fix(esp_tee): Validate the stack pointer at the privilege switch boundary

components/esp_tee/test_apps/tee_test_fw/main/CMakeLists.txt

@@ -1,6 +1,6 @@
 idf_build_get_property(idf_path IDF_PATH)
 
-set(priv_requires bootloader_support esp_driver_gptimer esp_tee esp_timer mbedtls spi_flash)
+set(priv_requires bootloader_support esp_driver_gptimer esp_system esp_tee esp_timer mbedtls spi_flash)
 # Test FW related
 list(APPEND priv_requires nvs_flash test_utils unity)
 # TEE related

components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_panic.c

@@ -29,6 +29,7 @@
 
 #include "unity.h"
 #include "esp_tee.h"
+#include "esp_private/hw_stack_guard.h"
 #include "secure_service_num.h"
 
 #define ALIGN_DOWN_TO_MMU_PAGE_SIZE(addr)  ((addr) & ~((SOC_MMU_PAGE_SIZE) - 1))
@@ -229,6 +230,25 @@ TEST_CASE("Test REE-TEE isolation: DROM-W1", "[exception]")
     TEST_FAIL_MESSAGE("Exception should have been generated");
 }
 
+TEST_CASE("Test REE-TEE isolation: Corrupted SP", "[exception]")
+{
+    uintptr_t atk_sp = (uintptr_t)&_iram_start - 0x100;
+
+    /* Disable U-mode interrupts so the tick cannot preempt before the ecall */
+    __asm__ volatile("csrci ustatus, 0x1\n\t" : : : "memory");
+
+    /* Stop the REE-owned HW stack guard, as a malicious REE could */
+#if CONFIG_ESP_SYSTEM_HW_STACK_GUARD
+    esp_hw_stack_guard_monitor_stop();
+#endif
+
+    /* Cross into the TEE with the doctored sp; the handler rejects it and panics */
+    __asm__ volatile("mv sp, %0\n\t"
+                     "ecall\n\t" : : "r"(atk_sp) : "memory");
+
+    TEST_FAIL_MESSAGE("Exception should have been generated");
+}
+
 static void do_stack_overflow(int depth, volatile uint8_t *sink)
 {
     if (depth == -1) {

components/esp_tee/test_apps/tee_test_fw/tee_exception_test_map.py

@@ -23,6 +23,7 @@ _BASE_CONFIG = {
         'DROM-R1': 'Load access fault',
         'DROM-W1': 'Store access fault',
         'MMU-spillover': 'Illegal instruction',
+        'Corrupted SP': 'Environment call from U-mode',
     },
     'apm_violation': {
         'eFuse': 'APM - Space exception',