GitLab

Adds a 1us delay after enabling power to a CPU core, to prevent
inrush-caused CPU crash before it's up.

Change-Id: I8f4c1b0dc0d1d976b31ddc30efe7a77a1619b1b3
Signed-off-by: Icenowy Zheng <icenowy@sipeed.com>

Group the SCP base/size definitions in a more logical location.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Id43f9b468d7d855a2413173d674a5ee666527808

BL31 does not appear to ever access the DRAM allocated to BL32,
so there is no need to map it at EL3.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Ie8727b793e53ea14517894942266f6da0333eb74

The SRAM on Allwinner platforms is shared between BL31 and coprocessor
firmware. Previously, SRAM was mapped as normal memory by default.
This scheme requires carveouts and cache maintenance code for proper
synchronization with the coprocessor.

A better scheme is to only map pages owned by BL31 as normal memory,
and leave everything else as device memory. This removes the need for
cache maintenance, and it makes the mapping for BL31 RW data explicit
instead of magic.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I820ddeba2dfa2396361c2322308c0db51b55c348

This constant specifically refers to the number of static mmap regions.
Rename it to make that clear.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I475c037777ce2a10db2631ec0e7446bb73590a36

When the BL31 for the Allwinner H616 runs in DRAM, we need to make sure
we tell the non-secure world about the memory region it uses.

Add a reserved-memory node to the DT, which covers the area that BL31
could occupy. The "no-map" property will prevent OSes from mapping
the area, so there would be no speculative accesses.

Change-Id: I808f3e1a8089da53bbe4fc6435a808e9159831e1
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The new Allwinner H616 SoC lacks the management controller and the secure
SRAM A2, so we need to tweak the memory map quite substantially:
We run BL31 in DRAM. Since the DRAM starts at 1GB, we cannot use our
compressed virtual address space (max 256MB) anymore, so we revert to
the full 32bit VA space and use a flat mapping throughout all of it.

The missing controller also means we need to always use the native PSCI
ops, using the CPUIDLE hardware, as SCPI and suspend depend on the ARISC.

Change-Id: I77169b452cb7f5dc2ef734f3fc6e5d931749141d
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

Change-Id: I557fd05401e24204952135cf3ca26479a43ad1f1
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

In preparation for changing the memory map, express the locations of the
various code and data pieces more dynamically, allowing SoCs to override
the memmap later.
Also prepare for the SCP region to become optional.

No functional change.

Change-Id: I7ac01e309be2f23bde2ac2050d8d5b5e3d6efea2
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The code to power the current core off when SCPI is not available is now
different for the two supported SoC families.
To make adding new platforms easier, move sunxi_cpu_power_off_self()
into the SoC directory, so we don't need to carry definitions for both
methods for all SoCs.

On the H6 we just need to trigger the CPUIDLE hardware, so can get rid
of all the code to program the ARISC, which is now only needed for the
A64 version.

Change-Id: Id2a1ac7dcb375e2fd021b441575ce86b4d7edf2c
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

For the existing SoCs we support, we use SEPARATE_NOBITS_REGION, to move
some parts of the data into separate memory regions (to save on the SRAM
A2 we are loaded into).
For the upcoming H616 platform this is of no concern (we run in DRAM),
so make this flag a platform choice instead.

Change-Id: Ic01d49578c6274660f8f112bd23680d3eca3be7a
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The upcoming refactoring to support the new H616 SoCs will push the A64
build over the edge, by using more than the 48KB of SRAM available.

To reduce the code size, set some libfdt options that aim to reduce
sanity checks (for saving code space):
- ASSUME_LATEST: only allow v17 DTBs (as created by dtc)
- ASSUME_NO_ROLLBACK: don't prepare for failed DT additions
- ASSUME_LIBFDT_ORDER: assume sane ordering, as done by dtc

Change-Id: I12c93ec09e7587c5ae71e54947f817c32ce5fd6d
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

This works even on SoCs that do not have an ARISC, and it avoids
clobbering whatever ARISC firmware might be running.

Change-Id: I9f2fed597189bb387de79e8e76a7da3375e1ee91
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

Now that we have split the native and the SCPI version of the PSCI ops,
we can introduce build options to compile in either or both of them.

If one version is not compiled in, some stub functions make sure the
common code still compiles and makes the right decisions.

By default both version are enabled (as before), but one of them can be
disabled on the make command line, or via a platform specific Makefile.

Change-Id: I0c019d8700c0208365eacf57809fb8bc608eb9c0
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Samuel Holland <samuel@sholland.org>

In order to keep SCP firmware as optional, the original, limited native
PSCI implementation was kept around as a fallback. This turned out to be
a good decision, as some newer SoCs omit the ARISC, and thus cannot run
SCP firmware.

However, keeping the two implementations in one file makes things
unnecessarily messy. First, it is difficult to compile out the
SCPI-based implementation where it is not applicable. Second the check
is done in each callback, while scpi_available is only updated at boot.
This makes the individual callbacks unnecessarily complicated.

It is cleaner to provide two entirely separate implementations in two
separate files. The native implementation does not support any kind of
CPU suspend, so its callbacks are greatly simplified. One function,
sunxi_validate_ns_entrypoint, is shared between the two implementations.

Finally, the logic for choosing between implementations is kept in a
third file, to provide for platforms where only one implementation is
applicable and the other is compiled out.

Change-Id: I4914f07d8e693dbce218e0e2394bef15c42945f8
Signed-off-by: Samuel Holland <samuel@sholland.org>

- When the SCPI shutdown/reset command returns success, the SCP is
  still waiting for the CPU to enter WFI. Do that.
- Peform board-level poweroff before CPU poweroff. If there is a PMIC
  available, it will turn everything off including the CPUs, so doing
  CPU poweroff first is a waste of cycles.
- During poweroff, attempt to turn off the local CPU using the ARISC.
  This should use slightly less power than just an infinite WFI.
- Drop the WFI in the reset failure path. The panic will hang anyway.

Change-Id: I897efecb3fe4e77a56041b97dd273156ec51ef8e
Signed-off-by: Samuel Holland <samuel@sholland.org>

When operating on the local cpu, sunxi_cpu_power_off_self() only "arms"
the ARISC to perform the power-off process; the SCP waits for the CPU to
enter WFI before acutally powering it off. Since this matches the
expected split between .pwr_domain_off and .pwr_domain_pwr_down_wfi, we
can move the sunxi_cpu_power_off_self() call to sunxi_pwr_domain_off().
Since that change makes sunxi_pwr_down_wfi() equivalent to the default
implementation, the callback is no longer needed.

Change-Id: I7d65f66c550d1c69fa5e9945affd7a25b3d3ef42
Signed-off-by: Samuel Holland <samuel@sholland.org>

Currently, sunxi_cpu_off() has two separate code paths: one for the
local CPU, and one for other CPUs. Let's split them in to two functions.
This actually simplifies things, because all callers either operate on
the local CPU only (sunxi_pwr_down_wfi()) or other CPUs only
(sunxi_cpu_power_off_others()). This avoids needing a second MPIDR read
to choose the appropriate code path.

Change-Id: I55de85025235cc95466bfa106831fc4c2368f527
Signed-off-by: Samuel Holland <samuel@sholland.org>

Disabling secondary CPUs during boot is unnecessary because the other
CPUs are already in reset, and it saves an entirely insignificant amount
of power. Let's remove this bit of code that was added mostly "because
we can", and along with it remove an unconditional dependency on the CPU
ops functions.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Ia77a1b722da6ba989c3992b656a6cde3f2238fd7

Checking the exceptional case and letting the success case fall through
is not only more idiomatic, but it also allows adding more exceptional
cases in the future, such as a check for overlapping secure DRAM.

Change-Id: I720441a6a8853fd7f211ebe851f14d921a6db03d
Signed-off-by: Samuel Holland <samuel@sholland.org>

This duplicated the logic in psci_validate_mpidr() which was already
called from psci_cpu_on().

Change-Id: I96ee92f1ce3e9cc2985b4e229ba86ebd27b79915
Signed-off-by: Samuel Holland <samuel@sholland.org>

This optional PSCI function was only implemented when SCPI was
available. However, the underlying SCPI function is not able to fulfill
the necessary contract. First, the SCPI protocol has no way to represent
HW_STANDBY at the CPU power level. Second, the SCPI implementation
maintains its own logical view of power states, and its implementation
of SCPI_CMD_GET_CSS_POWER_STATE does not actually query the hardware.
Thus it cannot provide "the physical view of power state", as required
for this function by the PSCI specification.

Since the function is optional, drop it.

Change-Id: I5f3a0810ac19ddeb3c0c5d35aeb09f09a0b80c1d
Signed-off-by: Samuel Holland <samuel@sholland.org>

RSB is faster and more efficient, and it has a simpler driver. As long
as the PMIC is returned to I2C mode after use, the rich OS can later use
either bus.

Change-Id: I0c5f32e88a090c8c5cccb81bd24596b301ab9da7
Signed-off-by: Samuel Holland <samuel@sholland.org>

This gives the rich OS the flexibility to choose between I2C and RSB
communication. Since a runtime address can only be assigned once after
entering RSB mode, it also lets the rich OS choose any runtime address.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Id49c124c5e925985fc31c0ba38c7fb6c941aafa8

None of the other drivers (Linux, U-Boot, Crust) need to lower the bus
clock frequency to switch the PMIC to RSB mode. That logic is not needed
here, either. The hardware takes care of running this transaction at the
correct bus frequency.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Idcfe933df4da75d5fd5a4f3e362da40ac26bdad1

BL31 reports the following warning during boot:

  WARNING: BL31: cortex_a53: CPU workaround for 1530924 was missing!

Resolve this by enabling the workaround on the affected platforms.

Change-Id: Ia1d5075370be5ae67b7bece96ec0069d9692b14c
Signed-off-by: Samuel Holland <samuel@sholland.org>

While the Allwinner platform code nominally supported a custom
PRELOADED_BL33_BASE, some references to the BL33 load address used
another constant: PLAT_SUNXI_NS_IMAGE_OFFSET. To allow the DTB search
code to work if a U-Boot BL33 is loaded to a custom address,
consistently use PRELOADED_BL33_BASE. And to avoid this confusion in
the future, remove the other constant.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Ie6b97ae1fdec95d784676aef39200bef161471b0

The H6 has a "secure port controller" similar to the A64/H5, but with
more ports and a different register layout. Split the platform-specific
parts out into a header, and add the missing MMIO base address.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I3703868bc595459ecf9568b9d1605cb1be014bf5

H6 has a reorganized R_PRCM compared to A64/H5, with the security switch
at a different offset. Until now, we did not notice, because the switch
has no effect unless the secure mode e-fuse is blown.

Since we are adding more platform-specific CCU registers, move them to
their own header, and out of the memory map (where they do not belong).
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Ie77476db0515080954eaa2e32bf6c3de657cda86

Compiling BL31 for the Allwinner platform now produces a message about
the deprecation of gic_common.c.
Follow the advice and use include gicv2.mk instead.

Collect all includes at the beginning of the file on the way.

Change-Id: Iee46e21a630bfa831d28059f09aa7b049eb554bb
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The non-secure world has no business accessing the CPU power switches in
the PRCM; those are handled by TF-A or the SCP. Only allow access to the
clock control part of the PRCM.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I657b97f4ea8a0073448ad3343fbc66ba168ed89e

The base address for both the GPIO and the clock unit of the H6 memory map
have been typo-ed. Fix them to match the Linux DT and the manual.

The H6 code use neither of them, so this doesn't change or fix anything
in the real world, but should be corrected anyway.

The issue was found and reported by Github user "armlabs".

Change-Id: Ic6fdfb732ce1cfc54cbb927718035624a06a9e08
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

Since now the generic console_t structure holds the UART base address as
well, let's use that generic location and drop the UART driver specific
data structure at all.

Change-Id: I5c2fe3b6a667acf80c808cfec4a64059a2c9c25f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

If an SCP firmware is present and able to communicate via SCPI, then use
that to implement CPU and system power state transitions, including CPU
hotplug and system suspend. Otherwise, fall back to the existing CPU
power control implementation.

The last 16 KiB of SRAM A2 are reserved for the SCP firmware, and the
SCPI shared memory is at the very end of this region (and therefore the
end of SRAM A2). BL31 continues to start at the beginning of SRAM A2
(not counting the ARISC exception vector area) and fills up to the
beginning of the SCP firmware.

Because the SCP firmware is not loaded adjacent to the ARISC exception
vector area, the jump instructions used for exception handling cannot be
included in the SCP firmware image, and must be initialized here before
turning on the SCP.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I37b9b9636f94d4125230423726f3ac5e9cdb551c

The function names follow the naming convention used by the existing
ARM SCPI client.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I543bae7d46e206eb405dbedfcf7aeba88a12ca48

The SCP firmware is allocated the last 16KiB of SRAM A2. This includes
the SCPI shared memory area, which must be mapped as MT_DEVICE to
prevent problems with cache coherency between the AP CPUs and the SCP.
For simplicity, map the whole SCP region as MT_DEVICE.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Ie39eb5ff281b8898a3c1d9748dc08755f528e2f8

The ARISC vector area consists of 0x4000 bytes before the beginning of
usable SRAM. Still, it is technically a part of SRAM A2, so include it
in the memory definition. This avoids the confusing practice of
subtracting from the beginning of the SRAM region when referencing the
ARISC vectors.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: Iae89e01aeab93560159562692e03e88306e2a1bf

PLATFORM_CORE_COUNT - Unsigned int
PLATFORM_CLUSTER_COUNT - Unsigned int
PLATFORM_MAX_CPUS_PER_CLUSTER - Unsigned int
PLATFORM_CORE_COUNT_PER_CLUSTER - Unsigned int
Signed-off-by: Deepika Bhavnani <deepika.bhavnani@arm.com>
Change-Id: I7aea86891e54522c88af5ff16795a575f9a9322d

Remove the general BL31 mmap region: it duplicates the existing static
mapping for the entire SRAM region. Use the helper definitions when
applicable to simplify the code and add the MT_EXECUTE_NEVER flag.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I7a6b79e50e4b5c698774229530dd3d2a89e94a6d

Now that there is plenty of space (32 KiB) available for NOBITS
sections, we can afford using an entire page for coherent memory. In
fact, because it simplifies the code, this is a beneficial change for
loaded image (.text) size, where we are still close to the size limit.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I0b899dabcb162015c63b0e4aed0869569c889ed9