.h diff --git a/core/drivers/qcom/rpmh/kodiak/rpmh_msgram_config.h b/core/drivers/qcom/rpmh/kodiak/rpmh_msgram_config.h new file mode 100644 index 000000000..6cc71ad80 --- /dev/null +++ b/core/drivers/qcom/rpmh/kodiak/rpmh_msgram_config.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __RPMH_MSGRAM_CONFIG_H__ +#define __RPMH_MSGRAM_CONFIG_H__ + +#define MSG_RAM_SECTION_SIZE 0x10000 + +#endif /* __RPMH_MSGRAM_CONFIG_H__ */ diff --git a/core/drivers/qcom/rpmh/lemans/rpmh_msgram_config.h b/core/drivers/qcom/rpmh/lemans/rpmh_msgram_config.h new file mode 100644 index 000000000..6cc71ad80 --- /dev/null +++ b/core/drivers/qcom/rpmh/lemans/rpmh_msgram_config.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __RPMH_MSGRAM_CONFIG_H__ +#define __RPMH_MSGRAM_CONFIG_H__ + +#define MSG_RAM_SECTION_SIZE 0x10000 + +#endif /* __RPMH_MSGRAM_CONFIG_H__ */ diff --git a/core/drivers/qcom/rpmh/nord/rpmh_msgram_config.h b/core/drivers/qcom/rpmh/nord/rpmh_msgram_config.h new file mode 100644 index 000000000..b44baacc1 --- /dev/null +++ b/core/drivers/qcom/rpmh/nord/rpmh_msgram_config.h @@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: BSD-2-Clause */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __RPMH_MSGRAM_CONFIG_H__ +#define __RPMH_MSGRAM_CONFIG_H__ + +/* AOP message RAM section size: MSG_RAM_DRV_SIZE (0x400) + MSG_RAM_GAP_SIZE (0xC00) */ +#define MSG_RAM_SECTION_SIZE 0x1000 + +#endif /* __RPMH_MSGRAM_CONFIG_H__ */ diff --git a/core/drivers/qcom/rpmh/rpmh_client.c b/core/drivers/qcom/rpmh/rpmh_client.c index e10d73c37..8722ef996 100644 --- a/core/drivers/qcom/rpmh/rpmh_client.c +++ b/core/drivers/qcom/rpmh/rpmh_client.c @@ -22,6 +22,7 @@ #include #include "rpmh_hal.h" +#include "rpmh_msgram_config.h" #include "rpmh_resource_commands.h" #include "rpmh_tcs.h" @@ -66,7 +67,6 @@ struct client_queue { }; #define AOP_BOOT_COOKIE 0xA0C00C1E -#define MSG_RAM_SECTION_SIZE 0x10000 struct aop_msg_ram_dict { uint32_t boot_cookie_offset; @@ -242,7 +242,7 @@ static TEE_Result check_aop_init(void) return TEE_ERROR_GENERIC; } - dict_addr = base + AOP_MSG_RAM_SIZE - MSG_RAM_SECTION_SIZE; + dict_addr = base + 15 * MSG_RAM_SECTION_SIZE; dict = (struct aop_msg_ram_dict *)dict_addr; cookie_addr = base + dict->boot_cookie_offset; diff --git a/core/drivers/qcom/rpmh/sub.mk b/core/drivers/qcom/rpmh/sub.mk index 5152d9c0c..ef6901f3e 100644 --- a/core/drivers/qcom/rpmh/sub.mk +++ b/core/drivers/qcom/rpmh/sub.mk @@ -19,3 +19,6 @@ srcs-y += rpmh_resource_commands.c # DRV configuration srcs-y += rpmh_drv_config.c + +# Per-target rpmh_msgram_config.h (MSG_RAM_SECTION_SIZE) +global-incdirs-y += $(PLATFORM_FLAVOR)