mirror of
https://github.com/espressif/esp-idf.git
synced 2026-01-15 22:46:08 +00:00
feat(esp_tee): Support for ESP32-C61 - the esp_tee component
This commit is contained in:
Laukik Hase
@@ -6,8 +6,8 @@ idf_build_get_property(target IDF_TARGET)
|
||||
# headers & sources here are compiled into the app, not the esp_tee binary
|
||||
# (see subproject/ for the esp_tee binary build files)
|
||||
|
||||
# ESP-TEE is currently supported only on the ESP32-C6, H2 and C5 SoCs
|
||||
set(SUPPORTED_TARGETS "esp32c6" "esp32h2" "esp32c5")
|
||||
# ESP-TEE is currently supported only on the ESP32-C6, H2, C5 and C61 SoCs
|
||||
set(SUPPORTED_TARGETS "esp32c6" "esp32h2" "esp32c5" "esp32c61")
|
||||
if(NOT target IN_LIST SUPPORTED_TARGETS)
|
||||
message(STATUS "ESP-TEE is currently supported only on the ${SUPPORTED_TARGETS} SoCs")
|
||||
return()
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
menu "ESP-TEE (Trusted Execution Environment)"
|
||||
depends on IDF_TARGET_ESP32C6 || IDF_TARGET_ESP32H2 || IDF_TARGET_ESP32C5
|
||||
depends on IDF_TARGET_ESP32C6 || IDF_TARGET_ESP32H2 || IDF_TARGET_ESP32C5 || IDF_TARGET_ESP32C61
|
||||
|
||||
config SECURE_ENABLE_TEE
|
||||
bool "Enable the ESP-TEE framework"
|
||||
@@ -90,6 +90,7 @@ menu "ESP-TEE (Trusted Execution Environment)"
|
||||
|
||||
config SECURE_TEE_PBKDF2_EFUSE_HMAC_KEY_ID
|
||||
int "Secure Storage: eFuse HMAC key ID for PBKDF2 key derivation"
|
||||
depends on SOC_HMAC_SUPPORTED
|
||||
range -1 5
|
||||
default -1
|
||||
help
|
||||
|
||||
258
components/esp_tee/scripts/esp32c61/sec_srv_tbl_default.yml
Normal file
258
components/esp_tee/scripts/esp32c61/sec_srv_tbl_default.yml
Normal file
@@ -0,0 +1,258 @@
|
||||
secure_services:
|
||||
- family: misc
|
||||
entries:
|
||||
- id: 0
|
||||
type: custom
|
||||
function: invalid_secure_service
|
||||
args: 0
|
||||
# ID: 1-4 (4) - External memory (Flash) protection [SPI0]
|
||||
- family: flash_protection_spi0
|
||||
entries:
|
||||
- id: 1
|
||||
type: IDF
|
||||
function: mmu_hal_map_region
|
||||
args: 6
|
||||
- id: 2
|
||||
type: IDF
|
||||
function: mmu_hal_unmap_region
|
||||
args: 3
|
||||
- id: 3
|
||||
type: IDF
|
||||
function: mmu_hal_vaddr_to_paddr
|
||||
args: 4
|
||||
- id: 4
|
||||
type: IDF
|
||||
function: mmu_hal_paddr_to_vaddr
|
||||
args: 5
|
||||
# ID 5 empty
|
||||
# ID: 6-22 (17) - External memory (Flash) protection [SPI1]
|
||||
- family: flash_protection_spi1
|
||||
entries:
|
||||
- id: 6
|
||||
type: IDF
|
||||
function: spi_flash_hal_check_status
|
||||
args: 1
|
||||
- id: 7
|
||||
type: IDF
|
||||
function: spi_flash_hal_common_command
|
||||
args: 2
|
||||
- id: 8
|
||||
type: IDF
|
||||
function: spi_flash_hal_device_config
|
||||
args: 1
|
||||
- id: 9
|
||||
type: IDF
|
||||
function: spi_flash_hal_erase_block
|
||||
args: 2
|
||||
# ID: 10 empty
|
||||
- id: 11
|
||||
type: IDF
|
||||
function: spi_flash_hal_erase_sector
|
||||
args: 2
|
||||
- id: 12
|
||||
type: IDF
|
||||
function: spi_flash_hal_program_page
|
||||
args: 4
|
||||
- id: 13
|
||||
type: IDF
|
||||
function: spi_flash_hal_read
|
||||
args: 4
|
||||
- id: 14
|
||||
type: IDF
|
||||
function: spi_flash_hal_resume
|
||||
args: 1
|
||||
- id: 15
|
||||
type: IDF
|
||||
function: spi_flash_hal_set_write_protect
|
||||
args: 2
|
||||
- id: 16
|
||||
type: IDF
|
||||
function: spi_flash_hal_setup_read_suspend
|
||||
args: 2
|
||||
- id: 17
|
||||
type: IDF
|
||||
function: spi_flash_hal_supports_direct_read
|
||||
args: 2
|
||||
- id: 18
|
||||
type: IDF
|
||||
function: spi_flash_hal_supports_direct_write
|
||||
args: 2
|
||||
- id: 19
|
||||
type: IDF
|
||||
function: spi_flash_hal_suspend
|
||||
args: 1
|
||||
- id: 20
|
||||
type: IDF
|
||||
function: bootloader_flash_execute_command_common
|
||||
args: 7
|
||||
- id: 21
|
||||
type: IDF
|
||||
function: memspi_host_flush_cache
|
||||
args: 3
|
||||
- id: 22
|
||||
type: IDF
|
||||
function: spi_flash_chip_generic_config_host_io_mode
|
||||
args: 2
|
||||
# ID: 30-53 (24) - Interrupt Handling
|
||||
- family: interrupt_handling
|
||||
entries:
|
||||
- id: 30
|
||||
type: IDF
|
||||
function: esp_rom_route_intr_matrix
|
||||
args: 3
|
||||
- id: 31
|
||||
type: IDF
|
||||
function: rv_utils_intr_enable
|
||||
args: 1
|
||||
- id: 32
|
||||
type: IDF
|
||||
function: rv_utils_intr_disable
|
||||
args: 1
|
||||
- id: 33
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_priority
|
||||
args: 2
|
||||
- id: 34
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_type
|
||||
args: 2
|
||||
- id: 35
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_threshold
|
||||
args: 1
|
||||
- id: 36
|
||||
type: IDF
|
||||
function: rv_utils_intr_edge_ack
|
||||
args: 1
|
||||
- id: 37
|
||||
type: IDF
|
||||
function: rv_utils_intr_global_enable
|
||||
args: 0
|
||||
- id: 38
|
||||
type: IDF
|
||||
function: rv_utils_intr_get_enabled_mask
|
||||
args: 0
|
||||
- id: 39
|
||||
type: IDF
|
||||
function: rv_utils_set_cycle_count
|
||||
args: 1
|
||||
- id: 40
|
||||
type: IDF
|
||||
function: rv_utils_en_branch_predictor
|
||||
args: 0
|
||||
- id: 41
|
||||
type: IDF
|
||||
function: rv_utils_dis_branch_predictor
|
||||
args: 0
|
||||
- id: 42
|
||||
type: IDF
|
||||
function: rv_utils_wfe_mode_enable
|
||||
args: 1
|
||||
- id: 43
|
||||
type: IDF
|
||||
function: esprv_int_set_vectored
|
||||
args: 2
|
||||
# ID: 54-85 (32) - HAL
|
||||
- family: hal
|
||||
entries:
|
||||
- id: 54
|
||||
type: IDF
|
||||
function: wdt_hal_init
|
||||
args: 4
|
||||
- id: 55
|
||||
type: IDF
|
||||
function: wdt_hal_deinit
|
||||
args: 1
|
||||
# ID: 86-133 (48) - Crypto
|
||||
- family: crypto
|
||||
entries:
|
||||
- id: 86
|
||||
type: IDF
|
||||
function: esp_sha
|
||||
args: 4
|
||||
- id: 87
|
||||
type: IDF
|
||||
function: esp_sha_block
|
||||
args: 3
|
||||
- id: 88
|
||||
type: IDF
|
||||
function: esp_sha_dma
|
||||
args: 6
|
||||
- id: 89
|
||||
type: IDF
|
||||
function: esp_sha_read_digest_state
|
||||
args: 2
|
||||
- id: 90
|
||||
type: IDF
|
||||
function: esp_sha_write_digest_state
|
||||
args: 2
|
||||
- id: 91
|
||||
type: IDF
|
||||
function: esp_sha_set_mode
|
||||
args: 1
|
||||
- id: 92
|
||||
type: IDF
|
||||
function: esp_crypto_sha_enable_periph_clk
|
||||
args: 1
|
||||
- id: 93
|
||||
type: IDF
|
||||
function: esp_ecc_point_multiply
|
||||
args: 4
|
||||
- id: 94
|
||||
type: IDF
|
||||
function: esp_ecc_point_verify
|
||||
args: 1
|
||||
- id: 95
|
||||
type: IDF
|
||||
function: esp_crypto_ecc_enable_periph_clk
|
||||
args: 1
|
||||
# ID: 134-169 (36) - Reserved for future use
|
||||
- family: attestation
|
||||
entries:
|
||||
- id: 170
|
||||
type: custom
|
||||
function: esp_tee_att_generate_token
|
||||
args: 6
|
||||
# ID: 175-194 (20) - Secure Storage
|
||||
- family: secure_storage
|
||||
entries:
|
||||
- id: 175
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_clear_key
|
||||
args: 1
|
||||
- id: 176
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_gen_key
|
||||
args: 1
|
||||
- id: 177
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_ecdsa_sign
|
||||
args: 4
|
||||
- id: 178
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_ecdsa_get_pubkey
|
||||
args: 2
|
||||
- id: 179
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_aead_encrypt
|
||||
args: 4
|
||||
- id: 180
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_aead_decrypt
|
||||
args: 4
|
||||
# ID: 195-199 (5) - OTA
|
||||
- family: ota
|
||||
entries:
|
||||
- id: 195
|
||||
type: custom
|
||||
function: esp_tee_ota_begin
|
||||
args: 0
|
||||
- id: 196
|
||||
type: custom
|
||||
function: esp_tee_ota_write
|
||||
args: 3
|
||||
- id: 197
|
||||
type: custom
|
||||
function: esp_tee_ota_end
|
||||
args: 0
|
||||
# ID: 200+ - User-defined
|
||||
@@ -5,27 +5,32 @@
|
||||
*/
|
||||
#include <stdarg.h>
|
||||
|
||||
#include "soc/soc_caps.h"
|
||||
#include "esp_err.h"
|
||||
#include "esp_random.h"
|
||||
|
||||
#include "hal/sha_types.h"
|
||||
#include "hal/sha_hal.h"
|
||||
#include "rom/digital_signature.h"
|
||||
#include "hal/mmu_types.h"
|
||||
#include "hal/wdt_hal.h"
|
||||
#include "hal/spi_flash_hal.h"
|
||||
#include "hal/spi_flash_types.h"
|
||||
#include "esp_private/mspi_timing_tuning.h"
|
||||
#if SOC_SHA_SUPPORTED
|
||||
#include "hal/sha_types.h"
|
||||
#include "hal/sha_hal.h"
|
||||
#endif
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
#include "esp_hmac.h"
|
||||
#endif
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
#include "esp_ds.h"
|
||||
#include "rom/digital_signature.h"
|
||||
#endif
|
||||
#include "esp_crypto_lock.h"
|
||||
#include "esp_flash.h"
|
||||
|
||||
#include "soc/soc_caps.h"
|
||||
#include "sdkconfig.h"
|
||||
|
||||
#include "esp_tee.h"
|
||||
#include "secure_service_num.h"
|
||||
#include "sdkconfig.h"
|
||||
|
||||
/* ---------------------------------------------- Interrupts ------------------------------------------------- */
|
||||
|
||||
@@ -43,18 +48,19 @@ void IRAM_ATTR __wrap_esprv_int_set_vectored(int rv_int_num, bool vectored)
|
||||
|
||||
/* ---------------------------------------------- RTC_WDT ------------------------------------------------- */
|
||||
|
||||
void __wrap_wdt_hal_init(wdt_hal_context_t *hal, wdt_inst_t wdt_inst, uint32_t prescaler, bool enable_intr)
|
||||
void IRAM_ATTR __wrap_wdt_hal_init(wdt_hal_context_t *hal, wdt_inst_t wdt_inst, uint32_t prescaler, bool enable_intr)
|
||||
{
|
||||
esp_tee_service_call(5, SS_WDT_HAL_INIT, hal, wdt_inst, prescaler, enable_intr);
|
||||
}
|
||||
|
||||
void __wrap_wdt_hal_deinit(wdt_hal_context_t *hal)
|
||||
void IRAM_ATTR __wrap_wdt_hal_deinit(wdt_hal_context_t *hal)
|
||||
{
|
||||
esp_tee_service_call(2, SS_WDT_HAL_DEINIT, hal);
|
||||
}
|
||||
|
||||
/* ---------------------------------------------- AES ------------------------------------------------- */
|
||||
|
||||
#if SOC_AES_SUPPORTED
|
||||
typedef struct {
|
||||
uint8_t key_bytes;
|
||||
volatile uint8_t key_in_hardware; /* This variable is used for fault injection checks, so marked volatile to avoid optimisation */
|
||||
@@ -148,9 +154,10 @@ int __wrap_esp_aes_crypt_ofb(esp_aes_context *ctx,
|
||||
esp_crypto_sha_aes_lock_release();
|
||||
return err;
|
||||
}
|
||||
|
||||
#endif
|
||||
/* ---------------------------------------------- SHA ------------------------------------------------- */
|
||||
|
||||
#if SOC_SHA_SUPPORTED
|
||||
typedef enum {
|
||||
ESP_SHA1_STATE_INIT,
|
||||
ESP_SHA1_STATE_IN_PROCESS
|
||||
@@ -238,9 +245,11 @@ int __wrap_esp_sha_512_t_init_hash(uint16_t t)
|
||||
return esp_tee_service_call(2, SS_ESP_SHA_512_T_INIT_HASH, t);
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- HMAC ------------------------------------------------- */
|
||||
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
esp_err_t __wrap_esp_hmac_calculate(hmac_key_id_t key_id, const void *message, size_t message_len, uint8_t *hmac)
|
||||
{
|
||||
esp_crypto_hmac_lock_acquire();
|
||||
@@ -264,9 +273,11 @@ esp_err_t __wrap_esp_hmac_jtag_disable(void)
|
||||
esp_crypto_hmac_lock_release();
|
||||
return err;
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- DS ------------------------------------------------- */
|
||||
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
esp_err_t __wrap_esp_ds_sign(const void *message,
|
||||
const esp_ds_data_t *data,
|
||||
hmac_key_id_t key_id,
|
||||
@@ -318,16 +329,20 @@ esp_err_t __wrap_esp_ds_encrypt_params(esp_ds_data_t *data,
|
||||
esp_crypto_sha_aes_lock_release();
|
||||
return err;
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- MPI ------------------------------------------------- */
|
||||
|
||||
#if SOC_MPI_SUPPORTED
|
||||
void __wrap_esp_crypto_mpi_enable_periph_clk(bool enable)
|
||||
{
|
||||
esp_tee_service_call(2, SS_ESP_CRYPTO_MPI_ENABLE_PERIPH_CLK, enable);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- ECC ------------------------------------------------- */
|
||||
|
||||
#if SOC_ECC_SUPPORTED
|
||||
#define P256_LEN (256/8)
|
||||
#define P192_LEN (192/8)
|
||||
|
||||
@@ -352,8 +367,9 @@ int __wrap_esp_ecc_point_verify(const ecc_point_t *point)
|
||||
esp_crypto_ecc_lock_release();
|
||||
return err;
|
||||
}
|
||||
#endif
|
||||
|
||||
#if SOC_ECDSA_SUPPORTED
|
||||
#if SOC_ECC_SUPPORTED && SOC_ECDSA_SUPPORTED
|
||||
void __wrap_esp_crypto_ecc_enable_periph_clk(bool enable)
|
||||
{
|
||||
esp_tee_service_call(2, SS_ESP_CRYPTO_ECC_ENABLE_PERIPH_CLK, enable);
|
||||
|
||||
@@ -25,7 +25,7 @@ set(ESP_TEE_BUILD 1)
|
||||
set(NON_OS_BUILD 1)
|
||||
|
||||
# Additional components
|
||||
list(APPEND COMPONENTS bootloader_support efuse esp_hal_mspi esp_security mbedtls esp_stdio)
|
||||
list(APPEND COMPONENTS bootloader_support efuse esp_hal_mspi esp_hal_wdt esp_security mbedtls esp_stdio)
|
||||
|
||||
# TEE-specific components
|
||||
list(APPEND COMPONENTS tee_flash_mgr tee_ota_ops tee_sec_storage tee_attestation)
|
||||
|
||||
@@ -6,22 +6,22 @@
|
||||
|
||||
#include <string.h>
|
||||
|
||||
#include "soc/soc_caps.h"
|
||||
#include "esp_log.h"
|
||||
#include "esp_cpu.h"
|
||||
#include "esp_fault.h"
|
||||
#include "esp_flash.h"
|
||||
#include "esp_efuse.h"
|
||||
#include "esp_efuse_chip.h"
|
||||
#include "esp_hmac.h"
|
||||
#include "esp_random.h"
|
||||
#include "spi_flash_mmap.h"
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
#include "esp_hmac.h"
|
||||
#include "esp_hmac_pbkdf2.h"
|
||||
#endif
|
||||
|
||||
#include "mbedtls/aes.h"
|
||||
#include "mbedtls/gcm.h"
|
||||
#include "mbedtls/sha256.h"
|
||||
#include "mbedtls/ecdsa.h"
|
||||
#include "mbedtls/error.h"
|
||||
#include "esp_hmac_pbkdf2.h"
|
||||
|
||||
#include "esp_rom_sys.h"
|
||||
#include "nvs.h"
|
||||
@@ -87,9 +87,11 @@ static const char *TAG = "secure_storage";
|
||||
#error "TEE Secure Storage: Configured eFuse block (CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID) out of range!"
|
||||
#endif
|
||||
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
#if CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID == CONFIG_SECURE_TEE_PBKDF2_EFUSE_HMAC_KEY_ID
|
||||
#error "TEE Secure Storage: Configured eFuse block for storage encryption keys (CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID) and PBKDF2 key derivation (CONFIG_SECURE_TEE_PBKDF2_EFUSE_HMAC_KEY_ID) cannot be the same!"
|
||||
#endif
|
||||
#endif
|
||||
|
||||
static int buffer_hexdump(const char *label, const void *buffer, size_t length)
|
||||
{
|
||||
@@ -610,6 +612,7 @@ esp_err_t esp_tee_sec_storage_aead_decrypt(const esp_tee_sec_storage_aead_ctx_t
|
||||
return tee_sec_storage_crypt_common(ctx->key_id, ctx->input, ctx->input_len, ctx->aad, ctx->aad_len, (uint8_t *)tag, tag_len, output, false);
|
||||
}
|
||||
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
esp_err_t esp_tee_sec_storage_ecdsa_sign_pbkdf2(const esp_tee_sec_storage_pbkdf2_ctx_t *ctx,
|
||||
const uint8_t *hash, size_t hlen,
|
||||
esp_tee_sec_storage_ecdsa_sign_t *out_sign,
|
||||
@@ -743,3 +746,4 @@ exit:
|
||||
mbedtls_mpi_free(&s);
|
||||
return err;
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -3,10 +3,13 @@
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#include "secure_service_num.h"
|
||||
#include "esp_tee.h"
|
||||
|
||||
#include "soc/soc_caps.h"
|
||||
#include "esp_err.h"
|
||||
|
||||
#include "esp_tee.h"
|
||||
#include "esp_tee_sec_storage.h"
|
||||
#include "secure_service_num.h"
|
||||
|
||||
esp_err_t esp_tee_sec_storage_clear_key(const char *key_id)
|
||||
{
|
||||
@@ -38,7 +41,9 @@ esp_err_t esp_tee_sec_storage_aead_decrypt(const esp_tee_sec_storage_aead_ctx_t
|
||||
return esp_tee_service_call_with_noniram_intr_disabled(5, SS_ESP_TEE_SEC_STORAGE_AEAD_DECRYPT, ctx, tag, tag_len, output);
|
||||
}
|
||||
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
esp_err_t esp_tee_sec_storage_ecdsa_sign_pbkdf2(const esp_tee_sec_storage_pbkdf2_ctx_t *ctx, const uint8_t *hash, size_t hlen, esp_tee_sec_storage_ecdsa_sign_t *out_sign, esp_tee_sec_storage_ecdsa_pubkey_t *out_pubkey)
|
||||
{
|
||||
return esp_tee_service_call(6, SS_ESP_TEE_SEC_STORAGE_ECDSA_SIGN_PBKDF2, ctx, hash, hlen, out_sign, out_pubkey);
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -27,8 +27,11 @@ list(APPEND srcs "soc/${target}/esp_tee_secure_sys_cfg.c"
|
||||
"soc/${target}/esp_tee_pmp_pma_prot_cfg.c"
|
||||
"soc/${target}/esp_tee_apm_prot_cfg.c")
|
||||
|
||||
list(APPEND srcs "soc/common/esp_tee_apm_intr.c"
|
||||
"soc/common/esp_tee_aes_intr.c")
|
||||
list(APPEND srcs "soc/common/esp_tee_apm_intr.c")
|
||||
|
||||
if(CONFIG_SOC_AES_SUPPORTED)
|
||||
list(APPEND srcs "soc/common/esp_tee_aes_intr.c")
|
||||
endif()
|
||||
|
||||
# Common module implementation for TEE
|
||||
|
||||
@@ -44,6 +47,12 @@ list(APPEND include "include"
|
||||
"soc/common/include"
|
||||
"soc/${target}/include")
|
||||
|
||||
if(CONFIG_SOC_INT_PLIC_SUPPORTED)
|
||||
list(APPEND include "include/plic")
|
||||
elseif(CONFIG_SOC_INT_CLIC_SUPPORTED)
|
||||
list(APPEND include "include/clic")
|
||||
endif()
|
||||
|
||||
# Heap
|
||||
list(APPEND srcs "common/multi_heap.c")
|
||||
|
||||
@@ -59,9 +68,9 @@ list(APPEND srcs "common/syscall_stubs.c")
|
||||
idf_component_register(SRCS ${srcs}
|
||||
INCLUDE_DIRS ${include})
|
||||
|
||||
# NOTE: The ESP32-H2 ROM does not have sprintf/snprintf implementation,
|
||||
# NOTE: The ESP32-H2 and C61 ROM does not have sprintf/snprintf implementation,
|
||||
# thus newlib-nano implementation from the toolchain has been used.
|
||||
if(CONFIG_IDF_TARGET_ESP32H2)
|
||||
if(CONFIG_IDF_TARGET_ESP32H2 OR CONFIG_IDF_TARGET_ESP32C61)
|
||||
target_link_libraries(${COMPONENT_LIB} INTERFACE "--specs=nano.specs")
|
||||
endif()
|
||||
|
||||
|
||||
@@ -130,7 +130,7 @@ int __cxa_thread_atexit(void (*func)(void *), void *arg, void *dso)
|
||||
return 0;
|
||||
}
|
||||
|
||||
#if CONFIG_IDF_TARGET_ESP32H2
|
||||
#if CONFIG_IDF_TARGET_ESP32H2 || CONFIG_IDF_TARGET_ESP32C61
|
||||
void *_sbrk(ptrdiff_t incr)
|
||||
{
|
||||
return (void *) -1;
|
||||
|
||||
@@ -8,13 +8,23 @@
|
||||
#include "esp_fault.h"
|
||||
#include "soc/soc_caps.h"
|
||||
|
||||
#include "hal/sha_hal.h"
|
||||
#if SOC_AES_SUPPORTED
|
||||
#include "aes/esp_aes.h"
|
||||
#endif
|
||||
#if SOC_SHA_SUPPORTED
|
||||
#include "hal/sha_hal.h"
|
||||
#include "sha/sha_core.h"
|
||||
#endif
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
#include "esp_hmac.h"
|
||||
#endif
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
#include "esp_ds.h"
|
||||
#include "esp_crypto_periph_clk.h"
|
||||
#endif
|
||||
#if SOC_ECC_SUPPORTED
|
||||
#include "ecc_impl.h"
|
||||
#endif
|
||||
#include "esp_crypto_periph_clk.h"
|
||||
|
||||
#include "esp_tee.h"
|
||||
#include "esp_tee_memory_utils.h"
|
||||
@@ -32,6 +42,7 @@ void _ss_invalid_secure_service(void)
|
||||
|
||||
/* ---------------------------------------------- AES ------------------------------------------------- */
|
||||
|
||||
#if SOC_AES_SUPPORTED
|
||||
void _ss_esp_aes_intr_alloc(void)
|
||||
{
|
||||
esp_tee_aes_intr_alloc();
|
||||
@@ -144,9 +155,11 @@ int _ss_esp_aes_crypt_ofb(esp_aes_context *ctx,
|
||||
|
||||
return esp_aes_crypt_ofb(ctx, length, iv_off, iv, input, output);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- SHA ------------------------------------------------- */
|
||||
|
||||
#if SOC_SHA_SUPPORTED
|
||||
void _ss_esp_sha(esp_sha_type sha_type, const unsigned char *input, size_t ilen, unsigned char *output)
|
||||
{
|
||||
bool valid_addr = ((esp_tee_ptr_in_ree((void *)input) && esp_tee_ptr_in_ree((void *)output)) &&
|
||||
@@ -209,9 +222,11 @@ int _ss_esp_sha_512_t_init_hash(uint16_t t)
|
||||
return esp_sha_512_t_init_hash(t);
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- HMAC ------------------------------------------------- */
|
||||
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
esp_err_t _ss_esp_hmac_calculate(hmac_key_id_t key_id, const void *message, size_t message_len, uint8_t *hmac)
|
||||
{
|
||||
bool valid_addr = ((esp_tee_ptr_in_ree((void *)message) && esp_tee_ptr_in_ree((void *)hmac)) &&
|
||||
@@ -251,7 +266,9 @@ esp_err_t _ss_esp_hmac_jtag_disable(void)
|
||||
{
|
||||
return esp_hmac_jtag_disable();
|
||||
}
|
||||
#endif
|
||||
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
esp_err_t _ss_esp_ds_sign(const void *message,
|
||||
const esp_ds_data_t *data,
|
||||
hmac_key_id_t key_id,
|
||||
@@ -333,16 +350,20 @@ esp_err_t _ss_esp_ds_encrypt_params(esp_ds_data_t *data,
|
||||
|
||||
return esp_ds_encrypt_params(data, iv, p_data, key);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- MPI ------------------------------------------------- */
|
||||
|
||||
#if SOC_MPI_SUPPORTED
|
||||
void _ss_esp_crypto_mpi_enable_periph_clk(bool enable)
|
||||
{
|
||||
esp_crypto_mpi_enable_periph_clk(enable);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- ECC ------------------------------------------------- */
|
||||
|
||||
#if SOC_ECC_SUPPORTED
|
||||
int _ss_esp_ecc_point_multiply(const ecc_point_t *point, const uint8_t *scalar, ecc_point_t *result, bool verify_first)
|
||||
{
|
||||
bool valid_addr = (esp_tee_ptr_in_ree((void *)result)) &&
|
||||
@@ -360,11 +381,14 @@ int _ss_esp_ecc_point_verify(const ecc_point_t *point)
|
||||
{
|
||||
return esp_ecc_point_verify(point);
|
||||
}
|
||||
#endif
|
||||
|
||||
#if SOC_ECC_SUPPORTED && SOC_ECDSA_SUPPORTED
|
||||
void _ss_esp_crypto_ecc_enable_periph_clk(bool enable)
|
||||
{
|
||||
esp_crypto_ecc_enable_periph_clk(enable);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------- OTA ------------------------------------------------- */
|
||||
|
||||
|
||||
@@ -3,4 +3,4 @@ dependencies:
|
||||
espressif/json_generator:
|
||||
version: "^1.1.2"
|
||||
rules:
|
||||
- if: "target in [esp32c6, esp32h2, esp32c5]"
|
||||
- if: "target in [esp32c6, esp32h2, esp32c5, esp32c61]"
|
||||
|
||||
@@ -16,9 +16,15 @@ extern "C" {
|
||||
|
||||
FORCE_INLINE_ATTR bool esp_tee_ptr_in_ree(const void *p)
|
||||
{
|
||||
return (((intptr_t)p >= SOC_NS_IDRAM_START && (intptr_t)p < SOC_NS_IDRAM_END) ||
|
||||
((intptr_t)p >= (size_t)esp_tee_app_config.ns_drom_start && (intptr_t)p < SOC_S_MMU_MMAP_RESV_START_VADDR) ||
|
||||
((intptr_t)p >= SOC_RTC_DATA_LOW && (intptr_t)p < SOC_RTC_DATA_HIGH));
|
||||
intptr_t addr = (intptr_t)p;
|
||||
return (
|
||||
(addr >= SOC_NS_IDRAM_START && addr < SOC_NS_IDRAM_END) ||
|
||||
(addr >= (intptr_t)esp_tee_app_config.ns_drom_start &&
|
||||
addr < SOC_S_MMU_MMAP_RESV_START_VADDR)
|
||||
#if SOC_RTC_MEM_SUPPORTED
|
||||
|| (addr >= SOC_RTC_DATA_LOW && addr < SOC_RTC_DATA_HIGH)
|
||||
#endif
|
||||
);
|
||||
}
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
||||
@@ -32,12 +32,7 @@
|
||||
* should be stored via esp_app_tee_config structure
|
||||
*/
|
||||
|
||||
#if CONFIG_ESP_DEBUG_INCLUDE_OCD_STUB_BINS
|
||||
PROVIDE ( esp_tee_app_config = SRAM_REE_SEG_START + 0x22b0 );
|
||||
#else
|
||||
PROVIDE ( esp_tee_app_config = SRAM_REE_SEG_START + 0x2b0 );
|
||||
#endif
|
||||
|
||||
PROVIDE ( GDMA = 0x60080000 );
|
||||
|
||||
/* SPI Flash functions required from the ROM (refer esp32c5.rom.spiflash.ld) */
|
||||
@@ -101,9 +96,9 @@ SECTIONS
|
||||
/* HAL */
|
||||
*libhal.a:mmu_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:cache_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:wdt_hal_iram.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:apm_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_mspi.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_wdt.a:*(.literal .text .literal.* .text.*)
|
||||
/* IDF components */
|
||||
*libbootloader_support.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hw_support.a:*(.literal .text .literal.* .text.*)
|
||||
|
||||
@@ -101,9 +101,9 @@ SECTIONS
|
||||
/* HAL */
|
||||
*libhal.a:mmu_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:cache_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:wdt_hal_iram.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:apm_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_mspi.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_wdt.a:*(.literal .text .literal.* .text.*)
|
||||
/* IDF components */
|
||||
*libbootloader_support.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hw_support.a:*(.literal .text .literal.* .text.*)
|
||||
|
||||
216
components/esp_tee/subproject/main/ld/esp32c61/esp_tee.ld.in
Normal file
216
components/esp_tee/subproject/main/ld/esp32c61/esp_tee.ld.in
Normal file
@@ -0,0 +1,216 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
|
||||
#include "sdkconfig.h"
|
||||
#include "ld.common"
|
||||
|
||||
#define SRAM_TEE_SEG_START (0x40800000)
|
||||
#define SRAM_REE_SEG_START (SRAM_TEE_SEG_START + CONFIG_SECURE_TEE_IRAM_SIZE + CONFIG_SECURE_TEE_DRAM_SIZE)
|
||||
|
||||
#define SRAM_TEE_DRAM_SIZE (CONFIG_SECURE_TEE_DRAM_SIZE - CONFIG_SECURE_TEE_STACK_SIZE - CONFIG_SECURE_TEE_INTR_STACK_SIZE)
|
||||
#define SRAM_TEE_DRAM_END (SRAM_TEE_SEG_START + CONFIG_SECURE_TEE_IRAM_SIZE + SRAM_TEE_DRAM_SIZE)
|
||||
|
||||
#define SRAM_TEE_SEG_SIZE (CONFIG_SECURE_TEE_IRAM_SIZE + SRAM_TEE_DRAM_SIZE)
|
||||
|
||||
/* TEE interrupt stack is placed at the end of the TEE DRAM segment.
|
||||
* The top of the TEE stack is before the end of interrupt stack
|
||||
* and the bottom of the stack is at _heap_end.
|
||||
*/
|
||||
#define SRAM_TEE_STACK_SEG_START (SRAM_TEE_DRAM_END)
|
||||
#define SRAM_TEE_INTR_STACK_SEG_START (SRAM_TEE_DRAM_END + CONFIG_SECURE_TEE_STACK_SIZE)
|
||||
|
||||
#define FLASH_TEE_SEG_START (0x42000000)
|
||||
#define FLASH_TEE_SEG_SIZE (CONFIG_SECURE_TEE_IROM_SIZE + CONFIG_SECURE_TEE_DROM_SIZE)
|
||||
|
||||
/**
|
||||
* These values are the same in every app binary for the same chip target.
|
||||
*
|
||||
* Values that may change when the app is rebuilt, or in a new ESP-IDF version,
|
||||
* should be stored via esp_app_tee_config structure
|
||||
*/
|
||||
|
||||
PROVIDE ( esp_tee_app_config = SRAM_REE_SEG_START + 0x2b0 );
|
||||
PROVIDE ( GDMA = 0x60080000 );
|
||||
|
||||
/* SPI Flash functions required from the ROM (refer esp32c61.rom.spiflash.ld) */
|
||||
PROVIDE ( spi_flash_check_and_flush_cache = 0x40000230 );
|
||||
PROVIDE ( spi_flash_chip_generic_config_host_io_mode = 0x400002d4 );
|
||||
PROVIDE ( memspi_host_flush_cache = 0x40000318 );
|
||||
|
||||
/* Default entry point: */
|
||||
ENTRY(esp_tee_init);
|
||||
|
||||
MEMORY
|
||||
{
|
||||
/* Flash text section */
|
||||
irom_tee_seg (RX): org = FLASH_TEE_SEG_START + 0x20, len = FLASH_TEE_SEG_SIZE - 0x20
|
||||
|
||||
/* Flash data section */
|
||||
drom_tee_seg (R) : org = FLASH_TEE_SEG_START + 0x20, len = FLASH_TEE_SEG_SIZE - 0x20
|
||||
|
||||
/* I/DRAM section */
|
||||
sram_tee_seg (RWX) : org = SRAM_TEE_SEG_START, len = SRAM_TEE_SEG_SIZE
|
||||
|
||||
/* Stack section */
|
||||
stack_tee_seg (RW) : org = SRAM_TEE_STACK_SEG_START, len = CONFIG_SECURE_TEE_STACK_SIZE
|
||||
|
||||
/* Interrupt stack section */
|
||||
intr_stack_tee_seg (RW) : org = SRAM_TEE_INTR_STACK_SEG_START, len = CONFIG_SECURE_TEE_INTR_STACK_SIZE
|
||||
}
|
||||
|
||||
SECTIONS
|
||||
{
|
||||
.iram.tee.text :
|
||||
{
|
||||
/* Vectors go to start of IRAM */
|
||||
ASSERT(ABSOLUTE(.) % 0x100 == 0, "vector address must be 256 byte aligned");
|
||||
_tee_vec_start = ABSOLUTE(.);
|
||||
KEEP(*(.exception_vectors_table.text));
|
||||
KEEP(*(.exception_vectors.text));
|
||||
ALIGNED_SYMBOL(4, _invalid_pc_placeholder)
|
||||
_tee_vec_end = ABSOLUTE(.);
|
||||
|
||||
/* Code marked as running out of IRAM */
|
||||
_tee_iram_start = ABSOLUTE(.);
|
||||
*(.iram1 .iram1.*)
|
||||
/* TEE initialization */
|
||||
*libmain.a:esp_tee_init.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_tee_secure_sys_cfg.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_tee_pmp_pma_prot_cfg.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_tee_apm_prot_cfg.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:brownout.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:multi_heap.c*(.literal .text .literal.* .text.*)
|
||||
/* Panic handler */
|
||||
*libmain.a:esp_tee_panic.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:panic_helper_riscv.c*(.literal .text .literal.* .text.*)
|
||||
/* Service call execution */
|
||||
*libmain.a:esp_tee_vectors_clic.S*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_secure_dispatcher.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_secure_services_iram.c*(.literal .text .literal.* .text.*)
|
||||
/* Interrupt configuration */
|
||||
*libmain.a:esp_tee_intr.c*(.literal .text .literal.* .text.*)
|
||||
*libmain.a:esp_tee_apm_intr.c*(.literal .text .literal.* .text.*)
|
||||
/* HAL */
|
||||
*libhal.a:mmu_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:cache_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:apm_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_mspi.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_wdt.a:*(.literal .text .literal.* .text.*)
|
||||
/* IDF components */
|
||||
*libbootloader_support.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hw_support.a:*(.literal .text .literal.* .text.*)
|
||||
*liblog.a:*(.literal .text .literal.* .text.*)
|
||||
*libriscv.a:*(.literal .text .literal.* .text.*)
|
||||
/* TEE services: Secure storage, OTA, attestation */
|
||||
*libtee_flash_mgr.a:*(.literal .text .literal.* .text.*)
|
||||
*libtee_sec_storage.a:*(.literal .text .literal.* .text.*)
|
||||
*libtee_ota_ops.a:*(.literal .text .literal.* .text.*)
|
||||
*libtee_attestation.a:*(.literal .text .literal.* .text.*)
|
||||
|
||||
/* Align the end of code region as per PMP region granularity */
|
||||
ALIGNED_SYMBOL(_esp_pmp_align_size, _tee_iram_end)
|
||||
} > sram_tee_seg
|
||||
|
||||
.dram.tee.data :
|
||||
{
|
||||
_tee_dram_start = ABSOLUTE(.);
|
||||
_tee_data_start = ABSOLUTE(.);
|
||||
*(.data .data.*)
|
||||
*(.sdata .sdata.*)
|
||||
*(.dram1 .dram1.*)
|
||||
_tee_data_end = ABSOLUTE(.);
|
||||
} > sram_tee_seg
|
||||
|
||||
.dram.tee.bss (NOLOAD) :
|
||||
{
|
||||
ALIGNED_SYMBOL(8, _tee_bss_start)
|
||||
*(.bss .bss.*)
|
||||
*(.sbss .sbss.*)
|
||||
ALIGNED_SYMBOL(8, _tee_bss_end)
|
||||
} > sram_tee_seg
|
||||
|
||||
.dram.tee.rodata :
|
||||
{
|
||||
_tee_rodata_start = ABSOLUTE(.);
|
||||
/* TEE flash manager */
|
||||
*libtee_flash_mgr.a:*(.rodata .srodata .rodata.* .srodata.*)
|
||||
*libbootloader_support.a:bootloader_flash.*(.rodata .srodata .rodata.* .srodata.*)
|
||||
/* Secure services */
|
||||
*libmain.a:esp_secure_services_iram.c.*(.rodata .srodata .rodata.* .srodata.*)
|
||||
*libmain.a:esp_secure_dispatcher.c.*(.rodata .srodata .rodata.* .srodata.*)
|
||||
/* Panic handler */
|
||||
*libmain.a:panic_helper_riscv.*(.rodata .srodata .rodata.* .srodata.*)
|
||||
*libmain.a:esp_tee_apm_intr.c.*(.rodata .srodata .rodata.* .srodata.*)
|
||||
/* HAL (noflash) */
|
||||
*libhal.a:mmu_hal.c*(.rodata .srodata .rodata.* .srodata.*)
|
||||
*libhal.a:cache_hal.c*(.rodata .srodata .rodata.* .srodata.*)
|
||||
*libesp_hal_mspi.a:*(.rodata .srodata .rodata.* .srodata.*)
|
||||
_tee_rodata_end = ABSOLUTE(.);
|
||||
_tee_dram_end = ABSOLUTE(.);
|
||||
} > sram_tee_seg
|
||||
|
||||
.dram.tee.heap (NOLOAD): ALIGN(0x10)
|
||||
{
|
||||
_tee_heap_start = ABSOLUTE(.);
|
||||
. = ORIGIN(sram_tee_seg) + LENGTH(sram_tee_seg);
|
||||
_tee_heap_end = ABSOLUTE(.);
|
||||
} > sram_tee_seg
|
||||
|
||||
.dram.tee.stack (NOLOAD): ALIGN(0x10)
|
||||
{
|
||||
_tee_stack_bottom = ABSOLUTE(.);
|
||||
. = ORIGIN(stack_tee_seg) + LENGTH(stack_tee_seg);
|
||||
_tee_stack = ABSOLUTE(.);
|
||||
} > stack_tee_seg
|
||||
|
||||
.dram.tee.intr_stack (NOLOAD): ALIGN(0x10)
|
||||
{
|
||||
_tee_intr_stack_bottom = ABSOLUTE(.);
|
||||
. = ORIGIN(intr_stack_tee_seg) + LENGTH(intr_stack_tee_seg);
|
||||
_tee_intr_stack = ABSOLUTE(.);
|
||||
} > intr_stack_tee_seg
|
||||
|
||||
|
||||
.flash.tee.rodata : ALIGN(0x10)
|
||||
{
|
||||
_tee_flash_data_start = ABSOLUTE(.);
|
||||
*(.rodata_desc .rodata_desc.*) /* Should be the first. TEE App version info. DO NOT PUT ANYTHING BEFORE IT! */
|
||||
*(.rodata .rodata.*)
|
||||
*(.srodata .srodata.*)
|
||||
*(.gcc_except_table .gcc_except_table.*)
|
||||
_tee_flash_data_end = ABSOLUTE(.);
|
||||
} > drom_tee_seg
|
||||
|
||||
.flash.tee.text_dummy (NOLOAD):
|
||||
{
|
||||
/* Create an empty gap as big as .flash.tee.rodata section */
|
||||
. = ALIGN(ALIGNOF(.flash.tee.rodata)) + SIZEOF(.flash.tee.rodata);
|
||||
/* Add alignment of MMU page size + 0x20 bytes for the mapping header. */
|
||||
. = ALIGN(_esp_mmu_page_size) + 0x20;
|
||||
} > irom_tee_seg
|
||||
|
||||
.flash.tee.text :
|
||||
{
|
||||
_tee_flash_text_start = ABSOLUTE(.);
|
||||
*(.literal .text .literal.* .text.*)
|
||||
*(.stub .gnu.warning .gnu.linkonce.literal.* .gnu.linkonce.t.*.literal .gnu.linkonce.t.*)
|
||||
/**
|
||||
* CPU will try to prefetch up to 16 bytes of of instructions.
|
||||
* This means that any configuration (e.g. MMU, PMS) must allow
|
||||
* safe access to up to 16 bytes after the last real instruction, add
|
||||
* dummy bytes to ensure this
|
||||
*/
|
||||
. += _esp_flash_mmap_prefetch_pad_size;
|
||||
_tee_flash_text_end = ABSOLUTE(.);
|
||||
} > irom_tee_seg
|
||||
|
||||
#include "elf_misc.ld.in"
|
||||
}
|
||||
|
||||
ASSERT ((_tee_iram_end <= _tee_dram_start),
|
||||
"Error: TEE IRAM segment overflowed into the DRAM segment! Increase CONFIG_SECURE_TEE_IRAM_SIZE as required.");
|
||||
ASSERT((_tee_heap_end >= _tee_heap_start + 0x2000),
|
||||
"Error: TEE heap size is too small - minimum is 8KB (0x2000)! Increase CONFIG_SECURE_TEE_DRAM_SIZE as required.");
|
||||
@@ -101,9 +101,9 @@ SECTIONS
|
||||
/* HAL */
|
||||
*libhal.a:mmu_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:cache_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:wdt_hal_iram.c*(.literal .text .literal.* .text.*)
|
||||
*libhal.a:apm_hal.c*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_mspi.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hal_wdt.a:*(.literal .text .literal.* .text.*)
|
||||
/* IDF components */
|
||||
*libbootloader_support.a:*(.literal .text .literal.* .text.*)
|
||||
*libesp_hw_support.a:*(.literal .text .literal.* .text.*)
|
||||
|
||||
@@ -0,0 +1,226 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#include <stdbool.h>
|
||||
|
||||
#include "soc/soc.h"
|
||||
#include "soc/soc_caps.h"
|
||||
#include "soc/spi_mem_c_reg.h"
|
||||
#include "soc/efuse_reg.h"
|
||||
#include "soc/pcr_reg.h"
|
||||
#include "soc/lp_analog_peri_reg.h"
|
||||
#include "soc/lp_wdt_reg.h"
|
||||
|
||||
#include "soc/apm_defs.h"
|
||||
#include "hal/apm_types.h"
|
||||
#include "hal/apm_hal.h"
|
||||
|
||||
#include "esp_log.h"
|
||||
#include "esp_bit_defs.h"
|
||||
#include "esp_tee.h"
|
||||
#include "esp_tee_intr.h"
|
||||
|
||||
extern void tee_apm_violation_isr(void *arg);
|
||||
|
||||
static const char *TAG = "esp_tee_apm_prot_cfg";
|
||||
|
||||
/* NOTE: Figuring out the eFuse protection range based on where the TEE secure storage key is stored */
|
||||
#if CONFIG_SECURE_TEE_SEC_STG_MODE_RELEASE
|
||||
#if CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID < 0
|
||||
#error "TEE: eFuse protection region for APM out of range! (see CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID)"
|
||||
#endif
|
||||
#define LP_APM_EFUSE_REG_START \
|
||||
(EFUSE_RD_KEY0_DATA0_REG + (CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID * 0x20))
|
||||
|
||||
#define LP_APM_EFUSE_REG_END \
|
||||
(EFUSE_RD_KEY1_DATA0_REG + (CONFIG_SECURE_TEE_SEC_STG_EFUSE_HMAC_KEY_ID * 0x20))
|
||||
#elif CONFIG_SECURE_TEE_SEC_STG_MODE_DEVELOPMENT
|
||||
#define LP_APM_EFUSE_REG_START EFUSE_RD_KEY5_DATA0_REG
|
||||
#if CONFIG_SECURE_TEE_TEST_MODE
|
||||
#define LP_APM_EFUSE_REG_END EFUSE_RD_SYS_PART2_DATA0_REG
|
||||
#else
|
||||
#define LP_APM_EFUSE_REG_END LP_APM_EFUSE_REG_START
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* NOTE: Flash protection over the SPI1 controller */
|
||||
#define HP_APM_SPI1_REG_START DR_REG_MSPI1_BASE
|
||||
#if CONFIG_SECURE_TEE_EXT_FLASH_MEMPROT_SPI1
|
||||
#define HP_APM_SPI1_REG_END DR_REG_I2C_BASE
|
||||
#else
|
||||
#define HP_APM_SPI1_REG_END HP_APM_SPI1_REG_START
|
||||
#endif
|
||||
|
||||
/* NOTE: Super-Watchdog and Brownout Detector protection */
|
||||
#define LP_APM_SWD_REG_START (LP_WDT_SWD_CONFIG_REG)
|
||||
#define LP_APM_SWD_REG_END (LP_WDT_INT_CLR_REG)
|
||||
#define LP_APM_BOD_REG_START (LP_ANA_BOD_MODE0_CNTL_REG)
|
||||
#define LP_APM_BOD_REG_END (LP_ANA_LP_INT_CLR_REG)
|
||||
|
||||
/* NOTE: Following are the master IDs for setting the security mode and access through APM:
|
||||
* +---------+-------------+
|
||||
* | Bit | Source |
|
||||
* +---------+-------------+
|
||||
* | 0 | HP CPU |
|
||||
* | 1 | reserved |
|
||||
* | 2 | reserved |
|
||||
* | 3 | SDIO_SLV |
|
||||
* | 4 | reserved |
|
||||
* | 5 | MEM_MONITOR |
|
||||
* | 6 | TRACE |
|
||||
* | 7~15 | reserved |
|
||||
* | 16 | SPI2 |
|
||||
* | 17 | Dummy-1 |
|
||||
* | 18 | UHCI |
|
||||
* | 19 | I2S |
|
||||
* | 20 | Dummy-4 |
|
||||
* | 21 | Dummy-5 |
|
||||
* | 22 | reserved |
|
||||
* | 23 | SHA |
|
||||
* | 24 | ADC |
|
||||
* | 25 | PARLIO |
|
||||
* | 26~31 | Dummy-10~15 |
|
||||
* +---------+-------------+
|
||||
*/
|
||||
|
||||
#define APM_MASTERS_ALL (UINT32_MAX)
|
||||
#define APM_MASTERS_HP_CPU (BIT(APM_MASTER_HPCORE))
|
||||
#define APM_MASTERS_GDMA_CRYPTO (BIT(APM_MASTER_GDMA_SHA))
|
||||
#define APM_MASTERS_TEE (APM_MASTERS_HP_CPU | APM_MASTERS_GDMA_CRYPTO)
|
||||
#define APM_MASTERS_REE (APM_MASTERS_ALL & ~(APM_MASTERS_TEE))
|
||||
|
||||
/*----------------------- REE0 mode configuration -----------------------*/
|
||||
|
||||
/*----------------------- HP_APM configuration -----------------------*/
|
||||
|
||||
/* HP_APM: REE0 mode accessible regions */
|
||||
static apm_hal_ctrl_region_cfg_t hp_apm_regn_cfg_ree0[] = {
|
||||
/* Region 0: CPU peripherals (RW) */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 0, DR_REG_TRACE_BASE, 0x600D0000, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* NOTE: Without this entry, the REE D/IRAM region becomes inaccessible to
|
||||
* the MODEM master, resulting in an APM violation during Wi-Fi initialization.
|
||||
*/
|
||||
/* Region 1: REE SRAM region (RW) - for all other masters */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M1, 1, SOC_NS_IRAM_START, SOC_IRAM_HIGH, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 2: Peripherals [Start - MMU] (RW) */
|
||||
/* Protected: MMU */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 2, SOC_PERIPHERAL_LOW, SPI_MEM_MMU_ITEM_CONTENT_REG(0), APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 3: Peripherals [MMU - SPI1] (RW) */
|
||||
/* Protected: SPI1 */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 3, SPI_MEM_MMU_POWER_CTRL_REG(0), HP_APM_SPI1_REG_START, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 4: Peripherals [SPI1 - Interrupt Matrix] (RW) */
|
||||
/* Protected: Interrupt Matrix */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 4, HP_APM_SPI1_REG_END, DR_REG_INTMTX_BASE, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 5/6/7/8: Peripherals [ETM - PMU] (RW) */
|
||||
/* Protected: SHA, ECC, PCR (SHA, ECC), TEE, HP_APM, CPU_APM */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 5, DR_REG_SOC_ETM_BASE, DR_REG_SHA_BASE, APM_PERM_R | APM_PERM_W, true),
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 6, DR_REG_ECDSA_BASE, PCR_SHA_CONF_REG, APM_PERM_R | APM_PERM_W, true),
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 7, PCR_ECDSA_CONF_REG, DR_REG_TEE_BASE, APM_PERM_R | APM_PERM_W, true),
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M2, 8, 0x6009B000, DR_REG_PMU_BASE, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 9: EXT_MEM region (RW) */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M3, 9, SOC_S_DROM_HIGH, SOC_EXTRAM_DATA_HIGH, APM_PERM_R | APM_PERM_W, true),
|
||||
};
|
||||
|
||||
/* HP_APM: REE0 mode masters' configuration */
|
||||
static apm_hal_ctrl_sec_mode_cfg_t hp_apm_ctrl_sec_mode_cfg_ree0 =
|
||||
APM_HAL_SEC_MODE_CFG(APM_CTRL_HP_APM, APM_SEC_MODE_REE0, hp_apm_regn_cfg_ree0);
|
||||
|
||||
/*----------------------- LP_APM configuration -----------------------*/
|
||||
|
||||
static apm_hal_ctrl_region_cfg_t lp_apm_regn_cfg_ree0[] = {
|
||||
/* Region 0: LP Peripherals [PMU - SWDT] (RW) */
|
||||
/* Protected: SWDT */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 0, DR_REG_PMU_BASE, LP_APM_SWD_REG_START, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 2: LP Peripherals [SWDT - BOD] (RW) */
|
||||
/* Protected: BOD */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 1, LP_APM_SWD_REG_END, LP_APM_BOD_REG_START, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 3: LP Peripherals [BOD - eFuse BLK x] (RW) */
|
||||
/* Protected: eFuse BLK x */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 2, LP_APM_BOD_REG_END, LP_APM_EFUSE_REG_START, APM_PERM_R | APM_PERM_W, true),
|
||||
|
||||
/* Region 4: LP Peripherals [eFuse - END] (RW) */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 3, LP_APM_EFUSE_REG_END, DR_REG_TRACE_BASE, APM_PERM_R | APM_PERM_W, true),
|
||||
};
|
||||
|
||||
/* LP_APM: REE0 mode masters' configuration */
|
||||
static apm_hal_ctrl_sec_mode_cfg_t lp_apm_ctrl_sec_mode_cfg_ree0 =
|
||||
APM_HAL_SEC_MODE_CFG(APM_CTRL_LP_APM, APM_SEC_MODE_REE0, lp_apm_regn_cfg_ree0);
|
||||
|
||||
/*----------------------- CPU_APM configuration -----------------------*/
|
||||
|
||||
/* CPU_APM: REE0 mode accessible regions */
|
||||
static apm_hal_ctrl_region_cfg_t cpu_apm_regn_cfg_ree0[] = {
|
||||
/* Region 0: All SRAM access (RWX) */
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M0, 0, SOC_IRAM_LOW, SOC_DRAM_HIGH, APM_PERM_ALL, true),
|
||||
APM_HAL_REGION_ENTRY(APM_CTRL_ACCESS_PATH_M1, 0, SOC_IRAM_LOW, SOC_DRAM_HIGH, APM_PERM_ALL, true),
|
||||
};
|
||||
|
||||
/* CPU_APM: REE0 mode masters' configuration */
|
||||
static apm_hal_ctrl_sec_mode_cfg_t cpu_apm_ctrl_sec_mode_cfg_ree0 =
|
||||
APM_HAL_SEC_MODE_CFG(APM_CTRL_CPU_APM, APM_SEC_MODE_REE0, cpu_apm_regn_cfg_ree0);
|
||||
|
||||
/*---------------- TEE APM Setup -----------------------*/
|
||||
|
||||
static void enable_apm_intr(apm_ctrl_module_t ctrl_mod, uint32_t path_count)
|
||||
{
|
||||
for (uint32_t i = 0; i < path_count; i++) {
|
||||
apm_hal_ctrl_info_t *ctrl_info = calloc(1, sizeof(apm_hal_ctrl_info_t));
|
||||
assert(ctrl_info != NULL);
|
||||
|
||||
ctrl_info->ctrl_mod = ctrl_mod;
|
||||
ctrl_info->path = i;
|
||||
|
||||
int intr_src_num = apm_hal_get_intr_src_num(ctrl_info);
|
||||
|
||||
struct vector_desc_t apm_vd = {0};
|
||||
apm_vd.source = intr_src_num;
|
||||
apm_vd.isr = tee_apm_violation_isr;
|
||||
apm_vd.arg = (void *)ctrl_info;
|
||||
|
||||
/* Register interrupt handler with TEE. */
|
||||
esp_tee_intr_register((void *)&apm_vd);
|
||||
|
||||
/* Enable APM Ctrl interrupt for access path(M[0:n]) */
|
||||
apm_hal_clear_exception_status(ctrl_info);
|
||||
apm_hal_enable_intr(ctrl_info, true);
|
||||
}
|
||||
}
|
||||
|
||||
void esp_tee_configure_apm_protection(void)
|
||||
{
|
||||
/* Disable all control filter first to have full access of address rage. */
|
||||
apm_hal_enable_ctrl_filter_all(false);
|
||||
|
||||
/* HP_APM REE0 configuration. */
|
||||
apm_hal_set_ctrl_sec_mode_cfg(&hp_apm_ctrl_sec_mode_cfg_ree0);
|
||||
/* HP_APM interrupt configuration. */
|
||||
enable_apm_intr(APM_CTRL_HP_APM, APM_CTRL_HP_APM_PATH_NUM);
|
||||
ESP_LOGD(TAG, "[HP_APM] Configured for REE0");
|
||||
|
||||
/* LP_APM REE0 configuration. */
|
||||
apm_hal_set_ctrl_sec_mode_cfg(&lp_apm_ctrl_sec_mode_cfg_ree0);
|
||||
/* LP_APM interrupt configuration. */
|
||||
enable_apm_intr(APM_CTRL_LP_APM, APM_CTRL_LP_APM_PATH_NUM);
|
||||
ESP_LOGD(TAG, "[LP_APM] Configured for REE0");
|
||||
|
||||
/* CPU_APM REE0 configuration. */
|
||||
apm_hal_set_ctrl_sec_mode_cfg(&cpu_apm_ctrl_sec_mode_cfg_ree0);
|
||||
/* CPU_APM interrupt configuration. */
|
||||
enable_apm_intr(APM_CTRL_CPU_APM, APM_CTRL_CPU_APM_PATH_NUM);
|
||||
ESP_LOGD(TAG, "[CPU_APM] Configured for REE0");
|
||||
|
||||
/* Switch HP_CPU to TEE mode and rest of the masters to REE0 mode */
|
||||
apm_hal_set_master_sec_mode(APM_MASTERS_TEE, APM_SEC_MODE_TEE);
|
||||
apm_hal_set_master_sec_mode(APM_MASTERS_REE, APM_SEC_MODE_REE0);
|
||||
apm_hal_lock_master_sec_mode(APM_MASTERS_ALL);
|
||||
}
|
||||
@@ -0,0 +1,159 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#include <stdint.h>
|
||||
#include "sdkconfig.h"
|
||||
#include "soc/soc.h"
|
||||
#include "soc/ext_mem_defs.h"
|
||||
#include "esp_cpu.h"
|
||||
#include "esp_fault.h"
|
||||
#include "esp32c61/rom/rom_layout.h"
|
||||
#include "esp_tee.h"
|
||||
|
||||
#define IS_PMA_ENTRY_UNLOCKED(ENTRY) \
|
||||
((RV_READ_CSR((CSR_PMACFG0) + (ENTRY)) & PMA_L) == 0)
|
||||
|
||||
static void esp_cpu_configure_invalid_regions(void)
|
||||
{
|
||||
const unsigned PMA_NONE = PMA_L | PMA_EN;
|
||||
__attribute__((unused)) const unsigned PMA_RW = PMA_L | PMA_EN | PMA_R | PMA_W;
|
||||
__attribute__((unused)) const unsigned PMA_RX = PMA_L | PMA_EN | PMA_R | PMA_X;
|
||||
__attribute__((unused)) const unsigned PMA_RWX = PMA_L | PMA_EN | PMA_R | PMA_W | PMA_X;
|
||||
|
||||
// ROM uses some PMA entries, so we need to clear them before using them in ESP-IDF
|
||||
|
||||
// 0. Gap at bottom of address space
|
||||
PMA_RESET_AND_ENTRY_SET_NAPOT(0, 0, SOC_CPU_SUBSYSTEM_LOW, PMA_NAPOT | PMA_NONE);
|
||||
|
||||
// 1. Gap between debug region & IROM
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(1, SOC_CPU_SUBSYSTEM_HIGH, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(2, SOC_IROM_MASK_LOW, PMA_TOR | PMA_NONE);
|
||||
|
||||
// 3. Gap between ROM & RAM
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(3, SOC_DROM_MASK_HIGH, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(4, SOC_IRAM_LOW, PMA_TOR | PMA_NONE);
|
||||
|
||||
// 4. Gap between DRAM and I_Cache
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(5, SOC_IRAM_HIGH, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(6, SOC_IROM_LOW, PMA_TOR | PMA_NONE);
|
||||
|
||||
// 5. ROM has configured the MSPI region with RX permission, we should add W attribute for psram and lock the configuration
|
||||
// This function sets invalid regions but this is a valid memory region configuration that could have
|
||||
// been configured using PMP as well, but due to insufficient PMP entries we are configuring this using PMA.
|
||||
// This entry is also required to be set using PMA because the region needs to be configured as cacheable.
|
||||
PMA_RESET_AND_ENTRY_SET_NAPOT(7, SOC_IROM_LOW, (SOC_IROM_HIGH - SOC_IROM_LOW), PMA_NAPOT | PMA_RWX);
|
||||
|
||||
// 6. Gap between D_Cache & peripheral addresses
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(8, SOC_DROM_HIGH, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(9, SOC_PERIPHERAL_LOW, PMA_TOR | PMA_NONE);
|
||||
|
||||
// 7. End of address space
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(10, SOC_PERIPHERAL_HIGH, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(11, UINT32_MAX, PMA_TOR | PMA_NONE);
|
||||
|
||||
// 8. Using PMA to configure the TEE text and data section access attribute. */
|
||||
PMA_ENTRY_CFG_RESET(12);
|
||||
assert(IS_PMA_ENTRY_UNLOCKED(13));
|
||||
assert(IS_PMA_ENTRY_UNLOCKED(14));
|
||||
assert(IS_PMA_ENTRY_UNLOCKED(15));
|
||||
|
||||
extern int _tee_iram_end;
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(13, SOC_S_IRAM_START, PMA_NONE);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(14, (int)&_tee_iram_end, PMA_TOR | PMA_RX);
|
||||
PMA_RESET_AND_ENTRY_SET_TOR(15, SOC_S_DRAM_END, PMA_TOR | PMA_RW);
|
||||
|
||||
}
|
||||
|
||||
void esp_tee_configure_region_protection(void)
|
||||
{
|
||||
/* Notes on implementation:
|
||||
*
|
||||
* 1) Note: ESP32-C61 CPU support overlapping PMP regions
|
||||
*
|
||||
* 2) ESP32-C61 supports 16 PMA regions so we use this feature to block all the invalid address ranges
|
||||
*
|
||||
* 3) We use combination of NAPOT (Naturally Aligned Power Of Two) and TOR (top of range)
|
||||
* entries to map all the valid address space, bottom to top. This leaves us with some extra PMP entries
|
||||
* which can be used to provide more granular access
|
||||
*
|
||||
* 4) Entries are grouped in order with some static asserts to try and verify everything is
|
||||
* correct.
|
||||
*/
|
||||
const unsigned NONE = PMP_L;
|
||||
const unsigned R = PMP_L | PMP_R;
|
||||
const unsigned RW = PMP_L | PMP_R | PMP_W;
|
||||
const unsigned RX = PMP_L | PMP_R | PMP_X;
|
||||
const unsigned RWX = PMP_L | PMP_R | PMP_W | PMP_X;
|
||||
|
||||
//
|
||||
// Configure all the invalid address regions using PMA
|
||||
//
|
||||
esp_cpu_configure_invalid_regions();
|
||||
|
||||
//
|
||||
// Configure all the valid address regions using PMP
|
||||
//
|
||||
|
||||
// 1. CPU Subsystem region - contains interrupt config registers
|
||||
PMP_ENTRY_CFG_RESET(0);
|
||||
const uint32_t pmpaddr0 = PMPADDR_NAPOT(SOC_CPU_SUBSYSTEM_LOW, SOC_CPU_SUBSYSTEM_HIGH);
|
||||
PMP_ENTRY_SET(0, pmpaddr0, PMP_NAPOT | RWX);
|
||||
_Static_assert(SOC_CPU_SUBSYSTEM_LOW < SOC_CPU_SUBSYSTEM_HIGH, "Invalid CPU subsystem region");
|
||||
|
||||
// 2. I/D-ROM
|
||||
PMP_ENTRY_CFG_RESET(1);
|
||||
PMP_ENTRY_CFG_RESET(2);
|
||||
PMP_ENTRY_CFG_RESET(3);
|
||||
const uint32_t drom_start = (uint32_t)(ets_rom_layout_p->drom_start);
|
||||
if ((drom_start & (SOC_CPU_PMP_REGION_GRANULARITY - 1)) == 0) {
|
||||
PMP_ENTRY_SET(1, SOC_IROM_MASK_LOW, NONE);
|
||||
PMP_ENTRY_SET(2, drom_start, PMP_TOR | RX);
|
||||
PMP_ENTRY_SET(3, SOC_DROM_MASK_HIGH, PMP_TOR | R);
|
||||
} else {
|
||||
PMP_ENTRY_SET(1, SOC_IROM_MASK_LOW, NONE);
|
||||
PMP_ENTRY_SET(2, SOC_IROM_MASK_HIGH, PMP_TOR | RX);
|
||||
_Static_assert(SOC_IROM_MASK_LOW < SOC_IROM_MASK_HIGH, "Invalid I/D-ROM region");
|
||||
}
|
||||
|
||||
// 3. IRAM and DRAM
|
||||
PMP_ENTRY_CFG_RESET(4);
|
||||
PMP_ENTRY_CFG_RESET(5);
|
||||
PMP_ENTRY_CFG_RESET(6);
|
||||
if (esp_cpu_dbgr_is_attached()) {
|
||||
// Anti-FI check that cpu is really in ocd mode
|
||||
ESP_FAULT_ASSERT(esp_cpu_dbgr_is_attached());
|
||||
PMP_ENTRY_SET(4, SOC_IRAM_LOW, NONE);
|
||||
PMP_ENTRY_SET(5, SOC_IRAM_HIGH, PMP_TOR | RWX);
|
||||
_Static_assert(SOC_IRAM_LOW < SOC_IRAM_HIGH, "Invalid RAM region");
|
||||
} else {
|
||||
// REE SRAM (D/IRAM)
|
||||
PMP_ENTRY_SET(4, (int)SOC_NS_IRAM_START, NONE);
|
||||
PMP_ENTRY_SET(5, (int)esp_tee_app_config.ns_iram_end, PMP_TOR | RX);
|
||||
PMP_ENTRY_SET(6, SOC_DRAM_HIGH, PMP_TOR | RW);
|
||||
}
|
||||
|
||||
const uint32_t s_irom_resv_end = SOC_IROM_LOW + CONFIG_SECURE_TEE_IROM_SIZE + CONFIG_SECURE_TEE_DROM_SIZE;
|
||||
const uint32_t ns_irom_resv_end = ALIGN_UP_TO_MMU_PAGE_SIZE((uint32_t)esp_tee_app_config.ns_irom_end);
|
||||
const uint32_t ns_drom_resv_end = ALIGN_UP_TO_MMU_PAGE_SIZE((uint32_t)esp_tee_app_config.ns_drom_end);
|
||||
const uint32_t ns_drom_mmap_end = (uint32_t)(SOC_S_MMU_MMAP_RESV_START_VADDR);
|
||||
|
||||
// 4. I_Cache / D_Cache (flash) - REE
|
||||
PMP_ENTRY_CFG_RESET(7);
|
||||
PMP_ENTRY_CFG_RESET(8);
|
||||
PMP_ENTRY_CFG_RESET(9);
|
||||
PMP_ENTRY_CFG_RESET(10);
|
||||
PMP_ENTRY_SET(7, s_irom_resv_end, NONE);
|
||||
PMP_ENTRY_SET(8, ns_irom_resv_end, PMP_TOR | RX);
|
||||
PMP_ENTRY_SET(9, ns_drom_resv_end, PMP_TOR | R);
|
||||
PMP_ENTRY_SET(10, ns_drom_mmap_end, PMP_TOR | RX);
|
||||
|
||||
// 5. Peripheral addresses
|
||||
PMP_ENTRY_CFG_RESET(11);
|
||||
const uint32_t pmpaddr11 = PMPADDR_NAPOT(SOC_PERIPHERAL_LOW, SOC_PERIPHERAL_HIGH);
|
||||
PMP_ENTRY_SET(11, pmpaddr11, PMP_NAPOT | RW);
|
||||
_Static_assert(SOC_PERIPHERAL_LOW < SOC_PERIPHERAL_HIGH, "Invalid peripheral region");
|
||||
|
||||
//TODO: Add protection for SPIRAM
|
||||
}
|
||||
@@ -0,0 +1,124 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#include <stdarg.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "riscv/rv_utils.h"
|
||||
#include "riscv/encoding.h"
|
||||
|
||||
#include "hal/apm_hal.h"
|
||||
#include "hal/sha_ll.h"
|
||||
#include "hal/ecc_ll.h"
|
||||
#include "hal/ecdsa_ll.h"
|
||||
|
||||
#include "soc/clic_reg.h"
|
||||
#include "soc/interrupts.h"
|
||||
|
||||
#include "esp_tee.h"
|
||||
#include "esp_tee_intr.h"
|
||||
#include "esp_tee_rv_utils.h"
|
||||
|
||||
#include "esp_cpu.h"
|
||||
#include "esp_log.h"
|
||||
|
||||
#define CSR_MCOUNTEREN 0x306
|
||||
|
||||
#define _m2u_switch(arg0, arg1) \
|
||||
({ \
|
||||
register uintptr_t ra asm("ra") = (uintptr_t)(arg0); \
|
||||
register uintptr_t a1 asm("a1") = (uintptr_t)(arg1); \
|
||||
asm volatile("ecall" : :"r"(ra), "r"(a1) : ); \
|
||||
})
|
||||
|
||||
#define SET_BIT(t, n) (t |= (1UL << (n)))
|
||||
#define CLR_BIT(t, n) (t &= ~(1UL << (n)))
|
||||
|
||||
static const char *TAG = "esp_tee_secure_sys_cfg";
|
||||
|
||||
extern uint32_t _vector_table;
|
||||
extern uint32_t _mtvt_table;
|
||||
|
||||
void esp_tee_soc_secure_sys_init(void)
|
||||
{
|
||||
ESP_LOGI(TAG, "Current privilege level - 0x%x", esp_cpu_get_curr_privilege_level());
|
||||
|
||||
/* Setting the M-mode vector table */
|
||||
rv_utils_set_mtvec((uint32_t)&_vector_table);
|
||||
rv_utils_set_mtvt((uint32_t)&_mtvt_table);
|
||||
|
||||
/* Disable global interrupts */
|
||||
RV_CLEAR_CSR(mstatus, MSTATUS_UIE);
|
||||
RV_CLEAR_CSR(mstatus, MSTATUS_MIE);
|
||||
|
||||
/* Enabled support for U-mode interrupts */
|
||||
REG_SET_FIELD(CLIC_INT_CONFIG_REG, CLIC_INT_CONFIG_NMBITS, 0x01);
|
||||
REG_SET_FIELD(CLIC_INT_CONFIG_REG, CLIC_INT_CONFIG_UNLBITS, NLBITS);
|
||||
REG_SET_FIELD(CLIC_INT_CONFIG_REG, CLIC_INT_CONFIG_MNLBITS, NLBITS);
|
||||
|
||||
/* Allow reading the cycle counter CSRs from U-mode */
|
||||
RV_WRITE_CSR(CSR_MCOUNTEREN, 0x07);
|
||||
|
||||
/* Clearing all interrupt configurations */
|
||||
uint32_t core_id = esp_cpu_get_core_id();
|
||||
for (int i = 0; i < ETS_MAX_INTR_SOURCE; i++) {
|
||||
interrupt_clic_ll_route(core_id, i, ETS_INVALID_INUM);
|
||||
REG_CLR_BIT(DR_REG_INTMTX_BASE + 4 * i, BIT(8));
|
||||
}
|
||||
|
||||
/* TODO: IDF-8958
|
||||
* The values for the secure interrupt number and priority and
|
||||
* the interrupt priority threshold (for both M and U mode) need
|
||||
* to be investigated further
|
||||
*/
|
||||
esprv_int_set_threshold(0);
|
||||
|
||||
esprv_int_set_priority(TEE_SECURE_INUM, 7);
|
||||
esprv_int_set_type(TEE_SECURE_INUM, ESP_CPU_INTR_TYPE_LEVEL);
|
||||
esprv_int_enable(BIT(TEE_SECURE_INUM));
|
||||
esprv_int_set_vectored(TEE_SECURE_INUM, true);
|
||||
rv_utils_tee_intr_set_mode(TEE_SECURE_INUM, PRV_M);
|
||||
|
||||
esprv_int_set_priority(TEE_PASS_INUM, 1);
|
||||
esprv_int_set_type(TEE_PASS_INUM, ESP_CPU_INTR_TYPE_LEVEL);
|
||||
esprv_int_enable(BIT(TEE_PASS_INUM));
|
||||
esprv_int_set_vectored(TEE_PASS_INUM, true);
|
||||
rv_utils_tee_intr_set_mode(TEE_PASS_INUM, PRV_M);
|
||||
|
||||
ESP_LOGD(TAG, "Initial interrupt config -");
|
||||
ESP_LOGD(TAG, "mtvec: 0x%08x", RV_READ_CSR(mtvec));
|
||||
ESP_LOGD(TAG, "mtvt: 0x%08x", RV_READ_CSR(MTVT_CSR));
|
||||
ESP_LOGD(TAG, "mstatus: 0x%08x", RV_READ_CSR(mstatus));
|
||||
ESP_LOGD(TAG, "mcounteren: 0x%08x", RV_READ_CSR(CSR_MCOUNTEREN));
|
||||
|
||||
/* PMP, PMA and APM configuration to isolate the resources between TEE and REE. */
|
||||
esp_tee_configure_region_protection();
|
||||
esp_tee_configure_apm_protection();
|
||||
|
||||
/* Protect secure interrupt sources */
|
||||
esp_tee_protect_intr_src(ETS_LP_APM_M0_INTR_SOURCE); // LP_APM_M0
|
||||
esp_tee_protect_intr_src(ETS_HP_APM_M0_INTR_SOURCE); // HP_APM_M0
|
||||
esp_tee_protect_intr_src(ETS_HP_APM_M1_INTR_SOURCE); // HP_APM_M1
|
||||
esp_tee_protect_intr_src(ETS_HP_APM_M2_INTR_SOURCE); // HP_APM_M2
|
||||
esp_tee_protect_intr_src(ETS_HP_APM_M3_INTR_SOURCE); // HP_APM_M3
|
||||
esp_tee_protect_intr_src(ETS_CPU_APM_M0_INTR_SOURCE); // CPU_APM_M0
|
||||
esp_tee_protect_intr_src(ETS_CPU_APM_M1_INTR_SOURCE); // CPU_APM_M1
|
||||
esp_tee_protect_intr_src(ETS_SHA_INTR_SOURCE); // SHA
|
||||
esp_tee_protect_intr_src(ETS_ECC_INTR_SOURCE); // ECC
|
||||
esp_tee_protect_intr_src(ETS_ECDSA_INTR_SOURCE); // ECDSA
|
||||
|
||||
/* Disable protected crypto peripheral clocks; they will be toggled as needed when the peripheral is in use */
|
||||
sha_ll_enable_bus_clock(false);
|
||||
ecc_ll_enable_bus_clock(false);
|
||||
ecdsa_ll_enable_bus_clock(false);
|
||||
}
|
||||
|
||||
IRAM_ATTR inline void esp_tee_switch_to_ree(uint32_t ns_entry_addr)
|
||||
{
|
||||
/* 2nd argument is used as magic value to detect very first M2U switch */
|
||||
/* TBD: clean this up and use proper temporary register instead of a1 */
|
||||
/* Switch to non-secure world and launch App. */
|
||||
_m2u_switch(ns_entry_addr, ESP_TEE_M2U_SWITCH_MAGIC << 12);
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#pragma once
|
||||
|
||||
#include "soc/interrupt_matrix_reg.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
// LP_APM_M0_INTR
|
||||
#define TEE_SECURE_INT_APM_MASK_0 (0x00040000)
|
||||
// HP_APM_M0_INTR, HP_APM_M1_INTR, HP_APM_M2_INTR
|
||||
// HP_APM_M3_INTR, CPU_APM_M0_INTR, CPU_APM_M1_INTR
|
||||
#define TEE_SECURE_INT_APM_MASK_1 (0x0000003F)
|
||||
|
||||
// LP_RTC_TIMER_INTR
|
||||
#define TEE_SECURE_INT_MASK_0 (TEE_SECURE_INT_APM_MASK_0 | 0x00008000)
|
||||
#if !CONFIG_SECURE_TEE_TEST_MODE
|
||||
// SHA_INTR
|
||||
#define TEE_SECURE_INT_MASK_1 (TEE_SECURE_INT_APM_MASK_1 | 0x10000000)
|
||||
#else
|
||||
// + TG0_T0_INTR (only for test mode)
|
||||
#define TEE_SECURE_INT_MASK_1 (TEE_SECURE_INT_APM_MASK_1 | 0x10004000)
|
||||
#endif
|
||||
// ECC_INTR, ECDSA_INTR
|
||||
#define TEE_SECURE_INT_MASK_2 (0x00000003)
|
||||
|
||||
#define INTMTX_STATUS_REG_0 (INTERRUPT_CORE0_INT_STATUS_REG_0_REG)
|
||||
#define INTMTX_STATUS_REG_1 (INTERRUPT_CORE0_INT_STATUS_REG_1_REG)
|
||||
#define INTMTX_STATUS_REG_2 (INTERRUPT_CORE0_INT_STATUS_REG_2_REG)
|
||||
|
||||
#define INTMTX_SEC_STATUS_REG (INTERRUPT_CORE0_SECURE_STATUS_REG)
|
||||
#define INTMTX_SIG_IDX_ASSERT_IN_SEC_REG (INTERRUPT_CORE0_SIG_IDX_ASSERT_IN_SEC_REG)
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
@@ -1,116 +0,0 @@
|
||||
/*
|
||||
* SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
*
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
#pragma once
|
||||
|
||||
#include <stdint.h>
|
||||
#include <assert.h>
|
||||
|
||||
#include "riscv/csr.h"
|
||||
#include "riscv/interrupt.h"
|
||||
|
||||
#include "soc/interrupt_reg.h"
|
||||
#include "soc/plic_reg.h"
|
||||
|
||||
#include "esp_attr.h"
|
||||
#include "esp_tee.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_global_enable(void)
|
||||
{
|
||||
/*
|
||||
* Set the the U-mode previous enable global interrupts state
|
||||
*
|
||||
* NOTE: The TICK interrupt is setup before this service call and thus,
|
||||
* it occurs in the return path of this call.
|
||||
*
|
||||
* Before entering the U-mode interrupt handler routine, USTATUS:UIE is
|
||||
* cleared to disable U-mode interrupts temporarily.
|
||||
*
|
||||
* While exiting the above routine, URET is executed, setting USTATUS:UIE
|
||||
* to the value of USTATUS:UPIE. However, since no interrupts were enabled
|
||||
* previously, USTATUS:UPIE and thus, USTATUS:UIE is cleared.
|
||||
*
|
||||
* The service call completes and returns to U-mode with USTATUS:UIE disabled,
|
||||
* preventing any further interrupts in U-mode.
|
||||
*
|
||||
*/
|
||||
RV_SET_CSR(ustatus, USTATUS_UPIE);
|
||||
/* Enabling the global M-mode and U-mode interrupts */
|
||||
RV_SET_CSR(ustatus, USTATUS_UIE);
|
||||
RV_SET_CSR(mstatus, MSTATUS_UIE);
|
||||
RV_SET_CSR(mstatus, MSTATUS_MIE);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_global_disable(void)
|
||||
{
|
||||
RV_CLEAR_CSR(ustatus, USTATUS_UIE);
|
||||
RV_CLEAR_CSR(mstatus, MSTATUS_UIE);
|
||||
RV_CLEAR_CSR(mstatus, MSTATUS_MIE);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_enable(uint32_t intr_mask)
|
||||
{
|
||||
// Disable all interrupts to make updating of the interrupt mask atomic.
|
||||
unsigned old_xstatus = RV_CLEAR_CSR(mstatus, MSTATUS_MIE);
|
||||
REG_SET_BIT(PLIC_MXINT_ENABLE_REG, intr_mask);
|
||||
REG_SET_BIT(PLIC_UXINT_ENABLE_REG, intr_mask);
|
||||
RV_SET_CSR(mie, intr_mask);
|
||||
RV_SET_CSR(uie, intr_mask);
|
||||
RV_SET_CSR(mstatus, old_xstatus & MSTATUS_MIE);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_disable(uint32_t intr_mask)
|
||||
{
|
||||
// Disable all interrupts to make updating of the interrupt mask atomic.
|
||||
unsigned old_xstatus = RV_CLEAR_CSR(mstatus, MSTATUS_MIE);
|
||||
REG_CLR_BIT(PLIC_MXINT_ENABLE_REG, intr_mask);
|
||||
REG_CLR_BIT(PLIC_UXINT_ENABLE_REG, intr_mask);
|
||||
RV_CLEAR_CSR(mie, intr_mask);
|
||||
RV_CLEAR_CSR(uie, intr_mask);
|
||||
RV_SET_CSR(mstatus, old_xstatus & MSTATUS_MIE);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_set_type(int intr_num, enum intr_type type)
|
||||
{
|
||||
assert(intr_num >= 0 && intr_num < SOC_CPU_INTR_NUM);
|
||||
|
||||
if (type == INTR_TYPE_LEVEL) {
|
||||
REG_CLR_BIT(PLIC_MXINT_TYPE_REG, BIT(intr_num));
|
||||
REG_CLR_BIT(PLIC_UXINT_TYPE_REG, BIT(intr_num));
|
||||
} else {
|
||||
REG_SET_BIT(PLIC_MXINT_TYPE_REG, BIT(intr_num));
|
||||
REG_SET_BIT(PLIC_UXINT_TYPE_REG, BIT(intr_num));
|
||||
}
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_set_priority(int rv_int_num, int priority)
|
||||
{
|
||||
assert(rv_int_num >= 0 && rv_int_num < SOC_CPU_INTR_NUM);
|
||||
|
||||
REG_WRITE(PLIC_MXINT_PRI_REG(rv_int_num), priority);
|
||||
REG_WRITE(PLIC_UXINT_PRI_REG(rv_int_num), priority);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_set_threshold(int priority_threshold)
|
||||
{
|
||||
REG_WRITE(PLIC_MXINT_THRESH_REG, priority_threshold);
|
||||
REG_WRITE(PLIC_UXINT_THRESH_REG, priority_threshold);
|
||||
}
|
||||
|
||||
FORCE_INLINE_ATTR void rv_utils_tee_intr_edge_ack(int intr_num)
|
||||
{
|
||||
assert(intr_num >= 0 && intr_num < SOC_CPU_INTR_NUM);
|
||||
|
||||
REG_SET_BIT(PLIC_MXINT_CLEAR_REG, BIT(intr_num));
|
||||
REG_SET_BIT(PLIC_UXINT_CLEAR_REG, BIT(intr_num));
|
||||
}
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
@@ -21,6 +21,12 @@
|
||||
|
||||
static const char *TAG __attribute__((unused)) = "esp_tee_intr_test";
|
||||
|
||||
#if CONFIG_IDF_TARGET_ESP32C61
|
||||
#define TIMER_INTR_SRC ETS_TG0_T0_INTR_SOURCE
|
||||
#else
|
||||
#define TIMER_INTR_SRC ETS_TG0_T0_LEVEL_INTR_SOURCE
|
||||
#endif
|
||||
|
||||
/* ---------------------------------------------------- Utility functions ---------------------------------------------------- */
|
||||
|
||||
#define TEST_TIMER_GROUP (0)
|
||||
@@ -63,7 +69,7 @@ static void test_timer_deinit(void)
|
||||
|
||||
// Deregister ISR
|
||||
struct vector_desc_t timer_vd = {
|
||||
.source = ETS_TG0_T0_LEVEL_INTR_SOURCE,
|
||||
.source = TIMER_INTR_SRC,
|
||||
};
|
||||
esp_tee_intr_deregister((void *)&timer_vd);
|
||||
timer_ll_enable_clock(TEST_TIMER_GROUP, timer_id, false);
|
||||
@@ -90,7 +96,7 @@ static void test_timer_init(volatile uint32_t *arg)
|
||||
|
||||
// Register ISR
|
||||
struct vector_desc_t timer_vd = {
|
||||
.source = ETS_TG0_T0_LEVEL_INTR_SOURCE,
|
||||
.source = TIMER_INTR_SRC,
|
||||
.isr = test_timer_isr,
|
||||
.arg = (void *)arg,
|
||||
};
|
||||
|
||||
@@ -22,20 +22,25 @@ endif()
|
||||
set(mbedtls_test_srcs_dir "${idf_path}/components/mbedtls/test_apps/main")
|
||||
|
||||
# AES
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_aes.c"
|
||||
"${mbedtls_test_srcs_dir}/test_aes_gcm.c"
|
||||
"${mbedtls_test_srcs_dir}/test_aes_perf.c")
|
||||
if(CONFIG_SOC_AES_SUPPORTED)
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_aes.c"
|
||||
"${mbedtls_test_srcs_dir}/test_aes_gcm.c"
|
||||
"${mbedtls_test_srcs_dir}/test_aes_perf.c")
|
||||
endif()
|
||||
# SHA
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_mbedtls_sha.c"
|
||||
"${mbedtls_test_srcs_dir}/test_sha.c"
|
||||
"${mbedtls_test_srcs_dir}/test_sha_perf.c")
|
||||
|
||||
if(CONFIG_SOC_SHA_SUPPORTED)
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_mbedtls_sha.c"
|
||||
"${mbedtls_test_srcs_dir}/test_sha.c"
|
||||
"${mbedtls_test_srcs_dir}/test_sha_perf.c")
|
||||
endif()
|
||||
# Mixed
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_aes_sha_parallel.c")
|
||||
|
||||
if(CONFIG_SOC_AES_SUPPORTED AND CONFIG_SOC_SHA_SUPPORTED)
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_aes_sha_parallel.c")
|
||||
endif()
|
||||
# ECC
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_ecp.c")
|
||||
|
||||
if(CONFIG_SOC_ECC_SUPPORTED)
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_ecp.c")
|
||||
endif()
|
||||
# Utility
|
||||
list(APPEND srcs "${mbedtls_test_srcs_dir}/test_apb_dport_access.c"
|
||||
"${mbedtls_test_srcs_dir}/test_mbedtls_utils.c")
|
||||
|
||||
@@ -4,9 +4,17 @@
|
||||
* SPDX-License-Identifier: Apache-2.0
|
||||
*/
|
||||
|
||||
#include "soc/soc_caps.h"
|
||||
|
||||
#if SOC_AES_SUPPORTED
|
||||
#include "soc/aes_reg.h"
|
||||
#endif
|
||||
#if SOC_HMAC_SUPPORTED
|
||||
#include "soc/hmac_reg.h"
|
||||
#endif
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
#include "soc/ds_reg.h"
|
||||
#endif
|
||||
#include "soc/efuse_reg.h"
|
||||
#include "soc/pcr_reg.h"
|
||||
#include "soc/lp_analog_peri_reg.h"
|
||||
@@ -52,6 +60,7 @@ TEST_CASE("Test APM violation: MMU", "[apm_violation]")
|
||||
TEST_FAIL_MESSAGE("APM violation should have been generated");
|
||||
}
|
||||
|
||||
#if SOC_AES_SUPPORTED
|
||||
TEST_CASE("Test APM violation: AES", "[apm_violation]")
|
||||
{
|
||||
uint32_t val = UINT32_MAX;
|
||||
@@ -59,7 +68,9 @@ TEST_CASE("Test APM violation: AES", "[apm_violation]")
|
||||
TEST_ASSERT_EQUAL(0, val);
|
||||
TEST_FAIL_MESSAGE("APM violation should have been generated");
|
||||
}
|
||||
#endif
|
||||
|
||||
#if SOC_AES_SUPPORTED
|
||||
TEST_CASE("Test APM violation: HMAC", "[apm_violation]")
|
||||
{
|
||||
uint32_t val = UINT32_MAX;
|
||||
@@ -67,7 +78,9 @@ TEST_CASE("Test APM violation: HMAC", "[apm_violation]")
|
||||
TEST_ASSERT_EQUAL(0, val);
|
||||
TEST_FAIL_MESSAGE("APM violation should have been generated");
|
||||
}
|
||||
#endif
|
||||
|
||||
#if SOC_DIG_SIGN_SUPPORTED
|
||||
TEST_CASE("Test APM violation: DS", "[apm_violation]")
|
||||
{
|
||||
uint32_t val = UINT32_MAX;
|
||||
@@ -75,6 +88,7 @@ TEST_CASE("Test APM violation: DS", "[apm_violation]")
|
||||
TEST_ASSERT_EQUAL(0, val);
|
||||
TEST_FAIL_MESSAGE("APM violation should have been generated");
|
||||
}
|
||||
#endif
|
||||
|
||||
TEST_CASE("Test APM violation: SHA PCR", "[apm_violation]")
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user