You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@teaclave.apache.org by "ivila (via GitHub)" <gi...@apache.org> on 2026/09/16 03:41:58 UTC
[PR] optee-utee: make memref parameter access copy-based [teaclave-trustzone-sdk]
ivila opened a new pull request, #321:
URL: https://github.com/apache/teaclave-trustzone-sdk/pull/321
# Summary
Rework the typed memref parameter API so that TA code can no longer obtain a Rust slice directly over Normal-World shared memory. All reads and writes now go through explicit copies (`read_to_vec` / `read_at`, `set_output` / `write_at`), which removes the aliasing hazard and the easy TOCTOU window where a buffer is validated through one fetch and used through another.
# Motivation
A memref parameter is a `{buffer, size}` pair whose backing memory is mapped from the Normal World and stays writable by it for the whole call:
- Handing out `&[u8]` / `&mut [u8]` over that memory is unsound with respect to Rust aliasing (the REE mutates it behind the TA's back), and
- It invites double-fetch (TOCTOU) bugs: validate a field, then read it again "for real".
Copy-based access makes the safe thing the only thing the safe API exposes, and matches the guidance already in `docs/security-model.md` ("copy-then-validate").
# Changes
- `optee-utee: add ParameterMemref trait` — new supertrait exposing buffer_len(), shared by ParameterMemrefRead and ParameterMemrefWrite, replacing Read::buffer_len and Write::get_capacity. No behavior change.
- `optee-utee: remove get_buffer accessors` — drop the unsafe get_buffer / get_buffer_mut; add ParameterMemrefRead::read_at(offset, dest) returning the number of bytes read (BadParameters when offset is past the end, truncated at the end otherwise). read_to_vec remains the whole-buffer copy. Writes use set_output / write_at, which copy and update the reported size in one step.
- `examples, projects: use copy-based memref access` — migrate every TA (18 files) from get_buffer / get_buffer_mut / get_capacity to read_to_vec / read_at / set_output / buffer_len. Opportunistically adds missing input bounds checks in hotp-rs and signature_verification-rs.
- `docs: describe copy-based memref API` — update the parameter migration guide and the security model.
- `New unit test parameter::memref::tests::read_at_boundary_contract` covers the read_at boundary contract (offset == len → Ok(0), offset > len → BadParameters, no usize::MAX overflow).
# API / compatibility notes
- Breaking for the typed parameter API: **get_buffer, get_buffer_mut, and get_capacity are removed**, and buffer_len moves to the ParameterMemref supertrait. These types have not shipped in a release yet (they landed after v0.9.0), so no deprecation shim is provided. The legacy deprecated::ParamMemref::buffer() path is untouched.
# Future direction
Once **core::io / alloc::io** stabilize, I may re-express the `read/write` side as `io::Read` / `io::Write` adapters so callers can be generic over the standard traits. Any such adapter will keep the `copy` / `snapshot` semantics rather than exposing the shared buffer directly, since the REE can mutate it concurrently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
Re: [PR] optee-utee: make memref parameter access copy-based [teaclave-trustzone-sdk]
Posted by "ivila (via GitHub)" <gi...@apache.org>.
ivila merged PR #321:
URL: https://github.com/apache/teaclave-trustzone-sdk/pull/321
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org
Re: [PR] optee-utee: make memref parameter access copy-based [teaclave-trustzone-sdk]
Posted by "DemesneGH (via GitHub)" <gi...@apache.org>.
DemesneGH commented on PR #321:
URL: https://github.com/apache/teaclave-trustzone-sdk/pull/321#issuecomment-5707535529
LGTM, thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@teaclave.apache.org
For additional commands, e-mail: dev-help@teaclave.apache.org