Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_tee): Fix TEE attestation stack protection fault with secure boot enabled

Browse Source 
- Increased the TEE stack when secure boot is enabled
- Also, generate a build error when the generated TEE binary image size is
  greater than the TEE partition size
This commit is contained in:
Laukik Hase
2026-01-20 16:40:03 +05:30
parent 5fba5e3931
commit 31b113b649
9 changed files with 61 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_tee/test_apps/tee_test_fw/partitions_tee_ota.csv
+2 -2
View File
@@ -1,7 +1,7 @@
# ESP-IDF Partition Table
# Name, Type, SubType, Offset, Size, Flags
tee_0, app, tee_0, , 192K,
tee_1, app, tee_1, , 192K,
tee_0, app, tee_0, , 256K,
tee_1, app, tee_1, , 256K,
tee_otadata, data, tee_ota, , 8K,
secure_storage, data, nvs, , 56K,
ota_0, app, ota_0, , 512K,
1 # ESP-IDF Partition Table
2 # Name, Type, SubType, Offset, Size, Flags
3 tee_0, app, tee_0, , 192K, tee_0, app, tee_0, , 256K,
4 tee_1, app, tee_1, , 192K, tee_1, app, tee_1, , 256K,
5 tee_otadata, data, tee_ota, , 8K,
6 secure_storage, data, nvs, , 56K,
7 ota_0, app, ota_0, , 512K,
components/esp_tee/test_apps/tee_test_fw/pytest_esp_tee_ut.py
+15 -9
View File
@@ -24,6 +24,12 @@ CONFIG_OTA = [
for target in TESTING_TARGETS
]
CONFIG_TEST = [
# 'config, target, skip_autoflash, markers',
('tee_ota', target, 'y', (pytest.mark.host_test,))
for target in TESTING_TARGETS
]
CONFIG_ALL = [
# 'config, target, markers',
(config, target, (pytest.mark.generic,))
@@ -337,7 +343,7 @@ def tee_ota_stage_checks(dut: IdfDut, stage: TeeOtaStage, offset: str) -> None:
@idf_parametrize(
'config, target, skip_autoflash, markers',
CONFIG_OTA,
CONFIG_TEST,
indirect=['config', 'target', 'skip_autoflash'],
)
def test_esp_tee_ota_reboot_without_ota_end(dut: IdfDut) -> None:
@@ -352,7 +358,7 @@ def test_esp_tee_ota_reboot_without_ota_end(dut: IdfDut) -> None:
dut.write('"Test TEE OTA - Reboot without ending OTA"')
# OTA begin checks
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x40000')
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x50000')
# after reboot
tee_ota_stage_checks(dut, TeeOtaStage.REBOOT, '0x10000')
@@ -360,7 +366,7 @@ def test_esp_tee_ota_reboot_without_ota_end(dut: IdfDut) -> None:
@idf_parametrize(
'config, target, skip_autoflash, markers',
CONFIG_OTA,
CONFIG_TEST,
indirect=['config', 'target', 'skip_autoflash'],
)
def test_esp_tee_ota_valid_img(dut: IdfDut) -> None:
@@ -375,23 +381,23 @@ def test_esp_tee_ota_valid_img(dut: IdfDut) -> None:
dut.write('"Test TEE OTA - Valid image"')
# OTA begin checks
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x40000')
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x50000')
dut.expect('TEE OTA update successful!', timeout=10)
# after reboot 1
tee_ota_stage_checks(dut, TeeOtaStage.REBOOT, '0x40000')
tee_ota_stage_checks(dut, TeeOtaStage.REBOOT, '0x50000')
# resetting device to check for image validity
dut.serial.hard_reset()
# after reboot 2
dut.expect('TEE otadata - Current image state: VALID', timeout=10)
tee_ota_stage_checks(dut, TeeOtaStage.REBOOT, '0x40000')
tee_ota_stage_checks(dut, TeeOtaStage.REBOOT, '0x50000')
@idf_parametrize(
'config, target, skip_autoflash, markers',
CONFIG_OTA,
CONFIG_TEST,
indirect=['config', 'target', 'skip_autoflash'],
)
def test_esp_tee_ota_rollback(dut: IdfDut) -> None:
@@ -406,12 +412,12 @@ def test_esp_tee_ota_rollback(dut: IdfDut) -> None:
dut.write('"Test TEE OTA - Rollback"')
# OTA begin checks
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x40000')
tee_ota_stage_checks(dut, TeeOtaStage.BEGIN, '0x50000')
dut.expect('TEE OTA update successful!', timeout=10)
# after reboot 1
dut.expect('TEE otadata - Current image state: NEW', timeout=10)
dut.expect('Loaded TEE app from partition at offset 0x40000', timeout=10)
dut.expect('Loaded TEE app from partition at offset 0x50000', timeout=10)
rst_rsn = dut.expect(r'rst:(0x[0-9A-Fa-f]+) \(([^)]+)\)', timeout=10).group(2).decode()
# NOTE: LP_WDT_SYS (C6/H2) and RTC_WDT_SYS (C5) are expected as bootloader fails to load the dummy TEE app
if rst_rsn not in {'LP_WDT_SYS', 'RTC_WDT_SYS'}: