Skip to content

framework: Don't copy buffers for low-risk PSA operations #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gilles-peskine-arm wants to merge 2 commits into
base: main
Choose a base branch
from
Open

framework: Don't copy buffers for low-risk PSA operations #306

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
588e1c0
Use regex to classify functions that do not need buffer copying
gilles-peskine-arm May 28, 2026
c077860
Declare more functions that do not need buffer copying
gilles-peskine-arm May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions scripts/mbedtls_framework/code_wrapper/psa_wrapper.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

import itertools
import os
import re
from typing import Iterable, Iterator, List, Optional, Tuple

from .. import build_tree
Expand Down Expand Up @@ -145,18 +146,21 @@ def _detect_buffer_parameters(arguments: List[c_parsing_helper.ArgumentInfo],
yield BufferParameter(i, not t01[0].startswith('const '),
argument_names[i], argument_names[i+1])

@staticmethod
def _parameter_should_be_copied(function_name: str,
# These operations are low-risk and do not need buffer copying.
FUNCTIONS_NOT_REQUIRING_BUFFER_COPYING_RE = \
re.compile('|'.join([
'mbedtls_psa_inject_entropy', # privileged
'psa_(hash|mac|xof)_.*', # https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/795
'psa_crypto_driver_pake_get_.*', # no risk from simple getters
'psa_random_reseed', # privileged
]))
def _parameter_should_be_copied(self, function_name: str,
_buffer_name: Optional[str]) -> bool:
"""Whether the specified buffer argument to a PSA function should be copied.
"""
# False-positives that do not need buffer copying
if function_name in ('mbedtls_psa_inject_entropy',
'psa_crypto_driver_pake_get_password',
'psa_crypto_driver_pake_get_user',
'psa_crypto_driver_pake_get_peer'):
if re.fullmatch(self.FUNCTIONS_NOT_REQUIRING_BUFFER_COPYING_RE,
function_name):
return False

return True

@staticmethod
Expand Down