Commit graph

54 commits

Author SHA1 Message Date
Angus Gratton 8df3c666db flash encryption: Add config option to disable any plaintext reflashes
Enabled by default when Secure Boot is on, so Flash Encryption protection
is always available in case of a Secure Boot bypass.
2019-09-10 14:27:29 +10:00
Sagar Bijwe cdabee59ef docs: Added more wordings to capture secure boot and flash encryption dependency. 2019-09-10 10:31:10 +10:00
Angus Gratton 5122154dbb efuse/flash encryption: Reduce FLASH_CRYPT_CNT to a 7 bit efuse field
8th bit is not used by hardware.

As reported https://esp32.com/viewtopic.php?f=2&t=7800&p=40895#p40894
2019-04-09 09:59:35 +10:00
Ivan Grokhotkov b6113eb73b bootloader: account for load address when mapping cache pages
Bootloader used to calculate the number of cache pages assuming that
load address was aligned, while in reality load address for DROM and
IROM was offset by 0x20 bytes from the start of 64kB page. This
caused the bootloader to map one less page if the size of the image
was 0x4..0x1c less than a multiple of 64kB.

Reported in https://esp32.com/viewtopic.php?f=13&t=6952.
2019-01-23 17:13:30 +08:00
Ivan Grokhotkov db2223818b bootloader: verify that loaded image does not overlap bootloader code
Fixes CVE-2018-18558
2018-10-30 17:35:23 +08:00
Angus Gratton 283c47cbba bootloader: Fix secure boot digest generation for image length where (len%128 < 32) 2018-10-10 11:14:44 +11:00
Angus Gratton c990ca4e20 bootloader: Don't enable secure boot or flash encryption for 3/4 Coding Scheme 2018-10-02 10:01:20 +10:00
Jiang Jiang Jian d6e3943233 Merge branch 'bugfix/flash_mapp' into 'master'
spi_flash: add api to get valid mmu table pages number

See merge request idf/esp-idf!2070

(cherry picked from commit 8eaae96658)

75550315 add api get valid mmu table pages number
fa687743 spi_flash:
49a236da fix CI failed when flash chip size if 2MBytes
2018-03-31 06:51:08 +00:00
Angus Gratton 87f7d1875d esp32: Fix backwards compatibility for pre-v2.1 bootloaders
Older bootloaders don't set RTC_XTAL_FREQ_REG or call rtc_clk_init(),
app needs to pick this up.

Reported at
https://esp32.com/viewtopic.php?f=2&t=3939&p=17836
2017-12-27 16:54:25 +08:00
Angus Gratton c4b861ad65 log: Remove non-static TAG variables 2017-12-27 16:54:24 +08:00
Angus Gratton 7a18575af8 flash encryption: Also always disable ROM BASIC console when enabling flash encryption 2017-08-29 14:52:00 +10:00
Angus Gratton 1e22bcdfde esp32: Add KConfig option to disable ROM Console fallback on first boot 2017-08-29 14:52:00 +10:00
Angus Gratton 7755015f4f secure boot: Fix enabling secure boot on first bootloader boot
Bootloader would accidentally check its own image for a secure boot signature,
but bootloader is unsigned (protected by secure boot digest).
2017-08-23 11:19:42 +10:00
Angus Gratton 5eef5e7a5d bootloader: Fallback if OTA data is invalid
Make bootloader more robust if either OTA data or some OTA app slots are corrupt.
2017-08-15 09:42:19 +10:00
Angus Gratton 17adb40ca8 bootloader: Calculate SHA256 hash of image on every boot
Makes app image booting more reliable (256-bit rather than 8-bit verification.)

Some measurements, time to boot a 655KB app.bin file and run to app_main() execution.

(All for rev 1 silicon, ie no 340ms spurious WDT delay.)

80MHz QIO mode:
before = 300ms
after = 140ms

40MHz DIO mode:
before = 712ms
after = 577ms

40MHz DIO mode, secure boot enabled
before = 1380ms
after = 934ms

(Secure boot involves two ECC signature verifications (partition table, app) that take approx 300ms each with 80MHz CPU.)
2017-07-19 18:31:59 +10:00
Angus Gratton caaa29c676 esp_image_format: ESP32 additional header does not contain an encrypt flag 2017-07-19 18:25:17 +10:00
Angus Gratton 43b99edf2b bootloader: Calculate SHA-256 of image while loading/verifying 2017-07-19 18:25:17 +10:00
Angus Gratton 8f6134dd96 bootloader: Obfuscate loaded memory until verification is complete 2017-07-19 18:25:17 +10:00
Angus Gratton 0c8888d68f bootloader: Combine loading from flash & verifying to save boot time
Still needs updating to account for secure boot.
2017-07-19 18:25:17 +10:00
Tian Hao 26a3cb93c7 component/soc : move dport access header files to soc
1. move dport access header files to soc
2. reduce dport register write protection. Only protect read operation
2017-05-09 18:06:00 +08:00
Tian Hao f7e8856520 component/esp32 : fix dualcore bug
1. When dual core cpu run access DPORT register, must do protection.
2. If access DPORT register, must use DPORT_REG_READ/DPORT_REG_WRITE and DPORT_XXX register operation macro.
2017-05-08 21:53:43 +08:00
Angus Gratton e2479b46f7 secure boot: Fix bootloader image verification failure
* Failure prevented secure boot from enabling.
* Also adds unit test cases for esp_image_basic_verify()

Ref https://esp32.com/viewtopic.php?f=2&t=1602
TW11878
2017-04-26 11:23:35 +10:00
Ivan Grokhotkov 8a9516a973 Merge branch 'bugfix/bootloader_error_handling_code' into 'master'
Add error handling code in bootloader

Forgotten error handling

See merge request !650
2017-04-13 15:28:49 +08:00
Anton Maklakov e4353f2119 bootloader: Add error handling code 2017-04-11 18:15:36 +08:00
Alexey Gerenkov 0860f46220 spi_flash: Fixed bug in SPI flash ROM driver to work with embedded flash chip
1) fixed SPI_read_status: added check for flash busy flag in matrix mode
2) fixed SPI_page_program: enable write before writing data to SPI FIFO
3) SPI flash ROM funcs replacement is controlled via menuconfig option
2017-04-11 10:51:19 +08:00
Ivan Grokhotkov 8911e666a0 Merge branch 'feature/docs_partition_ota_flash' into 'master'
Partition/SPI/OTA docs & OTA new functionality

* Update partition, SPI flash & OTA docs to reflect functionality changes
* Refactor OTA implementation to perform checks mentioned in API doc
* Add new functions to OTA API: esp_ota_get_running_partition() & esp_ota_get_next_update_partition() functions
* Add spi_flash_cache2phys() & spi_flash_phys2cache() functions to support esp_ota_get_running_partition()


See merge request !513
2017-03-03 11:27:01 +08:00
Angus Gratton 4d67a2ba8b esp32 phy_init: Move DPORT Wifi clock masks to macro values
Amended fix for c642079 !534
2017-03-01 12:11:57 +11:00
Angus Gratton 25f739c183 ota ops: Add new functions esp_ota_get_next_update_partition / esp_ota_get_running_partition
* Update OTA example to use these.
* Refactor esp_ota_begin() to return ESP_ERR_OTA_PARTITION_CONFLICT as documented
2017-02-22 10:24:42 +11:00
Ivan Grokhotkov 3b583c150f bootloader: disconnect VRTC from SAR input in bootloader_random_disable
Bootloader enables SAR ADC in test mode to get some entropy for the RNG.
The bits which control the ADC test mux were not disabled, which caused
extra ~24uA current to be drawn from VRTC, increasing deep sleep current
consumption. This change disables relevant test mode bits in
bootloader_random_disable.
2017-02-21 17:07:15 +08:00
Angus Gratton 1f3a2e900c docs: Improve/clarify partition, OTA & SPI flash docs
Related to #313 https://github.com/espressif/esp-idf/issues/313
2017-02-20 15:31:42 +11:00
Ivan Grokhotkov 413f05ce09 Merge branch 'docs/flash_encryption_disable' into 'master'
Docs: Document flash encryption disable steps, clean up flash encryption & secure boot docs

Generate clean up of flash encryption & secure boot docs

Including steps for disabling flash encryption (for people who accidentally enable it).

See merge request !500
2017-02-15 13:31:08 +08:00
Angus Gratton 7c7edab328 flash encryption/secure boot: Restructure documentation
Also add steps to disable flash encryption, as some people seem to
accidentally enable it.

Explicitly mark the flash encryption and secure boot as "READ DOCS
FIRST" in menuconfig.
2017-02-15 09:42:46 +11:00
Angus Gratton eea2788f5a OTA: Fix issues with encrypted OTA
- OTA source can write non-16-byte multiples of data
- Assumption that empty ota_data is 0xFFFFFFFF untrue when encrypted
2017-01-26 18:52:35 +11:00
Angus Gratton d8aae55eeb Flash encryption: Temporary fix for issue with stale cache reads
Seems doing certain kinds of short reads while flash encryption is
enabled will return stale data. This fixes it, but is probably a
little heavy-handed performance wise.
2017-01-26 18:29:18 +11:00
Tian Zhong Xing 2173ad3b45 bootloader_support: fix bug OTA & flash encryption incompatible
ota data partition should be encrypted unconditionally when flash encrypt enable
2017-01-26 16:20:06 +11:00
Angus Gratton 7d40f17d1d bootloader_random: Restore all SARADC/I2S registers to reset values
Fix for issue with I2S0 not being usable after bootloader_random_enable()
2017-01-13 12:19:13 +11:00
Angus Gratton 3922ce47b2 bootloader: Enable early boot RNG entropy source
This reverts commit ceb8566970.
2017-01-04 17:07:12 +11:00
Angus Gratton 3783e28f0e bootloader: Check all partitions fit inside configured flash size 2016-12-30 14:19:46 +11:00
Angus Gratton d6fafd00db Secure boot: Option for app & partition table signing to happen outside build system 2016-12-19 13:12:05 +11:00
Angus Gratton ceb8566970 Flash encryption / secure boot: Temporarily disable on-device key generation
Will be enabled after seeding of HWRNG in bootloader is fully tested/qualified.
2016-12-01 23:49:13 -08:00
Angus Gratton a9d5e26748 Secure boot: Correctly re-sign if signing key changes, better error if missing 2016-12-01 23:49:12 -08:00
Angus Gratton 506c8cd964 secure boot & flash encryption: Rework configuration options
Add UART bootloader disable options for flash encryption
2016-12-01 23:49:12 -08:00
Angus Gratton 9eb135fd73 Flash encryption: Support enabling flash encryption in bootloader, app support
* App access functions are all flash encryption-aware
* Documentation for flash encryption
* Partition read/write is flash aware
* New encrypted write function
2016-12-01 23:49:12 -08:00
Angus Gratton c48612e516 mbedTLS SHA acceleration: Allow concurrent digest calculation, works with TLS
SHA hardware allows each of SHA1, SHA256, SHA384&SHA512 to calculate digests
concurrently.

Currently incompatible with AES acceleration due to a hardware reset problem.

Ref TW7111.
2016-11-22 20:42:38 +11:00
Angus Gratton 60f29236f6 Build system: Raise warning level
Default esp-idf builds now show -Wextra warnings (except for a few:
signed/unsigned comparison, unused parameters, old-style C declarations.)

CI building of examples runs with that level raised to -Werror, to catch
those changes going into the main repo.
2016-11-16 15:57:34 +11:00
Angus Gratton c15024e629 Merge branch 'master' into feature/build_component_project_vars 2016-11-14 14:54:41 +11:00
Angus Gratton 8691b54758 secure boot: Rename efuse option for UART bootloader to option for ROM interpreter 2016-11-14 11:08:42 +11:00
Angus Gratton e459f803da secure boot: Functional partition table & app signature verification 2016-11-14 11:08:42 +11:00
Angus Gratton fe66dd85f0 secure boot: Enable based on sdkconfig, remove "secure boot flag" from binary image 2016-11-14 11:08:42 +11:00
Angus Gratton 7402a1b973 partition_table: Move from 0x4000 to 0x8000
Also fix a bug with correctly padding bootloader image when length is
already a multiple of 16.
2016-11-14 11:08:42 +11:00