From 5fb2dc6c74f96669f58f4db5122dfa3b7c68ef59 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Fri, 10 Jul 2026 17:26:07 +0800 Subject: [PATCH] fix(esp_tee): ensure hal assert is enabled for tee builds --- components/esp_tee/include/private/esp_tee_binary.h | 8 ++++++++ .../subproject/main/core/esp_secure_services_iram.c | 7 ------- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/components/esp_tee/include/private/esp_tee_binary.h b/components/esp_tee/include/private/esp_tee_binary.h index aca66276090..726e87be2fc 100644 --- a/components/esp_tee/include/private/esp_tee_binary.h +++ b/components/esp_tee/include/private/esp_tee_binary.h @@ -57,6 +57,14 @@ extern "C" { #error "CONFIG_SECURE_TEE_DROM_SIZE must be a multiple of SOC_MMU_PAGE_SIZE" #endif +/* With HAL assertions disabled (level 0), a failed HAL_ASSERT() expands to + * __builtin_unreachable(): the compiler then optimizes assuming the asserted + * preconditions always hold, turning any unvalidated HAL input into undefined + * behavior. The TEE must never be built this way. */ +#if CONFIG_SECURE_ENABLE_TEE && (CONFIG_HAL_DEFAULT_ASSERTION_LEVEL < 1) +#error "ESP-TEE requires HAL assertions (CONFIG_HAL_DEFAULT_ASSERTION_LEVEL >= 1)" +#endif + /* TEE Secure Storage partition label and NVS namespace */ #define ESP_TEE_SEC_STG_PART_LABEL "secure_storage" #define ESP_TEE_SEC_STG_NVS_NAMESPACE "tee_sec_stg_ns" diff --git a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c index 5f8fea28433..d4350fe77e7 100644 --- a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c +++ b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c @@ -278,11 +278,6 @@ esp_err_t _ss_esp_tee_sec_storage_ecdsa_sign_pbkdf2(const esp_tee_sec_storage_pb /* ---------------------------------------------- MMU HAL ------------------------------------------------- */ -/* Gates for REE-supplied external-flash address ranges. The HAL maps whole pages, - * so validate the page-rounded span it will actually touch (not the raw byte len) - * and require page-aligned addresses, so a sub-page or misaligned request cannot - * smuggle in an adjacent TEE page. mmu_hal_check_valid_ext_vaddr_region() must be - * enforced HERE, at the boundary: it rejects out-of-window (aliased) vaddrs. */ static bool tee_ree_ext_vaddr_ok(uint32_t mmu_id, uint32_t vaddr, uint32_t len) { uint32_t page = mmu_hal_pages_to_bytes(mmu_id, 1); @@ -335,8 +330,6 @@ void _ss_mmu_hal_unmap_region(uint32_t mmu_id, uint32_t vaddr, uint32_t len) bool _ss_mmu_hal_vaddr_to_paddr(uint32_t mmu_id, uint32_t vaddr, uint32_t *out_paddr, mmu_target_t *out_target) { - /* Same aliasing gate as map/unmap; translation itself is page-granular and - * vaddr need not be aligned, so validate the page containing it. */ uint32_t page = mmu_hal_pages_to_bytes(mmu_id, 1); bool valid_addr = (tee_ree_ext_vaddr_ok(mmu_id, ALIGN_DOWN(vaddr, page), 1) && esp_tee_buf_in_ree(out_paddr, sizeof(uint32_t)) &&