|
|
@@ -32,7 +32,7 @@ void esp_flash_encryption_init_checks()
|
|
|
ESP_LOGE(TAG, "Flash encryption eFuse bit was not enabled in bootloader but CONFIG_SECURE_FLASH_ENC_ENABLED is on");
|
|
|
abort();
|
|
|
}
|
|
|
-#endif
|
|
|
+#endif // CONFIG_SECURE_FLASH_CHECK_ENC_EN_IN_APP
|
|
|
|
|
|
// First check is: if Release mode flash encryption & secure boot are enabled then
|
|
|
// FLASH_CRYPT_CNT *must* be write protected. This will have happened automatically
|
|
|
@@ -65,12 +65,42 @@ void esp_flash_encryption_init_checks()
|
|
|
ESP_LOGE(TAG, "Mismatch found in security options in bootloader menuconfig and efuse settings. Device is not secure.");
|
|
|
#else
|
|
|
ESP_LOGW(TAG, "Flash encryption mode is DEVELOPMENT (not secure)");
|
|
|
-#endif
|
|
|
+#endif // CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
|
|
|
} else if (mode == ESP_FLASH_ENC_MODE_RELEASE) {
|
|
|
ESP_LOGI(TAG, "Flash encryption mode is RELEASE");
|
|
|
}
|
|
|
}
|
|
|
+#endif // BOOTLOADER_BUILD
|
|
|
+
|
|
|
+/**
|
|
|
+ * This former inlined function must not be defined in the header file anymore.
|
|
|
+ * As it depends on efuse component, any use of it outside of `bootloader_support`,
|
|
|
+ * would require the caller component to include `efuse` as part of its `REQUIRES` or
|
|
|
+ * `PRIV_REQUIRES` entries.
|
|
|
+ * Attribute IRAM_ATTR must be specified for the app build.
|
|
|
+ */
|
|
|
+bool IRAM_ATTR esp_flash_encryption_enabled(void)
|
|
|
+{
|
|
|
+ uint32_t flash_crypt_cnt = 0;
|
|
|
+#ifndef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
|
|
|
+ flash_crypt_cnt = efuse_ll_get_flash_crypt_cnt();
|
|
|
+#else
|
|
|
+#if CONFIG_IDF_TARGET_ESP32
|
|
|
+ esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_FLASH_CRYPT_CNT[0]->bit_count);
|
|
|
+#else
|
|
|
+ esp_efuse_read_field_blob(ESP_EFUSE_SPI_BOOT_CRYPT_CNT, &flash_crypt_cnt, ESP_EFUSE_SPI_BOOT_CRYPT_CNT[0]->bit_count);
|
|
|
+#endif
|
|
|
#endif
|
|
|
+ /* __builtin_parity is in flash, so we calculate parity inline */
|
|
|
+ bool enabled = false;
|
|
|
+ while (flash_crypt_cnt) {
|
|
|
+ if (flash_crypt_cnt & 1) {
|
|
|
+ enabled = !enabled;
|
|
|
+ }
|
|
|
+ flash_crypt_cnt >>= 1;
|
|
|
+ }
|
|
|
+ return enabled;
|
|
|
+}
|
|
|
|
|
|
void esp_flash_write_protect_crypt_cnt(void)
|
|
|
{
|