refactor(esp_tee): Migrate secure services list from TBL to YAML
This commit is contained in:
Laukik Hase
@@ -0,0 +1,212 @@
|
||||
secure_services:
|
||||
- family: misc
|
||||
entries:
|
||||
- id: 0
|
||||
type: custom
|
||||
function: invalid_secure_service
|
||||
args: 0
|
||||
# ID: 1-4 (4) - External memory (Flash) protection [SPI0]
|
||||
- family: flash_protection_spi0
|
||||
entries:
|
||||
- id: 1
|
||||
type: IDF
|
||||
function: mmu_hal_map_region
|
||||
args: 6
|
||||
- id: 2
|
||||
type: IDF
|
||||
function: mmu_hal_unmap_region
|
||||
args: 3
|
||||
- id: 3
|
||||
type: IDF
|
||||
function: mmu_hal_vaddr_to_paddr
|
||||
args: 4
|
||||
- id: 4
|
||||
type: IDF
|
||||
function: mmu_hal_paddr_to_vaddr
|
||||
args: 5
|
||||
# ID: 30-53 (24) - Interrupt Handling
|
||||
- family: interrupt_handling
|
||||
entries:
|
||||
- id: 30
|
||||
type: IDF
|
||||
function: esp_rom_route_intr_matrix
|
||||
args: 3
|
||||
- id: 31
|
||||
type: IDF
|
||||
function: rv_utils_intr_enable
|
||||
args: 1
|
||||
- id: 32
|
||||
type: IDF
|
||||
function: rv_utils_intr_disable
|
||||
args: 1
|
||||
- id: 33
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_priority
|
||||
args: 2
|
||||
- id: 34
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_type
|
||||
args: 2
|
||||
- id: 35
|
||||
type: IDF
|
||||
function: rv_utils_intr_set_threshold
|
||||
args: 1
|
||||
- id: 36
|
||||
type: IDF
|
||||
function: rv_utils_intr_edge_ack
|
||||
args: 1
|
||||
- id: 37
|
||||
type: IDF
|
||||
function: rv_utils_intr_global_enable
|
||||
args: 0
|
||||
# ID: 54-85 (32) - HAL
|
||||
- family: hal
|
||||
entries:
|
||||
- id: 54
|
||||
type: IDF
|
||||
function: efuse_hal_chip_revision
|
||||
args: 0
|
||||
- id: 55
|
||||
type: IDF
|
||||
function: efuse_hal_get_chip_ver_pkg
|
||||
args: 1
|
||||
- id: 56
|
||||
type: IDF
|
||||
function: efuse_hal_get_disable_wafer_version_major
|
||||
args: 0
|
||||
- id: 57
|
||||
type: IDF
|
||||
function: efuse_hal_get_mac
|
||||
args: 1
|
||||
- id: 58
|
||||
type: IDF
|
||||
function: wdt_hal_init
|
||||
args: 4
|
||||
- id: 59
|
||||
type: IDF
|
||||
function: wdt_hal_deinit
|
||||
args: 1
|
||||
# ID: 86-133 (48) - Crypto
|
||||
- family: crypto
|
||||
entries:
|
||||
- id: 86
|
||||
type: IDF
|
||||
function: esp_aes_intr_alloc
|
||||
args: 0
|
||||
- id: 87
|
||||
type: IDF
|
||||
function: esp_aes_crypt_cbc
|
||||
args: 6
|
||||
- id: 88
|
||||
type: IDF
|
||||
function: esp_aes_crypt_cfb8
|
||||
args: 6
|
||||
- id: 89
|
||||
type: IDF
|
||||
function: esp_aes_crypt_cfb128
|
||||
args: 7
|
||||
- id: 90
|
||||
type: IDF
|
||||
function: esp_aes_crypt_ctr
|
||||
args: 7
|
||||
- id: 91
|
||||
type: IDF
|
||||
function: esp_aes_crypt_ecb
|
||||
args: 4
|
||||
- id: 92
|
||||
type: IDF
|
||||
function: esp_aes_crypt_ofb
|
||||
args: 6
|
||||
- id: 93
|
||||
type: IDF
|
||||
function: esp_sha
|
||||
args: 4
|
||||
- id: 94
|
||||
type: IDF
|
||||
function: esp_sha_block
|
||||
args: 3
|
||||
- id: 95
|
||||
type: IDF
|
||||
function: esp_sha_dma
|
||||
args: 6
|
||||
- id: 96
|
||||
type: IDF
|
||||
function: esp_sha_read_digest_state
|
||||
args: 2
|
||||
- id: 97
|
||||
type: IDF
|
||||
function: esp_sha_write_digest_state
|
||||
args: 2
|
||||
# ID: 134-149 (16) - eFuse
|
||||
- family: efuse
|
||||
entries:
|
||||
- id: 134
|
||||
type: IDF
|
||||
function: esp_efuse_check_secure_version
|
||||
args: 1
|
||||
- id: 135
|
||||
type: IDF
|
||||
function: esp_efuse_read_field_blob
|
||||
args: 3
|
||||
- id: 136
|
||||
type: IDF
|
||||
function: esp_flash_encryption_enabled
|
||||
args: 0
|
||||
# ID: 150-169 (20) - Reserved for future use
|
||||
- family: attestation
|
||||
entries:
|
||||
- id: 170
|
||||
type: custom
|
||||
function: esp_tee_att_generate_token
|
||||
args: 6
|
||||
# ID: 175-194 (20) - Secure Storage
|
||||
- family: secure_storage
|
||||
entries:
|
||||
- id: 175
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_init
|
||||
args: 0
|
||||
- id: 176
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_gen_key
|
||||
args: 2
|
||||
- id: 177
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_get_signature
|
||||
args: 4
|
||||
- id: 178
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_get_pubkey
|
||||
args: 2
|
||||
- id: 179
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_encrypt
|
||||
args: 8
|
||||
- id: 180
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_decrypt
|
||||
args: 8
|
||||
- id: 181
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_is_slot_empty
|
||||
args: 1
|
||||
- id: 182
|
||||
type: custom
|
||||
function: esp_tee_sec_storage_clear_slot
|
||||
args: 1
|
||||
# ID: 195-199 (5) - OTA
|
||||
- family: ota
|
||||
entries:
|
||||
- id: 195
|
||||
type: custom
|
||||
function: esp_tee_ota_begin
|
||||
args: 0
|
||||
- id: 196
|
||||
type: custom
|
||||
function: esp_tee_ota_write
|
||||
args: 3
|
||||
- id: 197
|
||||
type: custom
|
||||
function: esp_tee_ota_end
|
||||
args: 0
|
||||
# ID: 200+ - User-defined
|
||||
@@ -1,57 +0,0 @@
|
||||
# SS no. API type Function Args
|
||||
0 custom invalid_secure_service 0
|
||||
# ID: 1-47 (47) - External memory (Flash) protection
|
||||
1 IDF mmu_hal_map_region 6
|
||||
2 IDF mmu_hal_unmap_region 3
|
||||
3 IDF mmu_hal_vaddr_to_paddr 4
|
||||
4 IDF mmu_hal_paddr_to_vaddr 5
|
||||
# Services before the ID 48 will be placed in the internal memory table,
|
||||
# while the rest will be placed in the external memory table.
|
||||
# ID: 48-71 (24) - Interrupt Handling
|
||||
48 IDF esp_rom_route_intr_matrix 3
|
||||
49 IDF rv_utils_intr_enable 1
|
||||
50 IDF rv_utils_intr_disable 1
|
||||
51 IDF rv_utils_intr_set_priority 2
|
||||
52 IDF rv_utils_intr_set_type 2
|
||||
53 IDF rv_utils_intr_set_threshold 1
|
||||
54 IDF rv_utils_intr_edge_ack 1
|
||||
55 IDF rv_utils_intr_global_enable 0
|
||||
# ID: 72-119 (48) - HAL
|
||||
72 IDF efuse_hal_chip_revision 0
|
||||
73 IDF efuse_hal_get_chip_ver_pkg 1
|
||||
74 IDF efuse_hal_get_disable_wafer_version_major 0
|
||||
75 IDF efuse_hal_get_mac 1
|
||||
76 IDF wdt_hal_init 4
|
||||
77 IDF wdt_hal_deinit 1
|
||||
# ID: 120-167 (48) - Crypto
|
||||
120 IDF esp_aes_intr_alloc 0
|
||||
121 IDF esp_aes_crypt_cbc 6
|
||||
122 IDF esp_aes_crypt_cfb8 6
|
||||
123 IDF esp_aes_crypt_cfb128 7
|
||||
124 IDF esp_aes_crypt_ctr 7
|
||||
125 IDF esp_aes_crypt_ecb 4
|
||||
126 IDF esp_aes_crypt_ofb 6
|
||||
127 IDF esp_sha 4
|
||||
128 IDF esp_sha_dma 6
|
||||
129 IDF esp_sha_read_digest_state 2
|
||||
130 IDF esp_sha_write_digest_state 2
|
||||
131 IDF esp_sha_block 3
|
||||
# ID: 168-183 (16) - eFuse
|
||||
168 IDF esp_efuse_check_secure_version 1
|
||||
169 IDF esp_efuse_read_field_blob 3
|
||||
170 IDF esp_flash_encryption_enabled 0
|
||||
# ID: 184-249 (66) - Reserved for future use
|
||||
# ID: 270-293 (24) - Secure Storage
|
||||
270 custom esp_tee_sec_storage_init 0
|
||||
271 custom esp_tee_sec_storage_gen_key 2
|
||||
272 custom esp_tee_sec_storage_get_signature 4
|
||||
273 custom esp_tee_sec_storage_get_pubkey 2
|
||||
274 custom esp_tee_sec_storage_encrypt 8
|
||||
275 custom esp_tee_sec_storage_decrypt 8
|
||||
276 custom esp_tee_sec_storage_is_slot_empty 1
|
||||
277 custom esp_tee_sec_storage_clear_slot 1
|
||||
# ID: 294-299 (6) - OTA
|
||||
294 custom esp_tee_ota_begin 0
|
||||
295 custom esp_tee_ota_write 3
|
||||
296 custom esp_tee_ota_end 0
|
||||
# ID: 300+ - User-defined
|
||||
+44
-26
@@ -1,25 +1,37 @@
|
||||
# SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
import argparse
|
||||
import re
|
||||
from typing import List
|
||||
from typing import Set
|
||||
from typing import Tuple
|
||||
|
||||
SEC_SRV_TABLE_SPLIT_ID = 48
|
||||
import yaml
|
||||
|
||||
SEC_SRV_TABLE_SPLIT_ID = 30
|
||||
OUTPUT_HEADERS = [
|
||||
'secure_service_num.h',
|
||||
'secure_service_dec.h',
|
||||
'secure_service_int.h',
|
||||
'secure_service_ext.h',
|
||||
]
|
||||
|
||||
|
||||
def parse_services(secure_service_tbl: str) -> List[Tuple[int, str, int]]:
|
||||
def parse_services(yml_files: List[str], excluded_fam: Set[str]) -> List[Tuple[int, str, int]]:
|
||||
services, service_ids = [], set()
|
||||
pattern = re.compile(r'^([0-9A-Fa-fXx]+)\s+\S+\s+(\S+)\s+(\d+)')
|
||||
|
||||
with open(secure_service_tbl, 'r') as f:
|
||||
for line in f:
|
||||
if match := pattern.match(line):
|
||||
service_id = int(match.group(1), 0)
|
||||
if service_id in service_ids:
|
||||
raise ValueError(f'Duplicate service call ID found: 0x{service_id:X}')
|
||||
service_ids.add(service_id)
|
||||
services.append((service_id, match.group(2), int(match.group(3))))
|
||||
for yml_file in yml_files:
|
||||
with open(yml_file, 'r') as f:
|
||||
data = yaml.safe_load(f)
|
||||
for family in data.get('secure_services', []):
|
||||
family_name = family.get('family', '')
|
||||
if family_name in excluded_fam:
|
||||
continue
|
||||
for entry in family.get('entries', []):
|
||||
service_id = entry['id']
|
||||
if service_id in service_ids:
|
||||
raise ValueError(f'Duplicate service call ID found: 0x{service_id:X}')
|
||||
service_ids.add(service_id)
|
||||
services.append((service_id, entry['function'], entry['args']))
|
||||
|
||||
return sorted(services, key=lambda x: x[0])
|
||||
|
||||
@@ -83,30 +95,36 @@ def generate_table_split(services: List[Tuple[int, str, int]], output_file_1: st
|
||||
f2.write(header + body_2)
|
||||
|
||||
|
||||
def generate_wrap_list(secure_service_tbl: str) -> None:
|
||||
pattern = re.compile(r'^[0-9A-Fa-fXx]+\s+IDF\s+(\S+)\s+\d+')
|
||||
with open(secure_service_tbl, 'r') as f:
|
||||
wrap_list = [f'-Wl,--wrap={match.group(1)}' for line in f if (match := pattern.match(line))]
|
||||
def generate_wrap_list(yml_files: List[str], excluded_fam: Set[str]) -> None:
|
||||
wrap_list: list[str] = []
|
||||
for yml_file in yml_files:
|
||||
with open(yml_file, 'r') as f:
|
||||
data = yaml.safe_load(f)
|
||||
wrap_list.extend(
|
||||
f'-Wl,--wrap={entry["function"]}'
|
||||
for family in data.get('secure_services', [])
|
||||
for entry in family.get('entries', [])
|
||||
if entry['type'] == 'IDF' and family.get('family', '') not in excluded_fam
|
||||
)
|
||||
print(' '.join(wrap_list), end='')
|
||||
|
||||
|
||||
def main() -> None:
|
||||
parser = argparse.ArgumentParser(description='Generate secure service outputs')
|
||||
parser = argparse.ArgumentParser(description='Generate secure service outputs from YAML table')
|
||||
parser.add_argument('--wrap', action='store_true', help='Generate linker wrap options')
|
||||
parser.add_argument('secure_service_tbl', type=str, help='Path to secure service table file')
|
||||
parser.add_argument('output_files', nargs='*', help='Output files: [secure_service_num.h, secure_service_dec.h, secure_service_1.h, secure_service_2.h]')
|
||||
parser.add_argument('-s', '--sec_srv', nargs='+', required=True, help='Secure service table(s) in YAML')
|
||||
parser.add_argument('--exclude', nargs='*', default=[], help='List of API families to exclude from the output')
|
||||
|
||||
args = parser.parse_args()
|
||||
excluded_fam = set(args.exclude)
|
||||
|
||||
if args.wrap:
|
||||
generate_wrap_list(args.secure_service_tbl)
|
||||
generate_wrap_list(args.sec_srv, excluded_fam)
|
||||
else:
|
||||
if len(args.output_files) != 4:
|
||||
parser.error('Missing output header files!')
|
||||
services = parse_services(args.secure_service_tbl)
|
||||
generate_num_header(services, args.output_files[0])
|
||||
generate_dec_header(services, args.output_files[1])
|
||||
generate_table_split(services, args.output_files[2], args.output_files[3])
|
||||
services = parse_services(args.sec_srv, excluded_fam)
|
||||
generate_num_header(services, OUTPUT_HEADERS[0])
|
||||
generate_dec_header(services, OUTPUT_HEADERS[1])
|
||||
generate_table_split(services, OUTPUT_HEADERS[2], OUTPUT_HEADERS[3])
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
Reference in New Issue
Block a user