summaryrefslogtreecommitdiff
path: root/docs/threat_model
Commit message (Collapse)AuthorAgeFilesLines
* docs(spm): threat model for memory sharing functionalityJ-Alves2023-05-121-4/+182
| | | | | | | | Update the SPM threat model with information about FF-A v1.1 memory sharing functionality. Change-Id: I65ea0d53aba8ac2f8432539968ceaab6be109ac8 Signed-off-by: J-Alves <joao.alves@arm.com>
* docs(threat-model): add a notes related to the Measured BootManish V Badarkhe2023-04-191-3/+25
| | | | | | | | | | | | | | | | TF-A currently does not have any TPM2 driver for extending measurements into a discrete TPM chip. In TPM-based attestation scheme, measurements are just stored into a TCG-compatible event log buffer in secure memory. In light of the fact that Event Log measurements are taken by BL1 and BL2, we need to trust these components to store genuine measurements, and the Generic Threat Model always mitigates against attacks on these components, therefore, there is no explicit document for the Measured Boot threat model at this time is needed. Change-Id: I41b037b2f5956d327b53cd834345e5aefdcfb5ef Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
* docs(threat-model): refresh top-level pageSandrine Bailleux2023-04-041-4/+24
| | | | | | | | | | | | | The top-level page for threat model documents is evidently out-dated, as it contains text which no longer makes sense on its own. Most likely it relates back to the days where we had a single threat model document. Reword it accordingly. While we are at it, explain the motivation and structure of the documents. Change-Id: I63c8f38ec32b6edbfd1b4332eeaca19a01ae70e9 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* fix(optee): address late comments and fix bad rcJeffrey Kardatzke2023-02-091-11/+11
| | | | | | | | | | There were some late comments to the prior change (18635) which are address in this commit. There was also an invalid return value check which was changed and the wrong result was being returned via the SMC call for loading OP-TEE which is now fixed. Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com> Change-Id: I883ddf966662549a3ef9c801a2d4f47709422332
* feat(optee): add loading OP-TEE image via an SMCJeffrey Kardatzke2023-01-311-1/+47
| | | | | | | | | | | This adds the ability to load the OP-TEE image via an SMC called from non-secure userspace rather than loading it during boot. This should only be utilized on platforms that can ensure security is maintained up until the point the SMC is invoked as it breaks the normal barrier between the secure and non-secure world. Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com> Change-Id: I21cfa9699617c493fa4190f01d1cbb714e7449cc
* docs: add threat model for AP-RSS interfaceTamas Ban2022-12-092-1/+61
| | | | | Signed-off-by: Tamas Ban <tamas.ban@arm.com> Change-Id: Ic818da12584503e1a96396c4b55a8db14ae7584a
* docs: extend generic tf-a threat modelTamas Ban2022-12-011-3/+41
| | | | | | | | | Adding a new threat which is about leaving sensitive information in internal buffers which could be stolen by an attacker. Signed-off-by: Tamas Ban <tamas.ban@arm.com> Change-Id: I737e802c0adc9b00c89a0e21779745c51afb4b17
* docs(spm): update threat modelMadhukar Pappireddy2022-11-211-14/+283
| | | | | | | | | Update SPM threat model for possible threats, from malicious endpoints, related to interrupt management. The mitigations are based on the guidance provided in FF-A v1.1 EAC0 spec. Change-Id: Ib9e26e3f1c60fe3a2734a67de1dcf1cea4883d38 Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
* docs: add top level section numberingBoyan Karatotev2022-11-161-1/+0
| | | | | | | | | Top level sections are not numbered. Adding numbers makes referring to sections easier. For example the Maintainers page changes from "about/3.1" to simply "1.3.1". Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: If90a18ee8d6a6858d58f0687f31ea62b69399e04
* docs(spm): add threat model for el3 spmcShruti Gupta2022-10-272-0/+651
| | | | | | | | | Threat model for EL3 SPMC. The mitigations are based on the guidance provided in FF-A v1.1 EAC0 spec. Signed-off-by: Shruti Gupta <shruti.gupta@arm.com> Change-Id: I7f4c9370b6eefe6d1a7d1afac27e8b3a7b476072
* docs(threat-model): broaden the scope of threat #05Sandrine Bailleux2022-05-311-11/+24
| | | | | | | | | | | | | - Cite crash reports as an example of sensitive information. Previously, it might have sounded like this was the focus of the threat. - Warn about logging high-precision timing information, as well as conditionally logging (potentially nonsensitive) information depending on sensitive information. Change-Id: I33232dcb1e4b5c81efd4cd621b24ab5ac7b58685 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): emphasize whether mitigations are implementedSandrine Bailleux2022-05-311-78/+164
| | | | | | | | | | | | | | | | For each threat, we now separate: - how to mitigate against it; - whether TF-A currently implements these mitigations. A new "Mitigations implemented?" box is added to each threat to provide the implementation status. For threats that are partially mitigated from platform code, the original text is improved to make these expectations clearer. The hope is that platform integrators will have an easier time identifying what they need to carefully implement in order to follow the security recommendations from the threat model. Change-Id: I8473d75946daf6c91a0e15e61758c183603e195b Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): make measured boot out of scopeSandrine Bailleux2022-05-191-0/+3
| | | | | | | | | | | | | Add an explicit note that measured boot is out of scope of the threat model. For example, we have no threat related to the secure management of measurements, nor do we list its security benefits (e.g. in terms of repudiation). This might be a future improvement to the threat model but for now just acknowledge it is not considered. Change-Id: I2fb799a2ef0951aa681a755a948bd2b67415d156 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): revamp threat #9Sandrine Bailleux2022-05-171-6/+5
| | | | | | | | | | | | | | | | | Reword the description of threat #9 to make it more future-proof for Arm CCA. By avoiding specific references to secure or non-secure contexts, in favour of "worlds" and "security contexts", we make the description equally applicable to 2-world and 4-world architectures. Note that there are other threats that would benefit from such a similar revamp but this is out of scope of this patch. Also list malicious secure world code as a potential threat agent. This seems to be an oversight in the first version of the threat model (i.e. this change is not related to Arm CCA). Change-Id: Id8c8424b0a801104c4f3dc70e344ee702d2b259a Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): remove some redundant text in threat #08Sandrine Bailleux2022-05-171-7/+2
| | | | | | | The threat description was repeating the threat title. Change-Id: I67de2c0aab6e86bf33eb91e7562e075fcb76259b Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): make experimental features out of scopeSandrine Bailleux2022-05-171-0/+3
| | | | | | | | | By nature, experimental features are incomplete pieces of work, sometimes going under rapid change. Typically, the threat model implications have not been fully considered yet. Change-Id: Ice8d4273a789558e912f82cde592da4747b37fdf Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* docs(threat-model): cosmetic changesSandrine Bailleux2022-05-171-174/+183
| | | | | | | | | | | | | - Add empty lines after titles. - Reduce number of highlighting characters to fit title length. - Remove most ``monospaced text``. I think most of it looked weird in the rendered HTML version and it had no obvious meaning. Change-Id: I5f746a3de035d8ac59eec0af491c187bfe86dad7 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* feat(plat/fvp_r): Threat Model for TF-A v8-R64 SupportGary Morrison2021-12-164-2/+100
| | | | | | | Threat model for the current, BL1-only R-class support. Signed-off-by: Gary Morrison <gary.morrison@arm.com> Change-Id: I8479d5cb30f3cf3919281cc8dc1f21cada9511e0
* Merge "docs(spm): update threat model with FF-A v1.1" into integrationOlivier Deprez2021-11-261-4/+279
|\
| * docs(spm): update threat model with FF-A v1.1J-Alves2021-11-231-4/+279
| | | | | | | | | | | | | | | | Update SPM's threat model to contain threats related to notifications feature, compliant with FF-A v1.1 spec. Change-Id: I4a825be5dd14137a0d04d532adfe5343714794c5 Signed-off-by: J-Alves <joao.alves@arm.com>
* | docs(rme): add description of TF-A changes for RMEZelalem Aweke2021-11-151-0/+7
|/ | | | | | | | | This patch expands the RME documentation with description of TF-A changes for RME. It also modifies some other parts of TF-A documentation to account for RME changes. Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com> Change-Id: I9e6feeee235f0ba4b767d239f15840f1e0c540bb
* docs(ff-a): fix specification namingOlivier Deprez2021-09-061-2/+2
| | | | | | | | Rename the FF-A specification to: Arm Firmware Framework for Arm A-profile Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I4f9d29409d048e7a49832b95d39d2583c1fb5792
* docs(spmc): threat model documentOlivier Deprez2021-08-193-11/+633
| | | | | Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: Ib5f443a6997239d6ba4655d7df6c3fc61d45f991
* docs(threat model): add TF-A threat modelZelalem2021-04-302-0/+797
This is the first release of the public Trusted Firmware A class threat model. This release provides the baseline for future updates to be applied as required by developments to the TF-A code base. Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com> Change-Id: I3c9aadc46196837679f0b1377bec9ed4fc42ff11
View Lorry Controller Status