When newer GD32 application firmware jumps into original bootloader
firmware, the bootloader firmware gets stuck in exception. This is
because newer firmware enables some interrupts which the original
bootloader firmware does not disable before enabling interrupt flag.

Disabling all NVIC interrupts before going to other program solves this
issue.

Signed-off-by: Marek Behún <kabel@kernel.org>

Signed-off-by: Marek Behún <kabel@kernel.org>

Make the LED color structure (containing color channel values) a named
type (rgb_t) and use anonymous union to support accessing all channels
at once via 32 bit value, i.e.:

  rgb_t color;

  color.r = 0xff;
  color.g = 0x80;
  color.b = 0x00;

is equivalent to

  color.rgb = 0xff8000;

Signed-off-by: Marek Behún <kabel@kernel.org>

Signed-off-by: Marek Behún <kabel@kernel.org>

Signed-off-by: Marek Behún <kabel@kernel.org>

Signed-off-by: Marek Behún <kabel@kernel.org>

Add the ability to enable/disable USB port over-current protection and
to set the auto-enable timeout.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Currently if an USB port over-current event occurs, the port power is
disabled and a timer is started to auto-enable the port in one second.

The problem is that the same timer is used for both USB ports.

Instead of using a timer handle the auto-enablement in SysTick handler.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

The 16 bits of features are not enough. Enlarge it to 32 bits, but make
it so that it is backwards compatible with older tools.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add support for per-LED color correction when gamma correction is
enabled.

Currently we have a static gamma table for the red channel and another
table for green a blue channel. The PWM duty cycle of a channel is
then taken directly from these tables, i.e.:
  pwm_duty_r = gamma_table_r[channel_value_r]
  pwm_duty_g = gamma_table_g[channel_value_g]
  pwm_duty_b = gamma_table_b[channel_value_b]

But there are two problems:
- the gamma tables do not work correctly for old boards, because the
  LEDs on those boards have different properties after long hours of use
- this model does not work when some LEDs have been in use far more than
  others and so may be dimmer

Change this model so that there is only one gamma table (per
architecture), and the PWM duty of a LED channel is computed with a
per-LED correction:
  pwm_duty = (gamma_table[channel_value] * correction + rounding) / 4096
The correction parameter can be set different for each LED and each
channel, and the rounding parameter is common.

The default values are chosen so that there is minimal difference from
the previous model (only green and blue PWM duty cycles may be computed
differently, and this happens only for around 30 channel_values, and the
offset from the previous model is at most by 1).

This affects the efficiency of the led_set_color() function. When gamma
correction is enabled, the function is around 4x slower when setting
color on all LEDs, and around 1.7x slower when setting color on one LED.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Now that LTO is enabled for GD32, we can enable TRNG in the bootloader
and the resulting binary is still small enough to fit in the 11 KiB
space reserved for bootloader.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Enable Link Time Optimizations for STM32 and GD32. This is most useful
for GD32 bootloader, where the size of the binary was already reaching
the limit of 11 KiB (with LTO the binary is currently around 9.5 KiB).

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

For each collected random sequence do a simple randomness test:
- count the 1s in the sequnce
- count the changes in the sequence
If you on these two are too much away from the expected value of 256,
reject the sequence. Take the limit such that on average we will reject
only 1 sequence per year.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Implement true random number generator for STM32 and GD32. This works by
sampling the internal temperature sensor with ADC, taking the last bit
of each sample, and passing these collected bits via Von Neumann filter.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Implement finite blinking pattern and use it from
power_control_first_startup() instead of sleeping there.

This is needed because on MKL the I2C driver is handled in thread, and
if a factory reset is selected, power_control_first_startup() sleeps for
1.5 seconds blinking the selected reset, and U-Boot cannot communicate
with the MCU via I2C for these 1.5 seconds.

This also fixes the issue wherein if LED driver brightness is set to
zero and a light reset occurs, the knight rider reset pattern is not
shown immediately. Instead it is shown after the LED driver brightness
is first changed to non-zero value.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

This simplifies the main loop.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

There is currently a bug in reporting power on error. If a voltage
regulator fails to power on during power on sequence, an error should be
reported by blinking a LED corresponding to that regulator 5 times in
red. But the code handling this is currently in conflict with LED
pattern code: the error_manager() code sets the color and state of the
LED and sleeps to blink, but the LED pattern interrupt in the meantime
overwrites LED states.

Implement LED blinking as another special LED pattern than can be
triggered and use it instead of blinking the LED in error_manager().

Signed-off-by: Marek Behún <marek.behun@nic.cz>

If the compiler knows the values that are to be passed into the CRC
engine, it can push the data into CRC data register too fast, resulting
in invalid CRC calculation. To prevent this, uninline the crc32_plat()
function.

This behavior was seen on GD32. Do it also for STM32 just to be sure.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Handle the general control command hard reset request directly in
i2c_iface driver instead of communicating the request to main loop.
and bootloader

This allows us to simplify bootloader request.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

For security purposes forbid flashing bootloader firmware for now.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add new I2C commands CMD_BOARD_INFO_GET and CMD_BOARD_INFO_BURN to read
/ program board information.

These commands are only available if the FEAT_BOARD_INFO bit is set in
features.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Implement board information programming and reading. The board
information structure contains a 64 bits long serial number, board MAC
address (only the first one, other MAC addresses are computed from the
first one by incrementing it), and 8 bits long board revision number.

The structure is stored in Program Once Field of the flash IFR. There
are 4 slots for board information structure, in case of a failure during
burning.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add new I2C commands to support message signing with board private key.
The ECDSA signature algorithm is used with NIST256p elliptic curve.

These commands are available if the FEAT_CRYPTO bit is set in features.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Implement secure board private key generation and storage into flash
Program Once Fields, syscalls to sign messages with this private key, a
syscall to get board public key, and set the flash into secure mode so
that the private key cannot be read via MCU debug interface.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add synchronous functions to access the Program Once Fields of the flash
IFR.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add the trng_collect_entropy_sync() function, which synchronously wait
for the entropy to be produced by TRNG and then collects it.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Add a function that computes ECDSA public key (in compressed form) given
an elliptic curve definition and a private key.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Implement firmware signature verification. Application firmware
signature is verified in bootloader before jumping to application.
The firmware is also verified before flashing.

Add a new utility tools/signing.py which is used to append a signture to
firmware binaries.

Signed-off-by: Marek Behún <marek.behun@nic.cz>

Signed-off-by: Marek Behún <marek.behun@nic.cz>