[Question] firmware/psci.c: prevent registering pm_power_off

[Question] firmware/psci.c: prevent registering pm_power_off

[Mike Looijmans]

?Problem: The board uses gpio-poweroff to power down, because the "kill" signal 
is controlled by an I2C IO expander. This doesn't work because 
drivers/firmware/psci.c unconditionally registers pm_power_off, resulting in 
the gpio-poweroff driver to refuse to register. The PSCI firmware isn't 
actually capable of really turning off the power, but there appears to be no 
way to tell the psci driver about that.

My current workaround is to patch firmware/psci.c and remove this line:

pm_power_off = psci_sys_poweroff;

However, it would be desirable to have this under, for example, devicetree 
control. The structure of psci.c doesn't really make that an easy option 
though, but I'm willing to create a patch to do so.

Is this an option, or is there some ongoing effort in the kernel to make 
pm_power_off into something more managable?

An alternative approach would be to add a flag to the gpio-poweroff to 
override the pm_power_off value. Would that be a lesser evil?


Kind regards,

Mike Looijmans
System Expert

TOPIC Products
Materiaalweg 4, NL-5681 RJ Best
Postbus 440, NL-5680 AK Best
Telefoon: +31 (0) 499 33 69 79
E-mail: mike.looijmans at topicproducts.com
Website: www.topicproducts.com

Please consider the environment before printing this e-mail

[Question] firmware/psci.c: prevent registering pm_power_off

[Sudeep Holla]

On 27/03/17 14:36, Mike Looijmans wrote:
> Problem: The board uses gpio-poweroff to power down, because the "kill"
> signal is controlled by an I2C IO expander. This doesn't work because
> drivers/firmware/psci.c unconditionally registers pm_power_off,
> resulting in the gpio-poweroff driver to refuse to register. The PSCI
> firmware isn't actually capable of really turning off the power, but
> there appears to be no way to tell the psci driver about that.
> 

That's because {SYSTEM_OFF,RESET} functions are mandatory since v0.2 to
be compliant with a PSCI specification.

So the question is why is PSCI being advertised in the DT if the
firmware is not compliant ?

> My current workaround is to patch firmware/psci.c and remove this line:
> 
> pm_power_off = psci_sys_poweroff;
> 
> However, it would be desirable to have this under, for example,
> devicetree control. The structure of psci.c doesn't really make that an
> easy option though, but I'm willing to create a patch to do so.
> 

No, as mentioned above it's mandatory function for the firmware to
implement to be PSCI compliant, so I see no reason to patch that.

> Is this an option, or is there some ongoing effort in the kernel to make
> pm_power_off into something more managable?
> 
> An alternative approach would be to add a flag to the gpio-poweroff to
> override the pm_power_off value. Would that be a lesser evil?
> 

One approach is to implement SYSTEM_OFF in PSCI using the same GPIO. Thereby
making it compliant and allowing any secure entity running in the platform
to shutdown gracefully.

-- 
Regards,
Sudeep

[Question] firmware/psci.c: prevent registering pm_power_off

[Mike Looijmans]

?On 27-03-17 16:02, Sudeep Holla wrote:
>
>
> On 27/03/17 14:36, Mike Looijmans wrote:
>> Problem: The board uses gpio-poweroff to power down, because the "kill"
>> signal is controlled by an I2C IO expander. This doesn't work because
>> drivers/firmware/psci.c unconditionally registers pm_power_off,
>> resulting in the gpio-poweroff driver to refuse to register. The PSCI
>> firmware isn't actually capable of really turning off the power, but
>> there appears to be no way to tell the psci driver about that.
>>
>
> That's because {SYSTEM_OFF,RESET} functions are mandatory since v0.2 to
> be compliant with a PSCI specification.
>
> So the question is why is PSCI being advertised in the DT if the
> firmware is not compliant ?

The PSCI firmware doesn't have access to the GPIO to turn off power. It 
can start/stop CPUs and similar things that got moved to there.

>> My current workaround is to patch firmware/psci.c and remove this line:
>>
>> pm_power_off = psci_sys_poweroff;
>>
>> However, it would be desirable to have this under, for example,
>> devicetree control. The structure of psci.c doesn't really make that an
>> easy option though, but I'm willing to create a patch to do so.
>>
>
> No, as mentioned above it's mandatory function for the firmware to
> implement to be PSCI compliant, so I see no reason to patch that.
>
>> Is this an option, or is there some ongoing effort in the kernel to make
>> pm_power_off into something more managable?
>>
>> An alternative approach would be to add a flag to the gpio-poweroff to
>> override the pm_power_off value. Would that be a lesser evil?
>>
>
> One approach is to implement SYSTEM_OFF in PSCI using the same GPIO. Thereby
> making it compliant and allowing any secure entity running in the platform
> to shutdown gracefully.

Cannot practically do that. The GPIO to switch the power off is on a IO 
expander on an I2C bus behind a I2C multiplexer on the I2C controller of 
the CPU with a dozen other I2C devices. The PSCI would somehow need 
access to the I2C controller without interfering with the kernel, change 
the multiplexer (again without interfering) and then set the IO in the 
expander chip. The kernel on the other hand has everything it needs to 
do this in just a single device-tree entry.

I'd expect other boards to have similar issues, especially if they're 
modules on a carrier board like this one. The PSCI could turn off the 
CPU, but having it turn off the board completely, even if it could, 
would require board-unique firmware for each board. Hey, that's like 
moving back to the "platform data and code" times like before the 
devicetree was introduced.

-- 
Mike Looijmans


Kind regards,

Mike Looijmans
System Expert

TOPIC Products
Materiaalweg 4, NL-5681 RJ Best
Postbus 440, NL-5680 AK Best
Telefoon: +31 (0) 499 33 69 79
E-mail: mike.looijmans at topicproducts.com
Website: www.topicproducts.com

Please consider the environment before printing this e-mail

[Question] firmware/psci.c: prevent registering pm_power_off

[Mark Rutland]

On Mon, Mar 27, 2017 at 06:25:27PM +0200, Mike Looijmans wrote:
> On 27-03-17 16:02, Sudeep Holla wrote:
> >
> >On 27/03/17 14:36, Mike Looijmans wrote:
> >>Problem: The board uses gpio-poweroff to power down, because the "kill"
> >>signal is controlled by an I2C IO expander. This doesn't work because
> >>drivers/firmware/psci.c unconditionally registers pm_power_off,
> >>resulting in the gpio-poweroff driver to refuse to register. The PSCI
> >>firmware isn't actually capable of really turning off the power, but
> >>there appears to be no way to tell the psci driver about that.
> >
> >That's because {SYSTEM_OFF,RESET} functions are mandatory since v0.2 to
> >be compliant with a PSCI specification.
> >
> >So the question is why is PSCI being advertised in the DT if the
> >firmware is not compliant ?
> 
> The PSCI firmware doesn't have access to the GPIO to turn off power.

I take it that means no SYSTEM_RESET either.

Are there any other mandatory PSCI 0.2+ features that are not
implemented?

Which PSCI implementation is being used here?

If PSCI was advertised as a legacy < 0.2 version, we would not register
pm_power_off, but other features that you might want (e.g.
SYSTEM_SUSPEND) would not be available.

[...]

> >One approach is to implement SYSTEM_OFF in PSCI using the same GPIO. Thereby
> >making it compliant and allowing any secure entity running in the platform
> >to shutdown gracefully.
> 
> Cannot practically do that. The GPIO to switch the power off is on a
> IO expander on an I2C bus behind a I2C multiplexer on the I2C
> controller of the CPU with a dozen other I2C devices. The PSCI would
> somehow need access to the I2C controller without interfering with
> the kernel, change the multiplexer (again without interfering) and
> then set the IO in the expander chip.

Given this is SYSTEM_OFF, the firmware can forcefully get the kernel out
of the way. For example, it can send an SGI to other CPUs to bring those
into the FW before attempting to poke the HW.

> I'd expect other boards to have similar issues, especially if
> they're modules on a carrier board like this one. The PSCI could
> turn off the CPU, but having it turn off the board completely, even
> if it could, would require board-unique firmware for each board.
> Hey, that's like moving back to the "platform data and code" times
> like before the devicetree was introduced.

I appreciate that the board/module case is a little special, but this is
a much more constrained case than a general purpose kernel with platform
code, and it is possible to some extent to have a configurable firmware.

Thanks
Firmware 

[Question] firmware/psci.c: prevent registering pm_power_off

[Mike Looijmans]

?On 27-03-17 19:17, Mark Rutland wrote:
> On Mon, Mar 27, 2017 at 06:25:27PM +0200, Mike Looijmans wrote:
>> On 27-03-17 16:02, Sudeep Holla wrote:
>>>
>>> On 27/03/17 14:36, Mike Looijmans wrote:
>>>> Problem: The board uses gpio-poweroff to power down, because the "kill"
>>>> signal is controlled by an I2C IO expander. This doesn't work because
>>>> drivers/firmware/psci.c unconditionally registers pm_power_off,
>>>> resulting in the gpio-poweroff driver to refuse to register. The PSCI
>>>> firmware isn't actually capable of really turning off the power, but
>>>> there appears to be no way to tell the psci driver about that.
>>>
>>> That's because {SYSTEM_OFF,RESET} functions are mandatory since v0.2 to
>>> be compliant with a PSCI specification.
>>>
>>> So the question is why is PSCI being advertised in the DT if the
>>> firmware is not compliant ?
>>
>> The PSCI firmware doesn't have access to the GPIO to turn off power.
>
> I take it that means no SYSTEM_RESET either.

SYSTEM_RESET should work. (It actually does not, but I take it that's a bug in 
the firmware that needs to be resolved some day, since RESET and POWERDOWN 
don't work on any board at all, not even Xilinx' own boards.)

> Are there any other mandatory PSCI 0.2+ features that are not
> implemented?
>
> Which PSCI implementation is being used here?

The PCSI firmware is this (the module is an Zynq MPSoC):
https://github.com/Xilinx/arm-trusted-firmware

> If PSCI was advertised as a legacy < 0.2 version, we would not register
> pm_power_off, but other features that you might want (e.g.
> SYSTEM_SUSPEND) would not be available.

Interesting approach, it looks like with the "legacy" one can specify one's 
own call IDs.

>
> [...]
>
>>> One approach is to implement SYSTEM_OFF in PSCI using the same GPIO. Thereby
>>> making it compliant and allowing any secure entity running in the platform
>>> to shutdown gracefully.
>>
>> Cannot practically do that. The GPIO to switch the power off is on a
>> IO expander on an I2C bus behind a I2C multiplexer on the I2C
>> controller of the CPU with a dozen other I2C devices. The PSCI would
>> somehow need access to the I2C controller without interfering with
>> the kernel, change the multiplexer (again without interfering) and
>> then set the IO in the expander chip.
>
> Given this is SYSTEM_OFF, the firmware can forcefully get the kernel out
> of the way. For example, it can send an SGI to other CPUs to bring those
> into the FW before attempting to poke the HW.

So instead of a "set this GPIO" the power down routine becomes something like 
this in the ATF which will become a fork unique to this module/board combination:
- Move the I2C controller to the "trusted" domain
- Send a string of "magic" I2C bytes to the controller to set the mux
- Send a string of "magic" I2C bytes to the controller to activate the gpio

>> I'd expect other boards to have similar issues, especially if
>> they're modules on a carrier board like this one. The PSCI could
>> turn off the CPU, but having it turn off the board completely, even
>> if it could, would require board-unique firmware for each board.
>> Hey, that's like moving back to the "platform data and code" times
>> like before the devicetree was introduced.
>
> I appreciate that the board/module case is a little special, but this is
> a much more constrained case than a general purpose kernel with platform
> code, and it is possible to some extent to have a configurable firmware.

Well, having a I2C (or one-wire, SPI, gpio) power controller on a board cannot 
be that uncommon. How do other boards arrange this?

This would force all boards to write their own version of the ATF and somehow 
send the commands needed to turn off power, while the kernel has everything it 
needs to do that already.

It's the lack of choice I'm trying to solve here. The current situation is 
that if you have PSCI you MUST use it to turn off (and reset) the board, 
there's no possibility to have it any other way. Just because it sets a global 
variable unconditionally.



Kind regards,

Mike Looijmans
System Expert

TOPIC Products
Materiaalweg 4, NL-5681 RJ Best
Postbus 440, NL-5680 AK Best
Telefoon: +31 (0) 499 33 69 79
E-mail: mike.looijmans at topicproducts.com
Website: www.topicproducts.com

Please consider the environment before printing this e-mail