This patch removes support to secure the on-chip TZSRAM memory for
Tegra186 and Tegra194 platforms as the previous bootloader does that
for them.

Change-Id: I50c7b7f9694285fe31135ada09baed1cfedaaf07
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

TZSRAM loses power during System suspend, so the entire contents
are copied to TZDRAM before Sysem Suspend entry. The warmboot code
verifies and restores the contents to TZSRAM during System Resume.

This patch removes the code that sets up CPU vector to point to
TZSRAM during System Resume as a result. The trampoline code can
also be completely removed as a result.

Change-Id: I2830eb1db16efef3dfd96c4e3afc41a307588ca1
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

The BL3-1 firmware code is stored in TZSRAM on Tegra186 platforms. This
memory loses power when we enter System Suspend and so its contents are
stored to TZDRAM, before entry. This opens up an attack vector where the
TZDRAM contents might be tampered with when we are in the System Suspend
mode. To mitigate this attack the SE engine calculates the hash of entire
TZSRAM and stores it in PMC scratch, before we copy data to TZDRAM. The
WB0 code will validate the TZDRAM and match the hash with the one in PMC
scratch.

This patch adds driver for the SE engine, with APIs to calculate the hash
and store SE SHA256 hash-result to PMC scratch registers.

Change-Id: Ib487d5629225d3d99bd35d44f0402d6d3cf27ddf
Signed-off-by: Jeetesh Burman <jburman@nvidia.com>

This patch corrects the logic to read the uncore command/response bits
from the command/response values. The previous logic tapped into incorrect
bits leading to garbage counter values.

Change-Id: Ib8327ca3cb3d2086bb268e9a5366865cdf35b493
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch modifies the timeout loop to use udelay() instead of
mdelay(). This helps with the boot time on some platforms which
issue a lot of MCE calls and every mdelay adds up increasing the
boot time by a lot.

Change-Id: Ic50081b73e1cbc2714361235b5c396e294b8f752
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

MISRA Rule 10.3, the value of an expression shall not be assigned to
an object with a narrower essential type or of a different essential
type category.

The essential type of a enum member is anonymous enum, the enum member
should be casted to the right type when using it.

Both UL and ULL suffix equal to uint64_t constant in compiler
aarch64-linux-gnu-gcc, to avoid confusing, only keep U and ULL suffix
in platform code. So in some case, cast a constant to uint32_t is
necessary.

Change-Id: I1aae8cba81ef47481736e7f95f53570de7013187
Signed-off-by: Anthony Zhou <anzhou@nvidia.com>

This patch changes direct writes to ACTLR_ELx registers to use
read-modify-write instead.

Change-Id: I6e0eaa6974583f3035cb3724088f3f1c849da229
Signed-off-by: Steven Kao <skao@nvidia.com>

This patch removes unused type conversions as all the relevant macros
now use U()/ULL(), making these explicit typecasts unnecessary.

Change-Id: I01fb534649db2aaf186406b1aef6897662b44fe3
Signed-off-by: Anthony Zhou <anzhou@nvidia.com>

This patch removes unwanted error prints from the MCE command
handler, to reduce the code complexity for this function.

Tested with 'pmccabe'

Change-Id: I375d289db1df9e119eeb1830210974457c8905a4
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch fixes MISRA defects for the MCE driver.

* Using logical NOT for bool type function
* Using MPIDR_AFFLVL_MASK << MPIDR_AFFINITY_BITS replace
  MPIDR_CLUSTER_MASK

Change-Id: I97e96f172a3c1158646a15a184c273c53a103d63
Signed-off-by: Anthony Zhou <anzhou@nvidia.com>

Enforce full include path for includes. Deprecate old paths.

The following folders inside include/lib have been left unchanged:

- include/lib/cpus/${ARCH}
- include/lib/el3_runtime/${ARCH}

The reason for this change is that having a global namespace for
includes isn't a good idea. It defeats one of the advantages of having
folders and it introduces problems that are sometimes subtle (because
you may not know the header you are actually including if there are two
of them).

For example, this patch had to be created because two headers were
called the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platform
to avoid collision."). More recently, this patch has had similar
problems: 46f9b2c3a282 ("drivers: add tzc380 support").

This problem was introduced in commit 4ecca33988b9 ("Move include and
source files to logical locations"). At that time, there weren't too
many headers so it wasn't a real issue. However, time has shown that
this creates problems.

Platforms that want to preserve the way they include headers may add the
removed paths to PLAT_INCLUDES, but this is discouraged.

Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

All identifiers, regardless of use, that start with two underscores are
reserved. This means they can't be used in header guards.

The style that this project is now to use the full name of the file in
capital letters followed by 'H'. For example, for a file called
"uart_example.h", the header guard is UART_EXAMPLE_H.

The exceptions are files that are imported from other projects:

- CryptoCell driver
- dt-bindings folders
- zlib headers

Change-Id: I50561bf6c88b491ec440d0c8385c74650f3c106e
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

The codebase was using non-standard headers. It is needed to replace
them by the correct ones so that we can use the new libc headers.

Change-Id: I530f71d9510cb036e69fe79823c8230afe890b9d
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Since commit 031dbb122472 ("AArch32: Add essential Arch helpers"),
it is difficult to use consistent format strings for printf() family
between aarch32 and aarch64.

For example, uint64_t is defined as 'unsigned long long' for aarch32
and as 'unsigned long' for aarch64.  Likewise, uintptr_t is defined
as 'unsigned int' for aarch32, and as 'unsigned long' for aarch64.

A problem typically arises when you use printf() in common code.

One solution could be, to cast the arguments to a type long enough
for both architectures.  For example, if 'val' is uint64_t type,
like this:

  printf("val = %llx\n", (unsigned long long)val);

Or, somebody may suggest to use a macro provided by <inttypes.h>,
like this:

  printf("val = %" PRIx64 "\n", val);

But, both would make the code ugly.

The solution adopted in Linux kernel is to use the same typedefs for
all architectures.  The fixed integer types in the kernel-space have
been unified into int-ll64, like follows:

    typedef signed char           int8_t;
    typedef unsigned char         uint8_t;

    typedef signed short          int16_t;
    typedef unsigned short        uint16_t;

    typedef signed int            int32_t;
    typedef unsigned int          uint32_t;

    typedef signed long long      int64_t;
    typedef unsigned long long    uint64_t;

[ Linux commit: 0c79a8e ]

This gets along with the codebase shared between 32 bit and 64 bit,
with the data model called ILP32, LP64, respectively.

The width for primitive types is defined as follows:

                   ILP32           LP64
    int            32              32
    long           32              64
    long long      64              64
    pointer        32              64

'long long' is 64 bit for both, so it is used for defining uint64_t.
'long' has the same width as pointer, so for uintptr_t.

We still need an ifdef conditional for (s)size_t.

All 64 bit architectures use "unsigned long" size_t, and most 32 bit
architectures use "unsigned int" size_t.  H8/300, S/390 are known as
exceptions; they use "unsigned long" size_t despite their architecture
is 32 bit.

One idea for simplification might be to define size_t as 'unsigned long'
across architectures, then forbid the use of "%z" string format.
However, this would cause a distortion between size_t and sizeof()
operator.  We have unknowledge about the native type of sizeof(), so
we need a guess of it anyway.  I want the following formula to always
return 1:

  __builtin_types_compatible_p(size_t, typeof(sizeof(int)))

Fortunately, ARM is probably a majority case.  As far as I know, all
32 bit ARM compilers use "unsigned int" size_t.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

The type `unsigned long` is 32 bit wide in AArch32, but 64 bit wide in
AArch64. This is inconsistent and that's why we avoid using it as per
the Coding Guidelines. This patch changes all `UL` occurrences to `U`
or `ULL` depending on the context so that the size of the constant is
clear.

This problem affected the macro `BIT(nr)`. As long as this macro is used
to fill fields of registers, that's not a problem, since all registers
are 32 bit wide in AArch32 and 64 bit wide in AArch64. However, if the
macro is used to fill the fields of a 64-bit integer, it won't be able
to set the upper 32 bits in AArch32.

By changing the type of this macro to `unsigned long long` the behaviour
is always the same regardless of the architecture, as this type is
64-bit wide in both cases.

Some Tegra platform files have been modified by this patch.

Change-Id: I918264c03e7d691a931f0d1018df25a2796cc221
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

This fix modifies the order of system includes to meet the ARM TF coding
standard. There are some exceptions to this change in order to retain
header groupings and where there are headers within #if statements.

Change-Id: Ib5b668c992d817cc860e97b29e16ef106d17e404
Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>

Main fixes:

* Added explicit casts (e.g. 0U) to integers in order for them to be
  compatible with whatever operation they're used in [Rule 10.1]
* Force operands of an operator to the same type category [Rule 10.4]
* Added curly braces ({}) around if/while statements in order to
  make them compound [Rule 15.6]
* Added parentheses [Rule 12.1]
* Voided non C-library functions whose return types are not used [Rule 17.7]

Change-Id: I91404edec2e2194b1ce2672d2a3fc6a1f5bf41f1
Signed-off-by: Anthony Zhou <anzhou@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch enables the 'sign-compare' flag, to enable warning/errors
for comparisons between signed/unsigned variables. The warning has
been enabled for all the Tegra platforms, to start with.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

To make software license auditing simpler, use SPDX[0] license
identifiers instead of duplicating the license text in every file.

NOTE: Files that have been imported by FreeBSD have not been modified.

[0]: https://spdx.org/

Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761a
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

This patch adds max retries for all ARI requests and asserts
if the ARI request is still busy.

Change-Id: I454ad9b557bb59e513e4c0c6f071275c87d0e07a
Signed-off-by: Steven Kao <skao@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Not having U or ULL as a suffix for these enums causes
a lot of unnecessary MISRA issues. This patch adds U or
ULL suffix to these common enums to reduce number of
MISRA issues.

Signed-off-by: Anthony Zhou <anzhou@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

GCC version 4.8 (and presumably earlier) warn when non-standard types are
used for bitfield definitions when -pedantic is enabled. This prevents TF
from being built with such toolchains, since -Werror -pedantic options are
used.

gcc-4.9 removed this warning; -pedantic is intended to cause gcc to emit a
warning in all cases required by the standard, but the standard does not
require a warning in this case.

See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57773

Signed-off-by: Stephen Warren <swarren@nvidia.com>

This ARI call enables the EDBGREQ feature in the CCPLEX,
which will cause the CPUs to enter debug state instead of
vectoring to sw (ie MCA handler) upon receiving an async
abort signal.

Change-Id: Ifcb0e11446b6ac55179e3350d8f02b60ba32c94d
Signed-off-by: Rich Wiley <rwiley@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch updates the ARI header file to v3.1.

Change-Id: I3e58cf50d27fb6e72062bb9d9782b75296b32025
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch moves the smmu driver introduced by the Tegra186 port
to tegra/common so that future chips can (re)use it.

Change-Id: Ia44c7f2a62fb2d8869db3a44742a8c6b13c49036
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch splits the MCE driver into public and private interfaces
to allow usage of common functionality across multiple SoCs.

Change-Id: Ib58080e730d72f11ff79507d8e0acffb2ad5c606
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch moves the MCE's configurable parameters to tegra_def.h for
the Tegra186 SoC, to allow forward compatiblity.

Change-Id: If8660c1c09908a4064dbb67d5ca4fb78389cab13
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

The TEGRA_ARI_COPY_MISCREG_AA64_RST ARI should be called with
request_lo/hi set to zero. MTS automatically takes the reset
vector from MISCREG_AA64_RST register and does not need it to
be passed as parameters.  This patch updates the API and the
caller function accordingly.

Change-Id: Ie3e3402d93951102239d988ca9f0cdf94f290d2f
Signed-off-by: Krishna Sitaraman <ksitaraman@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch updates the ARI header to version 3.0

Change-Id: I7cfe0c61c80a6b78625232135dd63393602d32fe
Signed-off-by: Krishna Sitaraman <ksitaraman@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This change adds function to invoke for MISC_CCPLEX ARI calls and
the corresponding smc handler. This can be used to enable/disable
Coresight clock gating.

Change-Id: I4bc17aa478a46c29bfe17fd74f839a383ee2b644
Signed-off-by: Krishna Sitaraman <ksitaraman@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>