1 /*
2  * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
3  *
4  * SPDX-License-Identifier: Apache-2.0
5  */
6 
7 #include "sdkconfig.h"
8 
9 #pragma once
10 
11 #include <stdint.h>
12 #include "ets_sys.h"
13 #include "esp_assert.h"
14 
15 #ifdef __cplusplus
16 extern "C" {
17 #endif
18 
19 void ets_secure_boot_start(void);
20 
21 void ets_secure_boot_finish(void);
22 
23 void ets_secure_boot_hash(const uint32_t *buf);
24 
25 void ets_secure_boot_obtain(void);
26 
27 int ets_secure_boot_check(uint32_t *buf);
28 
29 void ets_secure_boot_rd_iv(uint32_t *buf);
30 
31 void ets_secure_boot_rd_abstract(uint32_t *buf);
32 
33 bool ets_secure_boot_check_start(uint8_t abs_index, uint32_t iv_addr);
34 
35 int ets_secure_boot_check_finish(uint32_t *abstract);
36 
37 #if CONFIG_ESP32_REV_MIN_FULL >= 300
38 #include "rsa_pss.h"
39 
40 #define SECURE_BOOT_NUM_BLOCKS 1
41 
42 #define CRC_SIGN_BLOCK_LEN 1196
43 #define SIG_BLOCK_PADDING 4096
44 #define ETS_SECURE_BOOT_V2_SIGNATURE_MAGIC 0xE7
45 
46 // Anti-FI measure: use full words for success/fail internally, instead of 0/non-zero
47 typedef enum {
48     SBV2_SUCCESS = 0x3A5A5AA5,
49     SB_SUCCESS   = 0x3A5A5AA5,
50     SBV2_FAILED = 0xA533885A,
51     SB_FAILED   = 0xA533885A,
52 } secure_boot_v2_status_t;
53 
54 /* Secure Boot Version 2 signature format for ESP32 ECO3 */
55 typedef struct {
56     uint8_t magic_byte;
57     uint8_t version;
58     uint8_t _reserved1;
59     uint8_t _reserved2;
60     uint8_t image_digest[32];
61     ets_rsa_pubkey_t key;
62     uint8_t signature[384];
63     uint32_t block_crc;
64     uint8_t _padding[16];
65 } ets_secure_boot_sig_block_t;
66 ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "invalid sig block size");
67 
68 /* ROM supports up to 3, but IDF only checks the first one (SECURE_BOOT_NUM_BLOCKS) */
69 #define SECURE_BOOT_MAX_APPENDED_SIGN_BLOCKS_TO_IMAGE 3
70 
71 /* Multiple key block support */
72 typedef struct {
73     ets_secure_boot_sig_block_t block[SECURE_BOOT_MAX_APPENDED_SIGN_BLOCKS_TO_IMAGE];
74     uint8_t _padding[4096 - (sizeof(ets_secure_boot_sig_block_t) * SECURE_BOOT_MAX_APPENDED_SIGN_BLOCKS_TO_IMAGE)];
75 } ets_secure_boot_signature_t;
76 
77 ESP_STATIC_ASSERT(sizeof(ets_secure_boot_signature_t) == 4096, "invalid sig sector size");
78 
79 typedef struct {
80     const void *key_digests[SECURE_BOOT_NUM_BLOCKS];
81 } ets_secure_boot_key_digests_t;
82 
83 /** @brief Verifies the signature block appended to a firmware image. Implemented in the ROM.
84  *
85  * This function is used to verify the bootloader before burning its public key hash into Efuse.
86  * Also, it is used to verify the app on loading the image on boot and on OTA.
87  *
88  * @param sig The signature block flashed aligned 4096 bytes from the firmware. (ROM implementation expects 3 blocks, sig->block[3]).
89  * @param image_digest The SHA-256 Digest of the firmware to be verified
90  * @param trusted_key_digest The SHA-256 Digest of the public key (ets_rsa_pubkey_t) of a single signature block.
91  * @param verified_digest RSA-PSS signature of image_digest. Pass an uninitialised array.
92  *
93  * @return SBV2_SUCCESS if signature is valid
94  * SBV2_FAILED for failures.
95  */
96 secure_boot_v2_status_t ets_secure_boot_verify_signature(const ets_secure_boot_signature_t *sig, const uint8_t *image_digest, const uint8_t *trusted_key_digest, uint8_t *verified_digest);
97 
98 /** @brief This function verifies the 1st stage bootloader. Implemented in the ROM.
99  *  Reboots post verification. It reads the Efuse key for verification of the public key.
100  *
101  * This function is not used in the current workflow.
102  *
103  */
104 void ets_secure_boot_verify_boot_bootloader(void);
105 
106 /** @brief Confirms if the secure boot V2 has been enabled. Implemented in the ROM.
107  *
108  * In ESP32-ECO3 - It checks the value of ABS_DONE_1 in EFuse.
109  *
110  * @return true if is Secure boot v2 has been enabled
111  * False if Secure boot v2 has not been enabled.
112  */
113 bool ets_use_secure_boot_v2(void);
114 
115 #else
116 #define SECURE_BOOT_NUM_BLOCKS 0
117 
118 #endif /* CONFIG_ESP32_REV_MIN_FULL >= 300 */
119 
120 #ifdef __cplusplus
121 }
122 #endif
123