Sanitise includes across codebase ...

Enforce full include path for includes. Deprecate old paths.

The following folders inside include/lib have been left unchanged:

- include/lib/cpus/${ARCH}
- include/lib/el3_runtime/${ARCH}

The reason for this change is that having a global namespace for
includes isn't a good idea. It defeats one of the advantages of having
folders and it introduces problems that are sometimes subtle (because
you may not know the header you are actually including if there are two
of them).

For example, this patch had to be created because two headers were
called the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platform
to avoid collision."). More recently, this patch has had similar
problems: 46f9b2c3a282 ("drivers: add tzc380 support").

This problem was introduced in commit 4ecca33988b9 ("Move include and
source files to logical locations"). At that time, there weren't too
many headers so it wasn't a real issue. However, time has shown that
this creates problems.

Platforms that want to preserve the way they include headers may add the
removed paths to PLAT_INCLUDES, but this is discouraged.

Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Initial Spectre V1 mitigations (CVE-2017-5753). ...

Initial Spectre Variant 1 mitigations (CVE-2017-5753).
A potential speculative data leak was found in PSCI code, this depends
on a non-robust implementation of the `plat_get_core_pos_by_mpidr()`
function. This is considered very low-risk. This patch adds a macro to
mitigate this. Note not all code paths could be analyzed with current
tools.

Add a macro which makes a variable 'speculation safe', using the
 __builtin_speculation_safe_value function of GCC and llvm. This will be
available in GCC 9, and is planned for llvm, but is not currently in
mainline GCC or llvm. In order to implement this mitigation the compiler
must support this builtin. Support is indicated by the
__HAVE_SPECULATION_SAFE_VALUE flag.

The -mtrack-speculation option maintains a 'tracker' register, which
determines if the processor is in false speculation at any point. This
adds instructions and increases code size, but avoids the performance
impact of a hard barrier.

Without the -mtrack-speculation option, __builtin_speculation_safe_value
expands to a

    ISB
    DSB SY

sequence after a conditional branch, before the
speculation safe variable is used. With -mtrack-speculation a

    CSEL tracker, tracker, XZR, [cond];
    AND safeval,tracker;
    CSDB

sequence is added instead, clearing the vulnerable variable by
AND'ing it with the tracker register, which is zero during speculative
execution. [cond] are the status flags which will only be true during
speculative execution. For more information on
__builtin_speculation_safe_value and the -mtrack-speculation option see
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/compiler-support-for-mitigations

The -mtracking option was not added, as the performance impact of the
mitigation is low, and there is only one occurence.

Change-Id: Ic9e66d1f4a5155e42e3e4055594974c230bfba3c
Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>

Merge pull request #1624 from glneo/less-cache-flushing ...

PSCI cache flush and comment fixup

psci: platform control of SYSTEM_SUSPEND entry ...

Some platforms can only resume from system suspend from the boot
CPU, hence they should only enter that state from that same core.

The following commit presents an interface that allows the platform to
reject system suspend entry near its very last stage (last CPU).

PSCI: Do not flush cache when unneeded ...

When a platform enables its caches before it accesses the
psci_non_cpu_pd_nodes structure then explicit cache maintenance
is not needed.

Signed-off-by: Andrew F. Davis <afd@ti.com>

PSCI: Update comment on MMU disablement ...

The MMU is not disabled in this path, update the comment to
reflect this. Also clarify that both paths call prepare_cpu_pwr_dwn(),
but the second path does stack cache maintenance.

Signed-off-by: Andrew F. Davis <afd@ti.com>

Mark BL31 initialization functions ...

Mark the initialization functions in BL31, such as context management,
EHF, RAS and PSCI as __init so that they can be reclaimed by the
platform when no longer needed

Change-Id: I7446aeee3dde8950b0f410cb766b7a2312c20130
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

Remove all other deprecated interfaces and files ...

Change-Id: Icd1cdd42afdc78895a9be6c46b414b0a155cfa63
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Remove deprecated file plat_psci_common.c ...

Change-Id: I9fd8016527ad7706494f34356fdae8efacef5f72
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Remove platform compatibility layer ...

Change-Id: I40d040aa05bcbf11536a96ce59827711456b93a8
Co-authored-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

xlat v2: Flush xlat tables after being modified ...

During cold boot, the initial translation tables are created with data
caches disabled, so all modifications go to memory directly. After the
MMU is enabled and data cache is enabled, any modification to the tables
goes to data cache, and eventually may get flushed to memory.

If CPU0 modifies the tables while CPU1 is off, CPU0 will have the
modified tables in its data cache. When CPU1 is powered on, the MMU is
enabled, then it enables coherency, and then it enables the data cache.
Until this is done, CPU1 isn't in coherency, and the translation tables
it sees can be outdated if CPU0 still has some modified entries in its
data cache.

This can be a problem in some cases. For example, the warm boot code
uses only the tables mapped during cold boot, which don't normally
change. However, if they are modified (and a RO page is made RW, or a XN
page is made executable) the CPU will see the old attributes and crash
when it tries to access it.

This doesn't happen in systems with HW_ASSISTED_COHERENCY or
WARMBOOT_ENABLE_DCACHE_EARLY. In these systems, the data cache is
enabled at the same time as the MMU. As soon as this happens, the CPU is
in coherency.

There was an attempt of a fix in psci_helpers.S, but it didn't solve the
problem. That code has been deleted. The code was introduced in commit
<264410306381> ("Invalidate TLB entries during warm boot").

Now, during a map or unmap operation, the memory associated to each
modified table is flushed. Traversing a table will also flush it's
memory, as there is no way to tell in the current implementation if the
table that has been traversed has also been modified.

Change-Id: I4b520bca27502f1018878061bc5fb82af740bb92
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

psci: Use bool in internal interfaces ...

Change-Id: I77c9cd2d1d6d0122cc49917fa686014bee154589
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Fix logic error to skip cache flushing ...

If either USE_COHERENT_MEM or HW_ASSISTED_COHERENCY being true
should cause us to not enter the ifdef block, then the logic
is not correct here. Posibly bad use of De Morgan's law?
Fix this.

Signed-off-by: Andrew F. Davis <afd@ti.com>

PSCI: Fix MISRA defects in common and setup code ...

MISRA C-2012 Rules 10.1, 10.3, 17.8 and 20.7.

Change-Id: I3980bd2a1d845559af4bbe2887a0250d0506a064
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Fix MISRA defects in stat code ...

MISRA C-2012 Rules 10.1, 10.3 and 20.7.

Change-Id: I972ce63f0d8fa157ed17e826b84f218fe498c517
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Fix MISRA defects in MEM_PROTECT ...

MISRA C-2012 Rules 10.1 and 10.3.

Change-Id: I88cd5f56cda5780f2e0ba541c0f5b561309ab3af
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Fix MISRA defects in ON/OFF/SUSPEND/SYSTEM_OFF ...

Fix violations of MISRA C-2012 Rules 8.13, 10.1, 10.3, 17.7 and 20.7.

Change-Id: I6f45a1069b742aebf9e1d6a403717b1522083f51
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Fix types of definitions ...

Also change header guards to fix defects of MISRA C-2012 Rule 21.1.

Change-Id: Ied0d4b0e557ef6119ab669d106d2ac5d99620c57
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Refactor lock macros to comply with MISRA ...

Fix MISRA C-2012 Directive 4.9 defects.

Change-Id: Ibd5364d8f138ddcf59c8074c32b35769366807dc
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Replace macros by static inline functions ...

Fix MISRA C-2012 Directive 4.9 and Rule 21.1 defects.

Change-Id: I96c216317d38741ee632d2640cd7b36e6723d5c2
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Fix MISRA Rule 5.3 Part 2 ...

Use a _ prefix for Macro arguments to prevent that argument from
hiding variables of the same name in the outer scope

Rule 5.3: An identifier declared in an inner scope shall not
          hide an identifier declared in an outer scope

Fixed For:
    make LOG_LEVEL=50 PLAT=fvp

Change-Id: I67b6b05cbad4aeca65ce52981b4679b340604708
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

Merge pull request #1313 from jonathanwright-ARM/jw/MISRA-switch-statements ...

Fix switch statements to comply with MISRA rules

psci: initialize array fully to comply with MISRA ...

Initializes each element of the last_cpu_in_non_cpu_pd array in PSCI
stat implementation to -1, the reset value. This satisfies MISRA rule
9.3.

Previously, only the first element of the array was initialized to -1.

Change-Id: I666c71e6c073710c67c6d24c07a219b1feb5b773
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

lib: fix switch statements to comply with MISRA rules ...

Ensure (where possible) that switch statements in lib comply with MISRA
rules 16.1 - 16.7.

Change-Id: I52bc896fb7094d2b7569285686ee89f39f1ddd84
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

Rename 'smcc' to 'smccc' ...

When the source code says 'SMCC' it is talking about the SMC Calling
Convention. The correct acronym is SMCCC. This affects a few definitions
and file names.

Some files have been renamed (smcc.h, smcc_helpers.h and smcc_macros.S)
but the old files have been kept for compatibility, they include the
new ones with an ERROR_DEPRECATED guard.

Change-Id: I78f94052a502436fdd97ca32c0fe86bd58173f2f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Merge pull request #1282 from robertovargas-arm/misra-changes ...

Misra changes

Fix MISRA rule 8.3 in common code ...

Rule 8.3: All declarations of an object or function shall
          use the same names and type qualifiers.

Change-Id: Iff384187c74a598a4e73f350a1893b60e9d16cec
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>

Invalidate TLB entries during warm boot ...

During the warm boot sequence:

1. The MMU is enabled with the data cache disabled. The MMU table walker
   is set up to access the translation tables as in cacheable memory,
   but its accesses are non-cacheable because SCTLR_EL3.C controls them
   as well.
2. The interconnect is set up and the CPU enters coherency with the
   rest of the system.
3. The data cache is enabled.

If the support for dynamic translation tables is enabled and another CPU
makes changes to a region, the changes may only be present in the data
cache, not in RAM. The CPU that is booting isn't in coherency with the
rest of the system, so the table walker of that CPU isn't either. This
means that it may read old entries from RAM and it may have invalid TLB
entries corresponding to the dynamic mappings.

This is not a problem for the boot code because the mapping is 1:1 and
the regions are static. However, the code that runs after the boot
sequence may need to access the dynamically mapped regions.

This patch invalidates all TLBs during warm boot when the dynamic
translation tables support is enabled to prevent this problem.

Change-Id: I80264802dc0aa1cb3edd77d0b66b91db6961af3d
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Add support for SMCCC_VERSION in PSCI features ...

On some platforms it may be necessary to discover the SMCCC version
via a PSCI features call.

Change-Id: I95281ac2263ca9aefda1809eb03464fbdb8ac24d
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>

Add PubSub events for CPU powerdown/powerup ...

The suspend hook is published at the start of a CPU powerdown
operation.  The resume hook is published at the end of a CPU powerup
operation.

Change-Id: I50c05e2dde0d33834095ac41b4fcea4c161bb434
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>