mirror of
https://github.com/espressif/esp-idf.git
synced 2024-10-05 20:47:46 -04:00
examples/flash_encryption: refactor, add test
1. Clean up the example code 2. Add demonstration of partition read/write operations 3. Add example test
This commit is contained in:
Ivan Grokhotkov
parent
a0256b9e9d
commit
f84394e550
@ -1,6 +1,9 @@
|
||||
# Flash Encryption
|
||||
|
||||
The example checks if the flash encryption feature is enabled/disabled and if enabled prints the flash encryption mode (DEVELOPMENT / RELEASE) and FLASH_CRYPT_CNT eFuse value
|
||||
The example checks if the flash encryption feature is enabled/disabled and if enabled prints the flash encryption mode (DEVELOPMENT / RELEASE) and FLASH_CRYPT_CNT eFuse value.
|
||||
|
||||
The example also demonstrates writing and reading encrypted partitions in flash.
|
||||
|
||||
## How to use example
|
||||
|
||||
### Hardware Required
|
||||
@ -21,7 +24,7 @@ idf.py menuconfig
|
||||
|
||||
### Build and Flash
|
||||
|
||||
When building the project and flashing it to the board FOR THE FIRST TIME after enabling flash encryption feature in menuconfig, run following command to program ESP32 and monitor the output
|
||||
When building the project and flashing it to the board FOR THE FIRST TIME after enabling flash encryption feature in menuconfig, run following command to program ESP32 and monitor the output:
|
||||
|
||||
```
|
||||
idf.py -p PORT flash monitor
|
||||
@ -31,21 +34,40 @@ idf.py -p PORT flash monitor
|
||||
|
||||
See the Getting Started Guide for full steps to configure and use ESP-IDF to build projects.
|
||||
|
||||
When reprogramming the device subsequently use following command for encrypted write of new plaintext application
|
||||
When reprogramming the device subsequently use following command for encrypted write of new plaintext application:
|
||||
|
||||
```
|
||||
idf.py encrypted-app-flash monitor
|
||||
idf.py -p PORT encrypted-app-flash monitor
|
||||
```
|
||||
|
||||
Please note above command programs only the app partition. In order to reprogram all partitions (bootloader, partition table and application) in encrypted form use
|
||||
Please note above command programs only the app partition. In order to reprogram all partitions (bootloader, partition table and application) in encrypted form use:
|
||||
|
||||
```
|
||||
idf.py encrypted-flash monitor
|
||||
idf.py -p PORT encrypted-flash monitor
|
||||
```
|
||||
|
||||
## Example Output
|
||||
|
||||
When the device boots for the first time after enabling flash encryption in Development mode the output would contain following
|
||||
When running the example without enabling flash encryption, the output would be as follows:
|
||||
|
||||
```
|
||||
Example to check Flash Encryption status
|
||||
This is ESP32 chip with 2 CPU cores, WiFi/BT/BLE, silicon revision 0, 2MB external flash
|
||||
FLASH_CRYPT_CNT eFuse value is 0
|
||||
Flash encryption feature is disabled
|
||||
Erasing partition "storage" (0x1000 bytes)
|
||||
Writing data with esp_partition_write:
|
||||
I (378) example: 0x3ffb4dc0 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f |................|
|
||||
I (378) example: 0x3ffb4dd0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f |................|
|
||||
Reading with esp_partition_read:
|
||||
I (388) example: 0x3ffb4da0 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f |................|
|
||||
I (398) example: 0x3ffb4db0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f |................|
|
||||
Reading with spi_flash_read:
|
||||
I (408) example: 0x3ffb4da0 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f |................|
|
||||
I (418) example: 0x3ffb4db0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f |................|
|
||||
```
|
||||
|
||||
After enabling flash encryption in Development mode, the output shows the process of enabling the flash encryption:
|
||||
|
||||
```
|
||||
I (168) boot: Checking flash encryption...
|
||||
@ -64,74 +86,23 @@ I (13229) flash_encrypt: Flash encryption completed
|
||||
I (13229) boot: Resetting with flash encryption enabled...
|
||||
```
|
||||
|
||||
Once the flash encryption is enabled the device will reset itself. At this stage the flash contents are in encrypted form. The output would be similar to
|
||||
Once the flash encryption is enabled the device will reset itself. At this stage the flash contents are in encrypted form. The output would be similar to:
|
||||
|
||||
```
|
||||
rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
|
||||
configsip: 0, SPIWP:0xee
|
||||
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
|
||||
mode:DIO, clock div:2
|
||||
load:0x3fff0018,len:4
|
||||
load:0x3fff001c,len:8452
|
||||
load:0x40078000,len:13652
|
||||
ho 0 tail 12 room 4
|
||||
load:0x40080400,len:6664
|
||||
entry 0x40080764
|
||||
I (30) boot: ESP-IDF v4.0-dev-850-gc4447462d-dirty 2nd stage bootloader
|
||||
I (30) boot: compile time 16:32:53
|
||||
I (31) boot: Enabling RNG early entropy source...
|
||||
I (37) boot: SPI Speed : 40MHz
|
||||
I (41) boot: SPI Mode : DIO
|
||||
I (45) boot: SPI Flash Size : 4MB
|
||||
I (49) boot: Partition Table:
|
||||
I (52) boot: ## Label Usage Type ST Offset Length
|
||||
I (60) boot: 0 nvs WiFi data 01 02 0000a000 00006000
|
||||
I (67) boot: 1 phy_init RF data 01 01 00010000 00001000
|
||||
I (75) boot: 2 factory factory app 00 00 00020000 00100000
|
||||
I (82) boot: End of partition table
|
||||
I (86) esp_image: segment 0: paddr=0x00020020 vaddr=0x3f400020 size=0x0808c ( 32908) map
|
||||
I (107) esp_image: segment 1: paddr=0x000280b4 vaddr=0x3ffb0000 size=0x01ea4 ( 7844) load
|
||||
I (111) esp_image: segment 2: paddr=0x00029f60 vaddr=0x40080000 size=0x00400 ( 1024) load
|
||||
0x40080000: _WindowOverflow4 at esp-idf/esp-idf/components/freertos/xtensa_vectors.S:1778
|
||||
|
||||
I (116) esp_image: segment 3: paddr=0x0002a368 vaddr=0x40080400 size=0x05ca8 ( 23720) load
|
||||
I (134) esp_image: segment 4: paddr=0x00030018 vaddr=0x400d0018 size=0x126a8 ( 75432) map
|
||||
0x400d0018: _flash_cache_start at ??:?
|
||||
|
||||
I (162) esp_image: segment 5: paddr=0x000426c8 vaddr=0x400860a8 size=0x01f4c ( 8012) load
|
||||
0x400860a8: prvAddNewTaskToReadyList at esp-idf/esp-idf/components/freertos/tasks.c:4561
|
||||
|
||||
I (171) boot: Loaded app from partition at offset 0x20000
|
||||
I (171) boot: Checking flash encryption...
|
||||
I (171) flash_encrypt: flash encryption is enabled (3 plaintext flashes left)
|
||||
I (178) boot: Disabling RNG early entropy source...
|
||||
I (184) cpu_start: Pro cpu up.
|
||||
I (188) cpu_start: Application information:
|
||||
I (193) cpu_start: Project name: flash-encryption
|
||||
I (198) cpu_start: App version: v4.0-dev-850-gc4447462d-dirty
|
||||
I (205) cpu_start: Compile time: Jun 17 2019 16:32:52
|
||||
I (211) cpu_start: ELF file SHA256: 8770c886bdf561a7...
|
||||
I (217) cpu_start: ESP-IDF: v4.0-dev-850-gc4447462d-dirty
|
||||
I (224) cpu_start: Starting app cpu, entry point is 0x40080e4c
|
||||
0x40080e4c: call_start_cpu1 at esp-idf/esp-idf/components/esp32/cpu_start.c:265
|
||||
|
||||
I (0) cpu_start: App cpu up.
|
||||
I (235) heap_init: Initializing. RAM available for dynamic allocation:
|
||||
I (241) heap_init: At 3FFAE6E0 len 00001920 (6 KiB): DRAM
|
||||
I (247) heap_init: At 3FFB2EC8 len 0002D138 (180 KiB): DRAM
|
||||
I (254) heap_init: At 3FFE0440 len 00003AE0 (14 KiB): D/IRAM
|
||||
I (260) heap_init: At 3FFE4350 len 0001BCB0 (111 KiB): D/IRAM
|
||||
I (266) heap_init: At 40087FF4 len 0001800C (96 KiB): IRAM
|
||||
I (273) cpu_start: Pro cpu start user code
|
||||
I (291) cpu_start: Starting scheduler on PRO CPU.
|
||||
I (0) cpu_start: Starting scheduler on APP CPU.
|
||||
|
||||
Sample program to check Flash Encryption
|
||||
This is ESP32 chip with 2 CPU cores, WiFi/BT/BLE, silicon revision 1, 4MB external flash
|
||||
Flash encryption feature is enabled
|
||||
Flash encryption mode is DEVELOPMENT
|
||||
Flash in encrypted mode with flash_crypt_cnt = 1
|
||||
Halting...
|
||||
Example to check Flash Encryption status
|
||||
This is ESP32 chip with 2 CPU cores, WiFi/BT/BLE, silicon revision 0, 4MB external flash
|
||||
FLASH_CRYPT_CNT eFuse value is 1
|
||||
Flash encryption feature is enabled in DEVELOPMENT mode
|
||||
Erasing partition "storage" (0x1000 bytes)
|
||||
Writing data with esp_partition_write:
|
||||
I (451) example: 0x3ffb4dc0 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f |................|
|
||||
I (451) example: 0x3ffb4dd0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f |................|
|
||||
Reading with esp_partition_read:
|
||||
I (461) example: 0x3ffb4da0 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f |................|
|
||||
I (471) example: 0x3ffb4db0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f |................|
|
||||
Reading with spi_flash_read:
|
||||
I (491) example: 0x3ffb4da0 29 68 2e 13 88 a0 5b 7f cc 6b 39 f9 d7 7b 32 2f |)h....[..k9..{2/|
|
||||
I (491) example: 0x3ffb4db0 9f e6 55 37 4b 91 b0 83 cd a6 e9 4e cd fa b4 c7 |..U7K......N....|
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
@ -139,7 +110,7 @@ I (0) cpu_start: Starting scheduler on APP CPU.
|
||||
It is also possible to use esptool.py utility to read the eFuse values and check if flash encryption is enabled or not
|
||||
|
||||
```
|
||||
python $IDF_PATH/components/esptool_py/esptool/espefuse.py --port /dev/cu.SLAB_USBtoUART summary
|
||||
python $IDF_PATH/components/esptool_py/esptool/espefuse.py --port PORT summary
|
||||
```
|
||||
|
||||
If FLASH_CRYPT_CNT eFuse value is non-zero flash encryption is enabled
|
||||
|
||||
41
examples/security/flash_encryption/example_test.py
Normal file
41
examples/security/flash_encryption/example_test.py
Normal file
@ -0,0 +1,41 @@
|
||||
from __future__ import print_function
|
||||
import os
|
||||
import sys
|
||||
|
||||
try:
|
||||
import IDF
|
||||
except ImportError:
|
||||
test_fw_path = os.getenv('TEST_FW_PATH')
|
||||
if test_fw_path and test_fw_path not in sys.path:
|
||||
sys.path.insert(0, test_fw_path)
|
||||
import IDF
|
||||
|
||||
|
||||
# To prepare a test runner for this example:
|
||||
# 1. Generate zero flash encryption key:
|
||||
# dd if=/dev/zero of=key.bin bs=1 count=32
|
||||
# 2.Burn Efuses:
|
||||
# espefuse.py --do-not-confirm -p $ESPPORT burn_efuse FLASH_CRYPT_CONFIG 0xf
|
||||
# espefuse.py --do-not-confirm -p $ESPPORT burn_efuse FLASH_CRYPT_CNT 0x1
|
||||
# espefuse.py --do-not-confirm -p $ESPPORT burn_key flash_encryption key.bin
|
||||
@IDF.idf_example_test(env_tag='Example_Flash_Encryption')
|
||||
def test_examples_security_flash_encryption(env, extra_data):
|
||||
dut = env.get_dut('flash_encryption', 'examples/security/flash_encryption')
|
||||
# start test
|
||||
dut.start_app()
|
||||
lines = [
|
||||
'FLASH_CRYPT_CNT eFuse value is 1',
|
||||
'Flash encryption feature is enabled in DEVELOPMENT mode',
|
||||
'with esp_partition_write',
|
||||
'00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f',
|
||||
'with esp_partition_read',
|
||||
'00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f',
|
||||
'with spi_flash_read',
|
||||
'29 68 2e 13 88 a0 5b 7f cc 6b 39 f9 d7 7b 32 2f'
|
||||
]
|
||||
for line in lines:
|
||||
dut.expect(line, timeout=2)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
test_examples_security_flash_encryption()
|
||||
@ -13,16 +13,29 @@
|
||||
#include "esp_efuse.h"
|
||||
#include "esp_system.h"
|
||||
#include "esp_spi_flash.h"
|
||||
#include "esp_partition.h"
|
||||
#include "esp_flash_encrypt.h"
|
||||
#include "esp_efuse_table.h"
|
||||
|
||||
void app_main()
|
||||
static void example_print_chip_info(void);
|
||||
static void example_print_flash_encryption_status(void);
|
||||
static void example_read_write_flash(void);
|
||||
|
||||
static const char* TAG = "example";
|
||||
|
||||
|
||||
void app_main(void)
|
||||
{
|
||||
uint32_t flash_crypt_cnt = 0;
|
||||
esp_flash_enc_mode_t mode;
|
||||
printf("\nExample to check Flash Encryption status\n");
|
||||
|
||||
printf("\nSample program to check Flash Encryption\n");
|
||||
example_print_chip_info();
|
||||
example_print_flash_encryption_status();
|
||||
example_read_write_flash();
|
||||
}
|
||||
|
||||
|
||||
static void example_print_chip_info(void)
|
||||
{
|
||||
/* Print chip information */
|
||||
esp_chip_info_t chip_info;
|
||||
esp_chip_info(&chip_info);
|
||||
@ -35,33 +48,52 @@ void app_main()
|
||||
|
||||
printf("%dMB %s flash\n", spi_flash_get_chip_size() / (1024 * 1024),
|
||||
(chip_info.features & CHIP_FEATURE_EMB_FLASH) ? "embedded" : "external");
|
||||
|
||||
esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, 7);
|
||||
|
||||
if (esp_flash_encryption_enabled()) {
|
||||
printf("Flash encryption feature is enabled\n");
|
||||
mode = esp_get_flash_encryption_mode();
|
||||
|
||||
if (mode == ESP_FLASH_ENC_MODE_DEVELOPMENT) {
|
||||
printf("Flash encryption mode is DEVELOPMENT\n");
|
||||
/* If odd bits set flash encryption is enabled else disabled */
|
||||
if (__builtin_parity(flash_crypt_cnt) == 1) {
|
||||
printf("Flash in encrypted mode with flash_crypt_cnt = %d\n", flash_crypt_cnt);
|
||||
}
|
||||
else {
|
||||
printf("Flash in plaintext mode with flash_crypt_cnt = %d\n", flash_crypt_cnt);
|
||||
}
|
||||
} else {
|
||||
printf("Flash encryption mode is RELEASE\n");
|
||||
}
|
||||
}
|
||||
else {
|
||||
printf("FLASH_CRYPT_CNT eFuse value is %d\n", flash_crypt_cnt);
|
||||
printf("Flash encryption feature is disabled\n\n");
|
||||
}
|
||||
|
||||
printf("Halting...\n");
|
||||
while(1) {
|
||||
vTaskDelay(1000 / portTICK_PERIOD_MS);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static void example_print_flash_encryption_status(void)
|
||||
{
|
||||
uint32_t flash_crypt_cnt = 0;
|
||||
esp_efuse_read_field_blob(ESP_EFUSE_FLASH_CRYPT_CNT, &flash_crypt_cnt, 7);
|
||||
printf("FLASH_CRYPT_CNT eFuse value is %d\n", flash_crypt_cnt);
|
||||
|
||||
esp_flash_enc_mode_t mode = esp_get_flash_encryption_mode();
|
||||
if (mode == ESP_FLASH_ENC_MODE_DISABLED) {
|
||||
printf("Flash encryption feature is disabled\n");
|
||||
} else {
|
||||
printf("Flash encryption feature is enabled in %s mode\n",
|
||||
mode == ESP_FLASH_ENC_MODE_DEVELOPMENT ? "DEVELOPMENT" : "RELEASE");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static void example_read_write_flash(void)
|
||||
{
|
||||
const esp_partition_t* partition = esp_partition_find_first(
|
||||
ESP_PARTITION_TYPE_DATA, ESP_PARTITION_SUBTYPE_ANY, "storage");
|
||||
assert(partition);
|
||||
|
||||
printf("Erasing partition \"%s\" (0x%x bytes)\n", partition->label, partition->size);
|
||||
|
||||
ESP_ERROR_CHECK(esp_partition_erase_range(partition, 0, partition->size));
|
||||
|
||||
/* Generate the data which will be written */
|
||||
const size_t data_size = 32;
|
||||
uint8_t plaintext_data[data_size];
|
||||
for (uint8_t i = 0; i < data_size; ++i) {
|
||||
plaintext_data[i] = i;
|
||||
}
|
||||
|
||||
printf("Writing data with esp_partition_write:\n");
|
||||
ESP_LOG_BUFFER_HEXDUMP(TAG, plaintext_data, data_size, ESP_LOG_INFO);
|
||||
ESP_ERROR_CHECK(esp_partition_write(partition, 0, plaintext_data, data_size));
|
||||
|
||||
uint8_t read_data[data_size];
|
||||
printf("Reading with esp_partition_read:\n");
|
||||
ESP_ERROR_CHECK(esp_partition_read(partition, 0, read_data, data_size));
|
||||
ESP_LOG_BUFFER_HEXDUMP(TAG, read_data, data_size, ESP_LOG_INFO);
|
||||
|
||||
printf("Reading with spi_flash_read:\n");
|
||||
ESP_ERROR_CHECK(spi_flash_read(partition->address, read_data, data_size));
|
||||
ESP_LOG_BUFFER_HEXDUMP(TAG, read_data, data_size, ESP_LOG_INFO);
|
||||
}
|
||||
|
||||
@ -0,0 +1,5 @@
|
||||
# Name, Type, SubType, Offset, Size, Flags
|
||||
nvs, data, nvs, 0x9000, 0x6000,
|
||||
# Extra partition to demonstrate reading/writing of encrypted flash
|
||||
storage, data, 0xff, 0xf000, 0x1000, encrypted
|
||||
factory, app, factory, 0x10000, 1M,
|
||||
|
12
examples/security/flash_encryption/sdkconfig.ci
Normal file
12
examples/security/flash_encryption/sdkconfig.ci
Normal file
@ -0,0 +1,12 @@
|
||||
# Default settings for testing this example in CI.
|
||||
# This configuration is not secure, don't use it in production!
|
||||
# See Flash Encryption API Guide for more details.
|
||||
|
||||
CONFIG_SECURE_FLASH_ENC_ENABLED=y
|
||||
CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
|
||||
CONFIG_SECURE_BOOT_ALLOW_ROM_BASIC=y
|
||||
CONFIG_SECURE_BOOT_ALLOW_JTAG=y
|
||||
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
|
||||
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_DEC=y
|
||||
CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_CACHE=y
|
||||
CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
|
||||
4
examples/security/flash_encryption/sdkconfig.defaults
Normal file
4
examples/security/flash_encryption/sdkconfig.defaults
Normal file
@ -0,0 +1,4 @@
|
||||
# This example uses an extra partition to demonstrate encrypted/non-encrypted reads/writes.
|
||||
CONFIG_PARTITION_TABLE_CUSTOM=y
|
||||
CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions_example.csv"
|
||||
CONFIG_PARTITION_TABLE_FILENAME="partitions_example.csv"
|
||||
Loading…
x
Reference in New Issue
Block a user