| 85bebe18 | 11-Oct-2023 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
refactor(console): disable getc() by default
The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A
refactor(console): disable getc() by default
The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A. It is dangerous to keep that feature enabled if not
strictly necessary, especially in production firmware builds.
Thus, we need a way to disable this feature. Moreover, when it is
disabled, all related code should be eliminated from the firmware
binaries, such that no remnant/dead getc() code remains in memory,
which could otherwise be used as a gadget as part of a bigger security
attack.
This patch disables getc() feature by default. For legitimate getc()
use cases [1], it can be explicitly enabled by building TF-A with
ENABLE_CONSOLE_GETC=1.
The following changes are introduced when getc() is disabled:
- The multi-console framework no longer provides the console_getc()
function.
- If the console driver selected by the platform attempts to register
a getc() callback into the multi-console framework then TF-A will
now fail to build.
If registered through the assembly function finish_console_register():
- On AArch64, you'll get:
Error: undefined symbol CONSOLE_T_GETC used as an immediate value.
- On AArch32, you'll get:
Error: internal_relocation (type: OFFSET_IMM) not fixed up
If registered through the C function console_register(), this requires
populating a struct console with a getc field, which will trigger:
error: 'console_t' {aka 'struct console'} has no member named 'getc'
- All console drivers which previously registered a getc() callback
have been modified to do so only when ENABLE_CONSOLE_GETC=1.
[1] Example of such use cases would be:
- Firmware recovery: retrieving a golden BL2 image over the console in
order to repair a broken firmware on a bricked board.
- Factory CLI tool: Drive some soak tests through the console.
Discussed on TF-A mailing list here:
https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/
Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>
show more ...
|
| 0df5cf18 | 25-May-2023 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs: clarify maintainers election process
Add a new page in TF-A documentation for clarifying the process to
elect a new maintainer. This builds on top of the Trusted Firmware
process [1], with the
docs: clarify maintainers election process
Add a new page in TF-A documentation for clarifying the process to
elect a new maintainer. This builds on top of the Trusted Firmware
process [1], with the following TF-A specific details:
- Must have contributed to the project for at least a couple of years.
- Must dedicate at least 2 hours a week for maintainer duties.
- Details about the election process. In particular, setting a
one-calendar-week deadline for other maintainers to raise
objections.
[1] https://developer.trustedfirmware.org/w/collaboration/project-maintenance-process/
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Change-Id: Ibef08bbbd4d18cd7aea13e01ba570972a7ee808d
show more ...
|
| 47801a69 | 17-Apr-2023 |
Sandrine Bailleux <sandrine.bailleux@arm.com> |
docs: extend deprecation policy
Our process documentation already mentions that if a platform is no
longer maintained, it is best to deprecate it to keep the project's
source tree clean and healthy.
docs: extend deprecation policy
Our process documentation already mentions that if a platform is no
longer maintained, it is best to deprecate it to keep the project's
source tree clean and healthy.
The same argument stands for drivers or library interfaces so extend
this policy to those.
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Change-Id: Ieb235d6a1fb089343e0e1e3e5f36067552f2f8f0
show more ...
|
| 9babfab4 | 02-Mar-2023 |
Govindraj Raja <govindraj.raja@arm.com> |
docs: add guidelines for thirdparty includes
Currently there is no guidelines in docs for including thirdparty
includes, trying to address that with a proposed method to use third
party includes.
C
docs: add guidelines for thirdparty includes
Currently there is no guidelines in docs for including thirdparty
includes, trying to address that with a proposed method to use third
party includes.
Change-Id: Ieec7a5c88a60b66ca72228741ba1894545130a06
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
show more ...
|