I have been stuck at this problem for more than a week. Hopefully good folks here can help clarify a few things.

Platform 4x Cortex A55 single cluster.

What I got working:

1. I can boot single core kernel to shell using TFA bl31

    Baremetal (bare minimum startup + platform specific SOC enablement, EL3) -> TFA bl31 -> Kernel

2. I added PSCI in DT and can see the hook trigger service and hotplug secondary core in.

Secondary core woke up:

1. Bare minimum startup (skip SOC specific enablement) -> TFA bl31 -> go thru 'plat_secondary_cold_boot_setup' path, using 'RESET_TO_BL31:=1' 

Now, I am not sure how from there, the secondary core would jump to:

a. If jump to kernel's 'secondary_holding_pen' it looks like it would drop from EL3 -> EL1 and wait (however at this point Core0 is already in cpu_idle) and won't continue

    a.1 For this case, I am also not sure why I hit "instruction abort" in core1 - from what I read MMU hasnt been set up, which is true. I also wonder at what point MMU is set up for this path in the secondary core?

b. If jump to 'secondary_entry' I believe the core is still in EL3 at this point and I will get an exception at 'set_cpu_boot_mode_flag'

c. If someone can summarize what are the minimum requirements for the secondary core to get set up before jumping to 'secondary_holding_pen'/'secondary_entry' whichever is applicable.

Any pointers would be much appreciated.

ps: I have access to Trace32.