[PATCH 0/3] ARM: bcm: Enable SMP on the Genexis XG6846B

[PATCH 0/3] ARM: bcm: Enable SMP on the Genexis XG6846B

[Linus Walleij]

When booted through CFE and mainline U-Boot, the XG6846B has no PSCI
provider. CFE powers up CPU1 and leaves it waiting in a holding pen.

Preserve the holding pen, add a board-specific SMP method using CFE's
GPIO mailbox and a wakeup IPI, and disable the inherited PSCI setup.
Tested on the XG6846B with both CPUs coming online.

Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
---
Linus Walleij (3):
      ARM: dts: broadcom: Preserve the XG6846B CFE holding pen
      ARM: bcm: Add CFE SMP support for the Genexis XG6846B
      ARM: dts: broadcom: Use CFE CPU bring-up on the XG6846B

 .../boot/dts/broadcom/bcm6846-genexis-xg6846b.dts  | 15 +++++-
 arch/arm/mach-bcm/Makefile                         |  2 +-
 arch/arm/mach-bcm/board_bcmbca.c                   | 53 ++++++++++++++++++++++
 3 files changed, 68 insertions(+), 2 deletions(-)
---
base-commit: 6356fd3dd29d8b5620507a0ce037c644e052b5dd
change-id: 20261011-genexis-xg6846-smp-v7-3-rc1-b470f0e20475

Best regards,
--  
Linus Walleij <linusw@kernel.org>

[PATCH 1/3] ARM: dts: broadcom: Preserve the XG6846B CFE holding pen

[Linus Walleij]

CFE copies the secondary CPU holding pen to physical address 0x1000.
The secondary-boot reservation covers this area, but its no-map
attribute prevents the reservation from taking effect with the normal
ARM kernel placement.

ARM reserves its initial page tables before scanning reserved-memory.
With TEXT_OFFSET=0x8000, those tables overlap the secondary-boot region.
The reserved-memory code rejects a no-map region overlapping an existing
reservation, leaving the CFE holding pen available for allocation.

Use an ordinary reservation, which can overlap the page-table
reservation while keeping the holding pen reserved. This also matches
the semantics of the vendor device tree's /memreserve/ entry.

Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
---
 arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
index a3616fb7b3a8..6cb221dca0ac 100644
--- a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
+++ b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
@@ -34,7 +34,7 @@ reserved-memory {
 		ranges;
 
 		secondary-boot@0 {
-			no-map;
+			/* Includes the kernel's initial page tables. */
 			reg = <0x00000000 0x00008000>;
 		};
 		pmc3-firmware@8000 {

-- 
2.56.0

[PATCH 2/3] ARM: bcm: Add CFE SMP support for the Genexis XG6846B

[Linus Walleij]

The XG6846B CFE bootloader powers up CPU1 and leaves it in a holding pen
waiting for an interrupt. After waking, the stub reads the GPIO
GeneralPurpose register at 0xff800568 and branches to the stored address
in ARM state. The vendor kernel uses this mailbox and a wakeup IPI.

Add a machine SMP fallback for the XG6846B when PSCI is unavailable.
Map the mailbox as device memory, write secondary_startup_arm and
complete the write before sending the wakeup IPI. CPU1 is already
running, so no power or reset sequence is needed. Using the ARM entry
also supports kernels built in Thumb-2 mode. Clear any Thumb function
pointer tag before programming this ARM entry address.

Build the BCMBCA machine description independently of DEBUG_BCMBCA,
keeping the debug UART mapping conditional. Restrict the fallback to
the XG6846B and retain the generic PSCI path when firmware provides it.

Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
---
 arch/arm/mach-bcm/Makefile       |  2 +-
 arch/arm/mach-bcm/board_bcmbca.c | 53 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-bcm/Makefile b/arch/arm/mach-bcm/Makefile
index 6baedf4c6304..fcc4e0174adc 100644
--- a/arch/arm/mach-bcm/Makefile
+++ b/arch/arm/mach-bcm/Makefile
@@ -58,6 +58,6 @@ endif
 
 # BCMBCA
 ifeq ($(CONFIG_ARCH_BCMBCA),y)
-obj-$(CONFIG_DEBUG_BCMBCA)	+= board_bcmbca.o
+obj-y				+= board_bcmbca.o
 obj-$(CONFIG_SMP)		+= bcm63xx_smp.o bcm63xx_pmb.o
 endif
diff --git a/arch/arm/mach-bcm/board_bcmbca.c b/arch/arm/mach-bcm/board_bcmbca.c
index b510d959870a..33d90b989bbf 100644
--- a/arch/arm/mach-bcm/board_bcmbca.c
+++ b/arch/arm/mach-bcm/board_bcmbca.c
@@ -1,9 +1,16 @@
 // SPDX-License-Identifier: GPL-2.0-only
 // Copyright (C) 2024 Linus Walleij <linus.walleij@linaro.org>
 
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/smp.h>
+
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
+#include <asm/psci.h>
+#include <asm/smp_plat.h>
 
+#ifdef CONFIG_DEBUG_BCMBCA
 /* This is needed for LL-debug/earlyprintk/debug-macro.S */
 static struct map_desc bcmbca_io_desc[] __initdata = {
 	{
@@ -13,11 +20,56 @@ static struct map_desc bcmbca_io_desc[] __initdata = {
 		.type = MT_DEVICE,
 	},
 };
+#endif
 
 static void __init bcmbca_map_io(void)
 {
+#ifdef CONFIG_DEBUG_BCMBCA
 	iotable_init(bcmbca_io_desc, ARRAY_SIZE(bcmbca_io_desc));
+#endif
+}
+
+#ifdef CONFIG_SMP
+#define BCM6846_CFE_MAILBOX	0xff800568
+
+static int bcm6846_boot_secondary(unsigned int cpu, struct task_struct *idle)
+{
+	void __iomem *mailbox;
+
+	/* CFE has already powered up CPU1 and left it waiting in WFI. */
+	if (cpu_logical_map(cpu) != 1)
+		return -EINVAL;
+
+	mailbox = ioremap(BCM6846_CFE_MAILBOX, sizeof(u32));
+	if (!mailbox)
+		return -ENOMEM;
+
+	/*
+	 * The CFE stub reads GPIO GeneralPurpose after an interrupt and
+	 * branches to it in ARM state. Clear any Thumb function pointer
+	 * tag and complete the MMIO write before sending the wakeup IPI.
+	 */
+	writel(__pa_symbol(secondary_startup_arm) & ~1, mailbox);
+	dsb(sy);
+	arch_send_wakeup_ipi_mask(cpumask_of(cpu));
+	iounmap(mailbox);
+
+	return 0;
+}
+
+static const struct smp_operations bcm6846_smp_ops __initconst = {
+	.smp_boot_secondary = bcm6846_boot_secondary,
+};
+
+static bool __init bcm6846_smp_init(void)
+{
+	if (!of_machine_is_compatible("genexis,xg6846b") || psci_smp_available())
+		return false;
+
+	smp_set_ops(&bcm6846_smp_ops);
+	return true;
 }
+#endif
 
 static const char * const bcmbca_dt_compat[] = {
 	/* TODO: Add other BCMBCA SoCs here to get debug UART support */
@@ -27,5 +79,6 @@ static const char * const bcmbca_dt_compat[] = {
 
 DT_MACHINE_START(BCMBCA_DT, "BCMBCA Broadband Access Processors")
 	.map_io = bcmbca_map_io,
+	.smp_init = smp_init_ops(bcm6846_smp_init),
 	.dt_compat = bcmbca_dt_compat,
 MACHINE_END

-- 
2.56.0

[PATCH 3/3] ARM: dts: broadcom: Use CFE CPU bring-up on the XG6846B

[Linus Walleij]

The XG6846B boots through CFE, which parks CPU1 in a holding pen and does
not provide PSCI. Chain-loading mainline U-Boot and starting Linux with
"go" does not install a PSCI implementation either. The working PSCI
interface in newer GenXOS firmware belongs to a different boot stack.

Disable the inherited PSCI node on this board so Linux does not issue
SMCs to an interface that is absent. Remove the CPU PSCI enable-method
properties and use the board-specific CFE SMP operations. Keep both CPU
nodes enabled and leave the SoC's PSCI defaults available to other boards.

Assisted-by: LLM
Signed-off-by: Linus Walleij <linusw@kernel.org>
---
 arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
index 6cb221dca0ac..bb467320e1f0 100644
--- a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
+++ b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
@@ -56,6 +56,19 @@ button-restart {
 	};
 };
 
+/* CFE parks CPU1 in its holding pen and does not provide PSCI. */
+&{/psci} {
+	status = "disabled";
+};
+
+&CA7_0 {
+	/delete-property/ enable-method;
+};
+
+&CA7_1 {
+	/delete-property/ enable-method;
+};
+
 &gpio0 {
 	status = "okay";
 };

-- 
2.56.0

Re: [PATCH 0/3] ARM: bcm: Enable SMP on the Genexis XG6846B

[Florian Fainelli]

On 10/12/26 01:03, Linus Walleij wrote:
> When booted through CFE and mainline U-Boot, the XG6846B has no PSCI
> provider. CFE powers up CPU1 and leaves it waiting in a holding pen.
> 
> Preserve the holding pen, add a board-specific SMP method using CFE's
> GPIO mailbox and a wakeup IPI, and disable the inherited PSCI setup.
> Tested on the XG6846B with both CPUs coming online.
> 
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>

This all looks reasonable to me, would appreciate a R-b tag from 
William/Anand/Kursad here before taking this.
-- 
Florian

Re: [PATCH 0/3] ARM: bcm: Enable SMP on the Genexis XG6846B

[William Zhang]

[-- Attachment #1: Type: text/plain, Size: 1931 bytes --]

Hi Linus,

On Mon, Oct 12, 2026 at 1:03 AM Linus Walleij <linusw@kernel.org> wrote:
>
> When booted through CFE and mainline U-Boot, the XG6846B has no PSCI
> provider. CFE powers up CPU1 and leaves it waiting in a holding pen.
>
> Preserve the holding pen, add a board-specific SMP method using CFE's
> GPIO mailbox and a wakeup IPI, and disable the inherited PSCI setup.
> Tested on the XG6846B with both CPUs coming online.
>
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---
> Linus Walleij (3):
>       ARM: dts: broadcom: Preserve the XG6846B CFE holding pen
>       ARM: bcm: Add CFE SMP support for the Genexis XG6846B
>       ARM: dts: broadcom: Use CFE CPU bring-up on the XG6846B
>
>  .../boot/dts/broadcom/bcm6846-genexis-xg6846b.dts  | 15 +++++-
>  arch/arm/mach-bcm/Makefile                         |  2 +-
>  arch/arm/mach-bcm/board_bcmbca.c                   | 53 ++++++++++++++++++++++
>  3 files changed, 68 insertions(+), 2 deletions(-)
> ---
> base-commit: 6356fd3dd29d8b5620507a0ce037c644e052b5dd
> change-id: 20261011-genexis-xg6846-smp-v7-3-rc1-b470f0e20475
>
> Best regards,
> --
> Linus Walleij <linusw@kernel.org>
>

The change ties the implementation to a specific board and includes
GPIO register definitions in the c code.  I suggest we define these
through the dts itself so the code can be generic and apply to other
boards via the dts.

In Broadcom's reference design, we introduce an SMP method for this
GPIO-based smp boot up support:
    enable-method = "brcm,bca-smp"
and implement through the CPU_METHOD_OF_DECLARE(bcm_smp,
"brcm,bca-smp", &bcm_smp_ops). This way we don't have to check the
board id but automatically run the smp init code using dts
"brcm,bca-smp" method.

We can also define gpio register in the cpu node along with the
enable-method property
    cpu-release-addr = <0xFF800568>;

Thanks,
William

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5473 bytes --]

Re: [PATCH 0/3] ARM: bcm: Enable SMP on the Genexis XG6846B

[Linus Walleij]

On Wed, Oct 14, 2026 at 3:11 AM William Zhang
<william.zhang@broadcom.com> wrote:

> The change ties the implementation to a specific board and includes
> GPIO register definitions in the c code.  I suggest we define these
> through the dts itself so the code can be generic and apply to other
> boards via the dts.

Good idea!

> In Broadcom's reference design, we introduce an SMP method for this
> GPIO-based smp boot up support:
>     enable-method = "brcm,bca-smp"
> and implement through the CPU_METHOD_OF_DECLARE(bcm_smp,
> "brcm,bca-smp", &bcm_smp_ops). This way we don't have to check the
> board id but automatically run the smp init code using dts
> "brcm,bca-smp" method.
>
> We can also define gpio register in the cpu node along with the
> enable-method property
>     cpu-release-addr = <0xFF800568>;

ARM64 has this file:
arch/arm64/kernel/smp_spin_table.c

I think we might want to look into doing something the same
generic for ARM.

Yours,
Linus Walleij