Trusty System Basics

1. Secure Memory Pool Configuration (memmap parameter)

Trusty uses memory partitioning to isolate secure and non-sesecure worlds. The memmap parameter defines memory regions during boot.

Key Configuration Parameters:

memmap=trusty@0x78000000$0x08000000 - Reserves 128MB for Trusty at 0x78000000
Memory regions are defined in the device tree or boot parameters
Supports multiple memory pools for different purposes

Best Practices:

Align memory regions to page boundaries
Use non-overlapping regions for secure/non-secure worlds
Consider future expansion when sizing memory pools

Note: The memory map must be configured at boot time and cannot be changed dynamically.

2. Capability-Based Access Control Model

Trusty implements a capability-based security model where access to resources is controlled through unforgeable tokens (capabilities).

Capability Types:

Memory capabilities - Control access to memory regions
Object capabilities - Control access to system objects (ports, services)
Process capabilities - Define process privileges

Key Characteristics:

Capabilities are referenced by handles (64-bit integers)
Capabilities cannot be forged - only obtained through legitimate means
All operations are checked against the calling process's capability set

// Example: Checking a capability
handle_t mem_cap = get_memory_capability();
if (!check_capability(mem_cap, CAP_ACCESS_READ)) {
    return ERR_ACCESS_DENIED;
}

3. Preventing TOCTOU Attacks

Trusty includes several design features to prevent Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities.

Defensive Mechanisms:

Atomic checks - Validation and use performed as single operation
Capability revocation - Immediate invalidation when no longer needed
Secure handles - Handle values are cryptographically random
Reference counting - Prevents premature object destruction

Warning: Developers must still be careful with multi-step operations that span multiple system calls.

Implementation Example:

// Safe file access pattern
handle_t file = open_file(path);
if (!validate_file(file)) {
    close_handle(file);  // Immediate cleanup
    return ERR_INVALID;
}

// Use the validated handle
result = read_file(file);

close_handle(file);  // Explicit cleanup
return result;

Memory and Permission Management in Trusty