Commit ced17112 authored by Sandrine Bailleux's avatar Sandrine Bailleux Committed by TrustedFirmware Code Review
Browse files

Merge changes from topic "pb/sphinx-doc" into integration

* changes:
  doc: Use proper note and warning annotations
  doc: Refactor contributor acknowledgements
  doc: Reorganise images and update links
  doc: Set correct syntax highlighting style
  doc: Add minimal glossary
  doc: Remove per-page contents lists
  doc: Make checkpatch ignore rst files
  doc: Format security advisory titles and headings
  doc: Reformat platform port documents
  doc: Normalise section numbering and headings
  doc: Reword document titles
parents 1665bcd0 e1c5026a
Advisory TFV-1 (CVE-2016-10319)
===============================
+----------------+-------------------------------------------------------------+
| Title | Malformed Firmware Update SMC can result in copy of |
| | unexpectedly large data into secure memory |
......
Advisory TFV-2 (CVE-2017-7564)
==============================
+----------------+-------------------------------------------------------------+
| Title | Enabled secure self-hosted invasive debug interface can |
| | allow normal world to panic secure world |
......
Advisory TFV-3 (CVE-2017-7563)
==============================
+----------------+-------------------------------------------------------------+
| Title | RO memory is always executable at AArch64 Secure EL1 |
+================+=============================================================+
......@@ -65,7 +68,7 @@ The vulnerability is mitigated by the following factors:
of the ``XN``, ``UXN`` or ``PXN`` bits in the translation tables. See the
``enable_mmu()`` function:
.. code:: c
::
sctlr = read_sctlr_el##_el(); \
sctlr |= SCTLR_WXN_BIT | SCTLR_M_BIT; \
......
Advisory TFV-4 (CVE-2017-9607)
==============================
+----------------+-------------------------------------------------------------+
| Title | Malformed Firmware Update SMC can result in copy or |
| | authentication of unexpected data in secure memory in |
......
Advisory TFV-5 (CVE-2017-15031)
===============================
+----------------+-------------------------------------------------------------+
| Title | Not initializing or saving/restoring ``PMCR_EL0`` can leak |
| | secure world timing information |
......
Advisory TFV-6 (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)
============================================================
+----------------+-------------------------------------------------------------+
| Title | Arm Trusted Firmware exposure to speculative processor |
| | vulnerabilities using cache timing side-channels |
......@@ -28,13 +31,13 @@ these vulnerabilities on Arm systems, please refer to the `Arm Processor
Security Update`_.
Variant 1 (`CVE-2017-5753`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
----------------------------
At the time of writing, no vulnerable patterns have been observed in upstream TF
code, therefore no workarounds have been applied or are planned.
Variant 2 (`CVE-2017-5715`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
----------------------------
Where possible on vulnerable CPUs, Arm recommends invalidating the branch
predictor as early as possible on entry into the secure world, before any branch
......@@ -122,7 +125,7 @@ Cortex-A76, Cortex-A53, Cortex-A55, Cortex-A32, Cortex-A7 and Cortex-A5.
For more information about non-Arm CPUs, please contact the CPU vendor.
Variant 3 (`CVE-2017-5754`_)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
----------------------------
This variant is only exploitable between Exception Levels within the same
translation regime, for example between EL0 and EL1, therefore this variant
......
Advisory TFV-7 (CVE-2018-3639)
==============================
+----------------+-------------------------------------------------------------+
| Title | Trusted Firmware-A exposure to cache speculation |
| | vulnerability Variant 4 |
......@@ -46,7 +49,7 @@ for platforms that are unaffected or where the risk is deemed low enough.
Arm CPUs not mentioned below are unaffected.
Static mitigation
~~~~~~~~~~~~~~~~~
-----------------
For affected CPUs, this approach enables the mitigation during EL3
initialization, following every PE reset. No mechanism is provided to disable
......@@ -67,7 +70,7 @@ TF-A implements this approach for the following affected CPUs:
(``S3_0_C15_C1_0``).
Dynamic mitigation
~~~~~~~~~~~~~~~~~~
------------------
For affected CPUs, this approach also enables the mitigation during EL3
initialization, following every PE reset. In addition, this approach implements
......
Advisory TFV-8 (CVE-2018-19440)
===============================
+----------------+-------------------------------------------------------------+
| Title | Not saving x0 to x3 registers can leak information from one |
| | Normal World SMC client to another |
......@@ -36,7 +39,7 @@ CPU context stored on the stack. This includes registers ``x0`` to ``x3``, as
can be seen in the ``lib/el3_runtime/aarch64/context.S`` file at line 339
(referring to the version of the code as of `commit c385955`_):
.. code:: c
::
/*
* This function restores all general purpose registers except x30 from the
......
......@@ -27,8 +27,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--------------
Note:
Individual files contain the following tag instead of the full license text.
.. note::
Individual files contain the following tag instead of the full license text.
::
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment