Send the FF-A power management messages from the SPMD to the SPMC and partitions

[aidangarske]

Context

DEN0077A 1.2 section 18.2.4 requires the SPMD to inform the SPMC of every CPU_OFF, CPU_SUSPEND, SYSTEM_OFF, SYSTEM_RESET, SYSTEM_RESET2 and SYSTEM_SUSPEND. The AArch64 monitor currently completes these without a message; this was deferred from the AArch64 support PR and is recorded as unsupported in docs/FF-A-Compatibility.md.

Origin

PR #29, Skoll FF-A lens (DEN0077A 18.2.4, Tables 18.6 to 18.8)

What is needed

• SPMD: validate the PSCI call, send the Table 18.6 framework direct request to the SPMC, complete the operation on SUCCESS and return DENIED otherwise, preserving x4-x17
• SPMD: refuse any other SPMC request to switch to the Normal world while a message is outstanding
• SPMC: forward to partitions registered for that operation (waiting state, SPMC-scheduled mode), answer with Table 18.8, DENIED if any partition denies and for CPU_OFF while the SPMC is resident
• SPMC: deny FFA_RUN, FFA_YIELD and direct requests from a partition while it processes the message
• Manifest: optional power_management list of PSCI operations in the FF-A section, direct messaging only
• Table 18.7 warm-boot message once a power-down state or warm boot exists

Blockers and dependencies

None for the single-core SPMC. The warm-boot message waits on multi-core or power-down support.

Acceptance criteria

• Host rows for the Table 18.6 and 18.8 encodings, the SPMD round trip, and the manifest field
• psci, psci-el2, resetneg and ffa-preempt show the message and response on all three QEMU machines with both engines
• New negative scenario where a partition answers DENIED and CPU_SUSPEND returns DENIED
• The unsupported row in docs/FF-A-Compatibility.md becomes an implemented row

[aidangarske]

W7 landed on wolfTrust-dev2 (PR #29) in b3587f0

• The SPMD sends the SPMC the Table 18.6 framework message for every valid CPU_SUSPEND, CPU_OFF, SYSTEM_OFF and SYSTEM_RESET. It completes the call only on a Table 18.8 SUCCESS with w4-w7 zero. Any other answer returns DENIED, with x4-x17 preserved.
• While the message is outstanding, the SPMD refuses the SPMC's FFA_MSG_WAIT, FFA_YIELD and FFA_NORMAL_WORLD_RESUME with DENIED.
• The SPMC denies CPU_OFF because it is resident on the only core, and grants the rest.
• Host rows in tests/host/ffa_spmd cover the encodings and the SPMD's handling of each answer.
• psci, psci-el2, el2dirtyneg, ffa-preempt and resetneg assert the message and response on virt GICv3 and GICv2 and on versal-virt, with both engines. The CPU_OFF round trip is the DENIED path.
• Not done, recorded as unsupported in docs/FF-A-Compatibility.md:
  • forwarding to partitions and the optional power_management manifest field, because manifest partitions take no FF-A messages and none could receive one;
  • the Table 18.7 warm-boot message, because no power-down state or warm boot exists yet.