Hi all,
I am sending the email below on behalf on Kenneth Kabogo, who unfortunately is facing issues with the mailing list.
Regards,
Sandrine Afsa
----
Dear TF-A Maintainers,
I am proposing the introduction of a standardized SMC Argument Validation Framework into the TF-A codebase.
Over the past several weeks of security auditing across multiple platform ports, I have identified a recurring architectural failure mode termed "Privilege-Blind Forwarding" (PBF). This occurs when an EL3 handler receives a non-secure physical address and forwards it to a secure memory operation without re-validating the range against the platform's current security state (GPT/RMM).
Furthermore, there is a widespread Structural TOCTOU (Double-Fetch) vulnerability in many SiP ports where handlers validate arguments but later re-fetch them from non-secure memory, allowing a malicious caller to swap addresses mid-execution.
The proposed framework addresses these via an Atomic Shadow-Copy design pattern, requiring all SMC arguments to be unmarshaled into EL3 registers/memory once before validation.
The 3-part prototype and migration guide are available for review on Gerrit:
Framework Hardening (Core Logic): https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/47441
Architectural Guidance (Documentation): https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/47465
Arm Platform Demonstration (Migration Guide): https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/47466
I look forward to the community's feedback on this architectural shift.
Best regards,
Kenneth Kabogo
Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
3 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)
** CID 501374: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 308 in mhu_send_signal_poll_loop()
_____________________________________________________________________________________________
*** CID 501374: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 308 in mhu_send_signal_poll_loop()
302 mhu_get_num_mhu_channels(mhu_recv_device, type);
303 uint32_t mhu_err;
304 uint32_t send_signal;
305 uint32_t recv_signal;
306
307 /* Signal using the last channel */
>>> CID 501374: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "send_num_channels - 1U", where "send_num_channels" is known to be equal to 0, underflows the type of "send_num_channels - 1U", which is type "unsigned int".
308 mhu_err = mhu_channel_send(mhu_send_device, send_num_channels - 1,
309 MHU_NOTIFY_VALUE, type);
310 if (mhu_err != 0) {
311 return mhu_err;
312 }
313
** CID 501373: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 379 in mhu_message_is_available()
_____________________________________________________________________________________________
*** CID 501373: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 379 in mhu_message_is_available()
373 {
374 const uint32_t num_channels =
375 mhu_get_num_mhu_channels(mhu_recv_device, type);
376 uint32_t mhu_err;
377 uint32_t value;
378
>>> CID 501373: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "num_channels - 1U", where "num_channels" is known to be equal to 0, underflows the type of "num_channels - 1U", which is type "unsigned int".
379 mhu_err = mhu_channel_receive_device_receive(
380 mhu_recv_device, num_channels - 1, &value, type);
381 if (mhu_err != 0) {
382 return mhu_err;
383 }
384
** CID 501372: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 359 in mhu_recv_signal_poll_loop()
_____________________________________________________________________________________________
*** CID 501372: Integer handling issues (INTEGER_OVERFLOW)
/drivers/arm/sfcp/sfcp_core/sfcp_link_hal.c: 359 in mhu_recv_signal_poll_loop()
353 return mhu_err;
354 }
355 }
356
357 /* Wait for next sender transfer */
358 do {
>>> CID 501372: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "recv_num_channels - 1U", where "recv_num_channels" is known to be equal to 0, underflows the type of "recv_num_channels - 1U", which is type "unsigned int".
359 mhu_err = mhu_channel_receive_device_receive(
360 mhu_recv_device, recv_num_channels - 1, &recv_signal,
361 type);
362 if (mhu_err != 0) {
363 return mhu_err;
364 }
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/arm-software-arm-trusted-firmware?tab=ov…
This event has been canceled with a note:
"Cancelling as no topic for this instance. Thanks."
TF-A Tech Forum
Thursday Jan 22, 2026 ⋅ 5pm – 6pm
Central European Time - Paris
Location
https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34…https://www.google.com/url?q=https%3A%2F%2Flinaro-org.zoom.us%2Fj%2F9355786…
Trusted Firmware is inviting you to a scheduled Zoom meeting.Topic: TF-A
Tech ForumTime: May 15, 2025 02:00 PM London Every 2 weeks on Thu,
78 occurrence(s)Please download and import the following iCalendar (.ics)
files to your calendar
system.Weekly: https://linaro-org.zoom.us/meeting/tJcocu6gqDgjEtOkyBhSQauR1sUyFwIcNKLa/ics…
Zoom
Meetinghttps://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34.1Meeting
ID: 935 5786 3987Passcode: 939141---One tap
mobile+12532158782,,93557863987# US (Tacoma)+13017158592,,93557863987# US
(Washington DC)---Dial by your location• +1 253 215 8782 US (Tacoma)• +1
301 715 8592 US (Washington DC)• +1 305 224 1968 US• +1 309 205 3325 US• +1
312 626 6799 US (Chicago)• +1 346 248 7799 US (Houston)• +1 360 209 5623
US• +1 386 347 5053 US• +1 507 473 4847 US• +1 564 217 2000 US• +1 646 558
8656 US (New York)• +1 646 931 3860 US• +1 669 444 9171 US• +1 669 900 9128
US (San Jose)• +1 689 278 1000 US• +1 719 359 4580 US• +1 253 205 0468 US•
833 548 0276 US Toll-free• 833 548 0282 US Toll-free• 833 928 4608 US
Toll-free• 833 928 4609 US Toll-free• 833 928 4610 US Toll-free• 877 853
5247 US Toll-free• 888 788 0099 US Toll-freeMeeting ID: 935 5786 3987Find
your local number: https://linaro-org.zoom.us/u/adoz9mILli
Guests
qwandor(a)google.com
praan(a)google.com
jeremimiller(a)google.com
jagdish.gediya(a)linaro.org
tf-a(a)lists.trustedfirmware.org
~~//~~
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this email because you are an attendee on the event.
Forwarding this invitation could allow any recipient to send a response to
the organizer, be added to the guest list, invite others regardless of
their own invitation status, or modify your RSVP.
Learn more https://support.google.com/calendar/answer/37135#forwarding
(re-sending as previous invitation got lost) Hi, As follow up to the last
session on Nov 13th 2025 [1], a new TF-A Tech Forum session with the
topic 'Scaling Hafnium for advanced mobile OS architectures' will be held
on Jan 22nd 2026 10.00am. Regards, Olivier. [1]
https://www.trustedfirmware.org/meetings/tf-a-technical-forum/ Scaling
Hafnium for advanced mobile OS architectures - Presented by Jack Suann
Trusted Firmware is inviting you to a scheduled Zoom meeting. Topic: TF-A
Tech Forum Join Zoom Meeting
https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34…
Meeting ID: 935 5786 3987 Passcode: 939141 --- One tap mobile
+12532158782,,93557863987# US (Tacoma) +13017158592,,93557863987# US
(Washington DC) --- Dial by your location +1 253 215 8782 US (Tacoma) +1
301 715 8592 US (Washington DC) +1 305 224 1968 US +1 309 205 3325 US +1
312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +1 360 209 5623 US
+1 386 347 5053 US +1 507 473 4847 US +1 564 217 2000 US +1 646 558 8656 US
(New York) +1 646 931 3860 US +1 669 444 9171 US +1 669 900 9128 US (San
Jose) +1 689 278 1000 US +1 719 359 4580 US +1 253 205 0468 US 833 548 0276
US Toll-free 833 548 0282 US Toll-free 833 928 4608 US Toll-free 833 928
4609 US Toll-free 833 928 4610 US Toll-free 877 853 5247 US Toll-free 888
788 0099 US Toll-free Meeting ID: 935 5786 3987 Find your local number:
https://linaro-org.zoom.us/u/adoz9mILli
TF-A Tech Forum Jan 22nd 10.00am -Part II Scaling Hafnium for advanced
mobile OS architectures
Thursday Jan 22, 2026 ⋅ 11am – 12pm
Central European Time - Paris
Location
https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34…https://www.google.com/url?q=https%3A%2F%2Flinaro-org.zoom.us%2Fj%2F9355786…
Hi, As follow up to the last session on Nov 13th 2025 [1], a new TF-A Tech
Forum session with the topic'Scaling Hafnium for advanced mobile OS
architectures' will be held on Jan 22nd 2026
10.00am. Regards,Olivier. [1] https://www.trustedfirmware.org/meetings/tf-a-technical-forum/ Scaling
Hafnium for advanced mobile OS architectures - Presented by Jack Suann PDF
Presentation Video Recording (Access Password: *PIs1^BD) Trusted
Firmware is inviting you to a scheduled Zoom meeting.Topic: TF-A Tech
ForumJoin Zoom
Meetinghttps://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34.1Meeting
ID: 935 5786 3987Passcode: 939141---One tap
mobile+12532158782,,93557863987# US (Tacoma)+13017158592,,93557863987# US
(Washington DC)---Dial by your location• +1 253 215 8782 US (Tacoma)• +1
301 715 8592 US (Washington DC)• +1 305 224 1968 US• +1 309 205 3325 US• +1
312 626 6799 US (Chicago)• +1 346 248 7799 US (Houston)• +1 360 209 5623
US• +1 386 347 5053 US• +1 507 473 4847 US• +1 564 217 2000 US• +1 646 558
8656 US (New York)• +1 646 931 3860 US• +1 669 444 9171 US• +1 669 900 9128
US (San Jose)• +1 689 278 1000 US• +1 719 359 4580 US• +1 253 205 0468 US•
833 548 0276 US Toll-free• 833 548 0282 US Toll-free• 833 928 4608 US
Toll-free• 833 928 4609 US Toll-free• 833 928 4610 US Toll-free• 877 853
5247 US Toll-free• 888 788 0099 US Toll-freeMeeting ID: 935 5786 3987Find
your local number: https://linaro-org.zoom.us/u/adoz9mILli
Guests
tf-a(a)lists.trustedfirmware.org