From d866feaeb8476541025efa4325459fae3f7f3493 Mon Sep 17 00:00:00 2001
From: houmingyong <houmingyong@huawei.com>
Date: Mon, 29 May 2023 21:29:46 +0800
Subject: [PATCH] support local attest

---
 CMakeLists.txt                                |   9 +-
 component/CMakeLists.txt                      |   1 +
 component/local_attest/CMakeLists.txt         |  60 +++++++
 component/local_attest/gp_local_attest.c      | 153 ++++++++++++++++++
 component/local_attest/local_attest_agent.h   |  28 ++++
 component/local_attest/sg_local_attest.c      |  22 +++
 component/local_attest/sg_local_attest.h      |  29 ++++
 component/local_attest/sgx_local_attest.c     |  20 +++
 .../remote_attest/ra_report/CMakeLists.txt    |   2 +-
 .../remote_attest/ra_report/gp_ra_report.c    | 131 +--------------
 .../ra_report/gp_report_helper.c              | 121 ++++++++++++++
 .../ra_report/gp_report_helper.h              |  24 +++
 .../client/secure_channel_client.c            |   7 +-
 .../secure_channel/enclave/CMakeLists.txt     |   3 -
 examples/secure_channel/basevalue.txt         |   1 +
 examples/secure_channel/client/client.c       |   9 +-
 .../client_with_recv_thread/client.c          |   9 +-
 inc/host_inc/status.h                         |   2 +
 18 files changed, 489 insertions(+), 142 deletions(-)
 create mode 100644 component/local_attest/CMakeLists.txt
 create mode 100644 component/local_attest/gp_local_attest.c
 create mode 100644 component/local_attest/local_attest_agent.h
 create mode 100644 component/local_attest/sg_local_attest.c
 create mode 100644 component/local_attest/sg_local_attest.h
 create mode 100644 component/local_attest/sgx_local_attest.c
 create mode 100644 component/remote_attest/ra_report/gp_report_helper.c
 create mode 100644 component/remote_attest/ra_report/gp_report_helper.h
 create mode 100644 examples/secure_channel/basevalue.txt

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 079be3b..25e6381 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -17,9 +17,6 @@ set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)
  
 set(LOCAL_ROOT_PATH ${CMAKE_CURRENT_SOURCE_DIR})
 
- 
-set(SECGEAR_DEBUG_LEVEL SECGEAR_LOG_LEVEL_DEBUG)
-add_definitions(-DSECGEAR_DEBUG_LEVEL=${SECGEAR_DEBUG_LEVEL})
 message("=============cmake help info=======================") 
 message("Example default cmd: cmake ..")
 message("same with default: cmake -DENCLAVE=SGX -DSDK_PATH=/opt/intel/sgxsdk -DSSL_PATH=/opt/intel/sgxssl ..")
@@ -40,6 +37,12 @@ set(PL_SDK_DEFAULT_PATH /root/dev/sdk)
 
 if(CMAKE_BUILD_TYPE MATCHES "Debug")
 	add_definitions(-DDEBUG_FILE_LINE)
+	#set enclave log level
+	set(PRINT_LEVEL 3)
+	add_definitions(-DPRINT_LEVEL=${PRINT_LEVEL})
+	#set host log level
+	set(SECGEAR_DEBUG_LEVEL SECGEAR_LOG_LEVEL_DEBUG)
+	add_definitions(-DSECGEAR_DEBUG_LEVEL=${SECGEAR_DEBUG_LEVEL})
 endif()
 set(CMAKE_C_FLAGS "-fstack-protector-all -W -Wall -Werror -Wextra -Werror=array-bounds -D_FORTIFY_SOURCE=2 -O2 -ftrapv")
 set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS} -s")
diff --git a/component/CMakeLists.txt b/component/CMakeLists.txt
index 7442334..83aa4cd 100644
--- a/component/CMakeLists.txt
+++ b/component/CMakeLists.txt
@@ -13,6 +13,7 @@ set(LIBRARY_INSTALL ${LOCAL_ROOT_PATH_INSTALL}/usr/lib64)
 ADD_SUBDIRECTORY(secure_channel)
 
 ADD_SUBDIRECTORY(remote_attest)
+ADD_SUBDIRECTORY(local_attest)
 
 
  
diff --git a/component/local_attest/CMakeLists.txt b/component/local_attest/CMakeLists.txt
new file mode 100644
index 0000000..45ebf82
--- /dev/null
+++ b/component/local_attest/CMakeLists.txt
@@ -0,0 +1,60 @@
+# Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+# secGear is licensed under the Mulan PSL v2.
+# You can use this software according to the terms and conditions of the Mulan PSL v2.
+# You may obtain a copy of Mulan PSL v2 at:
+#     http://license.coscl.org.cn/MulanPSL2
+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+# PURPOSE.
+# See the Mulan PSL v2 for more details.
+set(target_lib secgear_la)
+
+set(CMAKE_C_FLAGS "-W -Wall -fno-short-enums -fno-omit-frame-pointer -fstack-protector-strong -Wstack-protector \
+                  --param ssp-buffer-size=4 -frecord-gcc-switches -Wextra -nostdinc -nodefaultlibs -fno-peephole \
+                  -fno-peephole2 -Wno-main -Wno-error=unused-parameter -Wno-error=unused-but-set-variable \
+                  -Wno-error=format-truncation= -D_FORTIFY_SOURCE=2 -O2")
+set(COMMON_C_LINK_FLAGS "-Wl,-z,now -Wl,-z,relro -Wl,-z,noexecstack -Wl,-nostdlib -nodefaultlibs -nostartfiles")
+
+set(SOURCE_FILES sg_local_attest.c)
+
+if(CC_SGX)
+    set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS}")
+    add_definitions(-DSGX_ENCLAVE)
+    set(SOURCE_FILES ${SOURCE_FILES} sgx_local_attest.c)
+endif()
+
+if(CC_GP)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -march=armv8-a -fPIC")
+    set(CMAKE_SHARED_LINKER_FLAGS  "${COMMON_C_LINK_FLAGS} -Wl,-s")
+    add_definitions(-DGP_ENCLAVE)
+    aux_source_directory(${LOCAL_ROOT_PATH}/thirdparty/cjson/ CJSON_SRC)
+    FILE (GLOB_RECURSE BASE64_SRC "${LOCAL_ROOT_PATH}/thirdparty/base64url/*.c")
+    set(REPORT_HELPER ${LOCAL_ROOT_PATH}/component/remote_attest/ra_report/gp_report_helper.c)
+    set(SOURCE_FILES ${SOURCE_FILES} gp_local_attest.c ${CJSON_SRC} ${BASE64_SRC} ${REPORT_HELPER})
+    set(INCLUDE_DIR ${SDK_PATH}/include/TA
+                    ${SDK_PATH}/include/TA/huawei_ext
+                    ${SDK_PATH}/thirdparty/open_source/musl/libc
+                    ${SDK_PATH}/thirdparty/open_source/musl/libc/arch/aarch64
+                    ${SDK_PATH}/thirdparty/open_source/musl/libc/arch/generic
+                    ${LOCAL_ROOT_PATH}/thirdparty/cjson
+                    ${LOCAL_ROOT_PATH}/thirdparty/base64url
+                    ${LOCAL_ROOT_PATH}/inc/enclave_inc/gp/itrustee)
+endif()
+
+add_library(${target_lib} STATIC  ${SOURCE_FILES})
+
+target_include_directories(${target_lib} PRIVATE
+    ${LOCAL_ROOT_PATH}/inc/host_inc
+    ${LOCAL_ROOT_PATH}/component/remote_attest
+    ${LOCAL_ROOT_PATH}/component/remote_attest/ra_report
+    ${INCLUDE_DIR})
+
+install(TARGETS  ${target_lib}
+        ARCHIVE
+        DESTINATION ${LIBRARY_INSTALL}
+        PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_READ  GROUP_EXECUTE WORLD_READ  WORLD_EXECUTE)
+
+file(GLOB LA_HEADERS sg_local_attest.h)
+install(FILES ${LA_HEADERS}
+        DESTINATION /usr/include/secGear
+        PERMISSIONS OWNER_WRITE OWNER_READ GROUP_READ WORLD_READ)
diff --git a/component/local_attest/gp_local_attest.c b/component/local_attest/gp_local_attest.c
new file mode 100644
index 0000000..7f75147
--- /dev/null
+++ b/component/local_attest/gp_local_attest.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include "tee_ra_api.h"
+#include "tee_crypto_api.h"
+#include "base64url.h"
+#include "cJSON.h"
+#include "secgear_log.h"
+#include "status.h"
+#include "sg_report_st.h"
+#include "local_attest_agent.h"
+#include "gp_report_helper.h"
+
+#define CC_HASH_LEN 64
+typedef struct {
+    char *taid;
+    char *img_hash;
+    char *mem_hash;
+} gp_basevalue_t;
+
+#define HEX_ONE_CHAR_BITS 4
+#define HEX_BYTE_MAX 0xf
+
+static void hex2str(const uint8_t *source, int source_len, char *dest)
+{
+    char *hexEncode = "0123456789abcdef";
+    int i = 0, j =  0;
+    for (i = 0; i < source_len; i++) {
+        dest[j++] = hexEncode[(source[i] >> HEX_ONE_CHAR_BITS) & HEX_BYTE_MAX];
+        dest[j++] = hexEncode[(source[i]) & HEX_BYTE_MAX];
+    }
+}
+
+static cc_enclave_result_t gp_compare_hash(gp_basevalue_t *basevalue, char *ta_img, char *ta_mem)
+{
+    size_t imglen = 0;
+    size_t memlen = 0;
+    uint8_t *decodedimg = kpsecl_base64urldecode(ta_img, strlen(ta_img), &imglen);
+    uint8_t *decodedmem = kpsecl_base64urldecode(ta_mem, strlen(ta_mem), &memlen);
+
+    char heximg[CC_HASH_LEN + 1] = {0};
+    char hexmem[CC_HASH_LEN + 1] = {0};
+    hex2str(decodedimg, imglen, heximg);
+    hex2str(decodedmem, memlen, hexmem);
+    free(decodedimg);
+    free(decodedmem);
+
+    PrintInfo(PRINT_STRACE, "heximg:%s, hexmem:%s", heximg, hexmem);
+    PrintInfo(PRINT_STRACE, "img_hash:%s, mem_hash:%s", basevalue->img_hash, basevalue->mem_hash);
+
+    if (memcmp(heximg, basevalue->img_hash, strlen(basevalue->img_hash)) != 0 ||
+        memcmp(hexmem, basevalue->mem_hash, strlen(basevalue->mem_hash)) != 0) {
+        PrintInfo(PRINT_ERROR, "verify local report hash failed!\n");
+        return CC_ERROR_LOCAL_REPORT_HASH_MISMATCH;
+    }
+    return CC_SUCCESS;
+}
+
+static cc_enclave_result_t gp_verify_local_report(gp_basevalue_t *basevalue, uint8_t *nonce, size_t nonce_len,
+    cc_ra_buf_t *report)
+{
+    char *b64_nonce = NULL;
+    size_t b64_nonce_len = 0;
+    cc_enclave_result_t ret = CC_ERROR_LOCAL_REPORT_INVALID;
+
+    cJSON *cj_report = cJSON_ParseWithLength((char *)report->buf, report->len);
+    if (cj_report == NULL) {
+        PrintInfo(PRINT_ERROR, "report to json failed\n");
+        return ret;
+    }
+    cJSON *cj_payload = cJSON_GetObjectItemCaseSensitive(cj_report, "payload");
+    if (cj_payload == NULL) {
+        PrintInfo(PRINT_ERROR, "report payload failed!\n");
+        goto end;
+    }
+    b64_nonce = kpsecl_base64urlencode(nonce, nonce_len, &b64_nonce_len);
+    cJSON *cj_b64_nonce = cJSON_GetObjectItemCaseSensitive(cj_payload, "nonce");
+    if (cj_b64_nonce == NULL || strcmp(cj_b64_nonce->valuestring, b64_nonce)) {
+        PrintInfo(PRINT_ERROR, "check nonce value failed!\n");
+        free(b64_nonce);
+        goto end;
+    }
+    free(b64_nonce);
+
+    cJSON *cj_uuid = cJSON_GetObjectItemCaseSensitive(cj_payload, "uuid");
+    if (cj_uuid == NULL || strcmp(cj_uuid->valuestring, basevalue->taid)) {
+        PrintInfo(PRINT_ERROR, "check uuid failed!\n");
+        goto end;
+    }
+    cJSON *cj_ta_img = cJSON_GetObjectItemCaseSensitive(cj_payload, "ta_img");
+    if (cj_ta_img == NULL) {
+        PrintInfo(PRINT_ERROR, "check ta_img failed!\n");
+        goto end;
+    }
+    cJSON *cj_ta_mem = cJSON_GetObjectItemCaseSensitive(cj_payload, "ta_mem");
+    if (cj_ta_mem == NULL) {
+        PrintInfo(PRINT_ERROR, "check ta_mem failed!\n");
+        goto end;
+    }
+
+    ret = gp_compare_hash(basevalue, cj_ta_img->valuestring, cj_ta_mem->valuestring);
+end:
+    cJSON_Delete(cj_report);
+
+    return ret;
+}
+
+#define LOCAL_REPORT_OUT_LEN 0x3000
+#define LOCAL_REPORT_NONCE_LEN 32
+cc_enclave_result_t agent_local_attest(char *taid, char *img_hash, char *mem_hash)
+{
+    cc_get_ra_report_input_t ra_input = {0};
+    ra_input.taid = (uint8_t *)taid;
+    ra_input.with_tcb = false;
+
+    TEE_GenerateRandom(ra_input.nonce, LOCAL_REPORT_NONCE_LEN);
+    ra_input.nonce_len = LOCAL_REPORT_NONCE_LEN + 1;
+
+    cc_ra_buf_t *in = NULL;
+    cc_enclave_result_t ret = gen_ra_report_in_buff(&ra_input, &in);
+    if (ret != CC_SUCCESS) {
+        PrintInfo(PRINT_ERROR, "gen ra report in buff error! ret:%x\n", ret);
+        return -1;
+    }
+
+    uint8_t data[LOCAL_REPORT_OUT_LEN] = {0};
+    cc_ra_buf_t report = {LOCAL_REPORT_OUT_LEN, data};
+
+    TEE_Result gp_ret = ra_local_report((struct ra_buffer_data *)in, (struct ra_buffer_data *)&report);
+    free_cc_ra_buf(in);
+    if (gp_ret != CC_SUCCESS) {
+        PrintInfo(PRINT_ERROR, "get ra report failed, ret:%x\n", gp_ret);
+        return CC_ERROR_RA_GET_REPORT;
+    }
+
+    gp_basevalue_t basevalue = {
+        .taid = taid,
+        .img_hash = img_hash,
+        .mem_hash = mem_hash,
+    };
+    return gp_verify_local_report(&basevalue, ra_input.nonce, ra_input.nonce_len, &report);
+}
diff --git a/component/local_attest/local_attest_agent.h b/component/local_attest/local_attest_agent.h
new file mode 100644
index 0000000..c79bc03
--- /dev/null
+++ b/component/local_attest/local_attest_agent.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+
+#ifndef SECGEAR_LOCAL_ATTEST_AGENT_H
+#define SECGEAR_LOCAL_ATTEST_AGENT_H
+
+#include "status.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+cc_enclave_result_t agent_local_attest(char *taid, char *img_hash, char *mem_hash);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/component/local_attest/sg_local_attest.c b/component/local_attest/sg_local_attest.c
new file mode 100644
index 0000000..f94473e
--- /dev/null
+++ b/component/local_attest/sg_local_attest.c
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+#include "sg_local_attest.h"
+#include "local_attest_agent.h"
+
+cc_enclave_result_t cc_local_attest(char *taid, char *img_hash, char *mem_hash)
+{
+    if (taid == NULL || (img_hash == NULL && mem_hash == NULL)) {
+        return CC_ERROR_BAD_PARAMETERS;
+    }
+    
+    return agent_local_attest(taid, img_hash, mem_hash);
+}
diff --git a/component/local_attest/sg_local_attest.h b/component/local_attest/sg_local_attest.h
new file mode 100644
index 0000000..97f31ef
--- /dev/null
+++ b/component/local_attest/sg_local_attest.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+
+#ifndef SECGEAR_LOCAL_ATTESTATION_H
+#define SECGEAR_LOCAL_ATTESTATION_H
+
+#include "status.h"
+#include "secgear_defs.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+CC_API_SPEC cc_enclave_result_t cc_local_attest(char *taid, char *img_hash, char *mem_hash);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/component/local_attest/sgx_local_attest.c b/component/local_attest/sgx_local_attest.c
new file mode 100644
index 0000000..aa772b0
--- /dev/null
+++ b/component/local_attest/sgx_local_attest.c
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+#include "local_attest_agent.h"
+
+cc_enclave_result_t agent_local_attest(char *taid, char *img_hash, char *mem_hash)
+{
+    (void)taid;
+    (void)img_hash;
+    (void)mem_hash;
+    return CC_SUCCESS;
+}
diff --git a/component/remote_attest/ra_report/CMakeLists.txt b/component/remote_attest/ra_report/CMakeLists.txt
index 2f00dc7..4314f02 100644
--- a/component/remote_attest/ra_report/CMakeLists.txt
+++ b/component/remote_attest/ra_report/CMakeLists.txt
@@ -20,7 +20,7 @@ endif()
 if(CC_GP)
     aux_source_directory(${LOCAL_ROOT_PATH}/thirdparty/cjson/ CJSON_SRC)
     FILE (GLOB_RECURSE BASE64_SRC "${LOCAL_ROOT_PATH}/thirdparty/base64url/*.c")
-    set(SRC_FILES ${SRC_FILES} ${CJSON_SRC} ${BASE64_SRC} gp_ra_report.c)
+    set(SRC_FILES ${SRC_FILES} ${CJSON_SRC} ${BASE64_SRC} gp_ra_report.c gp_report_helper.c)
     set(INCLUDE_DIR ${SDK_PATH}/include/CA
                     ${LOCAL_ROOT_PATH}/thirdparty/cjson
                     ${LOCAL_ROOT_PATH}/thirdparty/libqca
diff --git a/component/remote_attest/ra_report/gp_ra_report.c b/component/remote_attest/ra_report/gp_ra_report.c
index 4625cd3..ca1fa03 100644
--- a/component/remote_attest/ra_report/gp_ra_report.c
+++ b/component/remote_attest/ra_report/gp_ra_report.c
@@ -13,136 +13,8 @@
 #include <string.h>
 #include "ra_client_api.h"
 #include "enclave_log.h"
-#include "cJSON.h"
-#include "base64url.h"
-
 #include "uni_ree_agent.h"
-
-static void free_cc_ra_buf(cc_ra_buf_t *ra_buf)
-{
-    if (ra_buf == NULL) {
-        return;
-    }
-    if (ra_buf->buf != NULL) {
-        free(ra_buf->buf);
-    }
-
-    free(ra_buf);
-    return;
-}
-
-/* caller need to free (cc_ra_buf_t **in) */
-static cc_enclave_result_t gen_provision_no_as_in_buff(cc_ra_buf_t **in)
-{
-    if (in == NULL) {
-        return CC_ERROR_BAD_PARAMETERS;
-    }
-    cc_enclave_result_t ret = CC_SUCCESS;
-    cJSON *in_json = cJSON_CreateObject();
-    cJSON_AddStringToObject(in_json, "handler", "provisioning-input");
-
-    cJSON *in_payload = cJSON_CreateObject();
-    cJSON_AddStringToObject(in_payload, "version", "TEE.RA.1.0");
-    cJSON_AddStringToObject(in_payload, "scenario", "sce_no_as");
-    cJSON_AddStringToObject(in_payload, "hash_alg", "HS256");
-
-    cJSON_AddItemToObject(in_json, "payload", in_payload);
-
-    char *in_buf = cJSON_PrintUnformatted(in_json);
-    uint32_t in_buf_len = strlen(in_buf) + 1;
-
-    cc_ra_buf_t *tmp_ra_buf = calloc(1, sizeof(cc_ra_buf_t));
-    if (tmp_ra_buf == NULL) {
-        ret = CC_ERROR_RA_MEMORY;
-        goto end;
-    }
-    tmp_ra_buf->buf = calloc(1, in_buf_len);
-    if (tmp_ra_buf->buf == NULL) {
-        ret = CC_ERROR_RA_MEMORY;
-        free(tmp_ra_buf);
-        goto end;
-    }
-    (void)memcpy(tmp_ra_buf->buf, in_buf, in_buf_len);
-    tmp_ra_buf->len = in_buf_len;
-
-    *in = tmp_ra_buf;
-end:
-    cJSON_free(in_buf);
-    cJSON_Delete(in_json);
-    return ret;
-}
-
-/* caller need to free (cc_ra_buf_t **in) */
-static cc_enclave_result_t gen_ra_report_in_buff(cc_get_ra_report_input_t *param, cc_ra_buf_t **json_buf)
-{
-    if (param == NULL || param->taid == NULL || json_buf == NULL) {
-        return CC_ERROR_BAD_PARAMETERS;
-    }
-    cc_enclave_result_t ret = CC_SUCCESS;
-    cJSON *in_json = cJSON_CreateObject();
-    cJSON_AddStringToObject(in_json, "handler", "report-input");
-
-    size_t b64_nonce_len = 0;
-    char *b64_nonce = kpsecl_base64urlencode(param->nonce, param->nonce_len, &b64_nonce_len);
-
-    cJSON *in_payload = cJSON_CreateObject();
-    cJSON_AddStringToObject(in_payload, "version", "TEE.RA.1.0");
-    cJSON_AddStringToObject(in_payload, "nonce", b64_nonce);
-    free(b64_nonce);
-    cJSON_AddStringToObject(in_payload, "uuid", (char *)param->taid);
-    cJSON_AddStringToObject(in_payload, "hash_alg", "HS256");
-    cJSON_AddBoolToObject(in_payload, "with_tcb", param->with_tcb);
-    if (param->req_key) {
-        cJSON_AddBoolToObject(in_payload, "request_key", param->req_key);
-    }
-
-    cJSON_AddItemToObject(in_json, "payload", in_payload);
-
-    char *in_buf = cJSON_PrintUnformatted(in_json);
-    uint32_t in_buf_len = strlen(in_buf) + 1;
-
-    print_debug("get ra report input json buf:%s\n", in_buf);
-
-    cc_ra_buf_t *tmp_ra_buf = calloc(1, sizeof(cc_ra_buf_t));
-    if (tmp_ra_buf == NULL) {
-        ret = CC_ERROR_RA_MEMORY;
-        goto end;
-    }
-    tmp_ra_buf->buf = calloc(1, in_buf_len);
-    if (tmp_ra_buf->buf == NULL) {
-        ret = CC_ERROR_RA_MEMORY;
-        free(tmp_ra_buf);
-        goto end;
-    }
-    (void)memcpy(tmp_ra_buf->buf, in_buf, in_buf_len);
-    tmp_ra_buf->len = in_buf_len;
-
-    *json_buf = (cc_ra_buf_t *)tmp_ra_buf;
-end:
-    cJSON_free(in_buf);
-    cJSON_Delete(in_json);
-    return ret;
-}
-
-static void print_ra_report(cc_ra_buf_t *report)
-{
-    if (report == NULL || report->buf == NULL) {
-        return;
-    }
-    cJSON *cj_report = cJSON_ParseWithLength((char *)report->buf, report->len);
-    if (cj_report == NULL) {
-        // print_debug("cjson parse report error!\n");
-        return;
-    }
-    char *str_report = cJSON_Print(cj_report);
-
-    print_debug("report:%s\n", str_report);
-    print_debug("report len:%u, str_len:%lu\n", report->len, strlen(str_report));
-
-    cJSON_free(str_report);
-    cJSON_Delete(cj_report);
-    return;
-}
+#include "gp_report_helper.h"
 
 #define PROVISION_OUT_LEN 0x3000
 static cc_enclave_result_t gp_ra_provision_no_as()
@@ -195,7 +67,6 @@ static cc_enclave_result_t gp_get_ra_report(cc_get_ra_report_input_t *in, cc_ra_
         print_error_term("get ra report failed, ret:%x\n", gp_ret);
         return CC_ERROR_RA_GET_REPORT;
     }
-    print_ra_report(report);
 
     return CC_SUCCESS;
 }
diff --git a/component/remote_attest/ra_report/gp_report_helper.c b/component/remote_attest/ra_report/gp_report_helper.c
new file mode 100644
index 0000000..0a73745
--- /dev/null
+++ b/component/remote_attest/ra_report/gp_report_helper.c
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+#include <stdlib.h>
+#include <string.h>
+#include "cJSON.h"
+#include "base64url.h"
+#include "gp_report_helper.h"
+
+void free_cc_ra_buf(cc_ra_buf_t *ra_buf)
+{
+    if (ra_buf == NULL) {
+        return;
+    }
+    if (ra_buf->buf != NULL) {
+        free(ra_buf->buf);
+    }
+
+    free(ra_buf);
+    return;
+}
+
+/* caller need to free (cc_ra_buf_t **in) */
+cc_enclave_result_t gen_provision_no_as_in_buff(cc_ra_buf_t **in)
+{
+    if (in == NULL) {
+        return CC_ERROR_BAD_PARAMETERS;
+    }
+    cc_enclave_result_t ret = CC_SUCCESS;
+    cJSON *in_json = cJSON_CreateObject();
+    cJSON_AddStringToObject(in_json, "handler", "provisioning-input");
+
+    cJSON *in_payload = cJSON_CreateObject();
+    cJSON_AddStringToObject(in_payload, "version", "TEE.RA.1.0");
+    cJSON_AddStringToObject(in_payload, "scenario", "sce_no_as");
+    cJSON_AddStringToObject(in_payload, "hash_alg", "HS256");
+
+    cJSON_AddItemToObject(in_json, "payload", in_payload);
+
+    char *in_buf = cJSON_PrintUnformatted(in_json);
+    uint32_t in_buf_len = strlen(in_buf) + 1;
+
+    cc_ra_buf_t *tmp_ra_buf = calloc(1, sizeof(cc_ra_buf_t));
+    if (tmp_ra_buf == NULL) {
+        ret = CC_ERROR_RA_MEMORY;
+        goto end;
+    }
+    tmp_ra_buf->buf = calloc(1, in_buf_len);
+    if (tmp_ra_buf->buf == NULL) {
+        ret = CC_ERROR_RA_MEMORY;
+        free(tmp_ra_buf);
+        goto end;
+    }
+    (void)memcpy(tmp_ra_buf->buf, in_buf, in_buf_len);
+    tmp_ra_buf->len = in_buf_len;
+
+    *in = tmp_ra_buf;
+end:
+    cJSON_free(in_buf);
+    cJSON_Delete(in_json);
+    return ret;
+}
+
+/* caller need to free (cc_ra_buf_t **in) */
+cc_enclave_result_t gen_ra_report_in_buff(cc_get_ra_report_input_t *param, cc_ra_buf_t **json_buf)
+{
+    if (param == NULL || param->taid == NULL || json_buf == NULL) {
+        return CC_ERROR_BAD_PARAMETERS;
+    }
+    cc_enclave_result_t ret = CC_SUCCESS;
+    cJSON *in_json = cJSON_CreateObject();
+    cJSON_AddStringToObject(in_json, "handler", "report-input");
+
+    size_t b64_nonce_len = 0;
+    char *b64_nonce = kpsecl_base64urlencode(param->nonce, param->nonce_len, &b64_nonce_len);
+
+    cJSON *in_payload = cJSON_CreateObject();
+    cJSON_AddStringToObject(in_payload, "version", "TEE.RA.1.0");
+    cJSON_AddStringToObject(in_payload, "nonce", b64_nonce);
+    free(b64_nonce);
+    cJSON_AddStringToObject(in_payload, "uuid", (char *)param->taid);
+    cJSON_AddStringToObject(in_payload, "hash_alg", "HS256");
+    cJSON_AddBoolToObject(in_payload, "with_tcb", param->with_tcb);
+    if (param->req_key) {
+        cJSON_AddBoolToObject(in_payload, "request_key", param->req_key);
+    }
+
+    cJSON_AddItemToObject(in_json, "payload", in_payload);
+
+    char *in_buf = cJSON_PrintUnformatted(in_json);
+    uint32_t in_buf_len = strlen(in_buf) + 1;
+
+    cc_ra_buf_t *tmp_ra_buf = calloc(1, sizeof(cc_ra_buf_t));
+    if (tmp_ra_buf == NULL) {
+        ret = CC_ERROR_RA_MEMORY;
+        goto end;
+    }
+    tmp_ra_buf->buf = calloc(1, in_buf_len);
+    if (tmp_ra_buf->buf == NULL) {
+        ret = CC_ERROR_RA_MEMORY;
+        free(tmp_ra_buf);
+        goto end;
+    }
+    (void)memcpy(tmp_ra_buf->buf, in_buf, in_buf_len);
+    tmp_ra_buf->len = in_buf_len;
+
+    *json_buf = (cc_ra_buf_t *)tmp_ra_buf;
+end:
+    cJSON_free(in_buf);
+    cJSON_Delete(in_json);
+    return ret;
+}
+
diff --git a/component/remote_attest/ra_report/gp_report_helper.h b/component/remote_attest/ra_report/gp_report_helper.h
new file mode 100644
index 0000000..58786d9
--- /dev/null
+++ b/component/remote_attest/ra_report/gp_report_helper.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) Huawei Technologies Co., Ltd. 2020. All rights reserved.
+ * secGear is licensed under the Mulan PSL v2.
+ * You can use this software according to the terms and conditions of the Mulan PSL v2.
+ * You may obtain a copy of Mulan PSL v2 at:
+ *     http://license.coscl.org.cn/MulanPSL2
+ * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+ * PURPOSE.
+ * See the Mulan PSL v2 for more details.
+ */
+
+#ifndef SECGEAR_GP_REPORT_HELPER_H
+#define SECGEAR_GP_REPORT_HELPER_H
+
+#include "status.h"
+#include "sg_report_st.h"
+
+cc_enclave_result_t gen_provision_no_as_in_buff(cc_ra_buf_t **in);
+cc_enclave_result_t gen_ra_report_in_buff(cc_get_ra_report_input_t *param, cc_ra_buf_t **json_buf);
+void free_cc_ra_buf(cc_ra_buf_t *ra_buf);
+
+#endif
+
diff --git a/component/secure_channel/client/secure_channel_client.c b/component/secure_channel/client/secure_channel_client.c
index 27b0812..21067b1 100644
--- a/component/secure_channel/client/secure_channel_client.c
+++ b/component/secure_channel/client/secure_channel_client.c
@@ -191,10 +191,11 @@ static cc_enclave_result_t get_taid_from_file(char *file, char *taid)
     }
 
     int ret = fscanf(fp, "%s", taid);    // only read taid from line
-    
-    printf("read ret:%d, taid:%s\n", ret, taid);
-
     fclose(fp);
+    if (ret < 0) {
+        printf("secure channel init read taid and hash from file failed\n");
+        return CC_ERROR_SEC_CHL_INIT_GET_TAID;
+    }
 
     return CC_SUCCESS;
 }
diff --git a/component/secure_channel/enclave/CMakeLists.txt b/component/secure_channel/enclave/CMakeLists.txt
index a84de8a..b2050fb 100644
--- a/component/secure_channel/enclave/CMakeLists.txt
+++ b/component/secure_channel/enclave/CMakeLists.txt
@@ -14,9 +14,6 @@ set(PREFIX secure_channel)
 set(SOURCE_FILES secure_channel_enclave.c ${CMAKE_CURRENT_SOURCE_DIR}/../secure_channel_common.c)
 FILE (GLOB_RECURSE BASE64_SRC "${LOCAL_ROOT_PATH}/thirdparty/base64url/*.c")
 
-set(PRINT_LEVEL 3)
-add_definitions(-DPRINT_LEVEL=${PRINT_LEVEL})
-
 if(CC_GP)
     add_definitions(-DGP_ENCLAVE)
     set(AUTO_FILES ${CMAKE_CURRENT_BINARY_DIR}/${PREFIX}_t.h ${CMAKE_CURRENT_BINARY_DIR}/${PREFIX}_args.h)
diff --git a/examples/secure_channel/basevalue.txt b/examples/secure_channel/basevalue.txt
new file mode 100644
index 0000000..694c455
--- /dev/null
+++ b/examples/secure_channel/basevalue.txt
@@ -0,0 +1 @@
+7763a15a-0a9e-4e86-90cd-e4262583948a 8b7373be89840534eafc2836110b31c7fee5b96ebbab09a1db87c34be393afee 52bc57fb201ebd00fcc66059084dfb38e98c0e4d11d7131d29448bc6f7cb5939
diff --git a/examples/secure_channel/client/client.c b/examples/secure_channel/client/client.c
index 08d2574..28b3695 100644
--- a/examples/secure_channel/client/client.c
+++ b/examples/secure_channel/client/client.c
@@ -49,6 +49,13 @@ int main(int argc, char **argv)
     cc_enclave_result_t ret;
     struct sockaddr_in svr_addr;
 
+    char *ta_basevalue_file = "../basevalue.txt";
+    char basevalue_real_path[PATH_MAX] = {0};
+    if (realpath(ta_basevalue_file, basevalue_real_path) == NULL) {
+        printf("ta basevalue file path error\n");
+        return -1;
+    }
+
     sockfd = socket(AF_INET, SOCK_STREAM, 0);
     if (sockfd == -1) {
         printf("create socket failed\n");
@@ -69,7 +76,7 @@ int main(int argc, char **argv)
     // step1: 初始化安全通道客户端，注册消息发送函数
     g_ctx.conn_kit.send = (void *)socket_write_and_read;
     g_ctx.conn_kit.conn = &sockfd;
-    g_ctx.basevalue = "/vendor/bin/basevalue.txt";  // content format:taid image_hash mem_hash
+    g_ctx.basevalue = basevalue_real_path;  // content format:taid image_hash mem_hash
     ret = cc_sec_chl_client_init(CC_SEC_CHL_ALGO_RSA_ECDH_AES_GCM, &g_ctx);
     if (ret != CC_SUCCESS) {
         printf("secure channel init failed:%u\n", ret);
diff --git a/examples/secure_channel/client_with_recv_thread/client.c b/examples/secure_channel/client_with_recv_thread/client.c
index db142bb..d492624 100644
--- a/examples/secure_channel/client_with_recv_thread/client.c
+++ b/examples/secure_channel/client_with_recv_thread/client.c
@@ -67,6 +67,13 @@ int main(int argc, char **argv)
     cc_enclave_result_t ret;
     struct sockaddr_in svr_addr;
 
+    char *ta_basevalue_file = "../basevalue.txt";
+    char basevalue_real_path[PATH_MAX] = {0};
+    if (realpath(ta_basevalue_file, basevalue_real_path) == NULL) {
+        printf("ta basevalue file path error\n");
+        return -1;
+    }
+
     sockfd = socket(AF_INET, SOCK_STREAM, 0);
     if (sockfd == -1) {
         printf("create socket failed\n");
@@ -87,7 +94,7 @@ int main(int argc, char **argv)
     // step1: 初始化安全通道客户端，注册消息发送函数
     g_ctx.conn_kit.send = (void *)socket_write_adpt;
     g_ctx.conn_kit.conn = &sockfd;
-    g_ctx.basevalue = "/vendor/bin/basevalue.txt";  // content format:taid image_hash mem_hash
+    g_ctx.basevalue = basevalue_real_path;  // content format:taid image_hash mem_hash
 
     // step2: 创建消息接收线程
     pthread_t thread;
diff --git a/inc/host_inc/status.h b/inc/host_inc/status.h
index 56f4da4..0ecb243 100644
--- a/inc/host_inc/status.h
+++ b/inc/host_inc/status.h
@@ -89,6 +89,8 @@ typedef enum _enclave_result_t
 
     CC_ERROR_REE_AGENT_NOT_INIT,
     CC_ERROR_RA_VERIFY_AGENT_NOT_INIT,
+    CC_ERROR_LOCAL_REPORT_INVALID,
+    CC_ERROR_LOCAL_REPORT_HASH_MISMATCH,
 /* secure channel */
     CC_ERROR_SEC_CHL_INVALID_CONN,          /* invalid connection */
     CC_ERROR_SEC_CHL_LEN_NOT_ENOUGH,       /* the buf length to store secure channle encrypt/decrypt is not enough */
-- 
2.33.0