treewide: remove references to CREDITS ...

The CREDITS file was removed from barebox in 2015 by commit 6570288f2d97
("Remove the CREDITS file"). Remove references to it from several files.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: sm.c: add the attribute 'volatile' to some asm() statements. ...

Prevent the compiler to eventually cache register values read/written
to/from CP15.

Signed-off-by: Giorgio Dal Molin <giorgio.nicole@arcor.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: i.MX: fixed enabling the MMU after switching in non secure mode. ...

The Domain Access Control Register (DACR) in CP15 is banked between
secure and non secure mode: there a copy of the reg. in secure mode and a
second copy in non secure mode.
As barebox boots on the imx7 SOC it runs in secure mode and initializes
the secure-mode copy of DACR (with 0x00000001).
After switching to non secure mode, for example with the command 'smc -n'
or while booting a kernel image with global.bootm.secure_state=nonsecure,
the active value of DACR is the copy in non-secure mode and that copy
was still uninitialized and in an UNKNOWN state.

This caused the cpu to hang as soon as the MMU was enabled in non-secure
mode.

We fix this by reading the DACR value in secure mode just before switching
to non secure and then initializing it again with the same value.

Signed-off-by: Giorgio Dal Molin <giorgio.nicole@arcor.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: Drop unused macros in exceptions.S ...

Those macros looks like a leftover from the time Barebox had some code
to deal with IRQs. That code is gone and there are no users for those
macros in the codebase anymore. Drop them.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

arm64: Set PXN/UXN attributes for uncached mem ...

The attributes should be set to avoid speculative access to memory-mapped
peripherals.

The patch has been tested with:

noinline unsigned long nox(void)
{
	return get_pc();
}

static void xn_test(void)
{
	void *adr = (void *)SOME_SRAM_ADDRESS;
	unsigned long ret;
	unsigned long (*fn)(void) = adr;

	memcpy(adr, nox, 0x1000);

	sync_caches_for_execution();

	ret = fn();
	printf("pc: 0x%08lx\n", ret);
}

Without this patch nox() gets executed in SRAM, with it runs into a
abort as expected.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM64: attribute argument to create_sections() is 64bit ...

The attribute argument to create_sections() is 64bit, so pass in a
64bit variable. This is done in preparation for using some of the upper
bits in the (UN)CACHED_MEM defines.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM64: Setup vectors in all lower execption levels ...

barebox on ARM64 often changes the exception level when loading a TF-A
or other secure monitor firmware. Make sure we have setup the vector
table in the exception level we then end up in.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: i.MX: external NAND boot: Leave icache disabled ...

It seems running from the NFC SRAM doesn't work with the instruction
cache enabled, it leads to corruptions on the i.MX27. We stumbled upon
this earlier and the solution at that time was to disable the
instruction cache in the NAND boot code. It is, however, more reliable
to just not enable the instruction cache in the first place.
This is not particularly nice as we have to ifdef this in generic code,
duplicate arm_cpu_lowlevel_init(), or call arm_cpu_lowlevel_init() later
when we are out of NFC SRAM. From the different bad solutions I chose
to ifdef the instruction cache away. It will be enabled later in the
common cache functions.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Merge branch 'for-next/rpi'

ARM: cache_64: invalidate icache in arm_early_mmu_cache_flush ...

So far arm_early_mmu_cache_flush has only been used in preparation for
executing newly-written code. For this reason, on ARMv7 and below,
it had always invalidate the icache after the dcache flush.
We don't do this on ARM64, but sync_caches_for_execution depends on this,
which had this comment that didn't hold true for ARM64:

> Despite the name arm_early_mmu_cache_flush not only flushes the
> data cache, but also invalidates the instruction cache.

It might be worthwhile to decouple dcache flushing from icache
invalidation, but for now, align what we do on ARM64 with what we do for
32-bit ARMs.

This fixes a potential read of stale instructions when loading
second-stage barebox from the PBL with MMU disabled.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: cache_64: invalidate dcache in arm_early_mmu_cache_invalidate ...

On some ARM cores, cache contents are indeterminate after a Power-On
Reset. Turning on the MMU on such cores risks interpreting random cache
lines as valid, causing hard-to-debug errors.

For this reason, we always invalidate the dcache on <= ARMv7. Let's do
likewise for ARM64. Newer ARM cores tend to come up with their dcaches
invalidated already, but for some, like the Cortex-A72, L2 caches are
invalidated dependent on a signal sampled at reset, so better play
it safe.

The icache invalidate here seems to serve no useful purpose. It's kept
for now for symmetry with ARM32.

Note that this is wrong should barebox be entered with the MMU enabled,
but this is so far not the case with any ARM64 platform we support.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM64: entry: save/restore potentially clobbered registers ...

While the comment is correct that currently arm_early_mmu_cache_invalidate()
is only a call to to v8_invalidate_icache_all() , which doesn't clobber x0-x2,
this starts to fall apart as soon as we do something more in this function.

Make sure to properly save/restore the parameters passed to the entry function.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

device: Introduce dma_offset ...

For devices that do not have a 1:1 mapping between DMA and CPU we need a
dma_offset. This adds dma_offset to struct device_d and starts honoring
it in ARM dma_(un)map_single(). Also we add some comments to functions
that would normally need a device argument to make the DMA <-> CPU
translations device specific.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Merge branch 'for-next/randfixes'

ARM: psci: declare locally used functions as static ...

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: implement CONFIG_PBL_BREAK for ARM64 ...

ARM64 uses a different assembler mnemonic for the breakpoint.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: move into ARM32 specific optee kernel start into lib32 dir ...

Otherwise it may also get built on a ARM64 config, which obviously
fails.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM64: Switch to 4 level page tables ...

3 level page tables only allow to resolve 39 bit addresses. Switch to 4
level page tables to add support for bigger physical address ranges.
This is needed for example on Layerscape SoCs where the PCI windows are
outside the 39bit range.

The early MMU support still uses 39bit addressing. We only use a single
level page table in early MMU support and with 48bit addresses we
wouldn't have enough granularity to map the SDRAM differently then the
rest of the address space.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: cpu: dtb: remove unused declaration ...

We no longer use __dtb_start on ARM and the declaration is unused in the
file. Drop it.
No functional change.

Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

commands: smc: verify PSCI_POWER_ON with interprocessor handshake ...

The use of psci_printf here, at least for the phytec-phycore-imx7,
is racy, because access to the UART is not synchronized. This may
lead to characters being swallowed and most certainly to garbled
text. One way around this would be using separate UART ports for
each core or even more generically, just dropping psci_printf and
resorting to inter-core communication over shared-memory to check
whether code execution succeeded.

Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: psci: factor out smc command into commands/ ...

So far, the smc command was only usable when barebox also provides the
secure monitor. It's useful to have it when barebox is a PSCI consumer
as well to test whether the secure monitor works.
Factor out the code into commands/ in preparation to do so.
No functional change.

Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: start: check for machine type last ...

A valid DTB may reside low in the Barebox binary address map. If this
binary is started at a very low address, we might mistake the pointer
for a machine type. Make sure to check for all other possibilities first
before interpreting the boarddata as a raw machine type.

Fixes: 19c24e2f0121 (ARM: start: Allow to pass machine type as boarddata)
Signed-off-by: Lucas Stach <dev@lynxeye.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: mmu-early: On i.MX6 with HAB map ROM is mapped without XN ...

On i.MX6 with HAB enabled we call into the ROM later in
imx6_hab_get_status(). This only works when the XN bit is not set for
this area, so remap the first MiB as cached which doesn't have the XN
bit set.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: psci: implement PSCI client driver ...

System reset on the STM32MP may be done via PSCI when running TF-A
as first-stage boot loader. Provide a PSCI driver to simplify using it:

- A psci_invoke function is exported, so other code can use it
- A fixup for the PSCI device tree node is registered
- A reset and poweroff handler via PSCI is registered for PSCI >= v0.2

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: psci: wire in smc command help ...

The smc command has a help defined, but unused. Wire it in, so
help smc and smc -invalidoption work as expected.

While at it, remove the unimplemented -z option. It's unneeded,
because -c turns off the CPU after starting it again already.
Also it seems it's not implementable without interprocessor communication,
which is probably overkill here.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: psci: use CONFIG_ARM_PSCI_DEBUG for smc command ...

There's already an option to use when debugging PSCI. Instead of
requiring users to #define DEBUG 1 as well, have the smc command be
usable when CONFIG_ARM_PSCI_DEBUG, not DEBUG is defined.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: psci: translate PSCI error codes in smc command ...

For more usability, translate CPU_ON error codes into the error
descriptions found in the PSCI Platform Design Document[1].

[1]: http://infocenter.arm.com/help/topic/com.arm.doc.den0022d/Power_State_Coordination_Interface_PDD_v1_1_DEN0022D.pdf

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Merge branch 'for-next/mxs'

ARM: mmu: use client domain permissions to support ARMv7 eXecute Never ...

The ARM Architecture Reference Manual notes[1]:
> When using the Short-descriptor translation table format, the XN
> attribute is not checked for domains marked as Manager.
> Therefore, the system must not include read-sensitive memory in
> domains marked as Manager, because the XN bit does not prevent
> speculative fetches from a Manager domain.

To avoid speculative access to read-sensitive memory-mapped peripherals
on ARMv7, let's use client domain permissions for all memory, so the XN
bit (and also R/W bits) can function.
This aligns us with what Linux is doing on ARMv7.

This fixes cache corruption instances that had been observed on the
i.MX6UL(L) when the instruction prefetcher speculates into memory following
the end of a 512M SDRAM[2].

While this is not necessary to avoid speculative accesses on < ARMv7,
we could probably have everything there in client domain as well, but
due to lack of test coverage, we'll restrict the change to ARMv7.

[1]: B3.7.2 - Execute-never restrictions on instruction fetching
[2]: "Cache Corruption on MX6UL(L)": https://community.nxp.com/thread/511925

Fixes: 0198567c4 ("ARM: mmu: mark uncached regions as eXecute never on v7")
Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

ARM: mmu: set R/W bits in ARMv7 translation table ...

With barebox using the manager permissions for domain 0 that's used for
all page table entries and directories, we never had the need so far to
explicitly set R/W bits. We did so anyway for sections in the early MMU
code, but later on in the normal MMU setup, we didn't do so consistently.

In preparation for switching to DOMAIN_CLIENT for ARMv7, configure R/W
everywhere in normal MMU code as well.

Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>