imx95_m7: do not issue D-cache clean by address while the cache is disabled

Author: dgarske

config/examples/imx95-m7.config

@@ -3,6 +3,18 @@ TARGET?=imx95_m7
 SIGN?=ECC256
 HASH?=SHA256
 DEBUG?=0
+# Per-step timing in ms, from the DWT cycle counter. DEBUG_HARDFAULT is
+# required alongside it on this target, and not for debugging: BOOT_BENCHMARK
+# on its own produces an image that panics before its first console write,
+# deterministically (3 of 3 cold boots), and enabling the fault handler makes
+# the fault stop happening. It is not image size - padding the failing build to
+# the working build's exact byte size still panics - and hal_init codegen is
+# identical between the two, so the trigger is layout-sensitive and not yet
+# root-caused. hal_status() independently stamps DWT_CYCCNT into the status
+# block at hal_init and at hal_prepare_boot, so the total verified-boot time is
+# readable even with both of these off.
+BOOT_BENCHMARK?=1
+CFLAGS_EXTRA+=-DDEBUG_HARDFAULT
 VTOR?=1
 CORTEX_M0?=0
 NO_ASM?=0

hal/imx95_m7.c

@@ -303,6 +303,17 @@ void hal_init(void)
     hal_status(HAL_STATUS_INIT);
 }
 
+#if defined(WOLFBOOT_UPDATE_DISK) || defined(BOOT_BENCHMARK)
+/* Microseconds from the DWT cycle counter hal_init() starts. The counter is
+ * 32-bit and wraps about every 5.4 s at 800 MHz, which bounds any single
+ * measurement rather than the boot as a whole - each BENCHMARK_END subtracts
+ * two reads, so a wrap only matters for an interval longer than that. */
+uint64_t hal_get_timer_us(void)
+{
+    return (uint64_t)DWT_CYCCNT / (IMX95_M7_CORE_HZ / 1000000UL);
+}
+#endif
+
 void hal_prepare_boot(void)
 {
     hal_status(HAL_STATUS_PREBOOT);

hal/imx95_m7.h

@@ -115,6 +115,14 @@ static inline void imx95_dcache_clean(const void *addr, uint32_t len)
 
     if (len == 0)
         return;
+    /* Nothing to clean while the cache is off - every store already reached
+     * memory. It is also unsafe: the M7 does maintenance by address even with
+     * the cache disabled, and out of a cold reset the cache RAMs hold random
+     * tags and dirty bits until hal_cache_enable() invalidates them, so a hit
+     * writes garbage to a random address and the bus error comes back as an
+     * imprecise BusFault. */
+    if ((SCB_CCR & CCR_DC) == 0UL)
+        return;
     line = ((uint32_t)(uintptr_t)addr) & ~(IMX95_CACHE_LINE - 1UL);
     end = (uint32_t)(uintptr_t)addr + len;
     for (; line < end; line += IMX95_CACHE_LINE) {
@@ -147,6 +155,12 @@ static inline void imx95_dwt_init(void)
     DWT_CTRL |= DWT_CYCCNTENA;
 }
 
+/* The M7 core clock on this part. Only used to turn cycle counts into
+ * milliseconds for the boot benchmark; override for a different clock. */
+#ifndef IMX95_M7_CORE_HZ
+#define IMX95_M7_CORE_HZ 800000000UL
+#endif
+
 /* Bounded spin. Wrap-safe for any delay shorter than a full 32-bit period
  * (~5.4 s at 800 MHz) because the comparison is done on the difference. */
 static inline void imx95_delay_cycles(uint32_t cycles)