Skip to content

Commit c4eec75

Browse files
laukik-haselaukik-hase
committed
refactor(esp_tee): Revised the secure service ID numbering scheme
Also: - Split the secure service table into two parts: one DRAM-resident and the other DROM-resident. The former holds the services invoked when the cache is disabled or suspended while the latter holds rest of the services.
1 parent a745100 commit c4eec75

File tree

11 files changed

+137
-115
lines changed

11 files changed

+137
-115
lines changed

‎components/esp_hw_support/include/esp_cpu.h‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -22,6 +22,10 @@
2222
#include "esp_err.h"
2323
#include "esp_attr.h"
2424

25+
#if CONFIG_SECURE_ENABLE_TEE && !NON_OS_BUILD
26+
#include "secure_service_num.h"
27+
#endif
28+
2529
#ifdef __cplusplus
2630
extern "C" {
2731
#endif
@@ -452,9 +456,9 @@ FORCE_INLINE_ATTR void esp_cpu_intr_edge_ack(int intr_num)
452456
#ifdef __XTENSA__
453457
xthal_set_intclear((unsigned) (1 << intr_num));
454458
#else
455-
#if CONFIG_SECURE_ENABLE_TEE && !ESP_TEE_BUILD
459+
#if CONFIG_SECURE_ENABLE_TEE && !NON_OS_BUILD
456460
extern esprv_int_mgmt_t esp_tee_intr_sec_srv_cb;
457-
esp_tee_intr_sec_srv_cb(2, TEE_INTR_EDGE_ACK_SRV_ID, intr_num);
461+
esp_tee_intr_sec_srv_cb(2, SS_RV_UTILS_INTR_EDGE_ACK, intr_num);
458462
#else
459463
rv_utils_intr_edge_ack((unsigned) intr_num);
460464
#endif

‎components/esp_tee/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ set(secure_service_tbl_parser_py
8888

8989
set(secure_service_gen_headers
9090
${CONFIG_DIR}/secure_service_num.h ${CONFIG_DIR}/secure_service_dec.h
91-
${CONFIG_DIR}/secure_service.h
91+
${CONFIG_DIR}/secure_service_int.h ${CONFIG_DIR}/secure_service_ext.h
9292
)
9393

9494
if(CONFIG_SECURE_ENABLE_TEE AND NOT esp_tee_build)

‎components/esp_tee/scripts/esp32c6/secure_service.tbl‎

Lines changed: 54 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,56 @@
11
# SS no. API type Function Args
22
0 custom invalid_secure_service 0
3-
1 IDF esp_rom_route_intr_matrix 3
4-
2 IDF rv_utils_intr_enable 1
5-
3 IDF rv_utils_intr_disable 1
6-
4 IDF rv_utils_intr_set_priority 2
7-
5 IDF rv_utils_intr_set_type 2
8-
6 IDF rv_utils_intr_set_threshold 1
9-
7 IDF rv_utils_intr_edge_ack 1
10-
8 IDF rv_utils_intr_global_enable 0
11-
9 IDF efuse_hal_chip_revision 0
12-
10 IDF efuse_hal_get_chip_ver_pkg 1
13-
11 IDF efuse_hal_get_disable_wafer_version_major 0
14-
12 IDF efuse_hal_get_mac 1
15-
13 IDF esp_efuse_check_secure_version 1
16-
14 IDF esp_efuse_read_field_blob 3
17-
15 IDF esp_flash_encryption_enabled 0
18-
16 IDF wdt_hal_init 4
19-
17 IDF wdt_hal_deinit 1
20-
18 IDF esp_aes_intr_alloc 0
21-
19 IDF esp_aes_crypt_cbc 6
22-
20 IDF esp_aes_crypt_cfb8 6
23-
21 IDF esp_aes_crypt_cfb128 7
24-
22 IDF esp_aes_crypt_ctr 7
25-
23 IDF esp_aes_crypt_ecb 4
26-
24 IDF esp_aes_crypt_ofb 6
27-
25 IDF esp_sha 4
28-
26 IDF esp_sha_dma 6
29-
27 IDF esp_sha_read_digest_state 2
30-
28 IDF esp_sha_write_digest_state 2
31-
29 IDF mmu_hal_map_region 6
32-
30 IDF mmu_hal_unmap_region 3
33-
31 IDF mmu_hal_vaddr_to_paddr 4
34-
32 IDF mmu_hal_paddr_to_vaddr 5
35-
33 custom esp_tee_ota_begin 0
36-
34 custom esp_tee_ota_write 3
37-
35 custom esp_tee_ota_end 0
38-
36 custom esp_tee_sec_storage_init 0
39-
37 custom esp_tee_sec_storage_gen_key 1
40-
38 custom esp_tee_sec_storage_get_signature 4
41-
39 custom esp_tee_sec_storage_get_pubkey 2
42-
40 custom esp_tee_sec_storage_encrypt 8
43-
41 custom esp_tee_sec_storage_decrypt 8
44-
42 custom esp_tee_sec_storage_is_slot_empty 1
45-
43 custom esp_tee_sec_storage_clear_slot 1
3+
# ID: 1-47 (47) - External memory (Flash) protection
4+
1 IDF mmu_hal_map_region 6
5+
2 IDF mmu_hal_unmap_region 3
6+
3 IDF mmu_hal_vaddr_to_paddr 4
7+
4 IDF mmu_hal_paddr_to_vaddr 5
8+
# Services before the ID 48 will be placed in the internal memory table,
9+
# while the rest will be placed in the external memory table.
10+
# ID: 48-71 (24) - Interrupt Handling
11+
48 IDF esp_rom_route_intr_matrix 3
12+
49 IDF rv_utils_intr_enable 1
13+
50 IDF rv_utils_intr_disable 1
14+
51 IDF rv_utils_intr_set_priority 2
15+
52 IDF rv_utils_intr_set_type 2
16+
53 IDF rv_utils_intr_set_threshold 1
17+
54 IDF rv_utils_intr_edge_ack 1
18+
55 IDF rv_utils_intr_global_enable 0
19+
# ID: 72-119 (48) - HAL
20+
72 IDF efuse_hal_chip_revision 0
21+
73 IDF efuse_hal_get_chip_ver_pkg 1
22+
74 IDF efuse_hal_get_disable_wafer_version_major 0
23+
75 IDF efuse_hal_get_mac 1
24+
76 IDF wdt_hal_init 4
25+
77 IDF wdt_hal_deinit 1
26+
# ID: 120-167 (48) - Crypto
27+
120 IDF esp_aes_intr_alloc 0
28+
121 IDF esp_aes_crypt_cbc 6
29+
122 IDF esp_aes_crypt_cfb8 6
30+
123 IDF esp_aes_crypt_cfb128 7
31+
124 IDF esp_aes_crypt_ctr 7
32+
125 IDF esp_aes_crypt_ecb 4
33+
126 IDF esp_aes_crypt_ofb 6
34+
127 IDF esp_sha 4
35+
128 IDF esp_sha_dma 6
36+
129 IDF esp_sha_read_digest_state 2
37+
130 IDF esp_sha_write_digest_state 2
38+
# ID: 168-183 (16) - eFuse
39+
168 IDF esp_efuse_check_secure_version 1
40+
169 IDF esp_efuse_read_field_blob 3
41+
170 IDF esp_flash_encryption_enabled 0
42+
# ID: 184-249 (66) - Reserved for future use
43+
# ID: 270-293 (24) - Secure Storage
44+
270 custom esp_tee_sec_storage_init 0
45+
271 custom esp_tee_sec_storage_gen_key 2
46+
272 custom esp_tee_sec_storage_get_signature 4
47+
273 custom esp_tee_sec_storage_get_pubkey 2
48+
274 custom esp_tee_sec_storage_encrypt 8
49+
275 custom esp_tee_sec_storage_decrypt 8
50+
276 custom esp_tee_sec_storage_is_slot_empty 1
51+
277 custom esp_tee_sec_storage_clear_slot 1
52+
# ID: 294-299 (6) - OTA
53+
294 custom esp_tee_ota_begin 0
54+
295 custom esp_tee_ota_write 3
55+
296 custom esp_tee_ota_end 0
56+
# ID: 300+ - User-defined

‎components/esp_tee/scripts/secure_service_tbl_parser.py‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
from typing import List
66
from typing import Tuple
77

8+
SEC_SRV_TABLE_SPLIT_ID = 48
9+
810

911
def parse_services(secure_service_tbl: str) -> List[Tuple[int, str, int]]:
1012
services, service_ids = [], set()
@@ -37,8 +39,9 @@ def generate_num_header(services: List[Tuple[int, str, int]], output_file: str)
3739
body = '\n'.join(f'#define SS_{name.upper()}\t{nr}' for nr, name, _ in services)
3840
footer = f'\n#define MAX_SECURE_SERVICES_ID\t{services[-1][0] + 1 if services else 0}\n'
3941
footer += f'#define SECURE_SERVICES_NUM\t{len(services)}\n\n'
42+
footer += f'#define SECURE_SERVICES_SPLIT_ID\t{SEC_SRV_TABLE_SPLIT_ID}\n\n'
4043
footer += '''typedef void (*secure_service_t)(void);
41-
typedef struct { int id; secure_service_t func; int nargs; } secure_service_entry_t;
44+
typedef struct { secure_service_t func; int nargs; } secure_service_entry_t;
4245
'''
4346
footer += '\n#ifdef __cplusplus\n}\n#endif\n'
4447
with open(output_file, 'w') as f:
@@ -62,16 +65,22 @@ def generate_dec_header(services: List[Tuple[int, str, int]], output_file: str)
6265
f.write(header + body + footer)
6366

6467

65-
def generate_table(services: List[Tuple[int, str, int]], output_file: str) -> None:
68+
def generate_table_split(services: List[Tuple[int, str, int]], output_file_1: str, output_file_2: str) -> None:
6669
header = '''/**
6770
* THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT EDIT!
6871
*/
6972
7073
#pragma once
7174
'''
72-
body = '\n'.join(f'__SECURE_SERVICE({nr}, {name}, {nargs})' for nr, name, nargs in services)
73-
with open(output_file, 'w') as f:
74-
f.write(header + body)
75+
services_1 = [service for service in services if service[0] < SEC_SRV_TABLE_SPLIT_ID]
76+
services_2 = [service for service in services if service[0] >= SEC_SRV_TABLE_SPLIT_ID]
77+
78+
body_1 = '\n'.join(f'__SECURE_SERVICE({nr}, {name}, {nargs})' for nr, name, nargs in services_1)
79+
body_2 = '\n'.join(f'__SECURE_SERVICE({nr}, {name}, {nargs})' for nr, name, nargs in services_2)
80+
81+
with open(output_file_1, 'w') as f1, open(output_file_2, 'w') as f2:
82+
f1.write(header + body_1)
83+
f2.write(header + body_2)
7584

7685

7786
def generate_wrap_list(secure_service_tbl: str) -> None:
@@ -85,19 +94,19 @@ def main() -> None:
8594
parser = argparse.ArgumentParser(description='Generate secure service outputs')
8695
parser.add_argument('--wrap', action='store_true', help='Generate linker wrap options')
8796
parser.add_argument('secure_service_tbl', type=str, help='Path to secure service table file')
88-
parser.add_argument('output_files', nargs='*', help='Output files: [secure_service_num.h, secure_service_dec.h, secure_service.h]')
97+
parser.add_argument('output_files', nargs='*', help='Output files: [secure_service_num.h, secure_service_dec.h, secure_service_1.h, secure_service_2.h]')
8998

9099
args = parser.parse_args()
91100

92101
if args.wrap:
93102
generate_wrap_list(args.secure_service_tbl)
94103
else:
95-
if len(args.output_files) != 3:
104+
if len(args.output_files) != 4:
96105
parser.error('Missing output header files!')
97106
services = parse_services(args.secure_service_tbl)
98107
generate_num_header(services, args.output_files[0])
99108
generate_dec_header(services, args.output_files[1])
100-
generate_table(services, args.output_files[2])
109+
generate_table_split(services, args.output_files[2], args.output_files[3])
101110

102111

103112
if __name__ == '__main__':

‎components/esp_tee/subproject/components/tee_attestation/esp_tee_att.tbl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
# SS no. API type Function Args
2-
101 custom esp_tee_att_generate_token 6
2+
250 custom esp_tee_att_generate_token 6

‎components/esp_tee/subproject/main/core/esp_secure_dispatcher.c‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,29 +13,21 @@
1313

1414
static const char *TAG = "esp_tee_sec_disp";
1515

16-
extern const secure_service_entry_t tee_secure_service_table[];
16+
extern const secure_service_entry_t tee_sec_srv_tbl_int_mem[];
17+
extern const secure_service_entry_t tee_sec_srv_tbl_ext_mem[];
1718

1819
/* ---------------------------------------------- Secure Service Dispatcher ------------------------------------------------- */
1920

20-
const secure_service_entry_t *find_service_by_id(uint32_t id)
21+
static const secure_service_entry_t *find_service_by_id(uint32_t id)
2122
{
2223
if (id >= MAX_SECURE_SERVICES_ID) {
2324
return NULL;
2425
}
2526

26-
size_t left = 0;
27-
size_t right = SECURE_SERVICES_NUM;
28-
29-
while (left < right) {
30-
size_t mid = left + (right - left) / 2;
31-
32-
if (tee_secure_service_table[mid].id == id) {
33-
return &tee_secure_service_table[mid];
34-
} else if (tee_secure_service_table[mid].id < id) {
35-
left = mid + 1;
36-
} else {
37-
right = mid;
38-
}
27+
if (id < SECURE_SERVICES_SPLIT_ID) {
28+
return &tee_sec_srv_tbl_int_mem[id];
29+
} else {
30+
return &tee_sec_srv_tbl_ext_mem[id];
3931
}
4032

4133
return NULL;

‎components/esp_tee/subproject/main/core/esp_secure_service_table.c‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,20 @@
1313
#pragma GCC diagnostic ignored "-Woverride-init"
1414
#endif
1515

16-
const DRAM_ATTR secure_service_entry_t tee_secure_service_table[] = {
17-
#define __SECURE_SERVICE(NR, SYM, ARGC) { .id = NR, .func = _ss_##SYM, .nargs = ARGC },
18-
#include "secure_service.h"
16+
const DRAM_ATTR secure_service_entry_t tee_sec_srv_tbl_int_mem[] = {
17+
[0 ... SECURE_SERVICES_SPLIT_ID - 1] = { .func = NULL, .nargs = 0 },
18+
#define __SECURE_SERVICE(NR, SYM, ARGC) [NR] = { .func = _ss_##SYM, .nargs = ARGC },
19+
#include "secure_service_int.h"
20+
#undef __SECURE_SERVICE
1921
};
22+
23+
const secure_service_entry_t tee_sec_srv_tbl_ext_mem[] = {
24+
[0 ... MAX_SECURE_SERVICES_ID] = { .func = NULL, .nargs = 0 },
25+
#define __SECURE_SERVICE(NR, SYM, ARGC) [NR] = { .func = _ss_##SYM, .nargs = ARGC },
26+
#include "secure_service_ext.h"
27+
#undef __SECURE_SERVICE
28+
};
29+
2030
#ifdef __GNUC__
2131
#pragma GCC diagnostic pop
2232
#endif

‎components/esp_tee/test_apps/tee_test_fw/components/test_sec_srv/test.tbl‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
# SS no. API type Function Args
2-
201 custom esp_tee_service_add 6
3-
202 custom esp_tee_service_sub 6
4-
203 custom esp_tee_service_mul 6
5-
204 custom esp_tee_service_div 6
6-
205 custom esp_tee_test_timer_init 6
7-
206 custom esp_tee_secure_int_test 6
8-
207 custom esp_tee_non_secure_int_test 6
9-
208 custom esp_tee_test_int_count 6
10-
209 custom esp_tee_test_resv_reg1_write_violation 0
11-
210 custom esp_tee_test_resv_reg1_exec_violation 0
12-
211 custom esp_tee_test_iram_reg1_write_violation 0
13-
212 custom esp_tee_test_iram_reg2_write_violation 0
14-
213 custom esp_tee_test_dram_reg1_exec_violation 0
15-
214 custom esp_tee_test_dram_reg2_exec_violation 0
16-
215 custom esp_tee_test_illegal_instruction 0
17-
216 custom dummy_secure_service 6
18-
217 custom add_in_loop 6
2+
300 custom esp_tee_service_add 2
3+
301 custom esp_tee_service_sub 2
4+
302 custom esp_tee_service_mul 2
5+
303 custom esp_tee_service_div 2
6+
304 custom esp_tee_test_timer_init 1
7+
305 custom esp_tee_secure_int_test 0
8+
306 custom esp_tee_non_secure_int_test 1
9+
307 custom esp_tee_test_int_count 1
10+
308 custom esp_tee_test_resv_reg1_write_violation 0
11+
309 custom esp_tee_test_resv_reg1_exec_violation 0
12+
310 custom esp_tee_test_iram_reg1_write_violation 0
13+
311 custom esp_tee_test_iram_reg2_write_violation 0
14+
312 custom esp_tee_test_dram_reg1_exec_violation 0
15+
313 custom esp_tee_test_dram_reg2_exec_violation 0
16+
314 custom esp_tee_test_illegal_instruction 0
17+
315 custom dummy_secure_service 0
18+
316 custom add_in_loop 3

0 commit comments

Comments
 (0)