Merge "refactor(console): disable getc() by default" into integration

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A. It is dangerous to keep that feature enabled if not
strictly necessary, especially in production firmware builds.

Thus, we need a way to disable this feature. Moreover, when it is
disabled, all related code should be eliminated from the firmware
binaries, such that no remnant/dead getc() code remains in memory,
which could otherwise be used as a gadget as part of a bigger security
attack.

This patch disables getc() feature by default. For legitimate getc()
use cases [1], it can be explicitly enabled by building TF-A with
ENABLE_CONSOLE_GETC=1.

The following changes are introduced when getc() is disabled:

- The multi-console framework no longer provides the console_getc()
function.

- If the console driver selected by the platform attempts to register
a getc() callback into the multi-console framework then TF-A will
now fail to build.

If registered through the assembly function finish_console_register():
- On AArch64, you'll get:
Error: undefined symbol CONSOLE_T_GETC used as an immediate value.
- On AArch32, you'll get:
Error: internal_relocation (type: OFFSET_IMM) not fixed up

If registered through the C function console_register(), this requires
populating a struct console with a getc field, which will trigger:
error: 'console_t' {aka 'struct console'} has no member named 'getc'

- All console drivers which previously registered a getc() callback
have been modified to do so only when ENABLE_CONSOLE_GETC=1.

[1] Example of such use cases would be:
- Firmware recovery: retrieving a golden BL2 image over the console in
order to repair a broken firmware on a bricked board.
- Factory CLI tool: Drive some soak tests through the console.

Discussed on TF-A mailing list here:
https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/

Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>

show more ...

Merge "Don't return error information from console_flush" into integration

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return typ

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Merge changes from topic "tegra-downstream-07092020" into integration

* changes:
Tegra194: remove AON_WDT IRQ mapping
Tegra: smmu: add smmu_verify function
Tegra: TZDRAM setup from soc specifi

Merge changes from topic "tegra-downstream-07092020" into integration

* changes:
Tegra194: remove AON_WDT IRQ mapping
Tegra: smmu: add smmu_verify function
Tegra: TZDRAM setup from soc specific early_boot handlers
Tegra: remove "platform_get_core_pos" function
Tegra: print GICC registers conditionally
lib: cpus: sanity check pointers before use
Tegra: spe: do not flush console in console_putc
Tegra: verify platform compatibility

show more ...

Tegra: spe: do not flush console in console_putc

SPE no longer requires the flush bit to be set to start transmitting
characters over the physical uart. Therefore, the flush bit is no
longer require

Tegra: spe: do not flush console in console_putc

SPE no longer requires the flush bit to be set to start transmitting
characters over the physical uart. Therefore, the flush bit is no
longer required when calling console_core_putc. However, flushing the
console still requires the flush bit.

This patch removes the flush bit from the mailbox messages in
console_core_putc to improve ACK latency.

Original change by: Mustafa Bilgen <mbilgen@nvidia.com>

Change-Id: I5b7d1f3ea69ea2ce308566dbaae222b04e4c373d
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

Merge changes from topic "tegra-downstream-07092020" into integration

* changes:
Tegra: memctrl: remove unused TZRAM setup function
Tegra: reorganize drivers and lib folders

Tegra: reorganize drivers and lib folders

This patch moves the 'drivers' and the 'lib' folders out of the
'common' folder. This way the 'common' folder shall contain only
the platform support requir

Tegra: reorganize drivers and lib folders

This patch moves the 'drivers' and the 'lib' folders out of the
'common' folder. This way the 'common' folder shall contain only
the platform support required for all Tegra platforms.

Change-Id: I2f238572d0a078d60c6b458a559538dc8a4d1856
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...