mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-16 01:24:27 +00:00

The ability to read a character from the console constitutes an attack vector into TF-A, as it gives attackers a means to inject arbitrary data into TF-A. It is dangerous to keep that feature enabled if not strictly necessary, especially in production firmware builds. Thus, we need a way to disable this feature. Moreover, when it is disabled, all related code should be eliminated from the firmware binaries, such that no remnant/dead getc() code remains in memory, which could otherwise be used as a gadget as part of a bigger security attack. This patch disables getc() feature by default. For legitimate getc() use cases [1], it can be explicitly enabled by building TF-A with ENABLE_CONSOLE_GETC=1. The following changes are introduced when getc() is disabled: - The multi-console framework no longer provides the console_getc() function. - If the console driver selected by the platform attempts to register a getc() callback into the multi-console framework then TF-A will now fail to build. If registered through the assembly function finish_console_register(): - On AArch64, you'll get: Error: undefined symbol CONSOLE_T_GETC used as an immediate value. - On AArch32, you'll get: Error: internal_relocation (type: OFFSET_IMM) not fixed up If registered through the C function console_register(), this requires populating a struct console with a getc field, which will trigger: error: 'console_t' {aka 'struct console'} has no member named 'getc' - All console drivers which previously registered a getc() callback have been modified to do so only when ENABLE_CONSOLE_GETC=1. [1] Example of such use cases would be: - Firmware recovery: retrieving a golden BL2 image over the console in order to repair a broken firmware on a bricked board. - Factory CLI tool: Drive some soak tests through the console. Discussed on TF-A mailing list here: https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/ Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Acked-by: Baruch Siach <baruch@tkos.co.il>
31 lines
1 KiB
C
31 lines
1 KiB
C
/*
|
|
* Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
|
|
*
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
*/
|
|
|
|
#ifndef CONSOLE_ASSERTIONS_H
|
|
#define CONSOLE_ASSERTIONS_H
|
|
|
|
#include <lib/cassert.h>
|
|
|
|
/*
|
|
* This file contains some separate assertions about console_t, moved here to
|
|
* keep them out of the way. Should only be included from <console.h>.
|
|
*/
|
|
CASSERT(CONSOLE_T_NEXT == __builtin_offsetof(console_t, next),
|
|
assert_console_t_next_offset_mismatch);
|
|
CASSERT(CONSOLE_T_FLAGS == __builtin_offsetof(console_t, flags),
|
|
assert_console_t_flags_offset_mismatch);
|
|
CASSERT(CONSOLE_T_PUTC == __builtin_offsetof(console_t, putc),
|
|
assert_console_t_putc_offset_mismatch);
|
|
#if ENABLE_CONSOLE_GETC
|
|
CASSERT(CONSOLE_T_GETC == __builtin_offsetof(console_t, getc),
|
|
assert_console_t_getc_offset_mismatch);
|
|
#endif
|
|
CASSERT(CONSOLE_T_FLUSH == __builtin_offsetof(console_t, flush),
|
|
assert_console_t_flush_offset_mismatch);
|
|
CASSERT(CONSOLE_T_DRVDATA == sizeof(console_t),
|
|
assert_console_t_drvdata_offset_mismatch);
|
|
|
|
#endif /* CONSOLE_ASSERTIONS_H */
|