Skip to content

Commit a745100

Browse files
laukik-haselaukik-hase
committed
refactor(esp_tee): Add argument count checks for secure services in the dispatcher
Also: - Unified the TEE build system-related scripts into a single script
1 parent a91f890 commit a745100

File tree

7 files changed

+171
-205
lines changed

7 files changed

+171
-205
lines changed

‎components/esp_tee/CMakeLists.txt‎

Lines changed: 24 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -82,57 +82,38 @@ else()
8282
endif()
8383
endif()
8484

85-
set(secure_service_hdr_py
86-
${COMPONENT_DIR}/scripts/secure_service_hdr.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
87-
)
88-
89-
set(secure_service_tbl_py
90-
${COMPONENT_DIR}/scripts/secure_service_tbl.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
91-
)
92-
93-
set(secure_service_wrap_py
94-
${COMPONENT_DIR}/scripts/secure_service_wrap.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
95-
)
85+
set(secure_service_tbl_parser_py
86+
${COMPONENT_DIR}/scripts/secure_service_tbl_parser.py ${CMAKE_CURRENT_BINARY_DIR}/secure_service.tbl
87+
)
9688

97-
set(secure_service_num_h
98-
${CONFIG_DIR}/secure_service_num.h
99-
)
100-
set(secure_service_dec_h
101-
${CONFIG_DIR}/secure_service_dec.h)
102-
103-
set(secure_service_h
89+
set(secure_service_gen_headers
90+
${CONFIG_DIR}/secure_service_num.h ${CONFIG_DIR}/secure_service_dec.h
10491
${CONFIG_DIR}/secure_service.h
105-
)
92+
)
10693

107-
if(CONFIG_SECURE_ENABLE_TEE)
108-
execute_process(COMMAND cat ${COMPONENT_DIR}/scripts/${target}/secure_service.tbl ${custom_secure_service_tbl}
94+
if(CONFIG_SECURE_ENABLE_TEE AND NOT esp_tee_build)
95+
execute_process(
96+
COMMAND cat ${COMPONENT_DIR}/scripts/${target}/secure_service.tbl ${custom_secure_service_tbl}
10997
OUTPUT_FILE secure_service.tbl
11098
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
111-
)
112-
113-
execute_process(COMMAND python ${secure_service_hdr_py} ${secure_service_num_h} ${secure_service_dec_h}
114-
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
115-
)
99+
)
116100

117-
execute_process(COMMAND python ${secure_service_tbl_py} ${secure_service_h}
101+
execute_process(
102+
COMMAND python ${secure_service_tbl_parser_py} ${secure_service_gen_headers}
118103
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
119-
)
120-
121-
set_property(DIRECTORY "${COMPONENT_DIR}" APPEND PROPERTY
122-
ADDITIONAL_MAKE_CLEAN_FILES ${secure_service_num_h} ${secure_service_dec_h} ${secure_service_h})
104+
)
123105

124-
# For TEE implementation, we don't wrap the APIs since the TEE would also internally use the same API and
125-
# it shouldn't route to secure service API.
126-
# Instead of wrapping, we append _ss_* to the API name and then it must be defined in esp_secure_services.c
127-
if(NOT esp_tee_build)
128-
execute_process(COMMAND python ${secure_service_wrap_py}
129-
OUTPUT_VARIABLE wrap_list
130-
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
131-
OUTPUT_STRIP_TRAILING_WHITESPACE
132-
)
106+
set_property(DIRECTORY ${COMPONENT_DIR} APPEND PROPERTY
107+
ADDITIONAL_MAKE_CLEAN_FILES ${secure_service_gen_headers}
108+
)
133109

134-
string(STRIP ${wrap_list} wrap_list)
110+
execute_process(
111+
COMMAND python ${secure_service_tbl_parser_py} "--wrap"
112+
OUTPUT_VARIABLE wrap_list
113+
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
114+
OUTPUT_STRIP_TRAILING_WHITESPACE
115+
)
135116

136-
target_link_libraries(${COMPONENT_LIB} INTERFACE "${wrap_list}")
137-
endif()
117+
string(STRIP "${wrap_list}" wrap_list)
118+
target_link_libraries(${COMPONENT_LIB} INTERFACE "${wrap_list}")
138119
endif()

‎components/esp_tee/scripts/secure_service_hdr.py‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

‎components/esp_tee/scripts/secure_service_tbl.py‎

Lines changed: 0 additions & 50 deletions
This file was deleted.

‎components/esp_tee/scripts/secure_service_tbl_parser.py‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
2+
# SPDX-License-Identifier: Apache-2.0
3+
import argparse
4+
import re
5+
from typing import List
6+
from typing import Tuple
7+
8+
9+
def parse_services(secure_service_tbl: str) -> List[Tuple[int, str, int]]:
10+
services, service_ids = [], set()
11+
pattern = re.compile(r'^([0-9A-Fa-fXx]+)\s+\S+\s+(\S+)\s+(\d+)')
12+
13+
with open(secure_service_tbl, 'r') as f:
14+
for line in f:
15+
if match := pattern.match(line):
16+
service_id = int(match.group(1), 0)
17+
if service_id in service_ids:
18+
raise ValueError(f'Duplicate service call ID found: 0x{service_id:X}')
19+
service_ids.add(service_id)
20+
services.append((service_id, match.group(2), int(match.group(3))))
21+
22+
return sorted(services, key=lambda x: x[0])
23+
24+
25+
def generate_num_header(services: List[Tuple[int, str, int]], output_file: str) -> None:
26+
header = '''/**
27+
* THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT EDIT!
28+
*/
29+
30+
#pragma once
31+
32+
#ifdef __cplusplus
33+
extern "C" {
34+
#endif
35+
36+
'''
37+
body = '\n'.join(f'#define SS_{name.upper()}\t{nr}' for nr, name, _ in services)
38+
footer = f'\n#define MAX_SECURE_SERVICES_ID\t{services[-1][0] + 1 if services else 0}\n'
39+
footer += f'#define SECURE_SERVICES_NUM\t{len(services)}\n\n'
40+
footer += '''typedef void (*secure_service_t)(void);
41+
typedef struct { int id; secure_service_t func; int nargs; } secure_service_entry_t;
42+
'''
43+
footer += '\n#ifdef __cplusplus\n}\n#endif\n'
44+
with open(output_file, 'w') as f:
45+
f.write(header + body + footer)
46+
47+
48+
def generate_dec_header(services: List[Tuple[int, str, int]], output_file: str) -> None:
49+
header = '''/**
50+
* THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT EDIT!
51+
*/
52+
53+
#pragma once
54+
55+
#ifdef __cplusplus
56+
extern "C" {
57+
#endif
58+
'''
59+
body = '\n'.join(f'void _ss_{name}(void);' for _, name, _ in services)
60+
footer = '\n#ifdef __cplusplus\n}\n#endif\n'
61+
with open(output_file, 'w') as f:
62+
f.write(header + body + footer)
63+
64+
65+
def generate_table(services: List[Tuple[int, str, int]], output_file: str) -> None:
66+
header = '''/**
67+
* THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT EDIT!
68+
*/
69+
70+
#pragma once
71+
'''
72+
body = '\n'.join(f'__SECURE_SERVICE({nr}, {name}, {nargs})' for nr, name, nargs in services)
73+
with open(output_file, 'w') as f:
74+
f.write(header + body)
75+
76+
77+
def generate_wrap_list(secure_service_tbl: str) -> None:
78+
pattern = re.compile(r'^[0-9A-Fa-fXx]+\s+IDF\s+(\S+)\s+\d+')
79+
with open(secure_service_tbl, 'r') as f:
80+
wrap_list = [f'-Wl,--wrap={match.group(1)}' for line in f if (match := pattern.match(line))]
81+
print(' '.join(wrap_list), end='')
82+
83+
84+
def main() -> None:
85+
parser = argparse.ArgumentParser(description='Generate secure service outputs')
86+
parser.add_argument('--wrap', action='store_true', help='Generate linker wrap options')
87+
parser.add_argument('secure_service_tbl', type=str, help='Path to secure service table file')
88+
parser.add_argument('output_files', nargs='*', help='Output files: [secure_service_num.h, secure_service_dec.h, secure_service.h]')
89+
90+
args = parser.parse_args()
91+
92+
if args.wrap:
93+
generate_wrap_list(args.secure_service_tbl)
94+
else:
95+
if len(args.output_files) != 3:
96+
parser.error('Missing output header files!')
97+
services = parse_services(args.secure_service_tbl)
98+
generate_num_header(services, args.output_files[0])
99+
generate_dec_header(services, args.output_files[1])
100+
generate_table(services, args.output_files[2])
101+
102+
103+
if __name__ == '__main__':
104+
main()

‎components/esp_tee/scripts/secure_service_wrap.py‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)