Skip to content

Commit 4aafa4d

Browse files
laukik-haselaukik-hase
committed
feat(esp_tee): Miscellaneous fixes and updates
- Rename `tee_test_fw` app configs for better CI tracking - Decrease the lower bound of TEE I/DRAM config options - Trim the TEE test-apps build - Improve the TEE/REE OTA pytest script with additional checks - Fix build issues when `tee_sec_storage`/`tee_ota_ops` are a a part of the project build but ESP-TEE is disabled
1 parent 9e48787 commit 4aafa4d

File tree

13 files changed

+90
-70
lines changed

13 files changed

+90
-70
lines changed

‎components/esp_tee/Kconfig.projbuild‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ menu "ESP-TEE (Trusted Execution Environment)"
1313
config SECURE_TEE_IRAM_SIZE
1414
hex "IRAM region size"
1515
default 0x8000
16-
range 0x7000 0xA000
16+
range 0x5000 0xA000
1717
help
1818
This configuration sets the IRAM size for the TEE module.
1919
This should be 256-byte (0x100) aligned.
2020

2121
config SECURE_TEE_DRAM_SIZE
2222
hex "DRAM region size"
23-
default 0x6000
24-
range 0x5000 0x7000
23+
default 0x5000
24+
range 0x4000 0x7000
2525
help
2626
This configuration sets the DRAM size for the TEE module.
2727
This should be 256-byte (0x100) aligned.

‎components/esp_tee/subproject/components/tee_ota_ops/CMakeLists.txt‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
idf_build_get_property(esp_tee_build ESP_TEE_BUILD)
22

33
set(srcs)
4-
set(priv_requires)
4+
set(priv_requires esp_tee)
55
set(include_dirs "include")
66

77
if(esp_tee_build)
88
list(APPEND srcs "esp_tee_ota_ops.c")
9-
list(APPEND priv_requires bootloader_support esp_tee log spi_flash tee_flash_mgr)
9+
list(APPEND priv_requires bootloader_support log spi_flash tee_flash_mgr)
1010
else()
11-
list(APPEND srcs "esp_tee_ota_ops_wrapper.c")
12-
list(APPEND priv_requires esp_tee)
11+
if(CONFIG_SECURE_ENABLE_TEE)
12+
list(APPEND srcs "esp_tee_ota_ops_wrapper.c")
13+
endif()
1314
endif()
1415

1516
idf_component_register(SRCS ${srcs}

‎components/esp_tee/subproject/components/tee_sec_storage/CMakeLists.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ if(esp_tee_build)
77
list(APPEND srcs "tee_sec_storage.c")
88
list(APPEND priv_requires efuse esp_partition log mbedtls nvs_flash spi_flash tee_flash_mgr)
99
else()
10-
list(APPEND srcs "tee_sec_storage_wrapper.c")
10+
if(CONFIG_SECURE_ENABLE_TEE)
11+
list(APPEND srcs "tee_sec_storage_wrapper.c")
12+
endif()
1113
endif()
1214

1315
idf_component_register(SRCS ${srcs}

‎components/esp_tee/test_apps/tee_cli_app/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,7 @@ cmake_minimum_required(VERSION 3.16)
44

55
include($ENV{IDF_PATH}/tools/cmake/project.cmake)
66

7+
# "Trim" the build. Include the minimal set of components, main, and anything it depends on.
8+
idf_build_set_property(MINIMAL_BUILD ON)
9+
710
project(tee_cli)

‎components/esp_tee/test_apps/tee_cli_app/main/CMakeLists.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,6 @@ if(CONFIG_SECURE_TEE_ATTESTATION)
88
endif()
99

1010
idf_component_register(SRCS ${srcs}
11-
INCLUDE_DIRS ".")
11+
INCLUDE_DIRS "."
12+
PRIV_REQUIRES app_update console esp_event esp_http_client
13+
esp_https_ota esp_wifi mbedtls nvs_flash)

‎components/esp_tee/test_apps/tee_cli_app/pytest_tee_cli.py‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,13 @@ def test_tee_cli_secure_ota_wifi(dut: Dut) -> None:
176176
server_port = 8001
177177
tee_bin = 'esp_tee/esp_tee.bin'
178178
user_bin = 'tee_cli.bin'
179+
prev_tee_offs = None
180+
prev_app_offs = None
181+
182+
# Fetch Wi-Fi credentials
183+
env_name = 'wifi_high_traffic'
184+
ap_ssid = get_env_config_variable(env_name, 'ap_ssid')
185+
ap_password = get_env_config_variable(env_name, 'ap_password')
179186

180187
# Start server
181188
thread1 = multiprocessing.Process(target=start_https_server, args=(dut.app.binary_path, '0.0.0.0', server_port))
@@ -187,17 +194,26 @@ def test_tee_cli_secure_ota_wifi(dut: Dut) -> None:
187194
# start test
188195
for i in range(iterations):
189196
# Boot up sequence checks
190-
dut.expect('Loaded TEE app from partition at offset', timeout=30)
191-
dut.expect('Loaded app from partition at offset', timeout=30)
197+
curr_tee_offs = (
198+
dut.expect(r'Loaded TEE app from partition at offset (0x[0-9a-fA-F]+)', timeout=30).group(1).decode()
199+
)
200+
curr_app_offs = (
201+
dut.expect(r'Loaded app from partition at offset (0x[0-9a-fA-F]+)', timeout=30).group(1).decode()
202+
)
203+
204+
# Check for offset change across iterations
205+
if prev_tee_offs is not None and curr_tee_offs == prev_tee_offs:
206+
raise ValueError('Updated TEE app is not running')
207+
208+
prev_tee_offs = curr_tee_offs
209+
if prev_app_offs is None:
210+
prev_app_offs = curr_app_offs
192211

193212
# Starting the test
194213
dut.expect('ESP-TEE: Secure services demonstration', timeout=30)
195214
time.sleep(2)
196215

197216
# Connecting to Wi-Fi
198-
env_name = 'wifi_high_traffic'
199-
ap_ssid = get_env_config_variable(env_name, 'ap_ssid')
200-
ap_password = get_env_config_variable(env_name, 'ap_password')
201217
dut.write(f'wifi_connect {ap_ssid} {ap_password}')
202218

203219
# Fetch the DUT IP address
@@ -213,6 +229,11 @@ def test_tee_cli_secure_ota_wifi(dut: Dut) -> None:
213229
if i == (iterations - 1):
214230
dut.write(f'user_ota https://{host_ip}:{str(server_port)}/{user_bin}')
215231
dut.expect('OTA Succeed, Rebooting', timeout=150)
232+
curr_app_offs = (
233+
dut.expect(r'Loaded app from partition at offset (0x[0-9a-fA-F]+)', timeout=30).group(1).decode()
234+
)
235+
if curr_app_offs == prev_app_offs:
236+
raise ValueError('Updated user app is not running')
216237
else:
217238
dut.write(f'tee_ota https://{host_ip}:{str(server_port)}/{tee_bin}')
218239
dut.expect('esp_tee_ota_end succeeded', timeout=150)

‎components/esp_tee/test_apps/tee_test_fw/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,7 @@ include($ENV{IDF_PATH}/tools/cmake/project.cmake)
66
# For registering the test-specific and attestation secure services
77
include(${CMAKE_CURRENT_LIST_DIR}/components/test_sec_srv/test_tee_project.cmake)
88

9+
# "Trim" the build. Include the minimal set of components, main, and anything it depends on.
10+
idf_build_set_property(MINIMAL_BUILD ON)
11+
912
project(esp_tee_test)

‎components/esp_tee/test_apps/tee_test_fw/main/CMakeLists.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
idf_build_get_property(idf_path IDF_PATH)
22

3-
set(priv_requires bootloader_support driver esp_tee esp_timer mbedtls spi_flash)
3+
set(priv_requires bootloader_support esp_driver_gptimer esp_tee esp_timer mbedtls spi_flash)
44
# Test FW related
5-
list(APPEND priv_requires cmock json nvs_flash test_utils unity)
5+
list(APPEND priv_requires json nvs_flash test_utils unity)
66
# TEE related
77
list(APPEND priv_requires tee_sec_storage tee_attestation tee_ota_ops test_sec_srv)
88

‎components/esp_tee/test_apps/tee_test_fw/pytest_esp_tee_ut.py‎

Lines changed: 12 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,20 @@
1414

1515
CONFIG_DEFAULT = [
1616
# 'config, target, markers',
17-
('default', target, (pytest.mark.generic,))
17+
('tee_default', target, (pytest.mark.generic,))
1818
for target in SUPPORTED_TARGETS
1919
]
2020

2121
CONFIG_OTA = [
2222
# 'config, target, skip_autoflash, markers',
23-
('ota', target, 'y', (pytest.mark.generic,))
23+
('tee_ota', target, 'y', (pytest.mark.generic,))
2424
for target in SUPPORTED_TARGETS
2525
]
2626

2727
CONFIG_ALL = [
2828
# 'config, target, markers',
2929
(config, target, (pytest.mark.generic,))
30-
for config in ['default', 'ota']
30+
for config in ['tee_default', 'tee_ota']
3131
for target in SUPPORTED_TARGETS
3232
]
3333

@@ -97,12 +97,7 @@ def test_esp_tee_crypto_sha(dut: IdfDut) -> None:
9797
def test_esp_tee_aes_perf(dut: IdfDut) -> None:
9898
# start test
9999
for i in range(24):
100-
if not i:
101-
dut.expect_exact('Press ENTER to see the list of tests')
102-
else:
103-
dut.expect_exact("Enter next test, or 'enter' to see menu")
104-
dut.write('"mbedtls AES performance"')
105-
dut.expect_unity_test_output(timeout=60)
100+
dut.run_all_single_board_cases(name=['mbedtls AES performance'])
106101

107102

108103
# ---------------- TEE Exceptions generation Tests ----------------
@@ -263,7 +258,7 @@ def test_esp_tee_flash_prot_esp_partition_mmap(dut: IdfDut) -> None:
263258
dut.serial.custom_flash()
264259

265260
# start test
266-
extra_data = dut.parse_test_menu()
261+
extra_data = dut._parse_test_menu()
267262
for test_case in extra_data:
268263
if test_case.name == 'Test REE-TEE isolation: Flash - SPI0 (esp_partition_mmap)':
269264
run_multiple_stages(dut, test_case.index, len(test_case.subcases), TeeFlashAccessApi.ESP_PARTITION_MMAP)
@@ -281,7 +276,7 @@ def test_esp_tee_flash_prot_spi_flash_mmap(dut: IdfDut) -> None:
281276
dut.serial.custom_flash()
282277

283278
# start test
284-
extra_data = dut.parse_test_menu()
279+
extra_data = dut._parse_test_menu()
285280
for test_case in extra_data:
286281
if test_case.name == 'Test REE-TEE isolation: Flash - SPI0 (spi_flash_mmap)':
287282
run_multiple_stages(dut, test_case.index, len(test_case.subcases), TeeFlashAccessApi.SPI_FLASH_MMAP)
@@ -299,7 +294,7 @@ def test_esp_tee_flash_prot_esp_rom_spiflash(dut: IdfDut) -> None:
299294
dut.serial.custom_flash()
300295

301296
# start test
302-
extra_data = dut.parse_test_menu()
297+
extra_data = dut._parse_test_menu()
303298
for test_case in extra_data:
304299
if test_case.name == 'Test REE-TEE isolation: Flash - SPI1 (esp_rom_spiflash)':
305300
run_multiple_stages(dut, test_case.index, len(test_case.subcases), TeeFlashAccessApi.ESP_ROM_SPIFLASH)
@@ -317,7 +312,7 @@ def test_esp_tee_flash_prot_esp_partition(dut: IdfDut) -> None:
317312
dut.serial.custom_flash()
318313

319314
# start test
320-
extra_data = dut.parse_test_menu()
315+
extra_data = dut._parse_test_menu()
321316
for test_case in extra_data:
322317
if test_case.name == 'Test REE-TEE isolation: Flash - SPI1 (esp_partition)':
323318
run_multiple_stages(dut, test_case.index, len(test_case.subcases), TeeFlashAccessApi.ESP_PARTITION)
@@ -335,7 +330,7 @@ def test_esp_tee_flash_prot_esp_flash(dut: IdfDut) -> None:
335330
dut.serial.custom_flash()
336331

337332
# start test
338-
extra_data = dut.parse_test_menu()
333+
extra_data = dut._parse_test_menu()
339334
for test_case in extra_data:
340335
if test_case.name == 'Test REE-TEE isolation: Flash - SPI1 (esp_flash)':
341336
run_multiple_stages(dut, test_case.index, len(test_case.subcases), TeeFlashAccessApi.ESP_FLASH)
@@ -347,13 +342,11 @@ def test_esp_tee_flash_prot_esp_flash(dut: IdfDut) -> None:
347342

348343

349344
@pytest.mark.generic
350-
@idf_parametrize('config', ['ota'], indirect=['config'])
345+
@idf_parametrize('config', ['tee_ota'], indirect=['config'])
351346
@idf_parametrize('target', SUPPORTED_TARGETS, indirect=['target'])
352347
def test_esp_tee_ota_negative(dut: IdfDut) -> None:
353348
# start test
354-
dut.expect_exact('Press ENTER to see the list of tests')
355-
dut.write('[ota_neg_1]')
356-
dut.expect_unity_test_output(timeout=120)
349+
dut.run_all_single_board_cases(group='ota_neg_1', timeout=30)
357350

358351
# erasing TEE otadata
359352
dut.serial.erase_partition('tee_otadata')
@@ -369,9 +362,7 @@ def test_esp_tee_ota_corrupted_img(dut: IdfDut) -> None:
369362
dut.serial.custom_flash_w_test_tee_img_gen()
370363

371364
# start test
372-
dut.expect_exact('Press ENTER to see the list of tests')
373-
dut.write('"Test TEE OTA - Corrupted image"')
374-
dut.expect_unity_test_output(timeout=120)
365+
dut.run_all_single_board_cases(name=['Test TEE OTA - Corrupted image'], timeout=30)
375366

376367
# erasing TEE otadata
377368
dut.serial.erase_partition('tee_otadata')

components/esp_tee/test_apps/tee_test_fw/sdkconfig.ci.default renamed to components/esp_tee/test_apps/tee_test_fw/sdkconfig.ci.tee_default

File renamed without changes.

0 commit comments

Comments
 (0)