1Threat Model for TF-A with Arm CCA support
2~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3
4Introduction
5************
6
7This document provides a threat model of TF-A firmware for platforms with Arm
8Realm Management Extension (RME) support which implement Arm Confidential
9Compute Architecture (Arm CCA).
10
11Although it is a separate document, it references the :ref:`Generic Threat
12Model` in a number of places, as some of the contents is commonly applicable to
13TF-A with or without Arm CCA support.
14
15Target of Evaluation
16********************
17
18In this threat model, the target of evaluation is the Trusted Firmware for
19A-class Processors (TF-A) with RME support and Arm CCA support. This includes
20the boot ROM (BL1), the trusted boot firmware (BL2) and the runtime EL3 firmware
21(BL31).
22
23Assumptions
24===========
25
26We make the following assumptions:
27
28- :ref:`Realm Management Extension (RME)` is enabled on the platform.
29
30- Arm CCA Hardware Enforced Security (HES) is available on the platform, as
31  recommended by `Arm CCA security model`_:
32
33    *[R0004] Arm strongly recommends that all implementations of CCA utilize*
34    *hardware enforced security (CCA HES).*
35
36- All TF-A images run from on-chip memory. Data used by these images also live
37  in on-chip memory. This means TF-A is not vulnerable to an attacker that can
38  probe or tamper with off-chip memory.
39
40  These are requirements of the `Arm CCA security model`_:
41
42    *[R0147] Monitor code executes entirely from on-chip memory.*
43
44    *[R0149] Any monitor data that may affect the CCA security guarantee, other*
45    *than GPT, is either held in on-chip memory, or in external memory but with*
46    *additional integrity protection.*
47
48  Note that this threat model hardens *[R0149]* requirement by forbidding to
49  hold data in external memory, even if it is integrity-protected - except for
50  GPT data.
51
52- TF-A BL1 image is immutable and thus implicitly trusted. It runs from
53  read-only memory or write-protected memory. This could be on-chip ROM, on-chip
54  OTP, locked on-chip flash, or write-protected on-chip RAM for example.
55
56  This is a requirement of the `Arm CCA security model`_:
57
58    *[R0158] Arm recommends that all initial boot code is immutable on a*
59    *secured system.*
60
61    *[R0050] If all or part of initial boot code is instantiated in on-chip*
62    *memory then other trusted subsystems or application PE cannot modify that*
63    *code before it has been executed.*
64
65- Trusted boot and measured boot are enabled. This means an attacker can't boot
66  arbitrary images that are not approved by platform providers.
67
68  These are requirements of the `Arm CCA security model`_:
69
70    *[R0048] A secured system can only load authorized CCA firmware.*
71
72    *[R0079] All Monitor firmware loaded by PE initial boot is measured and*
73    *verified as outlined in Verified boot.*
74
75- No experimental features are enabled. These are typically incomplete features,
76  which need more time to stabilize. Thus, we do not consider threats that may
77  come from them. It is not recommended to use these features in production
78  builds.
79
80Data Flow Diagram
81=================
82
83Figure 1 shows a high-level data flow diagram for TF-A. The diagram shows a
84model of the different components of a TF-A-based system and their interactions
85with TF-A. A description of each diagram element is given on Table 1. On the
86diagram, the red broken lines indicate trust boundaries. Components outside of
87the broken lines are considered untrusted by TF-A.
88
89.. uml:: ../resources/diagrams/plantuml/tfa_arm_cca_dfd.puml
90  :caption: Figure 1: Data Flow Diagram
91
92.. table:: Table 1: Data Flow Diagram Description
93
94  +-----------------+--------------------------------------------------------+
95  | Diagram Element | Description                                            |
96  +=================+========================================================+
97  |       DF1       | | Refer to DF1 description in the                      |
98  |                 |   :ref:`Generic Threat Model`. Additionally TF-A       |
99  |                 |   loads realm images.                                  |
100  +-----------------+--------------------------------------------------------+
101  |     DF2-DF6     | | Refer to DF2-DF6 descriptions in the                 |
102  |                 |   :ref:`Generic Threat Model`.                         |
103  +-----------------+--------------------------------------------------------+
104  |       DF7       | | Boot images interact with Arm CCA HES to record boot |
105  |                 |   measurements and retrieve data used for AP images    |
106  |                 |   authentication.                                      |
107  |                 |                                                        |
108  |                 | | The runtime firmware interacts with Arm CCA HES to   |
109  |                 |   obtain sensitive attestation data for the realm      |
110  |                 |   world.                                               |
111  +-----------------+--------------------------------------------------------+
112  |       DF8       | | Realm world software (e.g. TF-RMM) interact with     |
113  |                 |   TF-A through SMC call interface and/or shared        |
114  |                 |   memory.                                              |
115  +-----------------+--------------------------------------------------------+
116
117Threat Analysis
118***************
119
120In this threat model, we use the same method to analyse threats as in the
121:ref:`Generic Threat Model`. This section only points out differences where
122applicable.
123
124- There is an additional threat agent: *RealmCode*. It takes the form of
125  malicious or faulty code running in the realm world, including R-EL2, R-EL1
126  and R-EL0 levels.
127
128- At this time we only consider the ``Server`` target environment. New threats
129  identified in this threat model will only be given a risk rating for this
130  environment. Other environments may be added in a future revision
131
132Threat Assessment
133=================
134
135General Threats for All Firmware Images
136---------------------------------------
137
138The following table analyses the :ref:`General Threats` in the context of this
139threat model. Only deltas are pointed out.
140
141  +----+-------------+-------------------------------------------------------+
142  | ID | Applicable? | Comments                                              |
143  +====+=============+=======================================================+
144  | 05 |     Yes     |                                                       |
145  +----+-------------+-------------------------------------------------------+
146  | 06 |     Yes     |                                                       |
147  +----+-------------+-------------------------------------------------------+
148  | 08 |     Yes     | Additional diagram element: DF8.                      |
149  |    |             |                                                       |
150  |    |             | Additional threat agent: RealmCode.                   |
151  +----+-------------+-------------------------------------------------------+
152  | 11 |     Yes     | | Misconfiguration of the Memory Management Unit      |
153  |    |             |   (MMU) may allow a **normal/secure/realm** world     |
154  |    |             |   software to access sensitive data, execute arbitrary|
155  |    |             |   code or access otherwise restricted HW interface.   |
156  |    |             |                                                       |
157  |    |             | | **Note that on RME systems, MMU configuration also  |
158  |    |             |   includes Granule Protection Tables (GPT) setup.**   |
159  |    |             |                                                       |
160  |    |             | | Additional diagram elements: DF4, DF7, DF8.         |
161  |    |             |                                                       |
162  |    |             | | Additional threat agents: SecCode, RealmCode.       |
163  +----+-------------+-------------------------------------------------------+
164  | 13 |     Yes     | Additional diagram element: DF8.                      |
165  |    |             |                                                       |
166  |    |             | Additional threat agent: RealmCode.                   |
167  +----+-------------+-------------------------------------------------------+
168  | 15 |     Yes     | Additional diagram element: DF8.                      |
169  |    |             |                                                       |
170  |    |             | Additional threat agent: RealmCode.                   |
171  +----+-------------+-------------------------------------------------------+
172
173Threats to be Mitigated by the Boot Firmware
174--------------------------------------------
175
176The following table analyses the :ref:`Boot Firmware Threats` in the context of
177this threat model. Only deltas are pointed out.
178
179  +----+-------------+-------------------------------------------------------+
180  | ID | Applicable? | Comments                                              |
181  +====+=============+=======================================================+
182  | 01 |     Yes     | Additional diagram element: DF8.                      |
183  |    |             |                                                       |
184  |    |             | Additional threat agent: RealmCode.                   |
185  +----+-------------+-------------------------------------------------------+
186  | 02 |     Yes     | Additional diagram element: DF8.                      |
187  |    |             |                                                       |
188  |    |             | Additional threat agent: RealmCode.                   |
189  +----+-------------+-------------------------------------------------------+
190  | 03 |     Yes     |                                                       |
191  +----+-------------+-------------------------------------------------------+
192  | 04 |     Yes     |                                                       |
193  +----+-------------+-------------------------------------------------------+
194
195Threats to be Mitigated by the Runtime EL3 Firmware
196---------------------------------------------------
197
198The following table analyses the :ref:`Runtime Firmware Threats` in the context
199of this threat model. Only deltas are pointed out.
200
201  +----+-------------+-------------------------------------------------------+
202  | ID | Applicable? | Comments                                              |
203  +====+=============+=======================================================+
204  | 07 |     Yes     | Additional diagram element: DF8.                      |
205  |    |             |                                                       |
206  |    |             | Additional threat agent: RealmCode.                   |
207  +----+-------------+-------------------------------------------------------+
208  | 09 |     Yes     | Additional diagram element: DF8.                      |
209  |    |             |                                                       |
210  |    |             | Additional threat agent: RealmCode.                   |
211  +----+-------------+-------------------------------------------------------+
212  | 10 |     Yes     | Additional diagram element: DF8.                      |
213  |    |             |                                                       |
214  |    |             | Additional threat agent: RealmCode.                   |
215  +----+-------------+-------------------------------------------------------+
216  | 12 |     Yes     | Additional diagram element: DF8.                      |
217  |    |             |                                                       |
218  |    |             | Additional threat agent: RealmCode.                   |
219  +----+-------------+-------------------------------------------------------+
220  | 14 |     Yes     |                                                       |
221  +----+-------------+-------------------------------------------------------+
222
223*Copyright (c) 2023, Arm Limited. All rights reserved.*
224
225.. _Arm CCA Security Model: https://developer.arm.com/documentation/DEN0096/A_a
226