Add per-session OP-TEE client identity handling by sangho2 · Pull Request #885 · microsoft/litebox

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) · 2026-05-29T23:10:58Z

This PR adds support for handling OP-TEE client identity per session not per instance. Default client identity is now Public not User. It also does some additional sanity checks.

Sangho Lee (sangho2) · 2026-05-30T00:04:14Z

We should merge #865 first because this PR should have one more fix: per-session ClientIdenty rather than per-instance ClientIdentity. #865 heavily refactored related data structures and functions.

Weidong Cui (wdcui)

LGTM. Thanks.

I left some comments for your reference.

github-actions · 2026-07-01T23:05:31Z

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---
Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/enum_variant_added.ron
Failed in:
variant TeeLogin:ReeKernel in /home/runner/work/litebox/litebox/litebox_common_optee/src/lib.rs:859
--- failure inherent_method_missing: pub method removed or renamed ---
Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/inherent_method_missing.ron
Failed in:
OpteeShimEntrypoints::get_session_id, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:328
--- failure method_parameter_count_changed: pub method parameter count changed ---
Description:
A publicly-visible method now takes a different number of parameters, not counting the receiver (self) parameter.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#fn-change-arity
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/method_parameter_count_changed.ron
Failed in:
litebox_shim_optee::OpteeShim::load_ldelf takes 5 parameters in /home/runner/work/litebox/litebox/target/semver-checks/git-main/6cdb8120a331c645517a92a7f1842fbb3a172870/litebox_shim_optee/src/lib.rs:232, but now takes 3 parameters in /home/runner/work/litebox/litebox/litebox_shim_optee/src/lib.rs:240

Sangho Lee (sangho2) marked this pull request as ready for review May 29, 2026 23:45

Sangho Lee (sangho2) marked this pull request as draft May 29, 2026 23:52

Sangho Lee (sangho2) added the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label May 29, 2026

Sangho Lee (sangho2)force-pushed the sanghle/optee/fix_client_identity branch from a74c65c to 3e234d1Compare June 26, 2026 04:58

Sangho Lee (sangho2) removed the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label Jun 26, 2026

Sangho Lee (sangho2) changed the title ~~Fix OP-TEE client identity handling~~Fix OP-TEE client identity and session identifier storageJun 26, 2026

Sangho Lee (sangho2) mentioned this pull request Jun 26, 2026
Fix session ID sharing between the sessions of a single-instance TA #942
Closed

Sangho Lee (sangho2) changed the title ~~Fix OP-TEE client identity and session identifier storage~~Add per-session OP-TEE client identity handlingJun 26, 2026

Sangho Lee (sangho2)force-pushed the sanghle/optee/fix_client_identity branch from bc2ff08 to 4df48eaCompare June 26, 2026 17:09

Sangho Lee (sangho2) marked this pull request as ready for review June 26, 2026 19:32

Weidong Cui (wdcui) reviewed Jul 1, 2026
View reviewed changes

Comment threadlitebox_runner_lvbs/src/lib.rs

Weidong Cui (wdcui) reviewed Jul 1, 2026
View reviewed changes

Comment threadlitebox_shim_optee/src/session.rs Outdated

Weidong Cui (wdcui) approved these changes Jul 1, 2026
View reviewed changes

Sangho Lee added 8 commits July 1, 2026 20:43

fix OP-TEE client identity handling
45babf9

fix harness
e2e0a36

per-session client_identity
0de72be

nits
c4c4184

client_endian
f14c1a6

nits
70be3d1

feedback
4fa2ddb

rebase
df3b1a5

Sangho Lee (sangho2)force-pushed the sanghle/optee/fix_client_identity branch from 11fcf44 to df3b1a5Compare July 1, 2026 20:45

clear TA context and check meta bit
d0a75f0

Sangho Lee (sangho2) added this pull request to the merge queue Jul 1, 2026

Merged via the queue into main with commit 869dcdfJul 1, 2026
14 checks passed

Sangho Lee (sangho2) deleted the sanghle/optee/fix_client_identity branch July 1, 2026 23:46