[PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[ye.li]

From: Ye Li <ye.li@nxp.com>

After supporting get DRAM size from SM, the trampoline buffer address
still depends on PHYS_SDRAM_SIZE. If the real DDR size is less than
PHYS_SDRAM_SIZE, the trampoline buffer address is invalid and SPL will
crash. So use board_phys_sdram_size to get real DDR size to calculate
correct address.

Fixes: e1cc7117b630 ("imx9: scmi: Get DDR size through SM SCMI API")
Signed-off-by: Ye Li <ye.li@nxp.com>
---
 arch/arm/mach-imx/imx9/scmi/soc.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/scmi/soc.c
index 00b8693fbe0..ce86cdf8574 100644
--- a/arch/arm/mach-imx/imx9/scmi/soc.c
+++ b/arch/arm/mach-imx/imx9/scmi/soc.c
@@ -1177,10 +1177,11 @@ enum boot_device get_boot_device(void)
 
 bool arch_check_dst_in_secure(void *start, ulong size)
 {
-	ulong ns_end = CFG_SYS_SDRAM_BASE + PHYS_SDRAM_SIZE;
-#ifdef PHYS_SDRAM_2_SIZE
-	ns_end += PHYS_SDRAM_2_SIZE;
-#endif
+	ulong ns_end;
+	phys_size_t dram_size;
+
+	board_phys_sdram_size(&dram_size);
+	ns_end = CFG_SYS_SDRAM_BASE + dram_size;
 
 	if ((ulong)start < CFG_SYS_SDRAM_BASE || (ulong)start + size > ns_end)
 		return true;
@@ -1190,5 +1191,10 @@ bool arch_check_dst_in_secure(void *start, ulong size)
 
 void *arch_get_container_trampoline(void)
 {
-	return (void *)((ulong)CFG_SYS_SDRAM_BASE + PHYS_SDRAM_SIZE - SZ_16M);
+	phys_size_t size;
+
+	board_phys_sdram_size(&size);
+	size = (size > PHYS_SDRAM_SIZE) ? PHYS_SDRAM_SIZE : size;
+
+	return (void *)((ulong)CFG_SYS_SDRAM_BASE + size - SZ_16M);
 }
-- 
2.34.1

[PATCH 2/3] imx9: scmi: Correct shutdown checking

[ye.li]

From: Peng Fan <peng.fan@nxp.com>

The shutdown checking should use shutdown flags, not bootflags.

Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 arch/arm/mach-imx/imx9/scmi/soc.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/scmi/soc.c
index ce86cdf8574..4341a061d08 100644
--- a/arch/arm/mach-imx/imx9/scmi/soc.c
+++ b/arch/arm/mach-imx/imx9/scmi/soc.c
@@ -741,11 +741,11 @@ int get_reset_reason(bool sys, bool lm)
 		}
 		if (out.shutdownflags & MISC_SHUTDOWN_FLAG_VLD) {
 			printf("SYS shutdown reason: %s, origin: %ld, errid: %ld\n",
-			       rst[out.bootflags & MISC_SHUTDOWN_FLAG_REASON],
-			       out.bootflags & MISC_SHUTDOWN_FLAG_ORG_VLD ?
-			       FIELD_GET(MISC_SHUTDOWN_FLAG_ORIGIN, out.bootflags) : -1,
-			       out.bootflags & MISC_SHUTDOWN_FLAG_ERR_VLD ?
-			       FIELD_GET(MISC_SHUTDOWN_FLAG_ERR_ID, out.bootflags) : -1
+			       rst[out.shutdownflags & MISC_SHUTDOWN_FLAG_REASON],
+			       out.shutdownflags & MISC_SHUTDOWN_FLAG_ORG_VLD ?
+			       FIELD_GET(MISC_SHUTDOWN_FLAG_ORIGIN, out.shutdownflags) : -1,
+			       out.shutdownflags & MISC_SHUTDOWN_FLAG_ERR_VLD ?
+			       FIELD_GET(MISC_SHUTDOWN_FLAG_ERR_ID, out.shutdownflags) : -1
 			       );
 		}
 	}
@@ -772,11 +772,11 @@ int get_reset_reason(bool sys, bool lm)
 
 		if (out.shutdownflags & MISC_SHUTDOWN_FLAG_VLD) {
 			printf("LM shutdown reason: %s, origin: %ld, errid: %ld\n",
-			       rst[out.bootflags & MISC_SHUTDOWN_FLAG_REASON],
-			       out.bootflags & MISC_SHUTDOWN_FLAG_ORG_VLD ?
-			       FIELD_GET(MISC_SHUTDOWN_FLAG_ORIGIN, out.bootflags) : -1,
-			       out.bootflags & MISC_SHUTDOWN_FLAG_ERR_VLD ?
-			       FIELD_GET(MISC_SHUTDOWN_FLAG_ERR_ID, out.bootflags) : -1
+			       rst[out.shutdownflags & MISC_SHUTDOWN_FLAG_REASON],
+			       out.shutdownflags & MISC_SHUTDOWN_FLAG_ORG_VLD ?
+			       FIELD_GET(MISC_SHUTDOWN_FLAG_ORIGIN, out.shutdownflags) : -1,
+			       out.shutdownflags & MISC_SHUTDOWN_FLAG_ERR_VLD ?
+			       FIELD_GET(MISC_SHUTDOWN_FLAG_ERR_ID, out.shutdownflags) : -1
 			       );
 		}
 	}
-- 
2.34.1

[PATCH 3/3] imx9: scmi: use 48-bit MAC add instead of incrementing mac[5]

[ye.li]

From: Alice Guo <alice.guo@nxp.com>

Replace mac[5] += offset with a proper 48-bit MAC address add to avoid
overflow issues when mac[5] was close to 255.

Example:
i.MX95 MAC2: 00:11:22:33:44:FE + 6
Old: 00:11:22:33:44:04 (overflow, wraps to 0)
New: 00:11:22:33:45:04 (correct carry from mac[5] to mac[4])

Signed-off-by: Alice Guo <alice.guo@nxp.com>
Signed-off-by: Ye Li <ye.li@nxp.com>
---
 arch/arm/mach-imx/imx9/scmi/soc.c | 39 +++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/scmi/soc.c
index 4341a061d08..5a635ba8433 100644
--- a/arch/arm/mach-imx/imx9/scmi/soc.c
+++ b/arch/arm/mach-imx/imx9/scmi/soc.c
@@ -583,6 +583,35 @@ phys_size_t get_effective_memsize(void)
 	}
 }
 
+static inline u64 ether_addr_to_u64(const u8 *addr)
+{
+	u64 u = 0;
+	int i;
+
+	for (i = 0; i < 6; i++)
+		u = u << 8 | addr[i];
+
+	return u;
+}
+
+static inline void u64_to_ether_addr(u64 u, u8 *addr)
+{
+	int i;
+
+	for (i = 6 - 1; i >= 0; i--) {
+		addr[i] = u & 0xff;
+		u = u >> 8;
+	}
+}
+
+static inline void eth_addr_add(u8 *addr, long offset)
+{
+	u64 u = ether_addr_to_u64(addr);
+
+	u += offset;
+	u64_to_ether_addr(u, addr);
+}
+
 void imx_get_mac_from_fuse(int dev_id, unsigned char *mac)
 {
 	u32 val[2] = {};
@@ -627,16 +656,16 @@ void imx_get_mac_from_fuse(int dev_id, unsigned char *mac)
 		 * | 10     | netc switch | swp2                      |
 		 */
 		if (dev_id == 0)
-			mac[5] = mac[5] + 2; /* enetc3 mac/swp0 */
+			eth_addr_add(mac, 2); /* enetc3 mac/swp0 */
 		if (dev_id == 1)
-			mac[5] = mac[5] + 8; /* enetc1 */
+			eth_addr_add(mac, 8); /* enetc1 */
 		if (dev_id == 2)
-			mac[5] = mac[5] + 9; /* enetc2 */
+			eth_addr_add(mac, 9); /* enetc2 */
 	} else {
 		if (dev_id == 1)
-			mac[5] = mac[5] + 3;
+			eth_addr_add(mac, 3);
 		if (dev_id == 2)
-			mac[5] = mac[5] + 6;
+			eth_addr_add(mac, 6);
 	}
 
 	debug("%s: MAC%d: %pM\n", __func__, dev_id, mac);
-- 
2.34.1

Re: [PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[Peng Fan]

On Thu, Jun 18, 2026 at 09:17:47AM +0800, ye.li@oss.nxp.com wrote:
>From: Ye Li <ye.li@nxp.com>
>
>After supporting get DRAM size from SM, the trampoline buffer address
>still depends on PHYS_SDRAM_SIZE. If the real DDR size is less than
>PHYS_SDRAM_SIZE, the trampoline buffer address is invalid and SPL will
>crash. So use board_phys_sdram_size to get real DDR size to calculate
>correct address.
>
>Fixes: e1cc7117b630 ("imx9: scmi: Get DDR size through SM SCMI API")
>Signed-off-by: Ye Li <ye.li@nxp.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

Re: [PATCH 3/3] imx9: scmi: use 48-bit MAC add instead of incrementing mac[5]

[Peng Fan]

On Thu, Jun 18, 2026 at 09:17:49AM +0800, ye.li@oss.nxp.com wrote:
>From: Alice Guo <alice.guo@nxp.com>
>
>Replace mac[5] += offset with a proper 48-bit MAC address add to avoid
>overflow issues when mac[5] was close to 255.
>
>Example:
>i.MX95 MAC2: 00:11:22:33:44:FE + 6
>Old: 00:11:22:33:44:04 (overflow, wraps to 0)
>New: 00:11:22:33:45:04 (correct carry from mac[5] to mac[4])
>
>Signed-off-by: Alice Guo <alice.guo@nxp.com>
>Signed-off-by: Ye Li <ye.li@nxp.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

Re: [PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[Francesco Dolcini]

+ Emanuele

On Thu, Jun 18, 2026 at 09:17:47AM +0800, ye.li@oss.nxp.com wrote:
> From: Ye Li <ye.li@nxp.com>
> 
> After supporting get DRAM size from SM, the trampoline buffer address
> still depends on PHYS_SDRAM_SIZE. If the real DDR size is less than
> PHYS_SDRAM_SIZE, the trampoline buffer address is invalid and SPL will
> crash. So use board_phys_sdram_size to get real DDR size to calculate
> correct address.
> 
> Fixes: e1cc7117b630 ("imx9: scmi: Get DDR size through SM SCMI API")
> Signed-off-by: Ye Li <ye.li@nxp.com>
> ---
>  arch/arm/mach-imx/imx9/scmi/soc.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/scmi/soc.c
> index 00b8693fbe0..ce86cdf8574 100644
> --- a/arch/arm/mach-imx/imx9/scmi/soc.c
> +++ b/arch/arm/mach-imx/imx9/scmi/soc.c
> @@ -1177,10 +1177,11 @@ enum boot_device get_boot_device(void)
>  
>  bool arch_check_dst_in_secure(void *start, ulong size)
>  {
> -	ulong ns_end = CFG_SYS_SDRAM_BASE + PHYS_SDRAM_SIZE;
> -#ifdef PHYS_SDRAM_2_SIZE
> -	ns_end += PHYS_SDRAM_2_SIZE;
> -#endif
> +	ulong ns_end;
> +	phys_size_t dram_size;
> +
> +	board_phys_sdram_size(&dram_size);

Emanuele: does this change has any impact on the memory size detection we have
implemented in our i.MX95 based boards?

Peng: board_phys_sdram_size() in board/toradex/verdin-imx95/verdin-imx95.c

Francesco

Re: [PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[Ye Li]

On 6/18/2026 3:00 PM, Francesco Dolcini wrote:
> + Emanuele
> 
> On Thu, Jun 18, 2026 at 09:17:47AM +0800, ye.li@oss.nxp.com wrote:
>> From: Ye Li <ye.li@nxp.com>
>>
>> After supporting get DRAM size from SM, the trampoline buffer address
>> still depends on PHYS_SDRAM_SIZE. If the real DDR size is less than
>> PHYS_SDRAM_SIZE, the trampoline buffer address is invalid and SPL will
>> crash. So use board_phys_sdram_size to get real DDR size to calculate
>> correct address.
>>
>> Fixes: e1cc7117b630 ("imx9: scmi: Get DDR size through SM SCMI API")
>> Signed-off-by: Ye Li <ye.li@nxp.com>
>> ---
>>   arch/arm/mach-imx/imx9/scmi/soc.c | 16 +++++++++++-----
>>   1 file changed, 11 insertions(+), 5 deletions(-)
>>
>> diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/scmi/soc.c
>> index 00b8693fbe0..ce86cdf8574 100644
>> --- a/arch/arm/mach-imx/imx9/scmi/soc.c
>> +++ b/arch/arm/mach-imx/imx9/scmi/soc.c
>> @@ -1177,10 +1177,11 @@ enum boot_device get_boot_device(void)
>>   
>>   bool arch_check_dst_in_secure(void *start, ulong size)
>>   {
>> -	ulong ns_end = CFG_SYS_SDRAM_BASE + PHYS_SDRAM_SIZE;
>> -#ifdef PHYS_SDRAM_2_SIZE
>> -	ns_end += PHYS_SDRAM_2_SIZE;
>> -#endif
>> +	ulong ns_end;
>> +	phys_size_t dram_size;
>> +
>> +	board_phys_sdram_size(&dram_size);
> 
> Emanuele: does this change has any impact on the memory size detection we have
> implemented in our i.MX95 based boards?
> 
> Peng: board_phys_sdram_size() in board/toradex/verdin-imx95/verdin-imx95.c
> 
It won't have impact on the memory size detection. It uses the output of 
memory size detection for selection correct address for trampoline buffer.
Previously trampoline buffer uses PHYS_SDRAM_SIZE which is defined as 
2GB - 256MB, if the real DDR size detected at runtime is less than 
PHYS_SDRAM_SIZE (for example 1GB), this buffer address is invalid.

Best regards,
Ye Li

> Francesco
> 

Re: [PATCH 1/3] imx9: scmi: Fix SPL trampoline buffer for 1GB DDR

[Emanuele Ghidoli]

On 6/18/26 10:14, Ye Li wrote:
> 
> 
> On 6/18/2026 3:00 PM, Francesco Dolcini wrote:
>> + Emanuele
>>
>> On Thu, Jun 18, 2026 at 09:17:47AM +0800, ye.li@oss.nxp.com wrote:
>>> From: Ye Li <ye.li@nxp.com>
>>>
>>> After supporting get DRAM size from SM, the trampoline buffer address
>>> still depends on PHYS_SDRAM_SIZE. If the real DDR size is less than
>>> PHYS_SDRAM_SIZE, the trampoline buffer address is invalid and SPL will
>>> crash. So use board_phys_sdram_size to get real DDR size to calculate
>>> correct address.
>>>
>>> Fixes: e1cc7117b630 ("imx9: scmi: Get DDR size through SM SCMI API")
>>> Signed-off-by: Ye Li <ye.li@nxp.com>
>>> ---
>>>   arch/arm/mach-imx/imx9/scmi/soc.c | 16 +++++++++++-----
>>>   1 file changed, 11 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/arch/arm/mach-imx/imx9/scmi/soc.c b/arch/arm/mach-imx/imx9/
>>> scmi/soc.c
>>> index 00b8693fbe0..ce86cdf8574 100644
>>> --- a/arch/arm/mach-imx/imx9/scmi/soc.c
>>> +++ b/arch/arm/mach-imx/imx9/scmi/soc.c
>>> @@ -1177,10 +1177,11 @@ enum boot_device get_boot_device(void)
>>>     bool arch_check_dst_in_secure(void *start, ulong size)
>>>   {
>>> -    ulong ns_end = CFG_SYS_SDRAM_BASE + PHYS_SDRAM_SIZE;
>>> -#ifdef PHYS_SDRAM_2_SIZE
>>> -    ns_end += PHYS_SDRAM_2_SIZE;
>>> -#endif
>>> +    ulong ns_end;
>>> +    phys_size_t dram_size;
>>> +
>>> +    board_phys_sdram_size(&dram_size);
>>
>> Emanuele: does this change has any impact on the memory size detection we have
>> implemented in our i.MX95 based boards?
>>
>> Peng: board_phys_sdram_size() in board/toradex/verdin-imx95/verdin-imx95.c
>>
> It won't have impact on the memory size detection. It uses the output of
> memory size detection for selection correct address for trampoline buffer.
> Previously trampoline buffer uses PHYS_SDRAM_SIZE which is defined as 2GB -
> 256MB, if the real DDR size detected at runtime is less than PHYS_SDRAM_SIZE
> (for example 1GB), this buffer address is invalid.
> 
> Best regards,
> Ye Li
> 
>> Francesco
>>
> 

While it is not obvious that board_phys_sdram_size() is safe in all contexts,
it can be called here without side effects.

Tested-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>