1 /*
2  * SPDX-FileCopyrightText: 2021-2022 Espressif Systems (Shanghai) CO LTD
3  *
4  * SPDX-License-Identifier: Apache-2.0
5  */
6 
7 #pragma once
8 
9 #include <stdint.h>
10 #include <stdbool.h>
11 #include "ets_sys.h"
12 #include "rsa_pss.h"
13 #include "esp_assert.h"
14 
15 #ifdef __cplusplus
16 extern "C" {
17 #endif
18 
19 typedef struct ets_secure_boot_sig_block ets_secure_boot_sig_block_t;
20 typedef struct ets_secure_boot_signature ets_secure_boot_signature_t;
21 typedef struct ets_secure_boot_key_digests ets_secure_boot_key_digests_t;
22 
23 /* Anti-FI measure: use full words for success/fail, instead of
24    0/non-zero
25 */
26 typedef enum {
27     SB_SUCCESS = 0x3A5A5AA5,
28     SB_FAILED = 0x7533885E,
29 } secure_boot_status_t;
30 
31 /* Verify bootloader image (reconfigures cache to map), with
32    key digests provided as parameters.)
33 
34    Can be used to verify secure boot status before enabling
35    secure boot permanently.
36 
37    If result is ETS_OK, the "simple hash" of the bootloader is
38    copied into verified_hash.
39 */
40 secure_boot_status_t ets_secure_boot_verify_bootloader_with_keys(uint8_t *verified_hash, const ets_secure_boot_key_digests_t *trusted_keys, bool stage_load);
41 
42 /* Verify supplied signature against supplied digest, using
43    supplied trusted key digests.
44 
45    Doesn't reconfigure cache or any other hardware access.
46 */
47 secure_boot_status_t ets_secure_boot_verify_signature(const ets_secure_boot_signature_t *sig, const uint8_t *image_digest, const ets_secure_boot_key_digests_t *trusted_keys, uint8_t *verified_digest);
48 
49 /* Read key digests from efuse. Any revoked/missing digests will be
50    marked as NULL
51 
52    Returns 0 if at least one valid digest was found.
53 */
54 ETS_STATUS ets_secure_boot_read_key_digests(ets_secure_boot_key_digests_t *trusted_keys);
55 
56 #define CRC_SIGN_BLOCK_LEN 1196
57 #define SIG_BLOCK_PADDING 4096
58 #define ETS_SECURE_BOOT_V2_SIGNATURE_MAGIC 0xE7
59 
60 /* Secure Boot V2 signature block (up to 3 can be appended) */
61 struct ets_secure_boot_sig_block {
62     uint8_t magic_byte;
63     uint8_t version;
64     uint8_t _reserved1;
65     uint8_t _reserved2;
66     uint8_t image_digest[32];
67     ets_rsa_pubkey_t key;
68     uint8_t signature[384];
69     uint32_t block_crc;
70     uint8_t _padding[16];
71 };
72 
73 ESP_STATIC_ASSERT(sizeof(ets_secure_boot_sig_block_t) == 1216, "ets_secure_boot_sig_block_t should occupy 1216 Bytes in memory");
74 
75 #define SECURE_BOOT_NUM_BLOCKS 3
76 
77 /* V2 Secure boot signature sector (up to 3 blocks) */
78 struct ets_secure_boot_signature {
79     ets_secure_boot_sig_block_t block[SECURE_BOOT_NUM_BLOCKS];
80     uint8_t _padding[4096 - (sizeof(ets_secure_boot_sig_block_t) * SECURE_BOOT_NUM_BLOCKS)];
81 };
82 
83 ESP_STATIC_ASSERT(sizeof(ets_secure_boot_signature_t) == 4096, "ets_secure_boot_signature_t should occupy 4096 Bytes in memory");
84 
85 #define MAX_KEY_DIGESTS 3
86 
87 struct ets_secure_boot_key_digests {
88     const void *key_digests[MAX_KEY_DIGESTS];
89     bool allow_key_revoke;
90 };
91 
92 #ifdef __cplusplus
93 }
94 #endif
95