Skip to content

Commit 8b7204d

Browse files
mahavirjmahavirj
committed
Merge branch 'feature/esp_tee_cfg_srv' into 'master'
feat(esp_tee): Make the attestation service K-configurable See merge request espressif/esp-idf!36123
2 parents dfcc0b2 + c4eec75 commit 8b7204d

File tree

29 files changed

+461
-421
lines changed

29 files changed

+461
-421
lines changed

‎components/esp_hw_support/include/esp_cpu.h‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -22,6 +22,10 @@
2222
#include "esp_err.h"
2323
#include "esp_attr.h"
2424

25+
#if CONFIG_SECURE_ENABLE_TEE && !NON_OS_BUILD
26+
#include "secure_service_num.h"
27+
#endif
28+
2529
#ifdef __cplusplus
2630
extern "C" {
2731
#endif
@@ -452,9 +456,9 @@ FORCE_INLINE_ATTR void esp_cpu_intr_edge_ack(int intr_num)
452456
#ifdef __XTENSA__
453457
xthal_set_intclear((unsigned) (1 << intr_num));
454458
#else
455-
#if CONFIG_SECURE_ENABLE_TEE && !ESP_TEE_BUILD
459+
#if CONFIG_SECURE_ENABLE_TEE && !NON_OS_BUILD
456460
extern esprv_int_mgmt_t esp_tee_intr_sec_srv_cb;
457-
esp_tee_intr_sec_srv_cb(2, TEE_INTR_EDGE_ACK_SRV_ID, intr_num);
461+
esp_tee_intr_sec_srv_cb(2, SS_RV_UTILS_INTR_EDGE_ACK, intr_num);
458462
#else
459463
rv_utils_intr_edge_ack((unsigned) intr_num);
460464
#endif

‎components/esp_tee/CMakeLists.txt‎

Lines changed: 26 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -82,57 +82,38 @@ else()
8282
endif()
8383
endif()
8484

85-
set(secure_service_hdr_py
86-
${COMPONENT_DIR}/scripts/secure_service_hdr.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
87-
)
88-
89-
set(secure_service_tbl_py
90-
${COMPONENT_DIR}/scripts/secure_service_tbl.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
91-
)
92-
93-
set(secure_service_wrap_py
94-
${COMPONENT_DIR}/scripts/secure_service_wrap.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
85+
set(secure_service_tbl_parser_py
86+
${COMPONENT_DIR}/scripts/secure_service_tbl_parser.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
87+
)
88+
89+
set(secure_service_gen_headers
90+
${CONFIG_DIR}/secure_service_num.h ${CONFIG_DIR}/secure_service_dec.h
91+
${CONFIG_DIR}/secure_service_int.h ${CONFIG_DIR}/secure_service_ext.h
92+
)
93+
94+
if(CONFIG_SECURE_ENABLE_TEE AND NOT esp_tee_build)
95+
execute_process(
96+
COMMAND cat ${COMPONENT_DIR}/scripts/${target}/secure_service.tbl ${custom_secure_service_tbl}
97+
OUTPUT_FILE secure_service.tbl
98+
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
9599
)
96100

97-
set(secure_service_num_h
98-
${CONFIG_DIR}/secure_service_num.h
101+
execute_process(
102+
COMMAND python ${secure_service_tbl_parser_py} ${secure_service_gen_headers}
103+
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
99104
)
100-
set(secure_service_dec_h
101-
${CONFIG_DIR}/secure_service_dec.h)
102105

103-
set(secure_service_h
104-
${CONFIG_DIR}/secure_service.h
106+
set_property(DIRECTORY ${COMPONENT_DIR} APPEND PROPERTY
107+
ADDITIONAL_MAKE_CLEAN_FILES ${secure_service_gen_headers}
105108
)
106109

107-
if(CONFIG_SECURE_ENABLE_TEE)
108-
execute_process(COMMAND cat ${COMPONENT_DIR}/scripts/${target}/secure_service.tbl ${custom_secure_service_tbl}
109-
OUTPUT_FILE secure_service.tbl
110+
execute_process(
111+
COMMAND python ${secure_service_tbl_parser_py} "--wrap"
112+
OUTPUT_VARIABLE wrap_list
110113
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
111-
)
112-
113-
execute_process(COMMAND python ${secure_service_hdr_py} ${secure_service_num_h} ${secure_service_dec_h}
114-
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
115-
)
116-
117-
execute_process(COMMAND python ${secure_service_tbl_py} ${secure_service_h}
118-
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
119-
)
120-
121-
set_property(DIRECTORY "${COMPONENT_DIR}" APPEND PROPERTY
122-
ADDITIONAL_MAKE_CLEAN_FILES ${secure_service_num_h} ${secure_service_dec_h} ${secure_service_h})
123-
124-
# For TEE implementation, we don't wrap the APIs since the TEE would also internally use the same API and
125-
# it shouldn't route to secure service API.
126-
# Instead of wrapping, we append _ss_* to the API name and then it must be defined in esp_secure_services.c
127-
if(NOT esp_tee_build)
128-
execute_process(COMMAND python ${secure_service_wrap_py}
129-
OUTPUT_VARIABLE wrap_list
130-
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
131-
OUTPUT_STRIP_TRAILING_WHITESPACE
132-
)
133-
134-
string(STRIP ${wrap_list} wrap_list)
114+
OUTPUT_STRIP_TRAILING_WHITESPACE
115+
)
135116

136-
target_link_libraries(${COMPONENT_LIB} INTERFACE "${wrap_list}")
137-
endif()
117+
string(STRIP "${wrap_list}" wrap_list)
118+
target_link_libraries(${COMPONENT_LIB} INTERFACE "${wrap_list}")
138119
endif()

‎components/esp_tee/Kconfig.projbuild‎

Lines changed: 42 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -59,44 +59,56 @@ menu "ESP-TEE (Trusted Execution Environment)"
5959

6060
endmenu
6161

62-
choice SECURE_TEE_SEC_STG_MODE
63-
prompt "Secure Storage: Mode"
62+
menu "Secure Services"
6463
depends on SECURE_ENABLE_TEE
65-
default SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
66-
help
67-
Select the TEE secure storage mode
6864

69-
config SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
70-
bool "Development"
65+
choice SECURE_TEE_SEC_STG_MODE
66+
prompt "Secure Storage: Mode"
67+
depends on SECURE_ENABLE_TEE
68+
default SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
69+
help
70+
Select the TEE secure storage mode
71+
72+
config SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
73+
bool "Development"
74+
help
75+
Secure storage will be encrypted by the data stored in eFuse BLK2
76+
77+
config SECURE_TEE_SEC_STG_MODE_RELEASE
78+
depends on IDF_TARGET_ESP32C6
79+
bool "Release"
80+
help
81+
Secure storage will be encrypted by the data stored in eFuse block
82+
configured through the SECURE_TEE_SEC_STG_KEY_EFUSE_BLK option
83+
84+
endchoice
85+
86+
config SECURE_TEE_SEC_STG_KEY_EFUSE_BLK
87+
int "Secure Storage: Encryption key eFuse block"
88+
depends on SECURE_TEE_SEC_STG_MODE_RELEASE
89+
range 4 10
90+
default 10
7191
help
72-
Secure storage will be encrypted by the data stored in eFuse BLK2
92+
eFuse block ID storing the TEE secure storage encryption key
7393

74-
config SECURE_TEE_SEC_STG_MODE_RELEASE
75-
depends on IDF_TARGET_ESP32C6
76-
bool "Release"
94+
config SECURE_TEE_ATTESTATION
95+
bool "Enable Attestation"
96+
default y
7797
help
78-
Secure storage will be encrypted by the data stored in eFuse block
79-
configured through the SECURE_TEE_SEC_STG_KEY_EFUSE_BLK option
98+
This configuration enables the support for the Attestation service.
8099

81-
endchoice
82100

83-
config SECURE_TEE_SEC_STG_KEY_EFUSE_BLK
84-
int "Secure Storage: Encryption key eFuse block"
85-
depends on SECURE_TEE_SEC_STG_MODE_RELEASE
86-
range 4 10
87-
default 10
88-
help
89-
eFuse block ID storing the TEE secure storage encryption key
101+
config SECURE_TEE_ATT_KEY_SLOT_ID
102+
depends on SECURE_TEE_ATTESTATION
103+
int "Attestation: Secure Storage slot ID for EAT signing"
104+
default 0
105+
range 0 14
106+
help
107+
This configuration sets the slot ID from the TEE secure storage
108+
storing the ECDSA keypair for executing sign/verify operations
109+
from the TEE side for attestation.
90110

91-
config SECURE_TEE_ATT_KEY_SLOT_ID
92-
depends on SECURE_ENABLE_TEE
93-
int "Attestation: Secure Storage slot ID for EAT signing"
94-
default 0
95-
range 0 14
96-
help
97-
This configuration sets the slot ID from the TEE secure storage
98-
storing the ECDSA keypair for executing sign/verify operations
99-
from the TEE side (E.g. Attestation)
111+
endmenu
100112

101113
config SECURE_TEE_DEBUG_MODE
102114
bool "Enable Debug Mode"

‎components/esp_tee/scripts/esp32c6/secure_service.tbl‎

Lines changed: 54 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,56 @@
11
# SS no. API type Function Args
22
0 custom invalid_secure_service 0
3-
1 IDF esp_rom_route_intr_matrix 3
4-
2 IDF rv_utils_intr_enable 1
5-
3 IDF rv_utils_intr_disable 1
6-
4 IDF rv_utils_intr_set_priority 2
7-
5 IDF rv_utils_intr_set_type 2
8-
6 IDF rv_utils_intr_set_threshold 1
9-
7 IDF rv_utils_intr_edge_ack 1
10-
8 IDF rv_utils_intr_global_enable 0
11-
9 IDF efuse_hal_chip_revision 0
12-
10 IDF efuse_hal_get_chip_ver_pkg 1
13-
11 IDF efuse_hal_get_disable_wafer_version_major 0
14-
12 IDF efuse_hal_get_mac 1
15-
13 IDF esp_efuse_check_secure_version 1
16-
14 IDF esp_efuse_read_field_blob 3
17-
15 IDF esp_flash_encryption_enabled 0
18-
16 IDF wdt_hal_init 4
19-
17 IDF wdt_hal_deinit 1
20-
18 IDF esp_aes_intr_alloc 0
21-
19 IDF esp_aes_crypt_cbc 6
22-
20 IDF esp_aes_crypt_cfb8 6
23-
21 IDF esp_aes_crypt_cfb128 7
24-
22 IDF esp_aes_crypt_ctr 7
25-
23 IDF esp_aes_crypt_ecb 4
26-
24 IDF esp_aes_crypt_ofb 6
27-
25 IDF esp_sha 4
28-
26 IDF esp_sha_dma 6
29-
27 IDF esp_sha_read_digest_state 2
30-
28 IDF esp_sha_write_digest_state 2
31-
29 IDF mmu_hal_map_region 6
32-
30 IDF mmu_hal_unmap_region 3
33-
31 IDF mmu_hal_vaddr_to_paddr 4
34-
32 IDF mmu_hal_paddr_to_vaddr 5
35-
33 custom esp_tee_ota_begin 0
36-
34 custom esp_tee_ota_write 3
37-
35 custom esp_tee_ota_end 0
38-
36 custom esp_tee_sec_storage_init 0
39-
37 custom esp_tee_sec_storage_gen_key 1
40-
38 custom esp_tee_sec_storage_get_signature 4
41-
39 custom esp_tee_sec_storage_get_pubkey 2
42-
40 custom esp_tee_sec_storage_encrypt 8
43-
41 custom esp_tee_sec_storage_decrypt 8
44-
42 custom esp_tee_sec_storage_is_slot_empty 1
45-
43 custom esp_tee_sec_storage_clear_slot 1
46-
44 custom esp_tee_att_generate_token 6
3+
# ID: 1-47 (47) - External memory (Flash) protection
4+
1 IDF mmu_hal_map_region 6
5+
2 IDF mmu_hal_unmap_region 3
6+
3 IDF mmu_hal_vaddr_to_paddr 4
7+
4 IDF mmu_hal_paddr_to_vaddr 5
8+
# Services before the ID 48 will be placed in the internal memory table,
9+
# while the rest will be placed in the external memory table.
10+
# ID: 48-71 (24) - Interrupt Handling
11+
48 IDF esp_rom_route_intr_matrix 3
12+
49 IDF rv_utils_intr_enable 1
13+
50 IDF rv_utils_intr_disable 1
14+
51 IDF rv_utils_intr_set_priority 2
15+
52 IDF rv_utils_intr_set_type 2
16+
53 IDF rv_utils_intr_set_threshold 1
17+
54 IDF rv_utils_intr_edge_ack 1
18+
55 IDF rv_utils_intr_global_enable 0
19+
# ID: 72-119 (48) - HAL
20+
72 IDF efuse_hal_chip_revision 0
21+
73 IDF efuse_hal_get_chip_ver_pkg 1
22+
74 IDF efuse_hal_get_disable_wafer_version_major 0
23+
75 IDF efuse_hal_get_mac 1
24+
76 IDF wdt_hal_init 4
25+
77 IDF wdt_hal_deinit 1
26+
# ID: 120-167 (48) - Crypto
27+
120 IDF esp_aes_intr_alloc 0
28+
121 IDF esp_aes_crypt_cbc 6
29+
122 IDF esp_aes_crypt_cfb8 6
30+
123 IDF esp_aes_crypt_cfb128 7
31+
124 IDF esp_aes_crypt_ctr 7
32+
125 IDF esp_aes_crypt_ecb 4
33+
126 IDF esp_aes_crypt_ofb 6
34+
127 IDF esp_sha 4
35+
128 IDF esp_sha_dma 6
36+
129 IDF esp_sha_read_digest_state 2
37+
130 IDF esp_sha_write_digest_state 2
38+
# ID: 168-183 (16) - eFuse
39+
168 IDF esp_efuse_check_secure_version 1
40+
169 IDF esp_efuse_read_field_blob 3
41+
170 IDF esp_flash_encryption_enabled 0
42+
# ID: 184-249 (66) - Reserved for future use
43+
# ID: 270-293 (24) - Secure Storage
44+
270 custom esp_tee_sec_storage_init 0
45+
271 custom esp_tee_sec_storage_gen_key 2
46+
272 custom esp_tee_sec_storage_get_signature 4
47+
273 custom esp_tee_sec_storage_get_pubkey 2
48+
274 custom esp_tee_sec_storage_encrypt 8
49+
275 custom esp_tee_sec_storage_decrypt 8
50+
276 custom esp_tee_sec_storage_is_slot_empty 1
51+
277 custom esp_tee_sec_storage_clear_slot 1
52+
# ID: 294-299 (6) - OTA
53+
294 custom esp_tee_ota_begin 0
54+
295 custom esp_tee_ota_write 3
55+
296 custom esp_tee_ota_end 0
56+
# ID: 300+ - User-defined

‎components/esp_tee/scripts/secure_service_hdr.py‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

0 commit comments

Comments
 (0)