1 // Copyright 2015-2016 Espressif Systems (Shanghai) PTE LTD
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 #pragma once
15
16 #include <stdbool.h>
17 #include "esp_attr.h"
18 #include "esp_err.h"
19 #ifndef BOOTLOADER_BUILD
20 #include "esp_spi_flash.h"
21 #endif
22 #include "soc/efuse_periph.h"
23 #include "sdkconfig.h"
24
25 #ifdef __cplusplus
26 extern "C" {
27 #endif
28
29 /* @brief Flash encryption mode based on efuse values
30 */
31 typedef enum {
32 ESP_FLASH_ENC_MODE_DISABLED, // flash encryption is not enabled (flash crypt cnt=0)
33 ESP_FLASH_ENC_MODE_DEVELOPMENT, // flash encryption is enabled but for Development (reflash over UART allowed)
34 ESP_FLASH_ENC_MODE_RELEASE // flash encryption is enabled for Release (reflash over UART disabled)
35 } esp_flash_enc_mode_t;
36
37 /**
38 * @file esp_partition.h
39 * @brief Support functions for flash encryption features
40 *
41 * Can be compiled as part of app or bootloader code.
42 */
43
44 /** @brief Is flash encryption currently enabled in hardware?
45 *
46 * Flash encryption is enabled if the FLASH_CRYPT_CNT efuse has an odd number of bits set.
47 *
48 * @return true if flash encryption is enabled.
49 */
esp_flash_encryption_enabled(void)50 static inline /** @cond */ IRAM_ATTR /** @endcond */ bool esp_flash_encryption_enabled(void)
51 {
52 uint32_t flash_crypt_cnt = 0;
53 #if CONFIG_IDF_TARGET_ESP32
54 flash_crypt_cnt = REG_GET_FIELD(EFUSE_BLK0_RDATA0_REG, EFUSE_RD_FLASH_CRYPT_CNT);
55 #else
56 flash_crypt_cnt = REG_GET_FIELD(EFUSE_RD_REPEAT_DATA1_REG, EFUSE_SPI_BOOT_CRYPT_CNT);
57 #endif
58 /* __builtin_parity is in flash, so we calculate parity inline */
59 bool enabled = false;
60 while (flash_crypt_cnt) {
61 if (flash_crypt_cnt & 1) {
62 enabled = !enabled;
63 }
64 flash_crypt_cnt >>= 1;
65 }
66 return enabled;
67 }
68
69 /* @brief Update on-device flash encryption
70 *
71 * Intended to be called as part of the bootloader process if flash
72 * encryption is enabled in device menuconfig.
73 *
74 * If FLASH_CRYPT_CNT efuse parity is 1 (ie odd number of bits set),
75 * then return ESP_OK immediately (indicating flash encryption is enabled
76 * and functional).
77 *
78 * If FLASH_CRYPT_CNT efuse parity is 0 (ie even number of bits set),
79 * assume the flash has just been written with plaintext that needs encrypting.
80 *
81 * The following regions of flash are encrypted in place:
82 *
83 * - The bootloader image, if a valid plaintext image is found.[*]
84 * - The partition table, if a valid plaintext table is found.
85 * - Any app partition that contains a valid plaintext app image.
86 * - Any other partitions with the "encrypt" flag set. [**]
87 *
88 * After the re-encryption process completes, a '1' bit is added to the
89 * FLASH_CRYPT_CNT value (setting the parity to 1) and the EFUSE is re-burned.
90 *
91 * [*] If reflashing bootloader with secure boot enabled, pre-encrypt
92 * the bootloader before writing it to flash or secure boot will fail.
93 *
94 * [**] For this reason, if serial re-flashing a previous flashed
95 * device with secure boot enabled and using FLASH_CRYPT_CNT to
96 * trigger re-encryption, you must simultaneously re-flash plaintext
97 * content to all partitions with the "encrypt" flag set or this
98 * data will be corrupted (encrypted twice).
99 *
100 * @note The post-condition of this function is that all
101 * partitions that should be encrypted are encrypted.
102 *
103 * @note Take care not to power off the device while this function
104 * is running, or the partition currently being encrypted will be lost.
105 *
106 * @note RTC_WDT will reset while encryption operations will be performed (if RTC_WDT is configured).
107 *
108 * @return ESP_OK if all operations succeeded, ESP_ERR_INVALID_STATE
109 * if a fatal error occured during encryption of all partitions.
110 */
111 esp_err_t esp_flash_encrypt_check_and_update(void);
112
113
114 /** @brief Encrypt-in-place a block of flash sectors
115 *
116 * @note This function resets RTC_WDT between operations with sectors.
117 * @param src_addr Source offset in flash. Should be multiple of 4096 bytes.
118 * @param data_length Length of data to encrypt in bytes. Will be rounded up to next multiple of 4096 bytes.
119 *
120 * @return ESP_OK if all operations succeeded, ESP_ERR_FLASH_OP_FAIL
121 * if SPI flash fails, ESP_ERR_FLASH_OP_TIMEOUT if flash times out.
122 */
123 esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
124
125 /** @brief Write protect FLASH_CRYPT_CNT
126 *
127 * Intended to be called as a part of boot process if flash encryption
128 * is enabled but secure boot is not used. This should protect against
129 * serial re-flashing of an unauthorised code in absence of secure boot.
130 *
131 * @note On ESP32 V3 only, write protecting FLASH_CRYPT_CNT will also prevent
132 * disabling UART Download Mode. If both are wanted, call
133 * esp_efuse_disable_rom_download_mode() before calling this function.
134 *
135 */
136 void esp_flash_write_protect_crypt_cnt(void);
137
138 /** @brief Return the flash encryption mode
139 *
140 * The API is called during boot process but can also be called by
141 * application to check the current flash encryption mode of ESP32
142 *
143 * @return
144 */
145 esp_flash_enc_mode_t esp_get_flash_encryption_mode(void);
146
147
148 /** @brief Check the flash encryption mode during startup
149 *
150 * @note This function is called automatically during app startup,
151 * it doesn't need to be called from the app.
152 *
153 * Verifies the flash encryption config during startup:
154 *
155 * - Correct any insecure flash encryption settings if hardware
156 * Secure Boot is enabled.
157 * - Log warnings if the efuse config doesn't match the project
158 * config in any way
159 */
160 void esp_flash_encryption_init_checks(void);
161
162 #ifdef __cplusplus
163 }
164 #endif
165