sunxi: FEL boot mode improvements

The Allwinner SoCs support a special FEL boot mode, which can be activated by users via a button press (or other means). In the FEL mode, the BROM implements a custom FEL protocol over USB, which allows to upload code to the device and run it. This protocol had been reverse engineered and documented by Henrik Nordstr?m:

     http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

Because the BROM code is using some parts of the SRAM for itself, only a few areas are available for use in u-boot. Currently the SPL is loaded into the "0x2000-0x5cff Free for program use" area and the stack pointer is at the end of this area. This is barely enough to fit just the current SPL and leaves almost no headroom for the future code.

This patch enables the use of a more compact Thumb2 mode for compiling the FEL SPL binary. And also relocates the stack to another "0x8000-0xbfff Free for program use" area. Additionally, the BSS segment is cleared.

Signed-off-by Siarhei Siamashka <[email protected]>

---
  arch/arm/cpu/armv7/sunxi/Makefile           |  1 +
  arch/arm/cpu/armv7/sunxi/start_fel.S        | 42 +++++++++++++++++++++++++++++
  arch/arm/cpu/armv7/sunxi/u-boot-spl-fel.lds |  4 +--
  include/configs/sunxi-common.h              |  2 --
  4 files changed, 45 insertions(+), 4 deletions(-)

create mode 100644 arch/arm/cpu/armv7/sunxi/start_fel.S

arch/arm/cpu/armv7/sunxi/Makefile +1 -0

index a64bfa1..b3eff98 100644
@@ -21,5 +21,6 @@ ifdef CONFIG_SPL_BUILD
  obj-$(CONFIG_SUN7I)	+= dram.o
  ifdef CONFIG_SPL_FEL
  obj-y	+= start.o
+extra-y += start_fel.o
  endif
  endif

arch/arm/cpu/armv7/sunxi/start_fel.S new file +42 -0

new file mode 100644
index 0000000..2789fd9
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2014 Siarhei Siamashka <[email protected]>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+.syntax unified
+.text
+.arm
+.arch armv7a
+.p2align 2
+
+.globl _start_fel
+.globl s_init
+.globl __bss_start
+.globl __bss_end
+
+_start_fel:
+	/* Relocate stack to the 0x8000-0xBFFF area */
+	mov	r0, #0xC000
+	str	sp, [r0, #-4]!
+	str	lr, [r0, #-4]!
+	adr	lr, _exit_fel /* Return back to '_exit_fel' */
+	mov	sp, r0
+
+	/* Erase the BSS segment */
+	ldr	r0, =__bss_start
+	ldr	r1, =__bss_end
+	mov	r2, #0
+0:	cmp	r0, r1
+	strbne	r2, [r0], #1
+	bne	0b
+
+	/* Pass control to the 's_init()' function */
+	b	s_init
+
+_exit_fel:
+	/* Relocate stack back and return */
+	mov	r0, #0xC000
+	ldr	sp, [r0, #-4]!
+	ldr	lr, [r0, #-4]!
+	bx	lr

arch/arm/cpu/armv7/sunxi/u-boot-spl-fel.lds +2 -2

index 364e35c..418c2fc 100644
@@ -6,7 +6,7 @@
   */
  OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
  OUTPUT_ARCH(arm)
-ENTRY(s_init)
+ENTRY(_start_fel)
  SECTIONS
  {
  	. = 0x00002000;

@@ -14,7 +14,7 @@ SECTIONS
  	. = ALIGN(4);
  	.text :
  	{
-		*(.text.s_init)
+		arch/arm/cpu/armv7/sunxi/start_fel.o	(.text)
  		*(.text*)
  	}
 

include/configs/sunxi-common.h +0 -2

index 5d72d62..4b980e9 100644
@@ -18,10 +18,8 @@
   */
  #define CONFIG_SUNXI		/* sunxi family */
  #ifdef CONFIG_SPL_BUILD
-#ifndef CONFIG_SPL_FEL
  #define CONFIG_SYS_THUMB_BUILD	/* Thumbs mode to save space in SPL */
  #endif
-#endif
 
  #include <asm/arch/cpu.h>	/* get chip and board defs */
 

http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

+.syntax unified
+.text
+.arm
+.arch armv7a
+.p2align 2
+
+.globl _start_fel

+.globl s_init
+.globl __bss_start
+.globl __bss_end

Quoted 2 lines · Siarhei Siamashka

http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

I think a better reference is
https://github.com/hno/Allwinner-Info/blob/master/FEL-usb/USB-protocol.txt

Quoted 7 lines

+.syntax unified
+.text
+.arm
+.arch armv7a
+.p2align 2
+
+.globl _start_fel

Is there any reason not to use ENTRY() for this?

Quoted 3 lines

+.globl s_init
+.globl __bss_start
+.globl __bss_end

I don't think you need .globl to access external symbols, all .globl does is control the visibility of things defined in this file. IOW you can drop all 3 of these AFAICT.

[...]

arch/arm/cpu/armv7/sunxi/start_fel.S line 35

Quoted 2 lines

arch/arm/cpu/armv7/sunxi/start_fel.S new file +2 -0

+	/* Pass control to the 's_init()' function */
+	b	s_init

Since this code is in arm mode and s_init will, I think, be in Thumb mode after this patch shouldn't this be a bx?

Quoted 3 lines · On Mon, 21 Jul 2014 19:31:45 +0100 Ian Campbell <[email protected]> wrote:

Quoted 1 line · Siarhei Siamashka

Quoted 4 lines

Quoted 1 line

http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

I think a better reference is
https://github.com/hno/Allwinner-Info/blob/master/FEL-usb/USB-protocol.txt

Yes, very likely. Except that I'm a little bit concerned about the long term availability of this link (which is a personal repository on github).

Hi,

Quoted 8 lines · Siarhei Siamashka

Quoted 5 lines · On Mon, 21 Jul 2014 19:31:45 +0100 Ian Campbell <[email protected]> wrote:

Quoted 2 lines · Siarhei Siamashka

http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

Quoted 6 lines

Quoted 2 lines

I think a better reference is
https://github.com/hno/Allwinner-Info/blob/master/FEL-usb/USB-protocol.txt

Yes, very likely. Except that I'm a little bit concerned about the long term availability of this link (which is a personal repository on github).

Stupid question: why isn't this on the wiki?

Quoted 7 lines · On Mon, 21 Jul 2014 19:31:45 +0100 Ian Campbell <[email protected]> wrote:

Quoted 2 lines · Siarhei Siamashka

http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

I think a better reference is
https://github.com/hno/Allwinner-Info/blob/master/FEL-usb/USB-protocol.txt

Yes, very likely. Except that I'm a little bit concerned about the long term availability of this link (which is a personal repository on github).

I have quoted the relevant parts of the memory map information in the commit message. But now I wonder if we should replicate the Allwinner FEL mode memory map information somewhere in the u-boot documentation?

Quoted 6 lines

[...]

arch/arm/cpu/armv7/sunxi/start_fel.S line 35

Quoted 2 lines

arch/arm/cpu/armv7/sunxi/start_fel.S new file +2 -0

+	/* Pass control to the 's_init()' function */
+	b	s_init

Since this code is in arm mode and s_init will, I think, be in Thumb mode after this patch shouldn't this be a bx?

Since this branch instruction refers to an external symbol, the linker has all the necessary information and takes care of handling Thumb interworking whenever it is necessary.

The Allwinner SoCs support a special FEL boot mode, which can be activated by users via a button press (or other means). In the FEL mode, the BROM implements a custom FEL protocol over USB, which allows to upload code to the device and run it. This protocol had been reverse engineered and documented by Henrik Nordstr?m:

    http://lists.phcomp.co.uk/pipermail/arm-netbook/2012-June/004341.html

Because the BROM code is using some parts of the SRAM for itself, only a few areas are available for use in u-boot. Currently the SPL is loaded into the "0x2000-0x5cff Free for program use" area and the stack pointer is at the end of this area. This is barely enough to fit just the current SPL and leaves almost no headroom for the future code.

This patch enables the use of a more compact Thumb2 mode for compiling the FEL SPL binary. And also relocates the stack to another "0x8000-0xbfff Free for program use" area.

Additionally, the BSS segment is cleared.

Signed-off-by Siarhei Siamashka <[email protected]>

---
 arch/arm/cpu/armv7/sunxi/Makefile           |  1 +
 arch/arm/cpu/armv7/sunxi/start_fel.S        | 42 +++++++++++++++++++++++++++++
 arch/arm/cpu/armv7/sunxi/u-boot-spl-fel.lds |  4 +--
 include/configs/sunxi-common.h              |  2 --
 4 files changed, 45 insertions(+), 4 deletions(-)
 create mode 100644 arch/arm/cpu/armv7/sunxi/start_fel.S

arch/arm/cpu/armv7/sunxi/Makefile +1 -0

index a64bfa1..b3eff98 100644
@@ -21,5 +21,6 @@ ifdef CONFIG_SPL_BUILD
 obj-$(CONFIG_SUN7I)	+= dram.o
 ifdef CONFIG_SPL_FEL
 obj-y	+= start.o
+extra-y += start_fel.o
 endif
 endif

arch/arm/cpu/armv7/sunxi/start_fel.S new file +42 -0

new file mode 100644
index 0000000..2789fd9
@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2014 Siarhei Siamashka <[email protected]>
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+.syntax unified
+.text
+.arm
+.arch armv7a
+.p2align 2
+
+.globl _start_fel
+.globl s_init
+.globl __bss_start
+.globl __bss_end
+
+_start_fel:
+	/* Relocate stack to the 0x8000-0xBFFF area */
+	mov	r0, #0xC000
+	str	sp, [r0, #-4]!
+	str	lr, [r0, #-4]!
+	adr	lr, _exit_fel /* Return back to '_exit_fel' */
+	mov	sp, r0
+
+	/* Erase the BSS segment */
+	ldr	r0, =__bss_start
+	ldr	r1, =__bss_end
+	mov	r2, #0
+0:	cmp	r0, r1
+	strbne	r2, [r0], #1
+	bne	0b
+
+	/* Pass control to the 's_init()' function */
+	b	s_init
+
+_exit_fel:
+	/* Relocate stack back and return */
+	mov	r0, #0xC000
+	ldr	sp, [r0, #-4]!
+	ldr	lr, [r0, #-4]!
+	bx	lr

arch/arm/cpu/armv7/sunxi/u-boot-spl-fel.lds +2 -2

index 364e35c..418c2fc 100644
@@ -6,7 +6,7 @@
  */
 OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
 OUTPUT_ARCH(arm)
-ENTRY(s_init)
+ENTRY(_start_fel)
 SECTIONS
 {
 	. = 0x00002000;

@@ -14,7 +14,7 @@ SECTIONS
 	. = ALIGN(4);
 	.text :
 	{
-		*(.text.s_init)
+		arch/arm/cpu/armv7/sunxi/start_fel.o	(.text)
 		*(.text*)
 	}
 

include/configs/sunxi-common.h +0 -2

index 5d72d62..4b980e9 100644
@@ -18,10 +18,8 @@
  */
 #define CONFIG_SUNXI		/* sunxi family */
 #ifdef CONFIG_SPL_BUILD
-#ifndef CONFIG_SPL_FEL
 #define CONFIG_SYS_THUMB_BUILD	/* Thumbs mode to save space in SPL */
 #endif
-#endif
 
 #include <asm/arch/cpu.h>	/* get chip and board defs */
 

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

If this is not done, the Linux system ends up booted with the L2 cache disabled.

Hello Siarhei,

Quoted 4 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

Quoted 3 lines

If this is not done, the Linux system ends up booted with the L2 cache disabled.

I don't know a single about the sunxi, but shouldn't linux be patched instead. The commit message seems to indicate it is not an u-boot issue.

Quoted 7 lines · Jeroen Hofstee

Hello Siarhei,

Quoted 4 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

Quoted 6 lines

Quoted 3 lines

If this is not done, the Linux system ends up booted with the L2 cache disabled.

I don't know a single about the sunxi, but shouldn't linux be patched instead. The commit message seems to indicate it is not an u-boot issue.

The ACTLR may not be writeable from NS mode so it has to be setup in the bootloader before dropping to NS mode.

In any case I think these sorts of low level platform specific details are the sort of thing which the bootloader probably ought to be setting up.

Hello Ian,

Quoted 11 lines · Ian Campbell

Quoted 10 lines · Jeroen Hofstee

Hello Siarhei,

Quoted 7 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

If this is not done, the Linux system ends up booted with the L2 cache disabled.

Quoted 5 lines

Quoted 3 lines

I don't know a single about the sunxi, but shouldn't linux be patched instead. The commit message seems to indicate it is not an u-boot issue.

The ACTLR may not be writeable from NS mode so it has to be setup in the bootloader before dropping to NS mode.

mmm, I guess there is something wrong with the boot sequence if the kernel itself can't access raw hw.

Quoted 19 lines · Jeroen Hofstee

Hello Ian,

Quoted 16 lines · Ian Campbell

Quoted 7 lines · Jeroen Hofstee

Hello Siarhei,

Quoted 4 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

Quoted 6 lines

Quoted 3 lines

If this is not done, the Linux system ends up booted with the L2 cache disabled.

I don't know a single about the sunxi, but shouldn't linux be patched instead. The commit message seems to indicate it is not an u-boot issue.

The ACTLR may not be writeable from NS mode so it has to be setup in the bootloader before dropping to NS mode.

Quoted 2 lines

mmm, I guess there is something wrong with the boot sequence if the kernel itself can't access raw hw.

Do you know what ARM Secure and Non-Secure worlds are?

The kernel expects to be launched in NS mode and simply cannot access this register. This is a feature not a bug.

Quoted 23 lines · On Mon, 21 Jul 2014 21:59:51 +0100 Ian Campbell <[email protected]> wrote:

Quoted 21 lines · Jeroen Hofstee

Hello Ian,

Quoted 8 lines · Ian Campbell

Quoted 7 lines · Jeroen Hofstee

Hello Siarhei,

Quoted 4 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

Quoted 8 lines

Quoted 6 lines

Quoted 3 lines

If this is not done, the Linux system ends up booted with the L2 cache disabled.

I don't know a single about the sunxi, but shouldn't linux be patched instead. The commit message seems to indicate it is not an u-boot issue.

The ACTLR may not be writeable from NS mode so it has to be setup in the bootloader before dropping to NS mode.

mmm, I guess there is something wrong with the boot sequence if the kernel itself can't access raw hw.

Quoted 4 lines

Do you know what ARM Secure and Non-Secure worlds are?

The kernel expects to be launched in NS mode and simply cannot access this register. This is a feature not a bug.

Just curious. Is there a modern consensus about how this all is supposed to be done nowadays?

The last time I read anything about this subject was the following longish and already old discussion thread (which has probably already lost relevance):

    http://lists.linaro.org/pipermail/boot-architecture/2011-August/000060.html

Since the Allwinner BROM does not forcefully drop us to the non-secure mode, we have the absolute freedom of choice and may implement any policy.

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

If this is not done, the Linux system ends up booted with the L2 cache disabled.

Signed-off-by Siarhei Siamashka <[email protected]>

---
  arch/arm/cpu/armv7/sunxi/board.c | 12 ++++++++++++
  1 file changed, 12 insertions(+)

arch/arm/cpu/armv7/sunxi/board.c +2 -0

index 49c9448..86cf4c9 100644
@@ -69,6 +69,18 @@ void s_init(void)
  		"mcr p15, 0, r0, c1, c0, 1\n");
  #endif
 
+#if defined(CONFIG_SPL_FEL) && (defined(CONFIG_SUN4I) || defined(CONFIG_SUN5I))
+	/* For ARM Cortex-A8 based hardware (sun4i and sun5i), the L2EN bit is

Hi,

Quoted 20 lines · Siarhei Siamashka

This is needed to have feature parity with the normal boot mode, where the L2EN bit in the CP15 Auxiliary Control Register is set by the BROM code right from the start.

If this is not done, the Linux system ends up booted with the L2 cache disabled.

Signed-off-by Siarhei Siamashka <[email protected]>

---
  arch/arm/cpu/armv7/sunxi/board.c | 12 ++++++++++++
  1 file changed, 12 insertions(+)

arch/arm/cpu/armv7/sunxi/board.c +0 -0

index 49c9448..86cf4c9 100644
@@ -69,6 +69,18 @@ void s_init(void)
  		"mcr p15, 0, r0, c1, c0, 1\n");
  #endif
 

arch/arm/cpu/armv7/sunxi/board.c void s_init(void) · line 83

Quoted 12 lines

arch/arm/cpu/armv7/sunxi/board.c +12 -0

+#if defined(CONFIG_SPL_FEL) && (defined(CONFIG_SUN4I) || defined(CONFIG_SUN5I))
+	/* For ARM Cortex-A8 based hardware (sun4i and sun5i), the L2EN bit is
+	 * set by the BROM code in the "normal" mode, but not in the "FEL" mode.
+	 * Here we fix this inconsistency in the Auxiliary Ctl reg by also
+	 * setting the missing L2EN bit.
+	 */
+	asm volatile(
+		"mrc p15, 0, r0, c1, c0, 1\n"
+		"orr r0, r0, #2\n"
+		"mcr p15, 0, r0, c1, c0, 1\n" : : : "r0");
+#endif
+

Wouldn't it be better to do this in the start_fel.S file you've introduced in the first patch of this series ?

I expect this needs to be done on secondary processors. Need to keep that in mind if/when someone works on PSCI for sun[45]i.