diff --git a/docs/components/secure-partition-manager-mm.rst b/docs/components/secure-partition-manager-mm.rst index 4cdb96c10..d9b2b1b7c 100644 --- a/docs/components/secure-partition-manager-mm.rst +++ b/docs/components/secure-partition-manager-mm.rst @@ -4,17 +4,10 @@ Secure Partition Manager (MM) Foreword ======== -Two implementations of a Secure Partition Manager co-exist in the TF-A codebase: - -- SPM based on the FF-A specification (:ref:`Secure Partition Manager`). -- SPM based on the MM interface. - -Both implementations differ in their architectures and only one can be selected -at build time. - -This document describes the latter implementation where the Secure Partition Manager -resides at EL3 and management services run from isolated Secure Partitions at S-EL0. -The communication protocol is established through the Management Mode (MM) interface. +This document describes the implementation where the Secure Partition Manager +resides at EL3 and management services run from isolated Secure Partitions at +S-EL0. The communication protocol is established through the Management Mode +(MM) interface. Background ========== diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png deleted file mode 100644 index 0619cf260..000000000 Binary files a/docs/resources/diagrams/ffa-ns-interrupt-handling-managed-exit.png and /dev/null differ diff --git a/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png b/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png deleted file mode 100644 index f11002889..000000000 Binary files a/docs/resources/diagrams/ffa-ns-interrupt-handling-sp-preemption.png and /dev/null differ diff --git a/docs/threat_model/index.rst b/docs/threat_model/index.rst index b22fb1813..3e0393e38 100644 --- a/docs/threat_model/index.rst +++ b/docs/threat_model/index.rst @@ -31,7 +31,6 @@ data flow diagram, as well as a list of threats we have identified using the :caption: Contents threat_model - threat_model_spm threat_model_el3_spm threat_model_fvp_r threat_model_rss_interface diff --git a/docs/threat_model/threat_model_spm.rst b/docs/threat_model/threat_model_spm.rst deleted file mode 100644 index 24a115bfa..000000000 --- a/docs/threat_model/threat_model_spm.rst +++ /dev/null @@ -1,1340 +0,0 @@ -SPMC Threat Model -***************** - -************************ -Introduction -************************ -This document provides a threat model for the TF-A :ref:`Secure Partition Manager` -(SPM) implementation or more generally the S-EL2 reference firmware running on -systems implementing the FEAT_SEL2 (formerly Armv8.4 Secure EL2) architecture -extension. The SPM implementation is based on the `Arm Firmware Framework for -Arm A-profile`_ specification. - -In brief, the broad FF-A specification and S-EL2 firmware implementation -provide: - -- Isolation of mutually mistrusting SW components, or endpoints in the FF-A - terminology. -- Distinct sandboxes in the secure world called secure partitions. This permits - isolation of services from multiple vendors. -- A standard protocol for communication and memory sharing between FF-A - endpoints. -- Mutual isolation of the normal world and the secure world (e.g. a Trusted OS - is prevented to map an arbitrary NS physical memory region such as the kernel - or the Hypervisor). - -************************ -Target of Evaluation -************************ -In this threat model, the target of evaluation is the S-EL2 firmware or the -``Secure Partition Manager Core`` component (SPMC). -The monitor and SPMD at EL3 are covered by the :ref:`Generic TF-A threat model -`. - -The scope for this threat model is: - -- The TF-A implementation for the S-EL2 SPMC based on the Hafnium hypervisor - running in the secure world of TrustZone (at S-EL2 exception level). - The threat model is not related to the normal world Hypervisor or VMs. - The S-EL1 and EL3 SPMC solutions are not covered. -- The implementation complies with the FF-A v1.0 specification, and a few - features of FF-A v1.1 specification. -- Secure partitions are statically provisioned at boot time. -- Focus on the run-time part of the life-cycle (no specific emphasis on boot - time, factory firmware provisioning, firmware udpate etc.) -- Not covering advanced or invasive physical attacks such as decapsulation, - FIB etc. -- Assumes secure boot or in particular TF-A trusted boot (TBBR or dual CoT) is - enabled. An attacker cannot boot arbitrary images that are not approved by the - SiP or platform providers. - -Data Flow Diagram -====================== -Figure 1 shows a high-level data flow diagram for the SPM split into an SPMD -component at EL3 and an SPMC component at S-EL2. The SPMD mostly acts as a -relayer/pass-through between the normal world and the secure world. It is -assumed to expose small attack surface. - -A description of each diagram element is given in Table 1. In the diagram, the -red broken lines indicate trust boundaries. - -Components outside of the broken lines are considered untrusted. - -.. uml:: ../resources/diagrams/plantuml/spm_dfd.puml - :caption: Figure 1: SPMC Data Flow Diagram - -.. table:: Table 1: SPMC Data Flow Diagram Description - - +---------------------+--------------------------------------------------------+ - | Diagram Element | Description | - +=====================+========================================================+ - | ``DF1`` | SP to SPMC communication. FF-A function invocation or | - | | implementation-defined Hypervisor call. | - +---------------------+--------------------------------------------------------+ - | ``DF2`` | SPMC to SPMD FF-A call. | - +---------------------+--------------------------------------------------------+ - | ``DF3`` | SPMD to NS forwarding. | - +---------------------+--------------------------------------------------------+ - | ``DF4`` | SP to SP FF-A direct message request/response. | - | | Note as a matter of simplifying the diagram | - | | the SP to SP communication happens through the SPMC | - | | (SP1 performs a direct message request to the | - | | SPMC targeting SP2 as destination. And similarly for | - | | the direct message response from SP2 to SP1). | - +---------------------+--------------------------------------------------------+ - | ``DF5`` | HW control. | - +---------------------+--------------------------------------------------------+ - | ``DF6`` | Bootloader image loading. | - +---------------------+--------------------------------------------------------+ - | ``DF7`` | External memory access. | - +---------------------+--------------------------------------------------------+ - -********************* -Threat Analysis -********************* - -This threat model follows a similar methodology to the :ref:`Generic TF-A threat model -`. -The following sections define: - -- Trust boundaries -- Assets -- Theat agents -- Threat types - -Trust boundaries -============================ - -- Normal world is untrusted. -- Secure world and normal world are separate trust boundaries. -- EL3 monitor, SPMD and SPMC are trusted. -- Bootloaders (in particular BL1/BL2 if using TF-A) and run-time BL31 are - implicitely trusted by the usage of secure boot. -- EL3 monitor, SPMD, SPMC do not trust SPs. - -.. figure:: ../resources/diagrams/spm-threat-model-trust-boundaries.png - - Figure 2: Trust boundaries - -Assets -============================ - -The following assets are identified: - -- SPMC state. -- SP state. -- Information exchange between endpoints (partition messages). -- SPMC secrets (e.g. pointer authentication key when enabled) -- SP secrets (e.g. application keys). -- Scheduling cycles. -- Shared memory. - -Threat Agents -============================ - -The following threat agents are identified: - -- NS-Endpoint identifies a non-secure endpoint: normal world client at NS-EL2 - (Hypervisor) or NS-EL1 (VM or OS kernel). -- S-Endpoint identifies a secure endpoint typically a secure partition. -- Hardware attacks (non-invasive) requiring a physical access to the device, - such as bus probing or DRAM stress. - -Threat types -============================ - -The following threat categories as exposed in the :ref:`Generic TF-A threat model -` -are re-used: - -- Spoofing -- Tampering -- Repudiation -- Information disclosure -- Denial of service -- Elevation of privileges - -Similarly this threat model re-uses the same threat risk ratings. The risk -analysis is evaluated based on the environment being ``Server`` or ``Mobile``. - -Threat Assessment -============================ - -The following threats are identified by applying STRIDE analysis on each diagram -element of the data flow diagram. - -+------------------------+----------------------------------------------------+ -| ID | 01 | -+========================+====================================================+ -| ``Threat`` | **An endpoint impersonates the sender or receiver | -| | FF-A ID in a direct request/response invocation.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------++----------------+---------------+ -| ``Impact`` | Critical(5) | Critical(5) | | -+------------------------+------------------++----------------+---------------+ -| ``Likelihood`` | Critical(5) | Critical(5) | | -+------------------------+------------------++----------------+---------------+ -| ``Total Risk Rating`` | Critical(25) | Critical(25) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | The guidance below is left for a system integrator | -| | to implemented as necessary. | -| | The SPMC must enforce checks in the direct message | -| | request/response interfaces such an endpoint cannot| -| | spoof the origin and destination worlds (e.g. a NWd| -| | originated message directed to the SWd cannot use a| -| | SWd ID as the sender ID). | -| | Additionally a software component residing in the | -| | SPMC can be added for the purpose of direct | -| | request/response filtering. | -| | It can be configured with the list of known IDs | -| | and about which interaction can occur between one | -| | and another endpoint (e.g. which NWd endpoint ID | -| | sends a direct request to which SWd endpoint ID). | -| | This component checks the sender/receiver fields | -| | for a legitimate communication between endpoints. | -| | A similar component can exist in the OS kernel | -| | driver, or Hypervisor although it remains untrusted| -| | by the SPMD/SPMC. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 02 | -+========================+====================================================+ -| ``Threat`` | **Tampering with memory shared between an endpoint | -| | and the SPMC.** | -| | A malicious endpoint may attempt tampering with its| -| | RX/TX buffer contents while the SPMC is processing | -| | it (TOCTOU). | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF3, DF4, DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | Shared memory, Information exchange | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (16) | High (16) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | In context of FF-A v1.0 and v1.1 this is the case | -| | of sharing the RX/TX buffer pair and usage in the | -| | PARTITION_INFO_GET or mem sharing primitives. | -| | The SPMC must copy the contents of the TX buffer | -| | to an internal temporary buffer before processing | -| | its contents. The SPMC must implement hardened | -| | input validation on data transmitted through the TX| -| | buffer by an untrusted endpoint. | -| | The TF-A SPMC mitigates this threat by enforcing | -| | checks on data transmitted through RX/TX buffers. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 03 | -+========================+====================================================+ -| ``Threat`` | **An endpoint may tamper with its own state or the | -| | state of another endpoint.** | -| | A malicious endpoint may attempt violating: | -| | - its own or another SP state by using an unusual | -| | combination (or out-of-order) FF-A function | -| | invocations. | -| | This can also be an endpoint emitting | -| | FF-A function invocations to another endpoint while| -| | the latter is not in a state to receive it (e.g. a | -| | SP sends a direct request to the normal world early| -| | while the normal world is not booted yet). | -| | - the SPMC state itself by employing unexpected | -| | transitions in FF-A memory sharing, direct requests| -| | and responses, or handling of interrupts. | -| | This can be led by random stimuli injection or | -| | fuzzing. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state, SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | threat by following the guidance for partition | -| | runtime models as described in FF-A v1.1 EAC0 spec.| -| | The SPMC performs numerous checks in runtime to | -| | prevent illegal state transitions by adhering to | -| | the partition runtime model. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 04 | -+========================+====================================================+ -| ``Threat`` | *An attacker may attempt injecting errors by the | -| | use of external DRAM stress techniques.** | -| | A malicious agent may attempt toggling an SP | -| | Stage-2 MMU descriptor bit within the page tables | -| | that the SPMC manages. This can happen in Rowhammer| -| | types of attack. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP or SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | Hardware attack | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Low (2) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | Medium (8) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigations to this | -| | type of attack. It can be addressed by the use of | -| | dedicated HW circuity or hardening at the chipset | -| | or platform level left to the integrator. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 05 | -+========================+====================================================+ -| ``Threat`` | **Protection of the SPMC from a DMA capable device | -| | upstream to an SMMU.** | -| | A device may attempt to tamper with the internal | -| | SPMC code/data sections. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC or SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Elevation of privileges | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | A platform may prefer assigning boot time, | -| | statically alocated memory regions through the SMMU| -| | configuration and page tables. The FF-A v1.1 | -| | specification provisions this capability through | -| | static DMA isolation. | -| | The TF-A SPMC does not mitigate this threat. | -| | It will adopt the static DMA isolation approach in | -| | a future release. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 06 | -+========================+====================================================+ -| ``Threat`` | **Replay fragments of past communication between | -| | endpoints.** | -| | A malicious endpoint may replay a message exchange | -| | that occured between two legitimate endpoint as | -| | a matter of triggering a malfunction or extracting | -| | secrets from the receiving endpoint. In particular | -| | the memory sharing operation with fragmented | -| | messages between an endpoint and the SPMC may be | -| | replayed by a malicious agent as a matter of | -| | getting access or gaining permissions to a memory | -| | region which does not belong to this agent. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | Information exchange | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Repdudiation | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 07 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to extract data | -| | or state information by the use of invalid or | -| | incorrect input arguments.** | -| | Lack of input parameter validation or side effects | -| | of maliciously forged input parameters might affect| -| | the SPMC. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMD, SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP secrets, SPMC secrets, SP state, SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information discolure | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | High (4) | High (4) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | High (12) | High (12) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | Secure Partitions must follow security standards | -| | and best practises as a way to mitigate the risk | -| | of common vulnerabilities to be exploited. | -| | The use of software (canaries) or hardware | -| | hardening techniques (XN, WXN, BTI, pointer | -| | authentication, MTE) helps detecting and stopping | -| | an exploitation early. | -| | The TF-A SPMC mitigates this threat by implementing| -| | stack protector, pointer authentication, BTI, XN, | -| | WXN, security hardening techniques. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 08 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may forge a direct message | -| | request such that it reveals the internal state of | -| | another endpoint through the direct message | -| | response.** | -| | The secure partition or SPMC replies to a partition| -| | message by a direct message response with | -| | information which may reveal its internal state | -| | (.e.g. partition message response outside of | -| | allowed bounds). | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC or SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information discolure | -+------------------------+------------------+---------------+-----------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+---------------+-----------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+---------------+-----------------+ -| ``Likelihood`` | Low (2) | Low (2) | | -+------------------------+------------------+---------------+-----------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (6) | | -+------------------------+------------------+---------------+-----------------+ -| ``Mitigations`` | For the specific case of direct requests targeting | -| | the SPMC, the latter is hardened to prevent | -| | its internal state or the state of an SP to be | -| | revealed through a direct message response. | -| | Further, SPMC performs numerous checks in runtime | -| | on the basis of the rules established by partition | -| | runtime models to stop any malicious attempts by | -| | an endpoint to extract internal state of another | -| | endpoint. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 09 | -+========================+====================================================+ -| ``Threat`` | **Probing the FF-A communication between | -| | endpoints.** | -| | SPMC and SPs are typically loaded to external | -| | memory (protected by a TrustZone memory | -| | controller). A malicious agent may use non invasive| -| | methods to probe the external memory bus and | -| | extract the traffic between an SP and the SPMC or | -| | among SPs when shared buffers are held in external | -| | memory. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP/SPMC state, SP/SPMC secrets | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | Hardware attack | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low (2) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | It is expected the platform or chipset provides | -| | guarantees in protecting the DRAM contents. | -| | The TF-A SPMC does not mitigate this class of | -| | attack and this is left to the integrator. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 10 | -+========================+====================================================+ -| ``Threat`` | **A malicious agent may attempt revealing the SPMC | -| | state or secrets by the use of software-based cache| -| | side-channel attack techniques.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF7 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP or SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low (2) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium (6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | From an integration perspective it is assumed | -| | platforms consuming the SPMC component at S-EL2 | -| | (hence implementing the Armv8.4 FEAT_SEL2 | -| | architecture extension) implement mitigations to | -| | Spectre, Meltdown or other cache timing | -| | side-channel type of attacks. | -| | The TF-A SPMC implements one mitigation (barrier | -| | preventing speculation past exeception returns). | -| | The SPMC may be hardened further with SW | -| | mitigations (e.g. speculation barriers) for the | -| | cases not covered in HW. Usage of hardened | -| | compilers and appropriate options, code inspection | -| | are recommended ways to mitigate Spectre types of | -| | attacks. For non-hardened cores, the usage of | -| | techniques such a kernel page table isolation can | -| | help mitigating Meltdown type of attacks. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 11 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt flooding the | -| | SPMC with requests targeting a service within an | -| | endpoint such that it denies another endpoint to | -| | access this service.** | -| | Similarly, the malicious endpoint may target a | -| | a service within an endpoint such that the latter | -| | is unable to request services from another | -| | endpoint. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | Bounding the time for operations to complete can | -| | be achieved by the usage of a trusted watchdog. | -| | Other quality of service monitoring can be achieved| -| | in the SPMC such as counting a number of operations| -| | in a limited timeframe. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 12 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to allocate | -| | notifications bitmaps in the SPMC, through the | -| | FFA_NOTIFICATION_BITMAP_CREATE.** | -| | This might be an attempt to exhaust SPMC's memory, | -| | or to allocate a bitmap for a VM that was not | -| | intended to receive notifications from SPs. Thus | -| | creating the possibility for a channel that was not| -| | meant to exist. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of service, Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(9) | Medium(9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this threat by defining a | -| | a fixed size pool for bitmap allocation. | -| | It also limits the designated FF-A calls to be used| -| | from NWd endpoints. | -| | In the NWd the hypervisor is supposed to limit the | -| | access to the designated FF-A call. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 13 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may attempt to destroy the | -| | notifications bitmaps in the SPMC, through the | -| | FFA_NOTIFICATION_BITMAP_DESTROY.** | -| | This might be an attempt to tamper with the SPMC | -| | state such that a partition isn't able to receive | -| | notifications. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(4) | Low(4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this issue by limiting the | -| | designated FF-A call to be issued by the NWd. | -| | Also, the notifications bitmap can't be destroyed | -| | if there are pending notifications. | -| | In the NWd, the hypervisor must restrict the | -| | NS-endpoints that can issue the designated call. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 14 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint might attempt to give | -| | permissions to an unintended sender to set | -| | notifications targeting another receiver using the | -| | FF-A call FFA_NOTIFICATION_BIND.** | -| | This might be an attempt to tamper with the SPMC | -| | state such that an unintended, and possibly | -| | malicious, communication channel is established. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by restricting | -| | designated FFA_NOTIFICATION_BIND call to be issued | -| | by the receiver only. The receiver is responsible | -| | for allocating the notifications IDs to one | -| | specific partition. | -| | Also, receivers that are not meant to receive | -| | notifications, must have notifications receipt | -| | disabled in the respective partition's manifest. | -| | As for calls coming from NWd, if the NWd VM has had| -| | its bitmap allocated at initialization, the TF-A | -| | SPMC can't guarantee this threat won't happen. | -| | The Hypervisor must mitigate in the NWd, similarly | -| | to SPMC for calls in SWd. Though, if the Hypervisor| -| | has been compromised, the SPMC won't be able to | -| | mitigate it for calls forwarded from NWd. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 15 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | set notifications that are not bound to it.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(4) | Low(4) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by checking the | -| | sender's ID provided in the input to the call | -| | FFA_NOTIFICATION_SET. The SPMC keeps track of which| -| | notifications are bound to which sender, for a | -| | given receiver. If the sender is an SP, the | -| | provided sender ID must match the ID of the | -| | currently running partition. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 16 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | get notifications that are not targeted to it.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Spoofing | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Informational(1) | Informational(1)| | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by checking the | -| | receiver's ID provided in the input to the call | -| | FFA_NOTIFICATION_GET. The SPMC keeps track of which| -| | notifications are pending for each receiver. | -| | The provided receiver ID must match the ID of the | -| | currently running partition, if it is an SP. | -| | For calls forwarded from NWd, the SPMC will return | -| | the pending notifications if the receiver had its | -| | bitmap created, and has pending notifications. | -| | If Hypervisor or OS kernel are compromised, the | -| | SPMC won't be able to mitigate calls from rogue NWd| -| | endpoints. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 17 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | get the information about pending notifications, | -| | through the FFA_NOTIFICATION_INFO_GET call.** | -| | This call is meant to be used by the NWd FF-A | -| | driver. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Information disclosure | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this by returning error to | -| | calls made by SPs to FFA_NOTIFICATION_INFO_GET. | -| | If Hypervisor or OS kernel are compromised, the | -| | SPMC won't be able mitigate calls from rogue NWd | -| | endpoints. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 18 | -+========================+====================================================+ -| ``Threat`` | **A malicious partition endpoint might attempt to | -| | flood another partition endpoint with notifications| -| | hindering its operation.** | -| | The intent of the malicious endpoint could be to | -| | interfere with both the receiver's and/or primary | -| | endpoint execution, as they can both be preempted | -| | by the NPI and SRI, respectively. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, CPU cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | DoS | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low(2) | Low(2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium(3) | Medium(3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium(6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | -| | However, the impact is limited due to the | -| | architecture: | -| | - Notifications are not queued, one that has been | -| | signaled needs to be retrieved by the receiver, | -| | until it can be sent again. | -| | - Both SRI and NPI can't be pended until handled | -| | which limits the amount of spurious interrupts. | -| | - A given receiver could only bind a maximum number| -| | of notifications to a given sender, within a given | -| | execution context. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 19 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint may abuse FFA_RUN call to | -| | resume or turn on other endpoint execution | -| | contexts, attempting to alter the internal state of| -| | SPMC and SPs, potentially leading to illegal state | -| | transitions and deadlocks.** | -| | An endpoint can call into another endpoint | -| | execution context using FFA_MSG_SEND_DIRECT_REQ | -| | ABI to create a call chain. A malicious endpoint | -| | could abuse this to form loops in a call chain that| -| | could lead to potential deadlocks. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF4 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | threats by following the guidance for partition | -| | runtime models as described in FF-A v1.1 EAC0 spec.| -| | The SPMC performs numerous checks in runtime to | -| | prevent illegal state transitions by adhering to | -| | the partition runtime model. Further, if the | -| | receiver endpoint is a predecessor of current | -| | endpoint in the present call chain, the SPMC denies| -| | any attempts to form loops by returning FFA_DENIED | -| | error code. Only the primary scheduler is allowed | -| | to turn on execution contexts of other partitions | -| | though SPMC does not have the ability to | -| | scrutinize its identity. Secure partitions have | -| | limited ability to resume execution contexts of | -| | other partitions based on the runtime model. Such | -| | attempts cannot compromise the integrity of the | -| | SPMC. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 20 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint can perform a | -| | denial-of-service attack by using FFA_INTERRUPT | -| | call that could attempt to cause the system to | -| | crash or enter into an unknown state as no physical| -| | interrupt could be pending for it to be handled in | -| | the SPMC.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC provides mitigation against such | -| | attack by detecting invocations from partitions | -| | and simply returning FFA_ERROR status interface. | -| | SPMC only allows SPMD to use FFA_INTERRUPT ABI to | -| | communicate a pending secure interrupt triggered | -| | while execution was in normal world. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 21 | -+========================+====================================================+ -| ``Threat`` | **A malicious secure endpoint might deactivate a | -| | (virtual) secure interrupt that was not originally | -| | signaled by SPMC, thereby attempting to alter the | -| | state of the SPMC and potentially lead to system | -| | crash.** | -| | SPMC maps the virtual interrupt ids to the physical| -| | interrupt ids to keep the implementation of virtual| -| | interrupt driver simple. | -| | Similarly, a malicious secure endpoint might invoke| -| | the deactivation ABI more than once for a secure | -| | interrupt. Moreover, a malicious secure endpoint | -| | might attempt to deactivate a (virtual) secure | -| | interrupt that was signaled to another endpoint | -| | execution context by the SPMC even before secure | -| | interrupt was handled. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | At initialization, the TF-A SPMC parses the | -| | partition manifests to find the target execution | -| | context responsible for handling the various | -| | secure physical interrupts. The TF-A SPMC provides | -| | mitigation against above mentioned threats by: | -| | | -| | - Keeping track of each pending virtual interrupt | -| | signaled to an execution context of a secure | -| | secure partition. | -| | - Denying any deactivation call from SP if there is| -| | no pending physical interrupt mapped to the | -| | given virtual interrupt. | -| | - Denying any deactivation call from SP if the | -| | virtual interrupt has not been signaled to the | -| | current execution context. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 22 | -+========================+====================================================+ -| ``Threat`` | **A malicious secure endpoint might not deactivate | -| | a virtual interrupt signaled to it by the SPMC but | -| | perform secure interrupt signal completion. This | -| | attempt to corrupt the internal state of the SPMC | -| | could lead to an unknown state and further lead to | -| | system crash.** | -| | Similarly, a malicious secure endpoint could | -| | deliberately not perform either interrupt | -| | deactivation or interrupt completion signal. Since,| -| | the SPMC can only process one secure interrupt at a| -| | time, this could choke the system where all | -| | interrupts are indefinitely masked which could | -| | potentially lead to system crash or reboot. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Tampering, Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigation against | -| | such threat. This is a limitation of the current | -| | SPMC implementation and needs to be handled in the | -| | future releases. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 23 | -+========================+====================================================+ -| ``Threat`` | **A malicious endpoint could leverage non-secure | -| | interrupts to preempt a secure endpoint, thereby | -| | attempting to render it unable to handle a secure | -| | virtual interrupt targetted for it. This could lead| -| | to priority inversion as secure virtual interrupts | -| | are kept pending while non-secure interrupts are | -| | handled by normal world VMs.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC alone does not provide mitigation | -| | against such threats. System integrators must take | -| | necessary high level design decisions that takes | -| | care of interrupt prioritization. The SPMC performs| -| | its role of enabling SPs to specify appropriate | -| | action towards non-secure interrupt with the help | -| | of partition manifest based on the guidance in the | -| | FF-A v1.1 EAC0 specification. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 24 | -+========================+====================================================+ -| ``Threat`` | **A secure endpoint depends on primary scheduler | -| | for CPU cycles. A malicious endpoint could delay | -| | the secure endpoint from being scheduled. Secure | -| | interrupts, if not handled timely, could compromise| -| | the state of SP and SPMC, thereby rendering the | -| | system unresponsive.** | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2, DF3, DF5 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state, SP state, Scheduling cycles | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (9) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide full mitigation | -| | against such threats. However, based on the | -| | guidance provided in the FF-A v1.1 EAC0 spec, SPMC | -| | provisions CPU cycles to run a secure endpoint | -| | execution context in SPMC schedule mode which | -| | cannot be preempted by a non-secure interrupt. | -| | This reduces the dependency on primary scheduler | -| | for cycle allocation. Moreover, all further | -| | interrupts are masked until pending secure virtual | -| | interrupt on current CPU is handled. This allows SP| -| | execution context to make progress even upon being | -| | interrupted. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 25 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint can use memory sharing | -| | calls to exhaust SPMC resources.** | -| | For each on-going operation that involves an SP, | -| | the SPMC allocates resources to track its state. | -| | If the operation is never concluded, the resources | -| | are never freed. | -| | In the worst scenario, multiple operations that | -| | never conclude may exhaust the SPMC resources to a | -| | point in which renders memory sharing operations | -| | impossible. This could affect other, non-harmful | -| | FF-A endpoints, from legitimately using memory | -| | share functionality. The intent might even be | -| | to cause the SPMC to consume excessive CPU cycles, | -| | attempting to make it deny its service to the NWd. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, SPMD | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SPMC state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | High (4) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (16) | Medium (9) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC uses a statically allocated pool of | -| | memory to keep track of on-going memory sharing | -| | operations. After a possible attack, this could | -| | fail due to insufficient memory, and return an | -| | error to the caller. At this point, any other | -| | endpoint that requires use of memory sharing for | -| | its operation could get itself in an unusable | -| | state. | -| | Regarding CPU cycles starving threat, the SPMC | -| | doesn't provide any mitigation for this, as any | -| | FF-A endpoint, at the virtual FF-A instance is | -| | allowed to invoke memory share/lend/donate. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 26 | -+========================+====================================================+ -| ``Threat`` | **A borrower may interfere with lender's | -| | operation, if it terminates due to a fatal error | -| | condition without releasing the memory | -| | shared/lent.** | -| | Such scenario may render the lender inoperable. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC does not provide mitigation for such | -| | scenario. The FF-A endpoints must attempt to | -| | relinquish memory shared/lent themselves in | -| | case of failure. The memory used to track the | -| | operation in the SPMC will also remain usuable. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 27 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint may attempt to tamper with | -| | the content of the memory shared/lent, whilst | -| | being accessed by other FF-A endpoints.** | -| | It might attempt to do so: using one of the clear | -| | flags, when either retrieving or relinquishing | -| | access to the memory via the respective FF-A | -| | calls; or directly accessing memory without | -| | respecting the synchronization protocol between | -| | all involved endpoints. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, FF-A endpoint | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service, Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | Low (2) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Medium (3) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | Medium (6) | Medium(6) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The first case defined in the threat, the TF-A | -| | SPMC mitigates it, by ensuring a memory is cleared | -| | only when all borrowers have relinquished access | -| | to the memory, in a scenario involving multiple | -| | borrowers. Also, if the receiver is granted RO, | -| | permissions, the SPMC will reject any request | -| | to clear memory on behalf of the borrower, by | -| | returning an error to the respective FF-A call. | -| | The second case defined in the threat can't be | -| | mitigated by the SPMC. It is up to the NS/S FF-A | -| | endpoints to establish a robust protocol for using | -| | the shared memory. | -+------------------------+----------------------------------------------------+ - -+------------------------+----------------------------------------------------+ -| ID | 28 | -+========================+====================================================+ -| ``Threat`` | **A rogue FF-A endpoint may attempt to share | -| | memory that is not in its translation regime, or | -| | attempt to specify attributes more permissive than | -| | those it possesses at a given time.** | -| | Both ways could be an attempt for escalating its | -| | privileges. | -+------------------------+----------------------------------------------------+ -| ``Diagram Elements`` | DF1, DF2 | -+------------------------+----------------------------------------------------+ -| ``Affected TF-A | SPMC, FF-A endpoint | -| Components`` | | -+------------------------+----------------------------------------------------+ -| ``Assets`` | SP state | -+------------------------+----------------------------------------------------+ -| ``Threat Agent`` | NS-Endpoint, S-Endpoint | -+------------------------+----------------------------------------------------+ -| ``Threat Type`` | Denial of Service, Tampering | -+------------------------+------------------+-----------------+---------------+ -| ``Application`` | ``Server`` | ``Mobile`` | | -+------------------------+------------------+-----------------+---------------+ -| ``Impact`` | High (4) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Likelihood`` | Medium (3) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Total Risk Rating`` | High (12) | Low (2) | | -+------------------------+------------------+-----------------+---------------+ -| ``Mitigations`` | The TF-A SPMC mitigates this threat by performing | -| | sanity checks to the provided memory region | -| | descriptor. | -| | For operations at the virtual FF-A instance, and | -| | once the full memory descriptor is provided, | -| | the SPMC validates that the memory is part of the | -| | caller's translation regime. The SPMC also checks | -| | that the memory attributes provided are within | -| | those the owner possesses, in terms of | -| | permissiveness. If more permissive attributes are | -| | specified, the SPMC returns an error | -| | FFA_INVALID_PARAMETERS. The permissiveness rules | -| | are enforced in any call to share/lend or donate | -| | the memory, and in retrieve requests. | -+------------------------+----------------------------------------------------+ - --------------- - -*Copyright (c) 2021-2023, Arm Limited. All rights reserved.* - -.. _Arm Firmware Framework for Arm A-profile: https://developer.arm.com/docs/den0077/latest -.. _FF-A ACS: https://github.com/ARM-software/ff-a-acs/releases -