sunxi-fel: use RX DMA for H616 FEL writes

The H616 BROM FEL path copies received USB data byte-by-byte from the
MUSB FIFO. Even after switching the controller to high-speed mode, this
leaves large post-SPL DRAM writes far slower than the USB link can
support.

After SPL has initialized DRAM, install an H616-specific thunk for
writes into the known DRAM window. The thunk builds the MMU remap it
needs, hooks the BROM RX FIFO copy helper, and replaces it with a
MUSB/USBC endpoint-DMA receive path. It routes the active RX endpoint
DRQ through VEND0 before starting the internal DMA channel, so the FEL
wire protocol stays unchanged.

Coalesce full high-speed packets into bounded RX DMA requests and use
larger progress chunks once the RX DMA thunk is installed. This reduces
device-side FIFO-copy overhead and host-side progress overhead for
large DRAM writes. Use a 192 KiB DMA request cap; 256 KiB requests can
time out while the host is writing.

Add the checked-in DMA thunk header to the sunxi-fel prerequisites and
thunk documentation. This makes the binary rebuild when the generated
header changes without making the sunxi-fel target regenerate thunk
headers.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Author: jameshilliard

Makefile

@@ -140,8 +140,10 @@ PROGRESS := progress.c progress.h
 SOC_INFO := soc_info.c soc_info.h
 FEL_LIB  := fel_lib.c fel_lib.h
 SPI_FLASH:= fel-spiflash.c fel-spiflash.h fel-remotefunc-spi-data-transfer.h
+FEL_THUNKS := thunks/fel-to-spl-thunk.h thunks/fel-to-secure-svc-return-thunk.h
+FEL_THUNKS += thunks/h616-fel-rx-dma-thunk.h
 
-sunxi-fel: fel.c fit_image.c thunks/fel-to-spl-thunk.h thunks/fel-to-secure-svc-return-thunk.h $(PROGRESS) $(SOC_INFO) $(FEL_LIB) $(SPI_FLASH)
+sunxi-fel: fel.c fit_image.c $(FEL_THUNKS) $(PROGRESS) $(SOC_INFO) $(FEL_LIB) $(SPI_FLASH)
 	$(CC) $(HOST_CFLAGS) $(LIBUSB_CFLAGS) $(ZLIB_CFLAGS) $(LDFLAGS) -o $@ \
 		$(filter %.c,$^) $(LIBS) $(LIBUSB_LIBS) $(ZLIB_LIBS) -lfdt
 

fel.c

@@ -37,6 +37,7 @@ static uint32_t uboot_entry = 0; /* entry point (address) of U-Boot */
 static uint32_t uboot_size  = 0; /* size of U-Boot binary */
 static bool enter_in_aarch64 = false;
 static bool fel_usb_high_speed_enabled = false;
+static bool fel_dram_ready = false;
 
 #define FEL_REENUM_TIMEOUT_MS		5000
 #define FEL_REENUM_RETRY_MS		100
@@ -108,6 +109,12 @@ typedef struct image_header {
 
 #define SID_STR_SIZE		36
 
+#define	DRAM_BASE		0x40000000
+#define	DRAM_SIZE		0x80000000
+#define	DRAM_END		(DRAM_BASE + DRAM_SIZE)
+
+static void aw_fel_install_rx_dma_thunk(feldev_handle *dev);
+
 static uint32_t get_le32(const void *ptr)
 {
 	uint32_t val;
@@ -183,6 +190,10 @@ double aw_write_buffer(feldev_handle *dev, void *buf, uint32_t offset,
 
 	double start = gettime();
 
+	if (fel_usb_high_speed_enabled && fel_dram_ready &&
+	    offset >= DRAM_BASE && offset < DRAM_END)
+		aw_fel_install_rx_dma_thunk(dev);
+
 	aw_fel_write_buffer(dev, buf, offset, len, progress);
 	return gettime() - start;
 }
@@ -409,9 +420,6 @@ static uint32_t fel_to_secure_svc_return_thunk[] = {
 	#include "thunks/fel-to-secure-svc-return-thunk.h"
 };
 
-#define	DRAM_BASE		0x40000000
-#define	DRAM_SIZE		0x80000000
-
 uint32_t aw_read_arm_cp_reg(feldev_handle *dev, soc_info_t *soc_info,
 			    uint32_t coproc, uint32_t opc1, uint32_t crn,
 			    uint32_t crm, uint32_t opc2)
@@ -466,6 +474,25 @@ void fel_writel(feldev_handle *dev, uint32_t addr, uint32_t val)
 	fel_writel_n(dev, addr, &val, 1);
 }
 
+static void aw_fel_install_rx_dma_thunk(feldev_handle *dev)
+{
+	const fel_rx_dma_thunk_info *thunk = dev->soc_info->fel_rx_dma_thunk;
+	size_t i;
+
+	if (dev->rx_dma_patched || !thunk)
+		return;
+
+	uint32_t thunk_buf[thunk->size / sizeof(*thunk->code)];
+
+	pr_info("Patching BROM RX FIFO copy to use DMA.\n");
+	for (i = 0; i < sizeof(thunk_buf) / sizeof(*thunk_buf); i++)
+		thunk_buf[i] = htole32(thunk->code[i]);
+	aw_fel_write(dev, thunk_buf, thunk->addr, sizeof(thunk_buf));
+
+	aw_fel_execute(dev, thunk->addr + thunk->code[0]);
+	dev->rx_dma_patched = true;
+}
+
 static bool aw_fel_switch_usb_high_speed(feldev_handle *dev)
 {
 	soc_info_t *soc_info = dev->soc_info;
@@ -941,7 +968,7 @@ void aw_restore_and_enable_mmu(feldev_handle *dev,
 	};
 
 	pr_info("Setting write-combine mapping for DRAM.\n");
-	for (i = (DRAM_BASE >> 20); i < ((DRAM_BASE + DRAM_SIZE) >> 20); i++) {
+	for (i = (DRAM_BASE >> 20); i < (DRAM_END >> 20); i++) {
 		/* Clear TEXCB bits */
 		tt[i] &= ~((7 << 12) | (1 << 3) | (1 << 2));
 		/* Set TEXCB to 00100 (Normal uncached mapping) */
@@ -1108,6 +1135,7 @@ uint32_t aw_fel_write_and_execute_spl(feldev_handle *dev, uint8_t *buf, size_t l
 	/* re-enable the MMU if it was enabled by BROM */
 	if (tt != NULL)
 		aw_restore_and_enable_mmu(dev, soc_info, tt);
+	fel_dram_ready = true;
 
 	return spl_len;
 }
@@ -1640,7 +1668,7 @@ void usage(const char *cmd) {
 		"	-h, --help			Print this usage summary and exit\n"
 		"	-v, --verbose			Verbose logging\n"
 		"	-p, --progress			\"write\" transfers show a progress bar\n"
-		"	    --no-high-speed		Disable high-speed USB\n"
+		"	    --no-high-speed		Disable high-speed USB and fast writes\n"
 		"	-l, --list			Enumerate all (USB) FEL devices and exit\n"
 		"	-d, --dev bus:devnum		Use specific USB bus and device number\n"
 		"	    --sid SID			Select device by SID key (exact match)\n"

fel_lib.c

@@ -70,19 +70,17 @@ static void usb_error(int rc, const char *caption, int exitcode)
  * timeout, and "slow" transfers take place at approx. 64 KiB/sec - so we can
  * expect the maximum chunk being transmitted within 8 seconds or less.
  */
-static const int AW_USB_MAX_BULK_SEND = 512 * 1024; /* 512 KiB per bulk request */
+static const int AW_USB_MAX_BULK_SEND = 512 * 1024;
+static const int AW_USB_PROGRESS_BULK_SEND = 128 * 1024;
+static const int AW_USB_FAST_PROGRESS_BULK_SEND = 1024 * 1024;
 
+/*
+ * Keep progress updates frequent enough for slow BROM PIO transfers. Once an
+ * RX-DMA thunk is installed, 1 MiB chunks avoid host-side progress overhead.
+ */
 static void usb_bulk_send(libusb_device_handle *usb, int ep, const void *data,
-			  size_t length, bool progress)
+			  size_t length, size_t max_chunk, bool progress)
 {
-	/*
-	 * With no progress notifications, we'll use the maximum chunk size.
-	 * Otherwise, it's useful to lower the size (have more chunks) to get
-	 * more frequent status updates. 128 KiB per request seem suitable.
-	 * (Worst case of "slow" transfers -> one update every two seconds.)
-	 */
-	size_t max_chunk = progress ? 128 * 1024 : AW_USB_MAX_BULK_SEND;
-
 	size_t chunk;
 	int rc, sent;
 	while (length > 0) {
@@ -187,7 +185,7 @@ static void aw_send_usb_request(feldev_handle *dev, int type, int length)
 	};
 	req.length2 = req.length;
 	usb_bulk_send(dev->usb->handle, dev->usb->endpoint_out,
-		      &req, sizeof(req), false);
+		      &req, sizeof(req), AW_USB_MAX_BULK_SEND, false);
 }
 
 static bool aw_send_usb_request_may_disconnect(feldev_handle *dev, int type,
@@ -239,9 +237,18 @@ static bool aw_usb_read_may_disconnect(feldev_handle *dev, void *data,
 static void aw_usb_write(feldev_handle *dev, const void *data, size_t len,
 			 bool progress)
 {
+	size_t max_chunk = AW_USB_MAX_BULK_SEND;
+
+	if (progress) {
+		if (dev->rx_dma_patched)
+			max_chunk = AW_USB_FAST_PROGRESS_BULK_SEND;
+		else
+			max_chunk = AW_USB_PROGRESS_BULK_SEND;
+	}
+
 	aw_send_usb_request(dev, AW_USB_WRITE, len);
 	usb_bulk_send(dev->usb->handle, dev->usb->endpoint_out,
-		      data, len, progress);
+		      data, len, max_chunk, progress);
 	aw_read_usb_response(dev);
 }
 

fel_lib.h

@@ -35,6 +35,7 @@ typedef struct {
 	soc_name_t soc_name;
 	soc_info_t *soc_info;
 	bool disconnected;
+	bool rx_dma_patched;
 } feldev_handle;
 
 /* list_fel_devices() will return an array of this type */

soc_info.c

@@ -25,6 +25,16 @@
 #include <stdio.h>
 #include <string.h>
 
+static const uint32_t h616_fel_rx_dma_thunk_code[] = {
+	#include "thunks/h616-fel-rx-dma-thunk.h"
+};
+
+static const fel_rx_dma_thunk_info h616_fel_rx_dma_thunk = {
+	.addr = 0x00022000,
+	.code = h616_fel_rx_dma_thunk_code,
+	.size = sizeof(h616_fel_rx_dma_thunk_code),
+};
+
 /*
  * The FEL code from BROM in A10/A13/A20 sets up two stacks for itself. One
  * at 0x2000 (and growing down) for the IRQ handler. And another one at 0x7000
@@ -567,6 +577,7 @@ soc_info_t soc_info_table[] = {
 		.ver_reg      = 0x03000024,
 		.usb_musb_base= 0x05100000,
 		.fel_bulk_ep_addr = 0x00055100,
+		.fel_rx_dma_thunk = &h616_fel_rx_dma_thunk,
 		.needs_smc_workaround_if_zero_word_at_addr = 0x03006240,
 		.secure_boot_fuse_addr = 0x030060a0,
 		.secure_boot_fuse_mask = 0xf,

soc_info.h

@@ -19,6 +19,7 @@
 #define _SUNXI_TOOLS_SOC_INFO_H
 
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdint.h>
 
 /* SoC version information, as retrieved by the FEL protocol */
@@ -70,6 +71,12 @@ typedef struct {
 	uint32_t	size_bits;
 } sid_section;
 
+typedef struct {
+	uint32_t           addr;
+	const uint32_t    *code;
+	size_t             size;
+} fel_rx_dma_thunk_info;
+
 #define SID_SECTION(_name, _offset, _size_bits) {	\
 	.name = _name,					\
 	.offset = _offset,				\
@@ -142,6 +149,7 @@ typedef struct {
 	uint32_t           ver_reg;      /* MMIO address of "Version Register" */
 	uint32_t           usb_musb_base;/* base address of the USB OTG controller */
 	uint32_t           fel_bulk_ep_addr; /* BROM FEL bulk endpoint state */
+	const fel_rx_dma_thunk_info *fel_rx_dma_thunk;
 	const watchdog_info *watchdog;   /* Used for reset */
 	bool               sid_fix;      /* Use SID workaround (read via register) */
 	/* Use I$ workaround (disable I$ before first write to prevent stale thunk */

sunxi-fel.1

@@ -42,7 +42,7 @@ Enable verbose logging.
 .sp
 .B \-\-no-high-speed
 .RS 4
-Disable automatic high-speed USB switching.
+Disable automatic high-speed USB switching and post-SPL fast DRAM writes.
 .RE
 .sp
 .B \-l, \-\-list

thunks/Makefile

@@ -2,15 +2,16 @@
 # build "preprocessed" .h files for inclusion of ARM scratch code
 #
 
-SPL_THUNK := fel-to-spl-thunk.h
-SPL_THUNK += fel-to-secure-svc-return-thunk.h
+FEL_EXEC_THUNKS := fel-to-spl-thunk.h
+FEL_EXEC_THUNKS += fel-to-secure-svc-return-thunk.h
+FEL_EXEC_THUNKS += h616-fel-rx-dma-thunk.h
 THUNKS := clrsetbits.h
 THUNKS += memcpy.h
 THUNKS += readl_writel.h
 THUNKS += rmr-thunk.h
 THUNKS += sid_read_root.h
 
-all: $(SPL_THUNK) $(THUNKS)
+all: $(FEL_EXEC_THUNKS) $(THUNKS)
 # clean up object files afterwards
 	rm -f *.o
 
@@ -25,9 +26,10 @@ OBJDUMP := $(CROSS_COMPILE)objdump
 
 AWK_O_TO_H := LC_ALL=C awk -f objdump_to_h.awk
 
-# These thunks require the old output format. The "style" variable for
-# awk controls this, and causes the htole32() conversion to be omitted.
-$(SPL_THUNK): %.h: %.S FORCE
+# These thunks are copied into a uint32_t buffer and byte-swapped by fel.c.
+# The "style" variable for awk controls this, and causes the htole32()
+# conversion to be omitted.
+$(FEL_EXEC_THUNKS): %.h: %.S FORCE
 	$(AS) -o $(subst .S,.o,$<) -march=armv5te $<
 	$(OBJDUMP) -d $(subst .S,.o,$<) | $(AWK_O_TO_H) -v style=old > $@
 

thunks/README.md

@@ -8,10 +8,10 @@ usually via `sunxi-fel`.
 
 Normally you don't need to change or (re)build anything within this folder.
 Currently our main build process (via the parent directory's _Makefile_)
-includes `fel-to-spl-thunk.h` and `fel-to-secure-svc-return-thunk.h` directly.
-Other _.h_ files are provided **just for reference**. The main purpose of this
-folder is simply keeping track of _.S_ sources, to help with possible future
-maintenance of the various code snippets.
+includes `fel-to-spl-thunk.h`, `fel-to-secure-svc-return-thunk.h`, and
+`h616-fel-rx-dma-thunk.h` directly. Other _.h_ files are provided **just for
+reference**. The main purpose of this folder is simply keeping track of _.S_
+sources, to help with possible future maintenance of the various code snippets.
 
 Please note that any files lacking explicit license information are intended
 to be covered by the project's [overall license](../LICENSE.md) (GPLv2).