alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-14 22:16:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

bootloader_support(esp32c2): Fix WR_DIS_RD_DIS burn for secure boot key

Browse Source 
SB key is left readable, the corresponding bit in RD_DIS is unset.
We set write-protection for RD_DIS to ensure that the SB key is always readable.
This commit is contained in:
KonstantinKondrashov
2023-01-06 00:44:46 +08:00
parent b7c28e92f1
commit df662c30e4
4 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
components/bootloader_support/src/esp32c2/secure_boot_secure_features.c
View File

@@ -45,5 +45,17 @@ esp_err_t esp_secure_boot_enable_secure_features(void)
esp_efuse_write_field_bit(ESP_EFUSE_SECURE_BOOT_EN);
#ifndef CONFIG_SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS
// Secure boot and Flash encryption share one eFuse key block so they can not be set separately.
// CONFIG_SECURE_BOOT_FLASH_ENC_KEYS_BURN_TOGETHER option is used to burn SB and FE at the same time.
// SB key is readable, the corresponding bit in RD_DIS is unset.
// We set write-protection for RD_DIS to ensure that the SB key is always readable.
// FE key is read-protected, the corresponding bit in RD_DIS is set.
ESP_LOGI(TAG, "Prevent read disabling of additional efuses...");
esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_RD_DIS);
#else
ESP_LOGW(TAG, "Allowing read disabling of additional efuses - SECURITY COMPROMISED");
#endif
return ESP_OK;
}