Merge "Measured Boot Driver: Fix MISRA-C 2012 defects" into integration

Crypto library: Migrate support to MbedTLS v2.24.0 ...

This patch migrates the mbedcrypto dependency for TF-A
to mbedTLS repo v2.24.0 which is the latest release tag.
The relevant documentation is updated to reflect the
use of new version.

Change-Id: I116f44242e8c98e856416ea871d11abd3234dac1
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

drivers: arm: gicv3: Allow detecting number of cores ...

A GICv3 interrupt controller will be instantiated for a certain number
of cores. This will result in the respective number of GICR frames. The
last frame will have the "Last" bit set in its GICR_TYPER register.

For platforms with a topology unknown at build time (the Arm FPGAs, for
instance), we need to learn the number of used cores at runtime, to size
the GICR region in the devicetree accordingly.

Add a generic function that iterates over all GICR frames until it
encounters one with the "Last" bit set. It returns the number of cores
the GICv3 has been configured for.

Change-Id: I79f033c50dfc1c275aba7122725868811abcc4f8
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

Measured Boot Driver: Fix MISRA-C 2012 defects ...

This patch fixes MISRA C-2012 Pointers and Arrays
Rule 18.4 defects reported by Coverity scan:
"misra_c_2012_rule_18_4_violation: Using arithmetic on pointer "

Change-Id: I06753b28467c473e346b9871c1657284fc43a3f3
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Merge changes from topic "stm32_drivers_update" into integration ...

* changes:
  clk: stm32mp1: fix rcc mckprot status
  drivers: st: add missing includes in ETZPC header
  mmc: st: clear some flags before sending a command
  mmc: st: correct retries management
  nand: raw_nand: fix timeout issue in nand_wait_ready
  mtd: spi_nor: change message level on macronix detection
  gpio: stm32_gpio: check GPIO node status after checking DT
  crypto: stm32_hash: fix issue when restarting computation

clk: stm32mp1: fix rcc mckprot status ...

MCKPROT hardening in RCC mandates that both bits RCC[TZEN] and
RCC[MCKPROT] are enabled. This change fixes stm32mp1_rcc_is_mckprot()
to check both bits, not RCC[MCKPROT] only.

This change also updates stm32mp1_rcc_is_secure() for consistency.

Change-Id: If1f07babdcb5677906ddbf974d9dc17255d4e174
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>

mmc: st: clear some flags before sending a command ...

The ICR static flags are cleared before sending a command.
The SDMMC_DCTRLR register is set to 0 if no data is expected on a given
command or on the next command in case of CMD55.

Change-Id: I5ae172a484218f53160e98b3684967c6960475a6
Signed-off-by: Yann Gautier <yann.gautier@st.com>

mmc: st: correct retries management ...

The retries number should be 3.
A warning message is added in mmc_block_read(), and the code is refactored.

Change-Id: I577c7dd91c451c7580b1660042cb5fe26ee3fa12
Signed-off-by: Yann Gautier <yann.gautier@st.com>

nand: raw_nand: fix timeout issue in nand_wait_ready ...

nand_wait_ready is called with a millisecond delay
but the timeout used a micro second. Fixing the conversion
in the timeout call.
The prototype of the function is also changed to use an unsigned int
parameter.

Change-Id: Ia3281be7980477dfbfdb842308d35ecd8b926fb8
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>

mtd: spi_nor: change message level on macronix detection ...

Change the detection message from WARN to INFO when macronix
NOR is detected.

Change-Id: I488696f1fb75b823e85decfcd6cd32e7b36a6c2e
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>

gpio: stm32_gpio: check GPIO node status after checking DT ...

The call to fdt_get_status(node) has to be done after the DT is found
to be valid.

Fixes: 1fc2130c5 stm32mp1: update device tree and gpio functions

Change-Id: I70f803aae3dde128a9e740f54c8837b64cb1a244
Signed-off-by: Yann Gautier <yann.gautier@st.com>

crypto: stm32_hash: fix issue when restarting computation ...

While restarting a new hash computation, STR register
is not cleared. It needs to be written before each
computation.

Change-Id: If65902dd21f9c139ec5da3ca87721232f73710db
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>

Select the Log Level for the Event Log Dump on Measured Boot at build time. ...

Builds in Debug mode with Measured Boot enabled might run out of trusted
SRAM. This patch allows to change the Log Level at which the Measured Boot
driver will dump the event log, so the latter can be accessed even on
Release builds if necessary, saving space on RAM.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I133689e313776cb3f231b774c26cbca4760fa120

Merge "plat: marvell: ap807: implement workaround for errata-id 3033912" into integration

build_macros.mk: include assert and define loop macros ...

Loop macros make it easier for developers to include new variables to
assert or define and also help code code readability on makefiles.

Change-Id: I0d21d6e67b3eca8976c4d856ac8ccc02c8bb5ffa
Signed-off-by: Leonardo Sandoval <leonardo.sandoval@linaro.org>

plat/allwinner: Only enable DRIVEVBUS if really needed ...

The DRIVEVBUS power rail of the AXP803 PMIC is mostly used to supply
the USB bus power on micro USB sockets, when used in host mode. As this
is a dynamic operation, and mostly we want micro USB sockets to act in
client mode initially, BL31 should not actually enable this power line.
However, on some boards DRIVEVBUS is used to supply power to normal
USB-A sockets. Failing to activate this line there results in
non-functional USB in U-Boot on those boards.

For that reason we were enabling DRIVEVBUS so far, as it did not seem to
cause any harm to the other boards. However it turns out that on the
Pinephone (and other systems with a battery), actually enabling DRIVEVBUS
unconditionally causes serious problems (reboot loop).

To accommodate both use cases, without reverting to a build time option,
check the default OTG configuration in the devicetree. For boards with
USB-A sockets this is set to "host", on boards with micro-B sockets to
"otg". Depending on this setting, we either enable DRIVEVBUS or leave it
alone.

This fixes TF-A on the Pinephone and potentially other battery powered
devices.

Change-Id: Iec0e07f218b2b4393bf4e05c3386261f8ed19e9f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

dualroot: add chain of trust for Platform owned SPs ...

For dualroot CoT there are two sets of SP certificates, one owned by
Silicon Provider(SiP) and other owned by Platform. Each certificate can
have a maximum of 4 SPs.

This patch reduces the number of SiP owned SPs from 8 to 4 and adds
the remaining 4 to Plat owned SP.
Plat owned SP certificate is signed using Platform RoT key and
protected against anti-rollback using the Non-trusted Non-volatile
counter.

Change-Id: Idc3ddd87d6d85a5506a7435f45a6ec17c4c50425
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

plat: marvell: ap807: implement workaround for errata-id 3033912 ...

ERRATA ID: RES-3033912 - Internal Address Space Init state causes
a hang upon accesses to [0xf070_0000, 0xf07f_ffff]
Workaround: Boot Firmware (ATF) should configure CCU_RGF_WIN(4) to
split [0x6e_0000, 0xff_ffff] to values [0x6e_0000, 0x6f_ffff] and
[0x80_0000, 0xff_ffff] that cause accesses to the segment of
[0xf070_0000, 0xf07f_ffff] to act as RAZWI. Reuse common
work-around code for both AP806 and AP807.

Change-Id: Ia91a4802d02917d1682faa0c81571093d1687d97
Signed-off-by: Stefan Chulski <stefanc@marvell.com>

tbbr/dualroot: rename SP package certificate file ...

Currently only single signing domain is supported for SP packages but
there is plan to support dual signing domains if CoT is dualroot.

SP_CONTENT_CERT_ID is the certificate file which is currently generated
and signed with trusted world key which in-turn is derived from Silicon
provider RoT key.
To allow dual signing domain for SP packages, other certificate file
will be derived from Platform owned RoT key.

This patch renames "SP_CONTENT_CERT_ID" to "SIP_SP_CONTENT_CERT_ID" and
does other related changes.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I0bc445a3ab257e2dac03faa64f46e36a9fed5e93

GIC-600: Fix MISRA-2012 defects ...

This patch fixes violation of Rules 10.1, 10.4,
11.9 and 13.2 reported by MISRA-2012 scan.

Change-Id: Ibe9190cb0f26ae85d9a31db8e92fbd32f1740e25
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

TZ DMC620 driver: Fix MISRA-2012 defects ...

This patch fixes defects 10.3, 10.4, 10.7, 20.7
reported by MISRA-2012 scan and adds braces for
conditional statements according to the TF-A
coding style.

Change-Id: If84ed31cdd55bc8e7cdd2a5f48c0dacc25792112
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Merge changes from topics "af/add_measured_boot_bl1_bl2", "af/add_measured_boot_driver", "af/add_measured_boot_driver_support", "af/add_measured_boot_fconf", "af/add_measured_boot_fvp" into integration ...

* changes:
  plat/arm/board/fvp: Add support for Measured Boot
  TF-A: Add support for Measured Boot driver to FCONF
  TF-A: Add support for Measured Boot driver in BL1 and BL2
  TF-A: Add Event Log for Measured Boot
  TF-A: Add support for Measured Boot driver

Merge "io_fip: return -ENFILE when a file is already open" into integration

Merge "gicv3: Do power management on Arm GIC-Clayton as well" into integration

TF-A: Add Event Log for Measured Boot ...

This patch adds support for Event Log generation required
for Measured Boot functionality.

Change-Id: I34f05a33565e6659e78499d62cc6fb00b7d6c2dc
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

gicv3: Do power management on Arm GIC-Clayton as well ...

The Arm GIC-Clayton IP has the same power management requirements as
the GIC-600, when it comes to powering up the redistributors before
using them.

Add the IIDR value to the existing list of implementations requiring
the power sequence.

Change-Id: Ib965dfe278c40a4fff94f65a8d445c27a2ae6fd2
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

TF-A GICv2 driver: Introduce makefile ...

This patch moves all GICv2 driver files into new added
'gicv2.mk' makefile for the benefit of the generic driver
which can evolve in the future without affecting platforms.

NOTE: Usage of 'drivers/arm/gic/common/gic_common.c' file
is now deprecated and platforms with GICv2 driver need to
be modified to include 'drivers/arm/gic/v2/gicv2.mk' in
their makefiles.

Change-Id: Ib10e71bdda0e5c7e80a049ddce2de1dd839602d1
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Merge changes from topic "brcm_rng_driver" into integration ...

* changes:
  driver: brcm: add RNG driver
  plat/brcm: Define RNG base address

Merge "IO Driver Misra Cleanup" into integration

IO Driver Misra Cleanup ...

This patch cleans up MISRA C violations in the IO driver files.  Some
things did not make sense to fix or would require sweeping changes
but the simple issues have been resolved.

Defects Fixed

File                        Line Rule
drivers/io/io_fip.c         39   MISRA C-2012 Rule 5.6 (required)
drivers/io/io_fip.c         52   MISRA C-2012 Rule 8.9 (advisory)
drivers/io/io_fip.c         60   MISRA C-2012 Rule 5.9 (advisory)
drivers/io/io_fip.c         285  MISRA C-2012 Rule 8.9 (advisory)
drivers/io/io_fip.c         336  MISRA C-2012 Rule 15.4 (advisory)
drivers/io/io_fip.c         340  MISRA C-2012 Rule 15.4 (advisory)
drivers/io/io_fip.c         342  MISRA C-2012 Rule 15.4 (advisory)
drivers/io/io_memmap.c      30   MISRA C-2012 Rule 5.6 (required)
drivers/io/io_memmap.c      32   MISRA C-2012 Rule 5.9 (advisory)
drivers/io/io_memmap.c      85   MISRA C-2012 Rule 11.8 (required)
drivers/io/io_semihosting.c 66   MISRA C-2012 Rule 11.8 (required)
drivers/io/io_storage.c     73   MISRA C-2012 Rule 5.9 (advisory)
drivers/io/io_storage.c     116  MISRA C-2012 Rule 13.4 (advisory)

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Id9b1b2b684588d4eaab674ed4ed04f3950dd21f4