IDF release/v4.0 08219f3cf

tools/sdk/include/bootloader_support/esp_flash_encrypt.h

@@ -11,8 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-#ifndef __ESP32_FLASH_ENCRYPT_H
-#define __ESP32_FLASH_ENCRYPT_H
+#pragma once
 
 #include <stdbool.h>
 #include "esp_attr.h"
@@ -20,7 +19,19 @@
 #ifndef BOOTLOADER_BUILD
 #include "esp_spi_flash.h"
 #endif
-#include "soc/efuse_reg.h"
+#include "soc/efuse_periph.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* @brief Flash encryption mode based on efuse values
+*/
+typedef enum {
+    ESP_FLASH_ENC_MODE_DISABLED,          // flash encryption is not enabled (flash crypt cnt=0)
+    ESP_FLASH_ENC_MODE_DEVELOPMENT,       // flash encryption is enabled but for Development (reflash over UART allowed)
+    ESP_FLASH_ENC_MODE_RELEASE            // flash encryption is enabled for Release (reflash over UART disabled)
+} esp_flash_enc_mode_t;
 
 /**
  * @file esp_partition.h
@@ -110,8 +121,33 @@ esp_err_t esp_flash_encrypt_region(uint32_t src_addr, size_t data_length);
  * is enabled but secure boot is not used. This should protect against
  * serial re-flashing of an unauthorised code in absence of secure boot.
  *
- * @return 
  */
 void esp_flash_write_protect_crypt_cnt();
 
+/** @brief Return the flash encryption mode
+ *
+ * The API is called during boot process but can also be called by
+ * application to check the current flash encryption mode of ESP32
+ *
+ * @return
+ */
+esp_flash_enc_mode_t esp_get_flash_encryption_mode();
+
+
+/** @brief Check the flash encryption mode during startup
+ *
+ * @note This function is called automatically during app startup,
+ * it doesn't need to be called from the app.
+ *
+ * Verifies the flash encryption config during startup:
+ *
+ * - Correct any insecure flash encryption settings if hardware
+ *   Secure Boot is enabled.
+ * - Log warnings if the efuse config doesn't match the project
+ *  config in any way
+ */
+void esp_flash_encryption_init_checks(void);
+
+#ifdef __cplusplus
+}
 #endif