Commit ced17112 authored by Sandrine Bailleux's avatar Sandrine Bailleux Committed by TrustedFirmware Code Review
Browse files

Merge changes from topic "pb/sphinx-doc" into integration

* changes:
  doc: Use proper note and warning annotations
  doc: Refactor contributor acknowledgements
  doc: Reorganise images and update links
  doc: Set correct syntax highlighting style
  doc: Add minimal glossary
  doc: Remove per-page contents lists
  doc: Make checkpatch ignore rst files
  doc: Format security advisory titles and headings
  doc: Reformat platform port documents
  doc: Normalise section numbering and headings
  doc: Reword document titles
parents 1665bcd0 e1c5026a
Advisory TFV-1 (CVE-2016-10319)
===============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Malformed Firmware Update SMC can result in copy of | | Title | Malformed Firmware Update SMC can result in copy of |
| | unexpectedly large data into secure memory | | | unexpectedly large data into secure memory |
......
Advisory TFV-2 (CVE-2017-7564)
==============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Enabled secure self-hosted invasive debug interface can | | Title | Enabled secure self-hosted invasive debug interface can |
| | allow normal world to panic secure world | | | allow normal world to panic secure world |
......
Advisory TFV-3 (CVE-2017-7563)
==============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | RO memory is always executable at AArch64 Secure EL1 | | Title | RO memory is always executable at AArch64 Secure EL1 |
+================+=============================================================+ +================+=============================================================+
...@@ -65,7 +68,7 @@ The vulnerability is mitigated by the following factors: ...@@ -65,7 +68,7 @@ The vulnerability is mitigated by the following factors:
of the ``XN``, ``UXN`` or ``PXN`` bits in the translation tables. See the of the ``XN``, ``UXN`` or ``PXN`` bits in the translation tables. See the
``enable_mmu()`` function: ``enable_mmu()`` function:
.. code:: c ::
sctlr = read_sctlr_el##_el(); \ sctlr = read_sctlr_el##_el(); \
sctlr |= SCTLR_WXN_BIT | SCTLR_M_BIT; \ sctlr |= SCTLR_WXN_BIT | SCTLR_M_BIT; \
......
Advisory TFV-4 (CVE-2017-9607)
==============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Malformed Firmware Update SMC can result in copy or | | Title | Malformed Firmware Update SMC can result in copy or |
| | authentication of unexpected data in secure memory in | | | authentication of unexpected data in secure memory in |
......
Advisory TFV-5 (CVE-2017-15031)
===============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Not initializing or saving/restoring ``PMCR_EL0`` can leak | | Title | Not initializing or saving/restoring ``PMCR_EL0`` can leak |
| | secure world timing information | | | secure world timing information |
......
Advisory TFV-6 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)
============================================================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Arm Trusted Firmware exposure to speculative processor | | Title | Arm Trusted Firmware exposure to speculative processor |
| | vulnerabilities using cache timing side-channels | | | vulnerabilities using cache timing side-channels |
...@@ -28,13 +31,13 @@ these vulnerabilities on Arm systems, please refer to the `Arm Processor ...@@ -28,13 +31,13 @@ these vulnerabilities on Arm systems, please refer to the `Arm Processor
Security Update`_. Security Update`_.
Variant 1 (`CVE-2017-5753`_) Variant 1 (`CVE-2017-5753`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ----------------------------
At the time of writing, no vulnerable patterns have been observed in upstream TF At the time of writing, no vulnerable patterns have been observed in upstream TF
code, therefore no workarounds have been applied or are planned. code, therefore no workarounds have been applied or are planned.
Variant 2 (`CVE-2017-5715`_) Variant 2 (`CVE-2017-5715`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ----------------------------
Where possible on vulnerable CPUs, Arm recommends invalidating the branch Where possible on vulnerable CPUs, Arm recommends invalidating the branch
predictor as early as possible on entry into the secure world, before any branch predictor as early as possible on entry into the secure world, before any branch
...@@ -122,7 +125,7 @@ Cortex-A76, Cortex-A53, Cortex-A55, Cortex-A32, Cortex-A7 and Cortex-A5. ...@@ -122,7 +125,7 @@ Cortex-A76, Cortex-A53, Cortex-A55, Cortex-A32, Cortex-A7 and Cortex-A5.
For more information about non-Arm CPUs, please contact the CPU vendor. For more information about non-Arm CPUs, please contact the CPU vendor.
Variant 3 (`CVE-2017-5754`_) Variant 3 (`CVE-2017-5754`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ----------------------------
This variant is only exploitable between Exception Levels within the same This variant is only exploitable between Exception Levels within the same
translation regime, for example between EL0 and EL1, therefore this variant translation regime, for example between EL0 and EL1, therefore this variant
......
Advisory TFV-7 (CVE-2018-3639)
==============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Trusted Firmware-A exposure to cache speculation | | Title | Trusted Firmware-A exposure to cache speculation |
| | vulnerability Variant 4 | | | vulnerability Variant 4 |
...@@ -46,7 +49,7 @@ for platforms that are unaffected or where the risk is deemed low enough. ...@@ -46,7 +49,7 @@ for platforms that are unaffected or where the risk is deemed low enough.
Arm CPUs not mentioned below are unaffected. Arm CPUs not mentioned below are unaffected.
Static mitigation Static mitigation
~~~~~~~~~~~~~~~~~ -----------------
For affected CPUs, this approach enables the mitigation during EL3 For affected CPUs, this approach enables the mitigation during EL3
initialization, following every PE reset. No mechanism is provided to disable initialization, following every PE reset. No mechanism is provided to disable
...@@ -67,7 +70,7 @@ TF-A implements this approach for the following affected CPUs: ...@@ -67,7 +70,7 @@ TF-A implements this approach for the following affected CPUs:
(``S3_0_C15_C1_0``). (``S3_0_C15_C1_0``).
Dynamic mitigation Dynamic mitigation
~~~~~~~~~~~~~~~~~~ ------------------
For affected CPUs, this approach also enables the mitigation during EL3 For affected CPUs, this approach also enables the mitigation during EL3
initialization, following every PE reset. In addition, this approach implements initialization, following every PE reset. In addition, this approach implements
......
Advisory TFV-8 (CVE-2018-19440)
===============================
+----------------+-------------------------------------------------------------+ +----------------+-------------------------------------------------------------+
| Title | Not saving x0 to x3 registers can leak information from one | | Title | Not saving x0 to x3 registers can leak information from one |
| | Normal World SMC client to another | | | Normal World SMC client to another |
...@@ -36,7 +39,7 @@ CPU context stored on the stack. This includes registers ``x0`` to ``x3``, as ...@@ -36,7 +39,7 @@ CPU context stored on the stack. This includes registers ``x0`` to ``x3``, as
can be seen in the ``lib/el3_runtime/aarch64/context.S`` file at line 339 can be seen in the ``lib/el3_runtime/aarch64/context.S`` file at line 339
(referring to the version of the code as of `commit c385955`_): (referring to the version of the code as of `commit c385955`_):
.. code:: c ::
/* /*
* This function restores all general purpose registers except x30 from the * This function restores all general purpose registers except x30 from the
......
...@@ -27,8 +27,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ...@@ -27,8 +27,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-------------- --------------
Note: .. note::
Individual files contain the following tag instead of the full license text. Individual files contain the following tag instead of the full license text.
:: ::
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment