Merge changes from topic "od/hf-doc-migration" into integration
* changes:
docs(spm-mm): remove reference to SEL2 SPMC
docs: remove SEL2 SPMC threat model
docs: remove unused SPM related diagrams
diff --git a/docs/components/secure-partition-manager-mm.rst b/docs/components/secure-partition-manager-mm.rst
index 4cdb96c..d9b2b1b 100644
--- a/docs/components/secure-partition-manager-mm.rst
+++ b/docs/components/secure-partition-manager-mm.rst
@@ -4,17 +4,10 @@
Foreword
========
-Two implementations of a Secure Partition Manager co-exist in the TF-A codebase:
-
-- SPM based on the FF-A specification (:ref:`Secure Partition Manager`).
-- SPM based on the MM interface.
-
-Both implementations differ in their architectures and only one can be selected
-at build time.
-
-This document describes the latter implementation where the Secure Partition Manager
-resides at EL3 and management services run from isolated Secure Partitions at S-EL0.
-The communication protocol is established through the Management Mode (MM) interface.
+This document describes the implementation where the Secure Partition Manager
+resides at EL3 and management services run from isolated Secure Partitions at
+S-EL0. The communication protocol is established through the Management Mode
+(MM) interface.
Background
==========
diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png
deleted file mode 100644
index 0619cf2..0000000
--- a/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png
+++ /dev/null
Binary files differ
diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png
deleted file mode 100644
index f110028..0000000
--- a/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png
+++ /dev/null
Binary files differ
diff --git a/docs/threat_model/index.rst b/docs/threat_model/index.rst
index b22fb18..3e0393e 100644
--- a/docs/threat_model/index.rst
+++ b/docs/threat_model/index.rst
@@ -31,7 +31,6 @@
:caption: Contents
threat_model
- threat_model_spm
threat_model_el3_spm
threat_model_fvp_r
threat_model_rss_interface
diff --git a/docs/threat_model/threat_model_spm.rst b/docs/threat_model/threat_model_spm.rst
deleted file mode 100644
index 24a115b..0000000
--- a/docs/threat_model/threat_model_spm.rst
+++ /dev/null
@@ -1,1340 +0,0 @@
-SPMC Threat Model
-*****************
-
-************************
-Introduction
-************************
-This document provides a threat model for the TF-A :ref:`Secure Partition Manager`
-(SPM) implementation or more generally the S-EL2 reference firmware running on
-systems implementing the FEAT_SEL2 (formerly Armv8.4 Secure EL2) architecture
-extension. The SPM implementation is based on the `Arm Firmware Framework for
-Arm A-profile`_ specification.
-
-In brief, the broad FF-A specification and S-EL2 firmware implementation
-provide:
-
-- Isolation of mutually mistrusting SW components, or endpoints in the FF-A
- terminology.
-- Distinct sandboxes in the secure world called secure partitions. This permits
- isolation of services from multiple vendors.
-- A standard protocol for communication and memory sharing between FF-A
- endpoints.
-- Mutual isolation of the normal world and the secure world (e.g. a Trusted OS
- is prevented to map an arbitrary NS physical memory region such as the kernel
- or the Hypervisor).
-
-************************
-Target of Evaluation
-************************
-In this threat model, the target of evaluation is the S-EL2 firmware or the
-``Secure Partition Manager Core`` component (SPMC).
-The monitor and SPMD at EL3 are covered by the :ref:`Generic TF-A threat model
-<threat_analysis>`.
-
-The scope for this threat model is:
-
-- The TF-A implementation for the S-EL2 SPMC based on the Hafnium hypervisor
- running in the secure world of TrustZone (at S-EL2 exception level).
- The threat model is not related to the normal world Hypervisor or VMs.
- The S-EL1 and EL3 SPMC solutions are not covered.
-- The implementation complies with the FF-A v1.0 specification, and a few
- features of FF-A v1.1 specification.
-- Secure partitions are statically provisioned at boot time.
-- Focus on the run-time part of the life-cycle (no specific emphasis on boot
- time, factory firmware provisioning, firmware udpate etc.)
-- Not covering advanced or invasive physical attacks such as decapsulation,
- FIB etc.
-- Assumes secure boot or in particular TF-A trusted boot (TBBR or dual CoT) is
- enabled. An attacker cannot boot arbitrary images that are not approved by the
- SiP or platform providers.
-
-Data Flow Diagram
-======================
-Figure 1 shows a high-level data flow diagram for the SPM split into an SPMD
-component at EL3 and an SPMC component at S-EL2. The SPMD mostly acts as a
-relayer/pass-through between the normal world and the secure world. It is
-assumed to expose small attack surface.
-
-A description of each diagram element is given in Table 1. In the diagram, the
-red broken lines indicate trust boundaries.
-
-Components outside of the broken lines are considered untrusted.
-
-.. uml:: ../resources/diagrams/plantuml/spm_dfd.puml
- :caption: Figure 1: SPMC Data Flow Diagram
-
-.. table:: Table 1: SPMC Data Flow Diagram Description
-
- +---------------------+--------------------------------------------------------+
- | Diagram Element | Description |
- +=====================+========================================================+
- | ``DF1`` | SP to SPMC communication. FF-A function invocation or |
- | | implementation-defined Hypervisor call. |
- +---------------------+--------------------------------------------------------+
- | ``DF2`` | SPMC to SPMD FF-A call. |
- +---------------------+--------------------------------------------------------+
- | ``DF3`` | SPMD to NS forwarding. |
- +---------------------+--------------------------------------------------------+
- | ``DF4`` | SP to SP FF-A direct message request/response. |
- | | Note as a matter of simplifying the diagram |
- | | the SP to SP communication happens through the SPMC |
- | | (SP1 performs a direct message request to the |
- | | SPMC targeting SP2 as destination. And similarly for |
- | | the direct message response from SP2 to SP1). |
- +---------------------+--------------------------------------------------------+
- | ``DF5`` | HW control. |
- +---------------------+--------------------------------------------------------+
- | ``DF6`` | Bootloader image loading. |
- +---------------------+--------------------------------------------------------+
- | ``DF7`` | External memory access. |
- +---------------------+--------------------------------------------------------+
-
-*********************
-Threat Analysis
-*********************
-
-This threat model follows a similar methodology to the :ref:`Generic TF-A threat model
-<threat_analysis>`.
-The following sections define:
-
-- Trust boundaries
-- Assets
-- Theat agents
-- Threat types
-
-Trust boundaries
-============================
-
-- Normal world is untrusted.
-- Secure world and normal world are separate trust boundaries.
-- EL3 monitor, SPMD and SPMC are trusted.
-- Bootloaders (in particular BL1/BL2 if using TF-A) and run-time BL31 are
- implicitely trusted by the usage of secure boot.
-- EL3 monitor, SPMD, SPMC do not trust SPs.
-
-.. figure:: ../resources/diagrams/spm-threat-model-trust-boundaries.png
-
- Figure 2: Trust boundaries
-
-Assets
-============================
-
-The following assets are identified:
-
-- SPMC state.
-- SP state.
-- Information exchange between endpoints (partition messages).
-- SPMC secrets (e.g. pointer authentication key when enabled)
-- SP secrets (e.g. application keys).
-- Scheduling cycles.
-- Shared memory.
-
-Threat Agents
-============================
-
-The following threat agents are identified:
-
-- NS-Endpoint identifies a non-secure endpoint: normal world client at NS-EL2
- (Hypervisor) or NS-EL1 (VM or OS kernel).
-- S-Endpoint identifies a secure endpoint typically a secure partition.
-- Hardware attacks (non-invasive) requiring a physical access to the device,
- such as bus probing or DRAM stress.
-
-Threat types
-============================
-
-The following threat categories as exposed in the :ref:`Generic TF-A threat model
-<threat_analysis>`
-are re-used:
-
-- Spoofing
-- Tampering
-- Repudiation
-- Information disclosure
-- Denial of service
-- Elevation of privileges
-
-Similarly this threat model re-uses the same threat risk ratings. The risk
-analysis is evaluated based on the environment being ``Server`` or ``Mobile``.
-
-Threat Assessment
-============================
-
-The following threats are identified by applying STRIDE analysis on each diagram
-element of the data flow diagram.
-
-+------------------------+----------------------------------------------------+
-| ID | 01 |
-+========================+====================================================+
-| ``Threat`` | **An endpoint impersonates the sender or receiver |
-| | FF-A ID in a direct request/response invocation.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMD, SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Spoofing |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------++----------------+---------------+
-| ``Impact`` | Critical(5) | Critical(5) | |
-+------------------------+------------------++----------------+---------------+
-| ``Likelihood`` | Critical(5) | Critical(5) | |
-+------------------------+------------------++----------------+---------------+
-| ``Total Risk Rating`` | Critical(25) | Critical(25) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. |
-| | The guidance below is left for a system integrator |
-| | to implemented as necessary. |
-| | The SPMC must enforce checks in the direct message |
-| | request/response interfaces such an endpoint cannot|
-| | spoof the origin and destination worlds (e.g. a NWd|
-| | originated message directed to the SWd cannot use a|
-| | SWd ID as the sender ID). |
-| | Additionally a software component residing in the |
-| | SPMC can be added for the purpose of direct |
-| | request/response filtering. |
-| | It can be configured with the list of known IDs |
-| | and about which interaction can occur between one |
-| | and another endpoint (e.g. which NWd endpoint ID |
-| | sends a direct request to which SWd endpoint ID). |
-| | This component checks the sender/receiver fields |
-| | for a legitimate communication between endpoints. |
-| | A similar component can exist in the OS kernel |
-| | driver, or Hypervisor although it remains untrusted|
-| | by the SPMD/SPMC. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 02 |
-+========================+====================================================+
-| ``Threat`` | **Tampering with memory shared between an endpoint |
-| | and the SPMC.** |
-| | A malicious endpoint may attempt tampering with its|
-| | RX/TX buffer contents while the SPMC is processing |
-| | it (TOCTOU). |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF3, DF4, DF7 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | Shared memory, Information exchange |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | High (4) | High (4) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | High (4) | High (4) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | High (16) | High (16) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | In context of FF-A v1.0 and v1.1 this is the case |
-| | of sharing the RX/TX buffer pair and usage in the |
-| | PARTITION_INFO_GET or mem sharing primitives. |
-| | The SPMC must copy the contents of the TX buffer |
-| | to an internal temporary buffer before processing |
-| | its contents. The SPMC must implement hardened |
-| | input validation on data transmitted through the TX|
-| | buffer by an untrusted endpoint. |
-| | The TF-A SPMC mitigates this threat by enforcing |
-| | checks on data transmitted through RX/TX buffers. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 03 |
-+========================+====================================================+
-| ``Threat`` | **An endpoint may tamper with its own state or the |
-| | state of another endpoint.** |
-| | A malicious endpoint may attempt violating: |
-| | - its own or another SP state by using an unusual |
-| | combination (or out-of-order) FF-A function |
-| | invocations. |
-| | This can also be an endpoint emitting |
-| | FF-A function invocations to another endpoint while|
-| | the latter is not in a state to receive it (e.g. a |
-| | SP sends a direct request to the normal world early|
-| | while the normal world is not booted yet). |
-| | - the SPMC state itself by employing unexpected |
-| | transitions in FF-A memory sharing, direct requests|
-| | and responses, or handling of interrupts. |
-| | This can be led by random stimuli injection or |
-| | fuzzing. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMD, SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP state, SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | High (4) | High (4) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | High (12) | High (12) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC provides mitigation against such |
-| | threat by following the guidance for partition |
-| | runtime models as described in FF-A v1.1 EAC0 spec.|
-| | The SPMC performs numerous checks in runtime to |
-| | prevent illegal state transitions by adhering to |
-| | the partition runtime model. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 04 |
-+========================+====================================================+
-| ``Threat`` | *An attacker may attempt injecting errors by the |
-| | use of external DRAM stress techniques.** |
-| | A malicious agent may attempt toggling an SP |
-| | Stage-2 MMU descriptor bit within the page tables |
-| | that the SPMC manages. This can happen in Rowhammer|
-| | types of attack. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF7 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP or SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | Hardware attack |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering |
-+------------------------+------------------+---------------+-----------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+---------------+-----------------+
-| ``Impact`` | High (4) | High (4) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Likelihood`` | Low (2) | Medium (3) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Total Risk Rating`` | Medium (8) | High (12) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Mitigations`` | The TF-A SPMC does not provide mitigations to this |
-| | type of attack. It can be addressed by the use of |
-| | dedicated HW circuity or hardening at the chipset |
-| | or platform level left to the integrator. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 05 |
-+========================+====================================================+
-| ``Threat`` | **Protection of the SPMC from a DMA capable device |
-| | upstream to an SMMU.** |
-| | A device may attempt to tamper with the internal |
-| | SPMC code/data sections. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC or SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering, Elevation of privileges |
-+------------------------+------------------+---------------+-----------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+---------------+-----------------+
-| ``Impact`` | High (4) | High (4) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Total Risk Rating`` | High (12) | High (12) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Mitigations`` | A platform may prefer assigning boot time, |
-| | statically alocated memory regions through the SMMU|
-| | configuration and page tables. The FF-A v1.1 |
-| | specification provisions this capability through |
-| | static DMA isolation. |
-| | The TF-A SPMC does not mitigate this threat. |
-| | It will adopt the static DMA isolation approach in |
-| | a future release. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 06 |
-+========================+====================================================+
-| ``Threat`` | **Replay fragments of past communication between |
-| | endpoints.** |
-| | A malicious endpoint may replay a message exchange |
-| | that occured between two legitimate endpoint as |
-| | a matter of triggering a malfunction or extracting |
-| | secrets from the receiving endpoint. In particular |
-| | the memory sharing operation with fragmented |
-| | messages between an endpoint and the SPMC may be |
-| | replayed by a malicious agent as a matter of |
-| | getting access or gaining permissions to a memory |
-| | region which does not belong to this agent. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | Information exchange |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Repdudiation |
-+------------------------+------------------+---------------+-----------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+---------------+-----------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Likelihood`` | High (4) | High (4) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Total Risk Rating`` | High (12) | High (12) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 07 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may attempt to extract data |
-| | or state information by the use of invalid or |
-| | incorrect input arguments.** |
-| | Lack of input parameter validation or side effects |
-| | of maliciously forged input parameters might affect|
-| | the SPMC. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMD, SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP secrets, SPMC secrets, SP state, SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Information discolure |
-+------------------------+------------------+---------------+-----------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+---------------+-----------------+
-| ``Impact`` | High (4) | High (4) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Total Risk Rating`` | High (12) | High (12) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Mitigations`` | Secure Partitions must follow security standards |
-| | and best practises as a way to mitigate the risk |
-| | of common vulnerabilities to be exploited. |
-| | The use of software (canaries) or hardware |
-| | hardening techniques (XN, WXN, BTI, pointer |
-| | authentication, MTE) helps detecting and stopping |
-| | an exploitation early. |
-| | The TF-A SPMC mitigates this threat by implementing|
-| | stack protector, pointer authentication, BTI, XN, |
-| | WXN, security hardening techniques. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 08 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may forge a direct message |
-| | request such that it reveals the internal state of |
-| | another endpoint through the direct message |
-| | response.** |
-| | The secure partition or SPMC replies to a partition|
-| | message by a direct message response with |
-| | information which may reveal its internal state |
-| | (.e.g. partition message response outside of |
-| | allowed bounds). |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC or SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Information discolure |
-+------------------------+------------------+---------------+-----------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+---------------+-----------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Likelihood`` | Low (2) | Low (2) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Total Risk Rating`` | Medium (6) | Medium (6) | |
-+------------------------+------------------+---------------+-----------------+
-| ``Mitigations`` | For the specific case of direct requests targeting |
-| | the SPMC, the latter is hardened to prevent |
-| | its internal state or the state of an SP to be |
-| | revealed through a direct message response. |
-| | Further, SPMC performs numerous checks in runtime |
-| | on the basis of the rules established by partition |
-| | runtime models to stop any malicious attempts by |
-| | an endpoint to extract internal state of another |
-| | endpoint. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 09 |
-+========================+====================================================+
-| ``Threat`` | **Probing the FF-A communication between |
-| | endpoints.** |
-| | SPMC and SPs are typically loaded to external |
-| | memory (protected by a TrustZone memory |
-| | controller). A malicious agent may use non invasive|
-| | methods to probe the external memory bus and |
-| | extract the traffic between an SP and the SPMC or |
-| | among SPs when shared buffers are held in external |
-| | memory. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF7 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP/SPMC state, SP/SPMC secrets |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | Hardware attack |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Information disclosure |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Low (2) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (6) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | It is expected the platform or chipset provides |
-| | guarantees in protecting the DRAM contents. |
-| | The TF-A SPMC does not mitigate this class of |
-| | attack and this is left to the integrator. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 10 |
-+========================+====================================================+
-| ``Threat`` | **A malicious agent may attempt revealing the SPMC |
-| | state or secrets by the use of software-based cache|
-| | side-channel attack techniques.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF7 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP or SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Information disclosure |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Low (2) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (6) | Medium (6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | From an integration perspective it is assumed |
-| | platforms consuming the SPMC component at S-EL2 |
-| | (hence implementing the Armv8.4 FEAT_SEL2 |
-| | architecture extension) implement mitigations to |
-| | Spectre, Meltdown or other cache timing |
-| | side-channel type of attacks. |
-| | The TF-A SPMC implements one mitigation (barrier |
-| | preventing speculation past exeception returns). |
-| | The SPMC may be hardened further with SW |
-| | mitigations (e.g. speculation barriers) for the |
-| | cases not covered in HW. Usage of hardened |
-| | compilers and appropriate options, code inspection |
-| | are recommended ways to mitigate Spectre types of |
-| | attacks. For non-hardened cores, the usage of |
-| | techniques such a kernel page table isolation can |
-| | help mitigating Meltdown type of attacks. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 11 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may attempt flooding the |
-| | SPMC with requests targeting a service within an |
-| | endpoint such that it denies another endpoint to |
-| | access this service.** |
-| | Similarly, the malicious endpoint may target a |
-| | a service within an endpoint such that the latter |
-| | is unable to request services from another |
-| | endpoint. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. |
-| | Bounding the time for operations to complete can |
-| | be achieved by the usage of a trusted watchdog. |
-| | Other quality of service monitoring can be achieved|
-| | in the SPMC such as counting a number of operations|
-| | in a limited timeframe. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 12 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may attempt to allocate |
-| | notifications bitmaps in the SPMC, through the |
-| | FFA_NOTIFICATION_BITMAP_CREATE.** |
-| | This might be an attempt to exhaust SPMC's memory, |
-| | or to allocate a bitmap for a VM that was not |
-| | intended to receive notifications from SPs. Thus |
-| | creating the possibility for a channel that was not|
-| | meant to exist. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of service, Spoofing |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium(3) | Medium(3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium(3) | Medium(3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium(9) | Medium(9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this threat by defining a |
-| | a fixed size pool for bitmap allocation. |
-| | It also limits the designated FF-A calls to be used|
-| | from NWd endpoints. |
-| | In the NWd the hypervisor is supposed to limit the |
-| | access to the designated FF-A call. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 13 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may attempt to destroy the |
-| | notifications bitmaps in the SPMC, through the |
-| | FFA_NOTIFICATION_BITMAP_DESTROY.** |
-| | This might be an attempt to tamper with the SPMC |
-| | state such that a partition isn't able to receive |
-| | notifications. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Low(4) | Low(4) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this issue by limiting the |
-| | designated FF-A call to be issued by the NWd. |
-| | Also, the notifications bitmap can't be destroyed |
-| | if there are pending notifications. |
-| | In the NWd, the hypervisor must restrict the |
-| | NS-endpoints that can issue the designated call. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 14 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint might attempt to give |
-| | permissions to an unintended sender to set |
-| | notifications targeting another receiver using the |
-| | FF-A call FFA_NOTIFICATION_BIND.** |
-| | This might be an attempt to tamper with the SPMC |
-| | state such that an unintended, and possibly |
-| | malicious, communication channel is established. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering, Spoofing |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium(3) | Medium(3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium(6) | Medium(6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this by restricting |
-| | designated FFA_NOTIFICATION_BIND call to be issued |
-| | by the receiver only. The receiver is responsible |
-| | for allocating the notifications IDs to one |
-| | specific partition. |
-| | Also, receivers that are not meant to receive |
-| | notifications, must have notifications receipt |
-| | disabled in the respective partition's manifest. |
-| | As for calls coming from NWd, if the NWd VM has had|
-| | its bitmap allocated at initialization, the TF-A |
-| | SPMC can't guarantee this threat won't happen. |
-| | The Hypervisor must mitigate in the NWd, similarly |
-| | to SPMC for calls in SWd. Though, if the Hypervisor|
-| | has been compromised, the SPMC won't be able to |
-| | mitigate it for calls forwarded from NWd. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 15 |
-+========================+====================================================+
-| ``Threat`` | **A malicious partition endpoint might attempt to |
-| | set notifications that are not bound to it.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Spoofing |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Low(4) | Low(4) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this by checking the |
-| | sender's ID provided in the input to the call |
-| | FFA_NOTIFICATION_SET. The SPMC keeps track of which|
-| | notifications are bound to which sender, for a |
-| | given receiver. If the sender is an SP, the |
-| | provided sender ID must match the ID of the |
-| | currently running partition. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 16 |
-+========================+====================================================+
-| ``Threat`` | **A malicious partition endpoint might attempt to |
-| | get notifications that are not targeted to it.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Spoofing |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Informational(1) | Informational(1)| |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this by checking the |
-| | receiver's ID provided in the input to the call |
-| | FFA_NOTIFICATION_GET. The SPMC keeps track of which|
-| | notifications are pending for each receiver. |
-| | The provided receiver ID must match the ID of the |
-| | currently running partition, if it is an SP. |
-| | For calls forwarded from NWd, the SPMC will return |
-| | the pending notifications if the receiver had its |
-| | bitmap created, and has pending notifications. |
-| | If Hypervisor or OS kernel are compromised, the |
-| | SPMC won't be able to mitigate calls from rogue NWd|
-| | endpoints. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 17 |
-+========================+====================================================+
-| ``Threat`` | **A malicious partition endpoint might attempt to |
-| | get the information about pending notifications, |
-| | through the FFA_NOTIFICATION_INFO_GET call.** |
-| | This call is meant to be used by the NWd FF-A |
-| | driver. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Information disclosure |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium(3) | Medium(3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium(6) | Medium(6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this by returning error to |
-| | calls made by SPs to FFA_NOTIFICATION_INFO_GET. |
-| | If Hypervisor or OS kernel are compromised, the |
-| | SPMC won't be able mitigate calls from rogue NWd |
-| | endpoints. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 18 |
-+========================+====================================================+
-| ``Threat`` | **A malicious partition endpoint might attempt to |
-| | flood another partition endpoint with notifications|
-| | hindering its operation.** |
-| | The intent of the malicious endpoint could be to |
-| | interfere with both the receiver's and/or primary |
-| | endpoint execution, as they can both be preempted |
-| | by the NPI and SRI, respectively. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, CPU cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | DoS |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low(2) | Low(2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium(3) | Medium(3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium(6) | Medium(6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. |
-| | However, the impact is limited due to the |
-| | architecture: |
-| | - Notifications are not queued, one that has been |
-| | signaled needs to be retrieved by the receiver, |
-| | until it can be sent again. |
-| | - Both SRI and NPI can't be pended until handled |
-| | which limits the amount of spurious interrupts. |
-| | - A given receiver could only bind a maximum number|
-| | of notifications to a given sender, within a given |
-| | execution context. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 19 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint may abuse FFA_RUN call to |
-| | resume or turn on other endpoint execution |
-| | contexts, attempting to alter the internal state of|
-| | SPMC and SPs, potentially leading to illegal state |
-| | transitions and deadlocks.** |
-| | An endpoint can call into another endpoint |
-| | execution context using FFA_MSG_SEND_DIRECT_REQ |
-| | ABI to create a call chain. A malicious endpoint |
-| | could abuse this to form loops in a call chain that|
-| | could lead to potential deadlocks. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF4 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, SPMD |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, Scheduling cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering, Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC provides mitigation against such |
-| | threats by following the guidance for partition |
-| | runtime models as described in FF-A v1.1 EAC0 spec.|
-| | The SPMC performs numerous checks in runtime to |
-| | prevent illegal state transitions by adhering to |
-| | the partition runtime model. Further, if the |
-| | receiver endpoint is a predecessor of current |
-| | endpoint in the present call chain, the SPMC denies|
-| | any attempts to form loops by returning FFA_DENIED |
-| | error code. Only the primary scheduler is allowed |
-| | to turn on execution contexts of other partitions |
-| | though SPMC does not have the ability to |
-| | scrutinize its identity. Secure partitions have |
-| | limited ability to resume execution contexts of |
-| | other partitions based on the runtime model. Such |
-| | attempts cannot compromise the integrity of the |
-| | SPMC. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 20 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint can perform a |
-| | denial-of-service attack by using FFA_INTERRUPT |
-| | call that could attempt to cause the system to |
-| | crash or enter into an unknown state as no physical|
-| | interrupt could be pending for it to be handled in |
-| | the SPMC.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, SPMD |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, Scheduling cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering, Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC provides mitigation against such |
-| | attack by detecting invocations from partitions |
-| | and simply returning FFA_ERROR status interface. |
-| | SPMC only allows SPMD to use FFA_INTERRUPT ABI to |
-| | communicate a pending secure interrupt triggered |
-| | while execution was in normal world. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 21 |
-+========================+====================================================+
-| ``Threat`` | **A malicious secure endpoint might deactivate a |
-| | (virtual) secure interrupt that was not originally |
-| | signaled by SPMC, thereby attempting to alter the |
-| | state of the SPMC and potentially lead to system |
-| | crash.** |
-| | SPMC maps the virtual interrupt ids to the physical|
-| | interrupt ids to keep the implementation of virtual|
-| | interrupt driver simple. |
-| | Similarly, a malicious secure endpoint might invoke|
-| | the deactivation ABI more than once for a secure |
-| | interrupt. Moreover, a malicious secure endpoint |
-| | might attempt to deactivate a (virtual) secure |
-| | interrupt that was signaled to another endpoint |
-| | execution context by the SPMC even before secure |
-| | interrupt was handled. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | At initialization, the TF-A SPMC parses the |
-| | partition manifests to find the target execution |
-| | context responsible for handling the various |
-| | secure physical interrupts. The TF-A SPMC provides |
-| | mitigation against above mentioned threats by: |
-| | |
-| | - Keeping track of each pending virtual interrupt |
-| | signaled to an execution context of a secure |
-| | secure partition. |
-| | - Denying any deactivation call from SP if there is|
-| | no pending physical interrupt mapped to the |
-| | given virtual interrupt. |
-| | - Denying any deactivation call from SP if the |
-| | virtual interrupt has not been signaled to the |
-| | current execution context. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 22 |
-+========================+====================================================+
-| ``Threat`` | **A malicious secure endpoint might not deactivate |
-| | a virtual interrupt signaled to it by the SPMC but |
-| | perform secure interrupt signal completion. This |
-| | attempt to corrupt the internal state of the SPMC |
-| | could lead to an unknown state and further lead to |
-| | system crash.** |
-| | Similarly, a malicious secure endpoint could |
-| | deliberately not perform either interrupt |
-| | deactivation or interrupt completion signal. Since,|
-| | the SPMC can only process one secure interrupt at a|
-| | time, this could choke the system where all |
-| | interrupts are indefinitely masked which could |
-| | potentially lead to system crash or reboot. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, Scheduling cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Tampering, Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not provide mitigation against |
-| | such threat. This is a limitation of the current |
-| | SPMC implementation and needs to be handled in the |
-| | future releases. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 23 |
-+========================+====================================================+
-| ``Threat`` | **A malicious endpoint could leverage non-secure |
-| | interrupts to preempt a secure endpoint, thereby |
-| | attempting to render it unable to handle a secure |
-| | virtual interrupt targetted for it. This could lead|
-| | to priority inversion as secure virtual interrupts |
-| | are kept pending while non-secure interrupts are |
-| | handled by normal world VMs.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, SPMD |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, Scheduling cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC alone does not provide mitigation |
-| | against such threats. System integrators must take |
-| | necessary high level design decisions that takes |
-| | care of interrupt prioritization. The SPMC performs|
-| | its role of enabling SPs to specify appropriate |
-| | action towards non-secure interrupt with the help |
-| | of partition manifest based on the guidance in the |
-| | FF-A v1.1 EAC0 specification. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 24 |
-+========================+====================================================+
-| ``Threat`` | **A secure endpoint depends on primary scheduler |
-| | for CPU cycles. A malicious endpoint could delay |
-| | the secure endpoint from being scheduled. Secure |
-| | interrupts, if not handled timely, could compromise|
-| | the state of SP and SPMC, thereby rendering the |
-| | system unresponsive.** |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2, DF3, DF5 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, SPMD |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state, SP state, Scheduling cycles |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (9) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not provide full mitigation |
-| | against such threats. However, based on the |
-| | guidance provided in the FF-A v1.1 EAC0 spec, SPMC |
-| | provisions CPU cycles to run a secure endpoint |
-| | execution context in SPMC schedule mode which |
-| | cannot be preempted by a non-secure interrupt. |
-| | This reduces the dependency on primary scheduler |
-| | for cycle allocation. Moreover, all further |
-| | interrupts are masked until pending secure virtual |
-| | interrupt on current CPU is handled. This allows SP|
-| | execution context to make progress even upon being |
-| | interrupted. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 25 |
-+========================+====================================================+
-| ``Threat`` | **A rogue FF-A endpoint can use memory sharing |
-| | calls to exhaust SPMC resources.** |
-| | For each on-going operation that involves an SP, |
-| | the SPMC allocates resources to track its state. |
-| | If the operation is never concluded, the resources |
-| | are never freed. |
-| | In the worst scenario, multiple operations that |
-| | never conclude may exhaust the SPMC resources to a |
-| | point in which renders memory sharing operations |
-| | impossible. This could affect other, non-harmful |
-| | FF-A endpoints, from legitimately using memory |
-| | share functionality. The intent might even be |
-| | to cause the SPMC to consume excessive CPU cycles, |
-| | attempting to make it deny its service to the NWd. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, SPMD |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SPMC state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | High (4) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | High (4) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | High (16) | Medium (9) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC uses a statically allocated pool of |
-| | memory to keep track of on-going memory sharing |
-| | operations. After a possible attack, this could |
-| | fail due to insufficient memory, and return an |
-| | error to the caller. At this point, any other |
-| | endpoint that requires use of memory sharing for |
-| | its operation could get itself in an unusable |
-| | state. |
-| | Regarding CPU cycles starving threat, the SPMC |
-| | doesn't provide any mitigation for this, as any |
-| | FF-A endpoint, at the virtual FF-A instance is |
-| | allowed to invoke memory share/lend/donate. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 26 |
-+========================+====================================================+
-| ``Threat`` | **A borrower may interfere with lender's |
-| | operation, if it terminates due to a fatal error |
-| | condition without releasing the memory |
-| | shared/lent.** |
-| | Such scenario may render the lender inoperable. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | High (4) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | High (12) | Medium(6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC does not provide mitigation for such |
-| | scenario. The FF-A endpoints must attempt to |
-| | relinquish memory shared/lent themselves in |
-| | case of failure. The memory used to track the |
-| | operation in the SPMC will also remain usuable. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 27 |
-+========================+====================================================+
-| ``Threat`` | **A rogue FF-A endpoint may attempt to tamper with |
-| | the content of the memory shared/lent, whilst |
-| | being accessed by other FF-A endpoints.** |
-| | It might attempt to do so: using one of the clear |
-| | flags, when either retrieving or relinquishing |
-| | access to the memory via the respective FF-A |
-| | calls; or directly accessing memory without |
-| | respecting the synchronization protocol between |
-| | all involved endpoints. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, FF-A endpoint |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service, Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | Low (2) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Medium (3) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | Medium (6) | Medium(6) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The first case defined in the threat, the TF-A |
-| | SPMC mitigates it, by ensuring a memory is cleared |
-| | only when all borrowers have relinquished access |
-| | to the memory, in a scenario involving multiple |
-| | borrowers. Also, if the receiver is granted RO, |
-| | permissions, the SPMC will reject any request |
-| | to clear memory on behalf of the borrower, by |
-| | returning an error to the respective FF-A call. |
-| | The second case defined in the threat can't be |
-| | mitigated by the SPMC. It is up to the NS/S FF-A |
-| | endpoints to establish a robust protocol for using |
-| | the shared memory. |
-+------------------------+----------------------------------------------------+
-
-+------------------------+----------------------------------------------------+
-| ID | 28 |
-+========================+====================================================+
-| ``Threat`` | **A rogue FF-A endpoint may attempt to share |
-| | memory that is not in its translation regime, or |
-| | attempt to specify attributes more permissive than |
-| | those it possesses at a given time.** |
-| | Both ways could be an attempt for escalating its |
-| | privileges. |
-+------------------------+----------------------------------------------------+
-| ``Diagram Elements`` | DF1, DF2 |
-+------------------------+----------------------------------------------------+
-| ``Affected TF-A | SPMC, FF-A endpoint |
-| Components`` | |
-+------------------------+----------------------------------------------------+
-| ``Assets`` | SP state |
-+------------------------+----------------------------------------------------+
-| ``Threat Agent`` | NS-Endpoint, S-Endpoint |
-+------------------------+----------------------------------------------------+
-| ``Threat Type`` | Denial of Service, Tampering |
-+------------------------+------------------+-----------------+---------------+
-| ``Application`` | ``Server`` | ``Mobile`` | |
-+------------------------+------------------+-----------------+---------------+
-| ``Impact`` | High (4) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Likelihood`` | Medium (3) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Total Risk Rating`` | High (12) | Low (2) | |
-+------------------------+------------------+-----------------+---------------+
-| ``Mitigations`` | The TF-A SPMC mitigates this threat by performing |
-| | sanity checks to the provided memory region |
-| | descriptor. |
-| | For operations at the virtual FF-A instance, and |
-| | once the full memory descriptor is provided, |
-| | the SPMC validates that the memory is part of the |
-| | caller's translation regime. The SPMC also checks |
-| | that the memory attributes provided are within |
-| | those the owner possesses, in terms of |
-| | permissiveness. If more permissive attributes are |
-| | specified, the SPMC returns an error |
-| | FFA_INVALID_PARAMETERS. The permissiveness rules |
-| | are enforced in any call to share/lend or donate |
-| | the memory, and in retrieve requests. |
-+------------------------+----------------------------------------------------+
-
---------------
-
-*Copyright (c) 2021-2023, Arm Limited. All rights reserved.*
-
-.. _Arm Firmware Framework for Arm A-profile: https://developer.arm.com/docs/den0077/latest
-.. _FF-A ACS: https://github.com/ARM-software/ff-a-acs/releases
-
