Skip to content

Commit a91f890

Browse files
laukik-haselaukik-hase
committed
feat(esp_tee): Make the attestation service configurable
1 parent 4d93587 commit a91f890

File tree

17 files changed

+128
-76
lines changed

17 files changed

+128
-76
lines changed

‎components/esp_tee/Kconfig.projbuild‎

Lines changed: 42 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -59,44 +59,56 @@ menu "ESP-TEE (Trusted Execution Environment)"
5959

6060
endmenu
6161

62-
choice SECURE_TEE_SEC_STG_MODE
63-
prompt "Secure Storage: Mode"
62+
menu "Secure Services"
6463
depends on SECURE_ENABLE_TEE
65-
default SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
66-
help
67-
Select the TEE secure storage mode
6864

69-
config SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
70-
bool "Development"
65+
choice SECURE_TEE_SEC_STG_MODE
66+
prompt "Secure Storage: Mode"
67+
depends on SECURE_ENABLE_TEE
68+
default SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
69+
help
70+
Select the TEE secure storage mode
71+
72+
config SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
73+
bool "Development"
74+
help
75+
Secure storage will be encrypted by the data stored in eFuse BLK2
76+
77+
config SECURE_TEE_SEC_STG_MODE_RELEASE
78+
depends on IDF_TARGET_ESP32C6
79+
bool "Release"
80+
help
81+
Secure storage will be encrypted by the data stored in eFuse block
82+
configured through the SECURE_TEE_SEC_STG_KEY_EFUSE_BLK option
83+
84+
endchoice
85+
86+
config SECURE_TEE_SEC_STG_KEY_EFUSE_BLK
87+
int "Secure Storage: Encryption key eFuse block"
88+
depends on SECURE_TEE_SEC_STG_MODE_RELEASE
89+
range 4 10
90+
default 10
7191
help
72-
Secure storage will be encrypted by the data stored in eFuse BLK2
92+
eFuse block ID storing the TEE secure storage encryption key
7393

74-
config SECURE_TEE_SEC_STG_MODE_RELEASE
75-
depends on IDF_TARGET_ESP32C6
76-
bool "Release"
94+
config SECURE_TEE_ATTESTATION
95+
bool "Enable Attestation"
96+
default y
7797
help
78-
Secure storage will be encrypted by the data stored in eFuse block
79-
configured through the SECURE_TEE_SEC_STG_KEY_EFUSE_BLK option
98+
This configuration enables the support for the Attestation service.
8099

81-
endchoice
82100

83-
config SECURE_TEE_SEC_STG_KEY_EFUSE_BLK
84-
int "Secure Storage: Encryption key eFuse block"
85-
depends on SECURE_TEE_SEC_STG_MODE_RELEASE
86-
range 4 10
87-
default 10
88-
help
89-
eFuse block ID storing the TEE secure storage encryption key
101+
config SECURE_TEE_ATT_KEY_SLOT_ID
102+
depends on SECURE_TEE_ATTESTATION
103+
int "Attestation: Secure Storage slot ID for EAT signing"
104+
default 0
105+
range 0 14
106+
help
107+
This configuration sets the slot ID from the TEE secure storage
108+
storing the ECDSA keypair for executing sign/verify operations
109+
from the TEE side for attestation.
90110

91-
config SECURE_TEE_ATT_KEY_SLOT_ID
92-
depends on SECURE_ENABLE_TEE
93-
int "Attestation: Secure Storage slot ID for EAT signing"
94-
default 0
95-
range 0 14
96-
help
97-
This configuration sets the slot ID from the TEE secure storage
98-
storing the ECDSA keypair for executing sign/verify operations
99-
from the TEE side (E.g. Attestation)
111+
endmenu
100112

101113
config SECURE_TEE_DEBUG_MODE
102114
bool "Enable Debug Mode"

‎components/esp_tee/scripts/esp32c6/secure_service.tbl‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,3 @@
4343
41 custom esp_tee_sec_storage_decrypt 8
4444
42 custom esp_tee_sec_storage_is_slot_empty 1
4545
43 custom esp_tee_sec_storage_clear_slot 1
46-
44 custom esp_tee_att_generate_token 6

‎components/esp_tee/subproject/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ set(ESP_TEE_BUILD 1)
2525
set(NON_OS_BUILD 1)
2626

2727
# TEE-specific components
28-
list(APPEND COMPONENTS tee_flash_mgr tee_ota_ops tee_sec_storage attestation)
28+
list(APPEND COMPONENTS tee_flash_mgr tee_ota_ops tee_sec_storage tee_attestation)
2929

3030
# Include sdkconfig.h derived from the parent build.
3131
include_directories(${CONFIG_DIR})

‎components/esp_tee/subproject/components/attestation/private_include/esp_attestation_utils.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ extern "C" {
4141

4242
#define ESP_ATT_TK_MIN_SIZE (ESP_ATT_HDR_JSON_MAX_SZ + ESP_ATT_EAT_JSON_MAX_SZ + ESP_ATT_PUBKEY_JSON_MAX_SZ + ESP_ATT_SIGN_JSON_MAX_SZ)
4343

44-
#if ESP_TEE_BUILD
44+
#if ESP_TEE_BUILD && CONFIG_SECURE_TEE_ATTESTATION
4545
#define ESP_ATT_TK_KEY_ID (CONFIG_SECURE_TEE_ATT_KEY_SLOT_ID)
4646
#else
4747
#define ESP_ATT_TK_KEY_ID (-1)

‎components/esp_tee/subproject/components/tee_attestation/CMakeLists.txt‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
idf_build_get_property(esp_tee_build ESP_TEE_BUILD)
22

3+
set(srcs)
4+
set(include_dirs ".")
5+
set(priv_requires esp_tee)
6+
37
if(esp_tee_build)
4-
return()
8+
list(APPEND priv_requires attestation main)
59
endif()
610

7-
set(srcs "esp_tee_attestation.c")
8-
set(include_dirs ".")
9-
set(priv_requires esp_tee)
11+
if(CONFIG_SECURE_TEE_ATTESTATION)
12+
list(APPEND srcs "esp_tee_attestation.c")
13+
endif()
1014

1115
idf_component_register(SRCS ${srcs}
1216
INCLUDE_DIRS ${include_dirs}

‎components/esp_tee/subproject/components/tee_attestation/esp_tee_att.cmake‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file must be manually included in the project's top level CMakeLists.txt before project()
2+
# This ensures that the variables are set before TEE starts building
3+
4+
# Append secure service table consisting of secure services
5+
idf_build_set_property(CUSTOM_SECURE_SERVICE_TBL ${CMAKE_CURRENT_LIST_DIR}/esp_tee_att.tbl APPEND)

‎components/esp_tee/subproject/components/tee_attestation/esp_tee_att.tbl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# SS no. API type Function Args
2+
101 custom esp_tee_att_generate_token 6

‎components/esp_tee/subproject/components/tee_attestation/esp_tee_attestation.c‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -12,16 +12,44 @@
1212
#include "esp_log.h"
1313
#include "esp_err.h"
1414

15+
#if ESP_TEE_BUILD
16+
#include "esp_fault.h"
17+
#include "esp_tee_memory_utils.h"
18+
#include "esp_attestation.h"
19+
#endif
20+
1521
#include "esp_tee.h"
1622
#include "secure_service_num.h"
1723

1824
#include "sdkconfig.h"
1925

2026
static __attribute__((unused)) const char *TAG = "esp_tee_att";
2127

28+
#if ESP_TEE_BUILD
29+
30+
esp_err_t _ss_esp_tee_att_generate_token(const uint32_t nonce, const uint32_t client_id, const char *psa_cert_ref,
31+
uint8_t *token_buf, const size_t token_buf_size, uint32_t *token_len)
32+
{
33+
bool valid_addr = (esp_tee_ptr_in_ree((void *)psa_cert_ref) &&
34+
esp_tee_ptr_in_ree((void *)token_buf) &&
35+
esp_tee_ptr_in_ree((void *)token_len));
36+
valid_addr &= (esp_tee_ptr_in_ree((void *)((char *)psa_cert_ref + 20)) &&
37+
esp_tee_ptr_in_ree((void *)((char *)token_buf + token_buf_size)));
38+
39+
if (!valid_addr) {
40+
return ESP_ERR_INVALID_ARG;
41+
}
42+
ESP_FAULT_ASSERT(valid_addr);
43+
44+
return esp_att_generate_token(nonce, client_id, psa_cert_ref, token_buf, token_buf_size, token_len);
45+
}
46+
47+
#else
48+
2249
esp_err_t esp_tee_att_generate_token(const uint32_t nonce, const uint32_t client_id, const char *psa_cert_ref,
2350
uint8_t *token_buf, const size_t token_buf_size, uint32_t *token_len)
2451
{
2552
return (esp_err_t)esp_tee_service_call_with_noniram_intr_disabled(7, SS_ESP_TEE_ATT_GENERATE_TOKEN, nonce, client_id,
2653
psa_cert_ref, token_buf, token_buf_size, token_len);
2754
}
55+
#endif

‎components/esp_tee/subproject/main/core/esp_secure_services.c‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -434,26 +434,8 @@ esp_err_t _ss_esp_tee_sec_storage_clear_slot(uint16_t slot_id)
434434
return esp_tee_sec_storage_clear_slot(slot_id);
435435
}
436436

437-
/* ---------------------------------------------- Attestation ------------------------------------------------- */
438-
439-
esp_err_t _ss_esp_tee_att_generate_token(const uint32_t nonce, const uint32_t client_id, const char *psa_cert_ref,
440-
uint8_t *token_buf, const size_t token_buf_size, uint32_t *token_len)
441-
{
442-
bool valid_addr = (is_valid_ree_address((void *)psa_cert_ref) && is_valid_ree_address((void *)token_buf) &&
443-
is_valid_ree_address((void *)token_len));
444-
445-
valid_addr &= (is_valid_ree_address((void *)((char *)psa_cert_ref + 32)) && is_valid_ree_address((void *)((char *)token_buf + token_buf_size)));
446-
447-
if (!valid_addr) {
448-
return ESP_ERR_INVALID_ARG;
449-
}
450-
451-
ESP_FAULT_ASSERT(valid_addr);
452-
453-
return esp_att_generate_token(nonce, client_id, psa_cert_ref, token_buf, token_buf_size, token_len);
454-
}
455-
456437
/* ---------------------------------------------- MMU HAL ------------------------------------------------- */
438+
457439
void _ss_mmu_hal_map_region(uint32_t mmu_id, mmu_target_t mem_type, uint32_t vaddr,
458440
uint32_t paddr, uint32_t len, uint32_t *out_len)
459441
{

‎components/esp_tee/test_apps/tee_cli_app/CMakeLists.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,8 @@ list(APPEND EXTRA_COMPONENT_DIRS $ENV{IDF_PATH}/components/esp_tee/subproject/co
1313
$ENV{IDF_PATH}/components/esp_tee/subproject/components/tee_sec_storage)
1414

1515
include($ENV{IDF_PATH}/tools/cmake/project.cmake)
16+
17+
# Including the attestation service calls
18+
include($ENV{IDF_PATH}/components/esp_tee/subproject/components/tee_attestation/esp_tee_att.cmake)
19+
1620
project(tee_cli)

0 commit comments

Comments
 (0)