Skip to content

Commit 44289ee

Browse files
tusal-vaisalajenswikl
tusal-vaisala
authored and
jenswikl
committed
Add Application Secrets TEE client library
for accessing Application Secrets TA Co-developed-by: Katariina Lounento <katariina.lounento@vaisala.com> Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com> Co-developed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> Signed-off-by: Tuomas Salokanto <tuomas.salokanto@vaisala.com> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
1 parent 7101df5 commit 44289ee

8 files changed

Lines changed: 385 additions & 1 deletion

File tree

‎CMakeLists.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ set(CMAKE_TOOLCHAIN_FILE CMakeToolchain.txt)
66

77
option(CFG_WERROR "Build with -Werror" TRUE)
88
option(WITH_TEEACL "Build libteeacl" TRUE)
9+
option(WITH_ASTEEC "Build libasteec" TRUE)
910

1011
include(GNUInstallDirs)
1112

@@ -47,3 +48,6 @@ if(WITH_TEEACL)
4748
add_subdirectory(libteeacl)
4849
endif(WITH_TEEACL)
4950
add_subdirectory(libseteec)
51+
if(WITH_ASTEEC)
52+
add_subdirectory(libasteec)
53+
endif(WITH_ASTEEC)

‎Makefile‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,10 @@ libdir ?= $(LIBDIR)
2020
includedir ?= $(INCLUDEDIR)
2121

2222
WITH_TEEACL ?= 1
23+
WITH_ASTEEC ?= 1
2324

2425
.PHONY: all build build-libteec build-libckteec build-libseteec \
25-
build-libteeacl install copy_export clean cscope \
26+
build-libteeacl build-libasteec install copy_export clean cscope \
2627
clean-cscope \
2728
checkpatch-pre-req checkpatch-modified-patch checkpatch-modified-file \
2829
checkpatch-last-commit-patch checkpatch-last-commit-file \
@@ -44,6 +45,9 @@ build: build-libteec build-tee-supplicant build-libckteec build-libseteec
4445
ifeq ($(WITH_TEEACL),1)
4546
build: build-libteeacl
4647
endif
48+
ifeq ($(WITH_ASTEEC),1)
49+
build: build-libasteec
50+
endif
4751

4852
build-libckteec: build-libteec
4953
@echo "Building libckteec.so"
@@ -57,13 +61,20 @@ build-libteeacl:
5761
@echo "Building libteeacl.so"
5862
@$(MAKE) --directory=libteeacl --no-print-directory --no-builtin-variables
5963

64+
build-libasteec: build-libteec
65+
@echo "Building libasteec.so"
66+
@$(MAKE) --directory=libasteec --no-print-directory --no-builtin-variables
67+
6068
install: copy_export
6169

6270
clean: clean-libteec clean-tee-supplicant clean-cscope clean-libckteec \
6371
clean-libseteec
6472
ifeq ($(WITH_TEEACL),1)
6573
clean: clean-libteeacl
6674
endif
75+
ifeq ($(WITH_ASTEEC),1)
76+
clean: clean-libasteec
77+
endif
6778

6879
clean-libteec:
6980
@$(MAKE) --directory=libteec --no-print-directory clean
@@ -80,6 +91,9 @@ clean-libseteec:
8091
clean-libteeacl:
8192
@$(MAKE) --directory=libteeacl --no-print-directory clean
8293

94+
clean-libasteec:
95+
@$(MAKE) --directory=libasteec --no-print-directory clean
96+
8397
cscope:
8498
@echo " CSCOPE"
8599
${VPREFIX}find ${CURDIR} -name "*.[chsS]" > cscope.files
@@ -172,3 +186,8 @@ endif
172186
cp libseteec/include/*.h $(DESTDIR)$(includedir)
173187
cp -d ${O}/libseteec/libseteec.so* $(DESTDIR)$(libdir)
174188
cp -d ${O}/libseteec/libseteec.a $(DESTDIR)$(libdir)
189+
ifeq ($(WITH_ASTEEC),1)
190+
cp libasteec/include/*.h $(DESTDIR)$(includedir)
191+
cp -d ${O}/libasteec/libasteec.so* $(DESTDIR)$(libdir)
192+
cp -d ${O}/libasteec/libasteec.a $(DESTDIR)$(libdir)
193+
endif

‎libasteec/CMakeLists.txt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
project(asteec
2+
VERSION 1.0.0
3+
LANGUAGES C
4+
)
5+
6+
add_compile_options(${C_COMPILE_OPTIONS})
7+
8+
include(GNUInstallDirs)
9+
10+
################################################################################
11+
# Source files
12+
################################################################################
13+
set(SRC
14+
src/asteec.c
15+
)
16+
17+
################################################################################
18+
# Built library
19+
################################################################################
20+
add_library(asteec ${SRC})
21+
22+
configure_file(asteec.pc.in asteec.pc @ONLY)
23+
24+
set_target_properties(asteec PROPERTIES
25+
VERSION ${PROJECT_VERSION}
26+
SOVERSION ${PROJECT_VERSION_MAJOR}
27+
)
28+
29+
################################################################################
30+
# Flags always set
31+
################################################################################
32+
target_compile_definitions(asteec
33+
PRIVATE -D_GNU_SOURCE
34+
PRIVATE -DBINARY_PREFIX="LT"
35+
)
36+
37+
################################################################################
38+
# Public and private header and library dependencies
39+
################################################################################
40+
target_include_directories(asteec PUBLIC
41+
$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>
42+
$<INSTALL_INTERFACE:include>
43+
)
44+
45+
target_link_libraries(asteec
46+
PRIVATE teec
47+
)
48+
49+
################################################################################
50+
# Install targets
51+
################################################################################
52+
install(TARGETS asteec
53+
DESTINATION ${CMAKE_INSTALL_LIBDIR}
54+
)
55+
56+
install(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/include/" DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}")
57+
58+
install(FILES "${CMAKE_CURRENT_BINARY_DIR}/asteec.pc"
59+
DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig"
60+
)

‎libasteec/Makefile‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
include ../flags.mk
2+
include ../config.mk
3+
4+
OUT_DIR := $(OO)/libasteec
5+
6+
.PHONY: all libasteec clean
7+
8+
all: libasteec
9+
install: libasteec
10+
11+
LIB_NAME := libasteec
12+
MAJOR_VERSION := 1
13+
MINOR_VERSION := 0
14+
PATCH_VERSION := 0
15+
16+
LIB_MAJOR := $(LIB_NAME).so.$(MAJOR_VERSION)
17+
LIB_MAJ_MIN := $(LIB_NAME).so.$(MAJOR_VERSION).$(MINOR_VERSION)
18+
LIB_MAJ_MIN_PAT := $(LIB_NAME).so.$(MAJOR_VERSION).$(MINOR_VERSION).$(PATCH_VERSION)
19+
LIBASTEEC_SO_LIBRARY := $(LIB_MAJ_MIN_PAT)
20+
LIBASTEEC_AR_LIBRARY := $(LIB_NAME).a
21+
22+
LIBASTEEC_SRC_DIR := src
23+
24+
LIBASTEEC_SRCS = asteec.c
25+
26+
LIBASTEEC_INCLUDES = ${CURDIR}/include
27+
LIBASTEEC_INCLUDES += ${CURDIR}/../libteec/include
28+
29+
LIBASTEEC_CFLAGS := $(addprefix -I, $(LIBASTEEC_INCLUDES)) \
30+
$(CFLAGS) -D_GNU_SOURCE -fPIC
31+
32+
LIBASTEEC_LFLAGS := $(LDFLAGS) -L$(OUT_DIR)/../libteec -lteec
33+
34+
LIBASTEEC_OBJ_DIR := $(OUT_DIR)
35+
LIBASTEEC_OBJS := $(patsubst %.c,$(LIBASTEEC_OBJ_DIR)/%.o, $(LIBASTEEC_SRCS))
36+
37+
$(LIBASTEEC_OBJ_DIR)/%.o: ${LIBASTEEC_SRC_DIR}/%.c
38+
$(VPREFIX)mkdir -p $(LIBASTEEC_OBJ_DIR)
39+
@echo " CC $<"
40+
$(VPREFIX)$(CC) $(LIBASTEEC_CFLAGS) -c $< -o $@
41+
42+
libasteec: $(OUT_DIR)/$(LIBASTEEC_SO_LIBRARY)
43+
44+
$(OUT_DIR)/$(LIBASTEEC_SO_LIBRARY): $(LIBASTEEC_OBJS)
45+
@echo " LINK $@"
46+
$(VPREFIX)$(CC) -shared -Wl,-soname,$(LIB_MAJOR) -o $@ $+ $(LIBASTEEC_LFLAGS)
47+
@echo ""
48+
49+
libasteec: $(OUT_DIR)/$(LIBASTEEC_AR_LIBRARY)
50+
51+
$(OUT_DIR)/$(LIBASTEEC_AR_LIBRARY): $(LIBASTEEC_OBJS)
52+
@echo " AR $@"
53+
$(VPREFIX)$(AR) rcs $@ $+
54+
55+
libasteec:
56+
$(VPREFIX)ln -sf $(LIB_MAJ_MIN_PAT) $(OUT_DIR)/$(LIB_MAJ_MIN)
57+
$(VPREFIX)ln -sf $(LIB_MAJ_MIN) $(OUT_DIR)/$(LIB_MAJOR)
58+
$(VPREFIX)ln -sf $(LIB_MAJOR) $(OUT_DIR)/$(LIB_NAME).so
59+
60+
################################################################################
61+
# Cleaning up configuration
62+
################################################################################
63+
clean:
64+
$(RM) $(LIBASTEEC_OBJS)
65+
$(RM) $(OUT_DIR)/$(LIB_MAJ_MIN_PAT)
66+
$(RM) $(OUT_DIR)/$(LIB_MAJ_MIN)
67+
$(RM) $(OUT_DIR)/$(LIB_MAJOR)
68+
$(RM) $(OUT_DIR)/$(LIBASTEEC_SO_LIBRARY)
69+
$(RM) $(OUT_DIR)/$(LIBASTEEC_AR_LIBRARY)
70+
$(call rmdir,$(OUT_DIR))
71+

‎libasteec/asteec.pc.in‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
prefix="@CMAKE_INSTALL_PREFIX@"
2+
exec_prefix="${prefix}"
3+
libdir="${prefix}/lib"
4+
includedir="${prefix}/include"
5+
6+
Name: @PROJECT_NAME@
7+
Description: Application Secrets TEE Client library
8+
Version: @PROJECT_VERSION@
9+
Requires: teec
10+
Cflags: -I"${includedir}"
11+
Libs: -L"${libdir}" -lasteec

‎libasteec/include/asteec.h‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/* SPDX-License-Identifier: BSD-2-Clause */
2+
/*
3+
* Copyright (c) 2026, Vaisala Oyj.
4+
*/
5+
6+
#ifndef ASTEEC_H
7+
#define ASTEEC_H
8+
9+
#include <stddef.h>
10+
#include <stdint.h>
11+
#include <sys/types.h>
12+
#include <tee_client_api.h>
13+
14+
#ifdef __cplusplus
15+
extern "C" {
16+
#endif
17+
18+
/**
19+
* asteec_seal() - Seal secret using hardware unique TA specific key
20+
*
21+
* @param login_method Login method such as TEEC_LOGIN_PUBLIC or TEEC_LOGIN_GROUP
22+
* @param login_gid Group ID, used with TEEC_LOGIN_GROUP and
23+
* TEEC_LOGIN_GROUP_APPLICATION methods
24+
* @param plain Pointer to plain secret
25+
* @param plain_len Byte length of plain secret
26+
* @param sealed Pointer to buffer to receive sealed secret datablob.
27+
* May be NULL when *sealed_len is 0 to query the
28+
* required output size.
29+
* @param sealed_len On input, byte length of buffer @sealed. On output,
30+
* updated with the actual size on success or the required
31+
* size when TEEC_ERROR_SHORT_BUFFER is returned.
32+
*
33+
* @return TEEC_SUCCESS on success, TEEC_ERROR_* on failure
34+
*/
35+
TEEC_Result asteec_seal(uint32_t login_method, gid_t login_gid,
36+
const void *plain, size_t plain_len,
37+
void *sealed, size_t *sealed_len);
38+
39+
/**
40+
* asteec_unseal() - Unseal secret using hardware unique TA specific key
41+
*
42+
* @param login_method Login method such as TEEC_LOGIN_PUBLIC or TEEC_LOGIN_GROUP
43+
* @param login_gid Group ID, used with TEEC_LOGIN_GROUP and
44+
* TEEC_LOGIN_GROUP_APPLICATION methods
45+
* @param sealed Pointer to sealed secret datablob
46+
* @param sealed_len Byte length of sealed secret datablob
47+
* @param plain Pointer to buffer to receive plain secret.
48+
* May be NULL when *plain_len is 0 to query the
49+
* required output size.
50+
* @param plain_len On input, byte length of buffer @plain. On output,
51+
* updated with the actual size on success or the required
52+
* size when TEEC_ERROR_SHORT_BUFFER is returned.
53+
*
54+
* @return TEEC_SUCCESS on success, TEEC_ERROR_* on failure
55+
*/
56+
TEEC_Result asteec_unseal(uint32_t login_method, gid_t login_gid,
57+
const void *sealed, size_t sealed_len,
58+
void *plain, size_t *plain_len);
59+
60+
#ifdef __cplusplus
61+
}
62+
#endif
63+
64+
#endif /* ASTEEC_H */

‎libasteec/src/app_secrets_ta.h‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/* SPDX-License-Identifier: BSD-2-Clause */
2+
/*
3+
* Copyright (c) 2026, Vaisala Oyj.
4+
*/
5+
6+
#ifndef APP_SECRETS_TA_H
7+
#define APP_SECRETS_TA_H
8+
9+
#define APP_SECRETS_TA_UUID \
10+
{ 0x5ca4d9d9, 0xdee4, 0x47f4, \
11+
{ 0x97, 0x7a, 0x7e, 0xad, 0xc0, 0x60, 0xe5, 0x2c } }
12+
13+
/*
14+
* Seal secret using hardware unique TA specific key
15+
*
16+
* [in] memref[0] Plain secret
17+
* [out] memref[1] Sealed secret datablob
18+
*/
19+
#define TA_APPSECRETS_CMD_SEAL_SECRET 0x0
20+
21+
/*
22+
* Unseal secret using hardware unique TA specific key
23+
*
24+
* [in] memref[0] Sealed secret datablob
25+
* [out] memref[1] Plain secret
26+
*/
27+
#define TA_APPSECRETS_CMD_UNSEAL_SECRET 0x1
28+
29+
#endif /* APP_SECRETS_TA_H */

0 commit comments

Comments
 (0)